[oadp-1.6] OADP-6540: Skip restore of k8s RBAC system rolebindings#403
Conversation
PR openshift#311 added skip logic for system rolebindings (system:image-pullers, system:image-builders, system:deployers) but only for the authorization.openshift.io API group. OpenShift stores these as rbac.authorization.k8s.io objects and exposes them via both API groups. Velero backs up both variants since rolebindings are not in Velero's cohabitating resources dedup list. During restore with namespace mapping, the k8s RBAC variants were restored with stale subject references (old namespace), overwriting the correct auto-created rolebindings and causing ErrImagePull. Add a new RestoreItemAction for rolebindings (rbac.authorization.k8s.io) that skips the same system rolebindings, letting OpenShift create them with correct namespace references. Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
|
@openshift-cherrypick-robot: Ignoring requests to cherry-pick non-bug issues: OADP-6540 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
VerificationFix verified with OADP 1.6.0 downstream build on OCP 5.0 (arm64):
Both Cherry-picks:
Note Responses generated with Claude |
openshift-ci-robot
added
the
jira/valid-reference
|
@openshift-cherrypick-robot: This pull request references OADP-6540 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
removed
the
approved
TestGetRegistryEnvsForLocation was hitting real S3 to determine bucket region, causing CI failures when no AWS credentials are available. Mock GetBucketRegionFunc like s3_test.go and registry_test.go already do. Also fix wantErrString to match the full wrapped error from GetRegistryEnvsForLocation. Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
kaovilai
force-pushed
the
cherry-pick-402-to-oadp-1.6
branch
from
7bde02b to
89e04ef
Compare
|
@openshift-cherrypick-robot: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci
Bot
added
the
approved
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: openshift-cherrypick-robot, shubham-pampattiwar, sseago The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
5 participants
This is an automated cherry-pick of #402
Problem
When restoring with namespace mapping (e.g.
ns-a→ns-b), pods in the target namespace fail withErrImagePullbecause OpenShift auto-createssystem:image-pullerswith subjects pointing to the correct target namespace (system:serviceaccounts:ns-b), but Velero also restores the backed-uprbac.authorization.k8s.io/v1/RoleBindingwhich overwrites it with subjects still pointing to the source namespace (system:serviceaccounts:ns-a). Service accounts inns-bthen lack pull permissions.PR #311 fixed this for
authorization.openshift.iorolebindings, but not forrbac.authorization.k8s.io— both API groups are backed up becauserolebindingsis not in Velero's cohabitating resources dedup list.Fix
Skip the same three system rolebindings (
system:image-pullers,system:image-builders,system:deployers) for therbac.authorization.k8s.ioAPI group. OpenShift creates these automatically with correct subject namespace references when a project is created.Verification
Tested with OADP 1.6.0 downstream build on OCP 5.0 (arm64):
quay.io/redhat-user-workloads/ocp-art-tenant/art-fbc:v5.0__operator_nvr__oadp-operator-container-1.6.0-202606041057.p2.g747216b.assembly.stream.el9quay.io/tkaovila/openshift-velero-plugin:[OADP-6540](https://redhat.atlassian.net/browse/OADP-6540)via DPAunsupportedOverrides.openshiftPluginImageFqinBoth
rbac.authorization.k8s.ioandauthorization.openshift.iosystem rolebindings now skipped. Subjects in target namespace correctly referencesystem:serviceaccounts:test-rb-target.Cherry-picks to other branches:
Fixes: https://issues.redhat.com/browse/OADP-6540
/assign kaovilai