Bug 1570936

Summary: New infra projects (sdn, node, etc) should be immortal
Product: OpenShift Container Platform Reporter: Mike Fiedler <mifiedle>
Component: MasterAssignee: David Eads <deads>
Status: CLOSED NOTABUG QA Contact: Wang Haoran <haowang>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 3.10.0CC: aos-bugs, deads, jokerman, mmccomas
Target Milestone: ---   
Target Release: 3.10.0   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-30 12:11:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mike Fiedler 2018-04-23 19:07:57 UTC
Description of problem:

openshift-sdn, openshift-node and possibly openshift-web-console should get the same protections that kube-system and default have so that they cannot be deleted.

Version-Release number of selected component (if applicable): 3.10.0-0.27.0


How reproducible: Always


Steps to Reproduce:
1. oc delete openshift-sdn

Actual results:

SDN namespace deleted

Expected results:

As more OpenShift infra moves into pods/namespaces, those critical to cluster health should be protected.

Comment 1 David Eads 2018-04-30 12:11:14 UTC
I don't see why components should be immortal.  I wouldn't make the openshift-apiserver namespace immortal, so why should the SDN that depends on it be immortal?

I may consider making some future operator namespace immortal to ease recovery (or maybe not), but preventing the removal of a component after it has been installed doesn't seem reasonable to me.

Comment 2 Mike Fiedler 2018-05-03 18:45:02 UTC
Seems asymmetrical that we allow deletion of openshift-* namespaces but do not allow creation:

root@ip-172-31-13-231: ~ # oc new-project openshift-logging       
Error from server (Forbidden): project.project.openshift.io "openshift-logging" is forbidden: cannot request a project starting with "openshift-"

@deads is this as you would expect?  Maybe I'm being too picky.

Comment 3 David Eads 2018-05-03 19:27:07 UTC
We don't allow requesting a namespace with that pattern because normal users can request projects.  Normal users cannot delete any openshift- namespaces.  Only exception users can delete them and those same exceptional users can create them with `oc create namespace openshfit-logging`.

The two actions look similar, but aren't.  So I think they are symmetric.