Bug 1806568

Summary: openshift-apiserver-operator should go upgradeable=false if SCC has changed
Product: OpenShift Container Platform Reporter: David Eads <deads>
Component: openshift-apiserverAssignee: Abu Kashem <akashem>
Status: CLOSED DUPLICATE QA Contact: Xingxing Xia <xxia>
Severity: high Docs Contact:
Priority: high    
Version: 4.3.0CC: aos-bugs, mfojtik, sttts
Target Milestone: ---   
Target Release: 4.3.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1808602 1810596 (view as bug list) Environment:
Last Closed: 2020-04-08 19:03:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1810596    
Bug Blocks:    

Description David Eads 2020-02-24 14:40:35 UTC 
In 4.4, the SCC is maintained by the CVO.  This means that the ratchet logic of "reconcile-scc" has been lost.  Overall this is good (we documented that nothing should change the bootstrap SCC), but practically, anyone who has changed needs to handle the situation before they upgrade and have the resources stomped.

We can make a change to 4.3.z which prevents upgrades (upgradeable=false) on fairly complicated predicates and provide links and help for dealing with the situation *before* it goes bad.
Comment 1 Xingxing Xia 2020-03-16 10:35:16 UTC 
This bug's above PR and title were same as bug 1808602. Dup?
Comment 2 Abu Kashem 2020-04-08 19:03:36 UTC 
Yes, closing it, since it's a dup of 1808602.

*** This bug has been marked as a duplicate of bug 1808602 ***