Bug 1947800
| Summary: | Ingress: check (see bug 1947801#c4 steps) audit log to find deprecated API access related to this component to ensure this component won't access APIs that trigger APIRemovedInNextReleaseInUse alert | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Stefan Schimanski <sttts> |
| Component: | Networking | Assignee: | Stephen Greene <sgreene> |
| Networking sub component: | router | QA Contact: | Xingxing Xia <xxia> |
| Status: | CLOSED ERRATA | Docs Contact: | |
| Severity: | high | ||
| Priority: | high | CC: | alegrand, anpicker, aos-bugs, erooth, hongyli, jechen, juzhao, kakkoyun, kewang, lcosic, mfojtik, pkrupa, sgreene, surbania, xxia |
| Version: | 4.8 | Keywords: | Reopened |
| Target Milestone: | --- | ||
| Target Release: | 4.8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1947719 | Environment: | |
| Last Closed: | 2021-07-27 22:58:29 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1947719 | ||
|
Description
Stefan Schimanski
2021-04-09 09:42:36 UTC
(In reply to Stefan Schimanski from comment #0) > Here are the observed requests for this component: > > system:serviceaccount:openshift-cluster-version:default: > /apis/apiextensions.k8s.io/v1beta1/customresourcedefinitions/ingresses. > config.openshift.io Will open a PR for openshift/api to switch ingresses.config.openshift.io to apiextensions v1. Assigning to myself since this is high priority and the fix is straightforward. Verified in 4.8.0-0.nightly-2021-04-20-101404 $ oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.8.0-0.nightly-2021-04-20-101404 True False 25m Cluster version is 4.8.0-0.nightly-2021-04-20-101404 No DeprecatedAPIInUse info alerts was displayed, only 1) AlertmanagerReceiversNotConfigured warning alert 2) Watchdog info alerts were displayed Checking the audit logs for the listed API accesses to deprecated API versions,
$ oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.8.0-0.nightly-2021-04-29-151418 True False 58m Cluster version is 4.8.0-0.nightly-2021-04-29-151418
$ masters=$(oc get no -l node-role.kubernetes.io/master | sed '1d' | awk '{print $1}')
$ oc adm node-logs $masters --path=kube-apiserver/audit.log --raw | grep -e '"k8s.io/removed-release":"1.22"' | tee dep.json
$ cat dep.json | jq -r '.user.username+": "+.requestURI' | sort | uniq | grep 'ingresses.config.openshift.io'
No related requests for BZ comment#0 can be found, another thing there is a bug 1949593 - rename DeprecatedAPIInUse alert to APIRemovedInNextReleaseInUse, so no DeprecatedAPIInUse info alerts was displayed, but APIRemovedInNextReleaseInUse alerts are there.
We still see user/e2e-test-router-stress-5l5mh-user accessed ingresses.v1beta1.networking.k8s.io 1 times in [sig-arch][Late] clients should not use APIs that are removed in upcoming releases [Suite:openshift/conformance/parallel]. Tested in 4.8.0-0.nightly-2021-05-17-231618 env:
$ MASTERS=`oc get no | grep master | grep -o '^[^ ]*'`
$ for i in $MASTERS; do oc debug no/$i -- chroot /host bash -c "grep -hE '"'"k8s.io/removed-release":"[^"]+"'"' /var/log/kube-apiserver/audit*.log" ; done > all.log
$ wc -l all.log
1346 all.log
$ grep '"k8s.io/removed-release":"1.22"' all.log > 1.22.log
$ wc -l 1.22.log
354 1.22.log
$ jq -r '.user.username+": "+.requestURI' 1.22.log | sed 's/=[0-9][^&]*/=***/g' | sort | uniq -c | sort -n | grep -i ingress
11 system:kube-controller-manager: /apis/extensions/v1beta1/ingresses?limit=***&resourceVersion=***
116 system:kube-controller-manager: /apis/extensions/v1beta1/ingresses?allowWatchBookmarks=true&resourceVersion=***&timeout=***&timeoutSeconds=***&watch=true
No access to deprecated v1beta1 ingresses.config.openshift.io now.
But another group-version ingress of extensions/v1beta1 is still deprecated and accessed, should be fixed as well. Thus moving to ASSIGNED.
$ oc api-resources | grep ingress | grep extension
ingresses ing extensions/v1beta1 true Ingress
Reminded by our Dev in Slack channel that, for garbage collection, quota, namespace deletion, kube-controller-manager has to watch also deprecated APIs. As long as no access from components other than kcm, it is not bug. So updating to VERIFIED. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:2438 |