Bug 1961341

# oc adm release extract --to manifests registry.ci.openshift.org/ocp/release:4.7.0-0.nightly-2021-06-12-151209
Extracted release payload from digest sha256:a8873b0c5c017864effc7323bebdb2d3c7244973a0892362b04e3d8510240e0c created at 2021-06-12T15:17:00Z

# grep -r 'apiVersion: rbac' manifests | grep v1beta1
manifests/0000_50_cluster-autoscaler-operator_03_rbac.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1
manifests/0000_50_cluster-autoscaler-operator_03_rbac.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1
manifests/0000_70_cluster-network-operator_02_rbac.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1
manifests/0000_80_machine-config-operator_03_rbac.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1
manifests/0000_50_operator-marketplace_06_role_binding.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1
manifests/0000_50_operator-marketplace_06_role_binding.yaml:apiVersion: rbac.authorization.k8s.io/v1beta1

In 4.7, not only autoscaler but also network, machine-config and marketplace have rbacv1beta1 defined in manifests.

# oc get clusterrolebinding default-account-cluster-network-operator -n openshift-network-operator -oyaml | grep rbac
apiVersion: rbac.authorization.k8s.io/v1
  - apiVersion: rbac.authorization.k8s.io/v1beta1
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/default-account-cluster-network-operator
  apiGroup: rbac.authorization.k8s.io


# oc get clusterrolebinding default-account-openshift-machine-config-operator -n openshift-machine-config-operator -oyaml| grep rbac
apiVersion: rbac.authorization.k8s.io/v1
  - apiVersion: rbac.authorization.k8s.io/v1beta1
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/default-account-openshift-machine-config-operator
  apiGroup: rbac.authorization.k8s.io


# oc get clusterrolebinding marketplace-operator -n openshift-marketplace -oyaml | grep rbac
apiVersion: rbac.authorization.k8s.io/v1
  - apiVersion: rbac.authorization.k8s.io/v1beta1
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/marketplace-operator
  apiGroup: rbac.authorization.k8s.io

Looks like those in-cluster clusterrolebindings use the rbacv1.

Vadim, could you please help confirm if only autoscaler needs to be fixed?

You are correct, more PRs are required to make it work properly:

* cluster-autoscaler - https://github.com/openshift/cluster-autoscaler-operator/pull/206
* network-operator - https://github.com/openshift/cluster-network-operator/pull/1134
* machine-config-operator - https://github.com/openshift/machine-config-operator/pull/2620
* marketplace-operator - https://github.com/operator-framework/operator-marketplace/pull/409

Vadim, is PR in CVO required as well? We have CVO PR[1] in 4.8.

[1] CVO - https://github.com/openshift/cluster-version-operator/pull/565

Vadim, could you please take a look at comment#3? Thanks

(In reply to Yang Yang from comment #4)
> Vadim, could you please take a look at comment#3? Thanks

Correct, after PRs from comment#2 are merged we can proceed with cherry-picking https://github.com/openshift/cluster-version-operator/pull/565 on release-4.8

Vadim,

> Correct, after PRs from comment#2 are merged we can proceed with cherry-picking  https://github.com/openshift/cluster-version-operator/pull/565 on release-4.8

The PRs from comment#2 get merged. Would you like to cherry-pick the CVO PR to proceed at this moment? Thanks!

Done, created https://github.com/openshift/cluster-version-operator/pull/652

Verifying with 4.7.0-0.nightly-2021-09-22-201816

# oc get clusterversion
NAME      VERSION                             AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.7.0-0.nightly-2021-09-22-201816   True        False         137m    Cluster version is 4.7.0-0.nightly-2021-09-22-201816

# oc adm release extract --to 4.7
Extracted release payload created at 2021-09-22T20:21:28Z

# grep -r 'apiVersion: rbac' 4.7 | grep v1beta1

null

# oc get po -n openshift-cluster-version
NAME                                        READY   STATUS    RESTARTS   AGE
cluster-version-operator-56f859b98d-shtps   1/1     Running   0          166m

# oc logs pod/cluster-version-operator-56f859b98d-shtps -n openshift-cluster-version > cvo.log

# grep 'rbac.authorization.k8s.io/v1beta1' cvo.log
I0923 03:16:51.519313       1 request.go:591] Throttling request took 1.472133091s, request: GET:https://api-int.yangyang0923.qe.gcp.devcluster.openshift.com:6443/apis/rbac.authorization.k8s.io/v1beta1?timeout=32s

No resources are using rbacv1beta1. Moving it to verified state.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.7.33 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:3686