Hide Forgot
Description of problem: If you have a stray NetNamespace object without a corresponding Namespace, the migration script will fail when trying to create a NetworkPolicy in that namespace: Error from server (NotFound): error when creating "STDIN": namespaces "gsnvc" not found If you run the migration script, then run the unmigration script, then run the migration script again, it will fail: Error from server (AlreadyExists): error when creating "STDIN": networkpolicies.extensions "default-deny" already exists Expected results: migrate-network-policy.sh should be able to be run idempotently, failing midway through should not prevent subsequent runs.
Dan, can you take a look?
https://github.com/openshift/origin/pull/21210
Used latest migrate-network-policy.sh and no error message showed up any more when tested in v3.10.83. [root@qe-weliang-310master-etcd-nfs-1 ~]# ./policy.sh Deleting orphan NetNamespace 'weibin-testing': apiVersion: network.openshift.io/v1 kind: NetNamespace metadata: creationTimestamp: 2018-12-05T19:36:34Z name: weibin-testing resourceVersion: "50534" selfLink: /apis/network.openshift.io/v1/netnamespaces/weibin-testing uid: 12d64134-f8c5-11e8-b1be-fa163e4add6f netid: 3333 netname: weibin-testing netnamespace.network.openshift.io "weibin-testing" deleted NAMESPACE: default Namespace is global: adding label legacy-netid=0 NAMESPACE: hostports NAMESPACE: install-test NAMESPACE: kube-public NAMESPACE: kube-service-catalog Namespace is global: adding label legacy-netid=0 NAMESPACE: kube-system NAMESPACE: management-infra NAMESPACE: my-namespace NAMESPACE: openshift NAMESPACE: openshift-ansible-service-broker NAMESPACE: openshift-infra NAMESPACE: openshift-logging NAMESPACE: openshift-node NAMESPACE: openshift-sdn NAMESPACE: openshift-template-service-broker NAMESPACE: openshift-web-console NAMESPACE: p1 Renumbering formerly-shared namespaces: kube-service-catalog [root@qe-weliang-310master-etcd-nfs-1 ~]# oc version oc v3.10.83 kubernetes v1.10.0+b81c8f8 features: Basic-Auth GSSAPI Kerberos SPNEGO Server https://qe-weliang-310master-etcd-nfs-1.int.1205-fxp.qe.rhcloud.com:8443 openshift v3.10.83 kubernetes v1.10.0+b81c8f8 [root@qe-weliang-310master-etcd-nfs-1 ~]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0758