Bug 1981732 - [GSS][RFE][Add admission controller webhooks to the Noobaa CR]
Summary: [GSS][RFE][Add admission controller webhooks to the Noobaa CR]
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenShift Data Foundation
Classification: Red Hat Storage
Component: Multi-Cloud Object Gateway
Version: 4.7
Hardware: Unspecified
OS: Linux
unspecified
low
Target Milestone: ---
: ODF 4.12.0
Assignee: Utkarsh Srivastava
QA Contact: krishnaram Karthick
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-07-13 08:53 UTC by nravinas
Modified: 2024-10-01 18:58 UTC (History)
8 users (show)

Fixed In Version: 4.12.0-55
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-01-31 00:19:18 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github red-hat-storage ocs-ci pull 5421 0 None Merged Automate MCG admission control webhooks tests 2023-01-02 12:31:39 UTC
Red Hat Product Errata RHBA-2023:0551 0 None None None 2023-01-31 00:19:42 UTC

Comment 11 krishnaram Karthick 2022-12-05 13:52:13 UTC
verified the bug with v4.12.0-125 build

# oc delete noobaa noobaa -n openshift-storage
Error from server: admission webhook "admissionwebhook.noobaa.io" denied the request: Noobaa cleanup policy is not set, blocking Noobaa deletion


# oc get csv --show-labels -n openshift-storage

NAME                                         DISPLAY                       VERSION             REPLACES   PHASE       LABELS
mcg-operator.v4.12.0-125.stable              NooBaa Operator               4.12.0-125.stable              Succeeded   operators.coreos.com/mcg-operator.openshift-storage=
ocs-operator.v4.12.0-125.stable              OpenShift Container Storage   4.12.0-125.stable              Succeeded   full_version=4.12.0-125,operatorframework.io/arch.amd64=supported,operatorframework.io/arch.ppc64le=supported,operatorframework.io/arch.s390x=supported,operators.coreos.com/ocs-operator.openshift-storage=
odf-csi-addons-operator.v4.12.0-125.stable   CSI Addons                    4.12.0-125.stable              Succeeded   operators.coreos.com/odf-csi-addons-operator.openshift-storage=
odf-operator.v4.12.0-125.stable              OpenShift Data Foundation     4.12.0-125.stable              Succeeded   full_version=4.12.0-125,operatorframework.io/arch.amd64=supported,operatorframework.io/arch.ppc64le=supported,operatorframework.io/arch.s390x=supported,operators.coreos.com/odf-operator.openshift-storage=

Comment 17 errata-xmlrpc 2023-01-31 00:19:18 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenShift Data Foundation 4.12.0 enhancement and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:0551

Comment 18 bmesegue 2023-06-27 09:14:40 UTC
I still see this problem occurring as described.

I'm using an OCP 4.12.12

And using ODP Operator 4.12.4-rhodf, using the stable-4.12 channel.

Comment 19 Utkarsh Srivastava 2023-06-27 09:46:18 UTC
Hi,

Do you mean that you can still delete NooBaa CR and admission controller is _not_ preventing the deletions for you? If it is not preventing the deletion can you please confirm that in the NooBaa CR `cleanupPolicy.allowNoobaaDeletion` is set to `false`?

Regards,
Utkarsh Srivastava

Comment 20 bmesegue 2023-06-27 09:56:54 UTC
I'm not sure I understand the question.
What I mean is that I can't delete the NooBaa instance, I'm getting the following error back:

(I copied from description, It's hard to test because I need to sacrifice an environment I need)
"Error from server: admission webhook "admissionwebhook.noobaa.io" denied the request: Noobaa cleanup policy is not set, blocking Noobaa deletion"

I'm trying to delete the resource from an ansible script, but that's the same error I get.

Comment 21 Utkarsh Srivastava 2023-06-27 10:02:52 UTC
Ah, I see. Actually that is in fact the desired behaviour. This BZ was created for us to add this __feature__. We wanted to prevent accidental deletions of NooBaa which results in data loss.

If you want to be able to delete it anyway, you will have to set `cleanupPolicy.allowNoobaaDeletion: true` in your NooBaa CR. In order to do so from ansible script, just send a merge patch with previously mentioned attribute set. Once that is in place, noobaa's admission controller will no longer prevent the deletion.


Regards,
Utkarsh Srivastava

Comment 22 bmesegue 2023-06-27 10:50:44 UTC
Thanks Utkarsh,
I'll try that !


Note You need to log in before you can comment on or make changes to this bug.