+++ This bug was initially created as a clone of Bug #2105045 +++ Description of problem: OperatorGroups are used to scope an operator to a set of namespaces. OLM applies a label to each of the namespaces targeted by an operatorGroup. There is an issue in OLM where OLM updates a namespace's labels even if the labels haven't been changed. Effectively, the update request is a semantic no-op and it generates a apiserver and etcd load. Also, other controllers watching these namespaces will perform redundant work in response to the generated watch event and resourceVersion bump. Version-Release number of selected component (if applicable): 4.11 How reproducible: Always Steps to Reproduce: 1. Create an OperatorGroup that targets specific namespaces. Actual results: OLM updates the namespaces multiple times even though the labels it applies does not change. Expected results: OLM updates the namespaces once and does not update the namespace if the labels haven't changed. Additional info: --- Additional comment from agreene on 2022-07-07 18:54:52 UTC --- Upstream PR can be found here: https://github.com/operator-framework/operator-lifecycle-manager/pull/2809/ --- Additional comment from xzha on 2022-07-13 10:16:38 UTC --- verify: 1) install cluster zhaoxia@xzha-mac test % oc exec olm-operator-55c86c57f9-kzt4z -- olm --version OLM version: 0.19.0 git commit: 993f841d30a44513c792eb37a07c02e57fdb52a6 2) create ns and og zhaoxia@xzha-mac test % oc new-project test-2 zhaoxia@xzha-mac test % cat og.yaml.2 kind: OperatorGroup apiVersion: operators.coreos.com/v1 metadata: name: og-single namespace: test-2 spec: targetNamespaces: - test-2 zhaoxia@xzha-mac test % oc apply -f og.yaml.2 3) check olm operator log zhaoxia@xzha-mac test % grep test-2 olm.log.new3 time="2022-07-13T10:03:04Z" level=debug msg="updated target namespaces" namespace=test-2 operatorGroup=og-single targetNamespaces="[test-2]" time="2022-07-13T10:03:04Z" level=debug msg="OperatorGroup namespaces change detected" namespace=test-2 operatorGroup=og-single time="2022-07-13T10:03:04Z" level=debug msg="namespace change detected" namespace=test-2 operatorGroup=og-single targets="[test-2]" time="2022-07-13T10:03:04Z" level=debug msg="operatorgroup status updated" namespace=test-2 operatorGroup=og-single time="2022-07-13T10:03:04Z" level=debug msg="Requeueing out of sync namespaces" namespace=test-2 operatorGroup=og-single time="2022-07-13T10:03:04Z" level=debug msg=requeueing namespace=test-2 operatorGroup=og-single time="2022-07-13T10:03:04Z" level=debug msg="updated target namespaces" namespace=test-2 operatorGroup=og-single targetNamespaces="[test-2]" time="2022-07-13T10:03:04Z" level=debug msg="check that operatorgroup has updated CSV anotations" namespace=test-2 operatorGroup=og-single time="2022-07-13T10:03:04Z" level=debug msg="OperatorGroup CSV annotation completed" namespace=test-2 operatorGroup=og-single time="2022-07-13T10:03:04Z" level=debug msg="operatorgroup clusterroles ensured" namespace=test-2 operatorGroup=og-single no log "* sync {"update" "test-2"} *" LGTM, verified.
verify zhaoxia@xzha-mac test % oc exec catalog-operator-8478f466b9-hhrd4 -- olm --version OLM version: 0.19.0 git commit: 131ce3b85c7b631d562d421d3910b83caaa3add3 1, create a new project zhaoxia@xzha-mac test % oc new-project test-1 2, create og zhaoxia@xzha-mac test % cat og.yaml kind: OperatorGroup apiVersion: operators.coreos.com/v1 metadata: name: og-single namespace: test-1 spec: targetNamespaces: - test-1 zhaoxia@xzha-mac test % oc apply -f og.yaml operatorgroup.operators.coreos.com/og-single created zhaoxia@xzha-mac test % oc get og -n test-1 NAME AGE og-single 10s 3, check olm operator log zhaoxia@xzha-mac test % oc logs olm-operator-598bdb8b67-stdxh | grep test-1 zhaoxia@xzha-mac test % no log "* sync {"update" "test-2"} *" LGTM, verified.
verify: zhaoxia@xzha-mac openshift-tests-private % oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.11.0-0.nightly-2022-08-17-152830 True False 9m40s Cluster version is 4.11.0-0.nightly-2022-08-17-152830 zhaoxia@xzha-mac openshift-tests-private % oc exec catalog-operator-6474488b6f-npcvk -- olm --version OLM version: 0.19.0 git commit: 8a984d41acc67c0bc9bfe807fadeef23f83abd44 1, create ns tets-1 zhaoxia@xzha-mac openshift-tests-private % oc new-project test-1 Now using project "test-1" on server "https://api.ci-ln-p3ry48k-72292.origin-ci-int-gce.dev.rhcloud.com:6443". 2) create og zhaoxia@xzha-mac openshift-tests-private % cat ~/test/og.yaml kind: OperatorGroup apiVersion: operators.coreos.com/v1 metadata: name: og-single namespace: test-1 spec: targetNamespaces: - test-1 zhaoxia@xzha-mac openshift-tests-private % oc apply -f ~/test/og.yaml operatorgroup.operators.coreos.com/og-single created 3) check olm operator log zhaoxia@xzha-mac openshift-tests-private % oc logs olm-operator-7bd54cfc85-pxcfc | grep test-1 zhaoxia@xzha-mac openshift-tests-private % oc logs catalog-operator-6474488b6f-npcvk | grep test-1 zhaoxia@xzha-mac openshift-tests-private % no log "* sync {"update" "test-1"} *" lgtm, verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.11.1 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:6103