Skip to content

Commit 56edb44

Browse files
mattia-eleuterimattia-eleuteri
committed
fix(platform): harden migration 61 and the CRDs it ships
A cluster whose group snapshot CRDs carry the release labels while the ordinary snapshot CRDs do not would have its v1alpha1 CRDs deleted and never recreated, so the release is now recognised from either set. A group snapshot CRD that already serves v1beta2 but still lists v1alpha1 in storedVersions is recorded instead of adopted, since the chart drops v1alpha1 and the apiserver refuses that while it is stored. The image build fails when the rendered CRDs are missing, because yq succeeds on empty input and an image without them would delete the old CRDs and fail to create the new ones. Assisted-by: LLM Signed-off-by: Mattia Eleuteri <[email protected]>
1 parent ff25b6e commit 56edb44

3 files changed

Lines changed: 50 additions & 1 deletion

File tree

‎hack/migration-61-snapshot-crds.bats‎

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,9 @@ crd_field() {
175175
@test "a group snapshot CRD that already serves v1beta2 is adopted, not deleted" {
176176
prep
177177
edit_crds '.items |= map(if .spec.group == "groupsnapshot.storage.k8s.io"
178-
then .spec.versions = [{name: "v1beta2", served: true, storage: true}] else . end)'
178+
then .spec.versions = [{name: "v1beta2", served: true, storage: true}]
179+
| .status.storedVersions = ["v1beta2"]
180+
else . end)'
179181
rc=0
180182
run_migration 61 >"$WORK/out" 2>&1 || rc=$?
181183
cat "$WORK/out"; cat "$FAKE_CMDLOG"
@@ -241,3 +243,38 @@ crd_field() {
241243
grep -qxF "STAMP 62" "$FAKE_CMDLOG"
242244
rm -rf "$WORK"
243245
}
246+
247+
@test "release labels on the group snapshot CRDs alone still get them recreated" {
248+
prep
249+
edit_crds '.items |= map(if .spec.group == "snapshot.storage.k8s.io" then .metadata.labels = {} else . end)'
250+
rc=0
251+
run_migration 61 >"$WORK/out" 2>&1 || rc=$?
252+
cat "$WORK/out"; cat "$FAKE_CMDLOG"
253+
[ "$rc" -eq 0 ]
254+
for p in volumegroupsnapshotclasses volumegroupsnapshotcontents volumegroupsnapshots; do
255+
grep -qxF "DELETE $p.groupsnapshot.storage.k8s.io" "$FAKE_CMDLOG"
256+
grep -qxF "CREATE $p.groupsnapshot.storage.k8s.io" "$FAKE_CMDLOG"
257+
done
258+
if grep -qF "ANNOTATE volumesnapshot" "$FAKE_CMDLOG"; then echo "a foreign snapshot CRD was adopted" >&2; return 1; fi
259+
grep -qxF "STAMP 62" "$FAKE_CMDLOG"
260+
rm -rf "$WORK"
261+
}
262+
263+
@test "a v1beta2 group snapshot CRD that still stores v1alpha1 is recorded, not adopted" {
264+
prep
265+
edit_crds '.items |= map(if .metadata.name == "volumegroupsnapshotcontents.groupsnapshot.storage.k8s.io"
266+
then .spec.versions = [{name: "v1alpha1", served: true, storage: false}, {name: "v1beta2", served: true, storage: true}]
267+
| .status.storedVersions = ["v1alpha1", "v1beta2"]
268+
else . end)'
269+
rc=0
270+
run_migration 61 >"$WORK/out" 2>&1 || rc=$?
271+
cat "$WORK/out"; cat "$FAKE_CMDLOG"
272+
[ "$rc" -eq 0 ]
273+
if grep -qE "^(ANNOTATE|LABEL|DELETE) volumegroupsnapshotcontents" "$FAKE_CMDLOG"; then
274+
echo "a CRD still storing v1alpha1 was adopted or deleted" >&2; return 1
275+
fi
276+
if grep -qF "CREATE" "$FAKE_CMDLOG"; then echo "a CRD was created next to the recorded one" >&2; return 1; fi
277+
grep -qF "cozystack.io/migration-61-needs-attention=volumegroupsnapshotcontents.groupsnapshot.storage.k8s.io=stored-v1alpha1" "$FAKE_CMDLOG"
278+
grep -qxF "STAMP 62" "$FAKE_CMDLOG"
279+
rm -rf "$WORK"
280+
}

‎packages/core/platform/Makefile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ image-migrations:
5353
--show-only charts/snapshot-controller/templates/crds.yaml \
5454
| yq --split-exp '"images/migrations/snapshot-controller-crds/" + .metadata.name + ".yaml"' \
5555
'$(GROUP_SNAPSHOT_CRDS_EXPR)'
56+
# yq exits 0 on empty input, so a failed render would otherwise ship an
57+
# image whose migration 61 deletes the old CRDs and cannot recreate them.
58+
test "$$(ls images/migrations/snapshot-controller-crds | wc -l)" -eq 3
5659
docker buildx build images/migrations \
5760
$(call image-tags,platform-migrations,v$(COZYSTACK_VERSION)) \
5861
$(call cache-args,platform-migrations) \

‎packages/core/platform/images/migrations/migrations/61‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,16 @@ for plural in $GROUP_SNAPSHOT_CRDS; do
110110
echo "CRD $crd was not installed by $RELEASE_NS/$RELEASE_NAME; leaving it alone"
111111
continue
112112
fi
113+
RELEASE_INSTALLED=1
113114
if printf '%s' "$obj" | jq -e '[.spec.versions[].name] | index("v1beta2")' >/dev/null; then
115+
# The chart drops v1alpha1 from spec.versions, which the apiserver refuses
116+
# while v1alpha1 is still a stored version, so such a CRD is left to an
117+
# operator rather than adopted into an upgrade that cannot apply.
118+
if printf '%s' "$obj" | jq -e '.status.storedVersions // [] | index("v1alpha1")' >/dev/null; then
119+
echo "WARN: CRD $crd serves v1beta2 but still stores v1alpha1; the snapshot-controller upgrade fails until its objects are migrated and storedVersions trimmed" >&2
120+
LEFTOVERS="${LEFTOVERS}${LEFTOVERS:+,}${crd}=stored-v1alpha1"
121+
continue
122+
fi
114123
adopt "$crd" "$obj"
115124
continue
116125
fi

0 commit comments

Comments
 (0)