Skip to content

OCPBUGS-82532: Skip adoption of missing or terminal generated-by installplans - #3883

Open
haklein wants to merge 1 commit into
operator-framework:masterfrom
haklein:OCPBUGS-82532-skip-stale-generated-by-adoption
Open

OCPBUGS-82532: Skip adoption of missing or terminal generated-by installplans#3883
haklein wants to merge 1 commit into
operator-framework:masterfrom
haklein:OCPBUGS-82532-skip-stale-generated-by-adoption

Conversation

@haklein

@haklein haklein commented Jul 29, 2026

Copy link
Copy Markdown

ensureSubscriptionInstallPlanState adopts the installplan named by the olm.generated-by annotation whenever a subscription has no installplan reference. That is only valid while the generating plan is still in progress. Once the plan has been GC'd or has reached a terminal phase, adoption wedges the namespace:

  • plan missing: the NotFound error aborts syncResolvingNamespace before resolution, so no installplan is ever created again for any subscription in the namespace.
  • plan complete: the adoption resets the subscription to UpgradePending with currentCSV=startingCSV, which no longer exists after upgrades. The change is never persisted and the sync bails out before resolution on every iteration.

Both are hit by deleting an unapproved installplan (a documented way to get a plan for a newer version when one is pending), on any namespace with dependency-generated subscriptions, e.g. ODF.

Description of the change:

Treat a missing plan as "nothing to adopt" and skip adoption of plans in a terminal phase so resolution can create a fresh installplan. Failed plans are still adopted when fail-forward is enabled, which depends on the subscription referencing them.

Motivation for the change:

Fixes OCPBUGS-82532

Architectural changes:

n/a

Testing remarks:

Unit tests cover the full decision table of the adoption path:

generated-by plan fail-forward expected
missing - no error, no adoption, resolution proceeds
exists, in progress - adopted (existing behavior)
lookup fails (non-404) - sync error propagated (existing behavior)
exists, Complete - not adopted, resolution proceeds
exists, Failed off not adopted, resolution proceeds
exists, Failed on adopted, subscription marked Failed (existing behavior)

The two "not adopted"/"no error" rows are regression tests and fail against the previous code.

Reviewer Checklist

  • Implementation matches the proposed design, or proposal is updated to match implementation
  • Sufficient unit test coverage
  • Sufficient end-to-end test coverage
  • Bug fixes are accompanied by regression test(s)
  • e2e tests and flake fixes are accompanied evidence of flake testing, e.g. executing the test 100(0) times
  • tech debt/todo is accompanied by issue link(s) in comments in the surrounding code
  • Tests are comprehensible, e.g. Ginkgo DSL is being used appropriately
  • Docs updated or added to /doc
  • Commit messages sensible and descriptive
  • Tests marked as [FLAKE] are truly flaky and have an issue
  • Code is properly formatted

ensureSubscriptionInstallPlanState adopts the installplan named by the
olm.generated-by annotation whenever a subscription has no installplan
reference. That is only valid while the generating plan is still in
progress. Once the plan has been GC'd or has reached a terminal phase,
adoption wedges the namespace:

- plan missing: the NotFound error aborts syncResolvingNamespace before
  resolution, so no installplan is ever created again for any
  subscription in the namespace.
- plan complete: the adoption resets the subscription to UpgradePending
  with currentCSV=startingCSV, which no longer exists after upgrades.
  The change is never persisted and the sync bails out before
  resolution on every iteration.

Both are hit by deleting an unapproved installplan (a documented way to
get a plan for a newer version when one is pending), on any namespace
with dependency-generated subscriptions, e.g. ODF.

Treat a missing plan as "nothing to adopt" and skip adoption of plans
in a terminal phase so resolution can create a fresh installplan.
Failed plans are still adopted when fail-forward is enabled, which
depends on the subscription referencing them.

Fixes OCPBUGS-82532

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Harald Klein <hklein@redhat.com>
Copilot AI review requested due to automatic review settings July 29, 2026 14:28
@openshift-ci
openshift-ci Bot requested review from fgiudici and pedjak July 29, 2026 14:28
@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joelanford for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 29, 2026
@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown

Hi @haklein. Thanks for your PR.

I'm waiting for a operator-framework member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a resolution-wedging edge case in the Catalog Operator’s namespace resolution loop by preventing ensureSubscriptionInstallPlanState from “adopting” an olm.generated-by InstallPlan when that InstallPlan is missing (GC’d) or has already reached a terminal phase, allowing normal resolution to proceed and create a fresh InstallPlan.

Changes:

  • Treat NotFound when fetching the olm.generated-by InstallPlan as “nothing to adopt” (no error), so namespace resolution can continue.
  • Skip adoption when the generating InstallPlan is in a terminal phase (Complete, and Failed when fail-forward is disabled).
  • Add unit tests covering missing, transient-error, terminal-phase, and fail-forward adoption behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
pkg/controller/operators/catalog/operator.go Avoids wedging namespace resolution by skipping adoption for missing or terminal olm.generated-by InstallPlans.
pkg/controller/operators/catalog/operator_test.go Adds regression/unit tests for the new adoption-skipping behavior and error handling.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@tmshort

tmshort commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

/ok-to-test

@openshift-ci openshift-ci Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 29, 2026
@haklein haklein changed the title Skip adoption of missing or terminal generated-by installplans OCPBUGS-82532: Skip adoption of missing or terminal generated-by installplans Jul 30, 2026
@haklein

haklein commented Jul 30, 2026

Copy link
Copy Markdown
Author

/jira refresh

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants