-
Bug
-
Resolution: Done
-
Major
-
ACM 2.10.0
-
None
-
2
-
False
-
-
False
-
-
-
GRC Sprint 2024-04
-
Critical
-
No
Description of problem:
If I have two operator policies creating subscriptions in the same namespace and one of the subscriptions references an invalid operator/package, both operator policies are noncompliant because the `ConstraintsNotSatisfiable` condition gets set on all subscriptions in the namespace by OLM even though one subscription is not related to the other.
The OpenShift console seems to ignore this and present the correct status:
Version-Release number of selected component (if applicable):
How reproducible:
Every time
Steps to Reproduce:
Create a valid and invalid operator policy with subscriptions in the same namespace:
Valid:
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: case20-install-gk
namespace: open-cluster-management-global-set
spec:
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1beta1
kind: OperatorPolicy
metadata:
name: case20-install-gk
spec:
remediationAction: enforce
severity: critical
complianceType: musthave
subscription:
channel: stable
name: gatekeeper-operator-product
namespace: openshift-operators
installPlanApproval: Automatic
source: redhat-operators
sourceNamespace: openshift-marketplace
Invalid:
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: case20-install-gk2
namespace: open-cluster-management-global-set
spec:
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1beta1
kind: OperatorPolicy
metadata:
name: case20-install-gk2
spec:
remediationAction: enforce
severity: critical
complianceType: musthave
subscription:
channel: stable
name: gatekeeper-operator
namespace: openshift-operators
installPlanApproval: Automatic
source: redhat-operators
sourceNamespace: openshift-marketplace
Actual results:
Both operator policies are invalid with "ConstraintsNotSatisfiable".
Expected results:
Only the "case20-install-gk2" operator policy should be noncompliant with "ConstraintsNotSatisfiable".
Additional info:
Consider ignoring "ConstraintsNotSatisfiable" if the operator policy's subscription's related CSV is compliant. Also, deleting the invalid subscription does not cause OLM to reconcile and fix the existing subscription status.
