Loading...

Type: Bug
Resolution: Unresolved
Priority: Normal
Fix Version/s: 4.20.0
Affects Version/s: 4.15
Component/s: openshift-apiserver
Labels:

Activity Type:
Quality / Stability / Reliability
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Story Points:
None
Severity:
Moderate
Regression:
No

Target Backport Versions:

4.15.z, 4.17.z, 4.16.z, 4.18.z, 4.19.z
Target Version:

4.20.0
Release Blocker:
None
Sprint:
None

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

PX Impact Score:

Release Note Status:
In Progress
Release Note Type:
Enhancement
Release Note Text:

Hide
* Before this update, deleting an `istag` resource with the `--dry-run=server` option unintentionally caused actual deletion of the image from the server. This unexpected deletion occurred due to the `dry-run` option being implemented incorrectly in the `oc delete istag` command. With this release, the `dry-run` option is wired to the 'oc delete istag' command. As a result, the accidental deletion of image objects is prevented and the `istag` object remains intact when using the `--dry-run=server` option. (link:https://issues.redhat.com/browse/OCPBUGS-35855[OCPBUGS-35855])
______
The openshift-apiserver's image-related API servers (e.g., Image) didn’t have the --dry-run=server functionality wired through their storage layer, so the dry-run flag wasn’t honored. When users used oc with --dry-run=server on image resources, the requests were executed rather than simulated—this unintended behavior could lead to real, unexpected side effects.This PR respect the dry-run option and correctly simulate image operations without side effects, aligning with expected Kubernetes behavior and preventing unwanted modifications in workflows.

Show
* Before this update, deleting an `istag` resource with the `--dry-run=server` option unintentionally caused actual deletion of the image from the server. This unexpected deletion occurred due to the `dry-run` option being implemented incorrectly in the `oc delete istag` command. With this release, the `dry-run` option is wired to the 'oc delete istag' command. As a result, the accidental deletion of image objects is prevented and the `istag` object remains intact when using the `--dry-run=server` option. (link: https://issues.redhat.com/browse/OCPBUGS-35855 [ OCPBUGS-35855 ]) ______ The openshift-apiserver's image-related API servers (e.g., Image) didn’t have the --dry-run=server functionality wired through their storage layer, so the dry-run flag wasn’t honored. When users used oc with --dry-run=server on image resources, the requests were executed rather than simulated—this unintended behavior could lead to real, unexpected side effects.This PR respect the dry-run option and correctly simulate image operations without side effects, aligning with expected Kubernetes behavior and preventing unwanted modifications in workflows.

Escape Reason:
None
Escape Impact:
None
Corrective Measures:
None
SDLC stage when should've been found:
None

Description of problem:

'oc delete istag/$ISTAG --dry-run=server' is unexpectedly deleting the object from the server this is not expected behavior.

- Attempted to delete the `istag` resource object by using the `dry-run=server` option. However, the object(image) was actually deleted from the server.
- Conversely, when applied the same `dry-run=server` parameter to other resources, they remained intact and were not deleted.

Version-Release number of selected component (if applicable):

OCP 4.15

How reproducible:

Try deleting the `istag` resource using the `--dry-run=server` option with the server strategy.

Steps to Reproduce:

1. Example with resource ImageStreamTag istag

~~~ 
[quickcluster@upi-0 ~]$ oc delete -n openshift istag/ubi8-openjdk-8:1.11 --dry-run=client
imagestreamtag.image.openshift.io "ubi8-openjdk-8:1.11" deleted (dry run)

[quickcluster@upi-0 ~]$ oc get istag -n openshift | grep -i ubi8-openjdk-8:1.11
ubi8-openjdk-8:1.11                                         image-registry.openshift-image-registry.svc:5000/openshift/ubi8-openjdk-8@sha256:022488b1bf697b7dd8c393171a3247bef4ea545a9ab828501e72168f2aac9415                                       4 weeks ago[

quickcluster@upi-0 ~]$ oc delete -n openshift istag/ubi8-openjdk-8:1.11 --dry-run=server
imagestreamtag.image.openshift.io "ubi8-openjdk-8:1.11" deleted (server dry run)

[quickcluster@upi-0 ~]$ oc get -n openshift istag | grep -i ubi8-openjdk-8:1.11 
~~~

2. Example with resource secret

~~~ 
[quickcluster@upi-0 ~]$ oc delete secrets/deployer-token-jz46t --dry-run=client
secret "deployer-token-jz46t" deleted (dry run)

[quickcluster@upi-0 ~]$ oc get secret | grep -i deployer-token-jz46t
deployer-token-jz46t       kubernetes.io/service-account-token   4      28d

[quickcluster@upi-0 ~]$ oc delete secrets/deployer-token-jz46t --dry-run=server
secret "deployer-token-jz46t" deleted (server dry run)

[quickcluster@upi-0 ~]$ oc get secret | grep -i deployer-token-jz46t
deployer-token-jz46t       kubernetes.io/service-account-token   4      28d
~~~

Actual results:

For `istag` resource, whenever tried to delete the image with option `dry-run=server`. It actually got deleted from the server.

Expected results:

After deleting the `istag` using the `--dry-run=server` option with the server strategy, the `istag` object should still remain on the server.

Additional info:

blocks

OCPBUGS-57206 'oc delete istag/$ISTAG --dry-run=server' is unexpectedly deleting the object from the server

Closed

is cloned by

OCPBUGS-62875 'oc create istag/$ISTAG --dry-run=server' is unexpectedly creating the object from the server

New

OCPBUGS-57206 'oc delete istag/$ISTAG --dry-run=server' is unexpectedly deleting the object from the server

Closed

links to

openshift/openshift-apiserver#511: OCPBUGS-35855: Wire dry run option to Image API server operations

openshift/origin#29834: OCPBUGS-35855: Add dry-run server test for imagestreamtag

Details

Description

Attachments

Issue Links

Easy Agile Planning Poker

Activity

People

Dates