Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-52309

[release-4.18] - [catalogd] OLMv1 is using PSA Labels version as latest instead of version pinned

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not a Bug
    • Icon: Major Major
    • 4.18.z
    • 4.18.z
    • OLM
    • Moderate
    • None
    • Glaceon OLM Sprint 267
    • 1
    • Rejected
    • False
    • Hide

      None

      Show
      None
    • Hide
      Before this update, the Kubernetes version in the pod security annotation was set to the value of latest. As result, a pod might apply pod security rules defined by a future Kubernetes version. With this update, the enforce-version pod security annotation is set to v1.31 to match the version of Kubernetes API version used in OLMv1.
      Show
      Before this update, the Kubernetes version in the pod security annotation was set to the value of latest. As result, a pod might apply pod security rules defined by a future Kubernetes version. With this update, the enforce-version pod security annotation is set to v1.31 to match the version of Kubernetes API version used in OLMv1.
    • Proposed
    • Release Notes

      Summary: OLMv1 should avoid setting Pod Security Admission (PSA) labels to latest. Instead, it should pin the PSA version to match the Kubernetes API version specified in the go.mod file.​

      Issue Description: Using latest for PSA labels introduces unpredictability:​

      • latest references the most recent Kubernetes version, which may include changes to PSA rules.​
      • A Pod compliant with OCP 4.18 / Kubernetes 1.31 might fail in future versions (e.g., Kubernetes 1.40) due to altered PSA rules.​
      • Without version pinning, behavior becomes unpredictable, compromising long-term stability.​

      Proposed Solution: OLMv1 should:​

      • Avoid setting PSA labels to latest.​
      • Pin PSA labels to the Kubernetes API version specified in the go.mod file.​

      More info: https://redhat-internal.slack.com/archives/C06KP34REFJ/p1739880491760029

              rh-ee-cmacedo Camila Macedo
              rh-ee-cmacedo Camila Macedo
              Jian Zhang Jian Zhang
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: