-
Feature Request
-
Resolution: Unresolved
-
Normal
-
None
-
None
-
None
-
None
-
Product / Portfolio Work
-
None
-
False
-
-
None
-
None
-
None
-
-
None
-
None
-
None
-
None
-
None
1. Proposed title of this feature request
After removing `image-registry` Investigate alternative methods to disable or suppress the `node-ca` daemonset without compromising cluster functionality.
2. What is the nature and description of the request?
Issue reported:
Customer reported an issue with the `image-registry` managementState set to "Removed", which does not remove the `node-ca` daemonset. The customer aims to eliminate unnecessary resources, including these pods, as they manage their image registry CA separately. The presence of these pods, though minimal in resources, is considered excessive as they are not needed for the customer's use case.
Actual Issue:
RH identified that when the managementState of the `image-registry` is set to "Removed", only the image registry deployment and its managed resources are removed, not the image registry operator itself. The pods `cluster-image-registry-operator-` and `node-ca-` remain running, as they are cluster-managed components and part of the Image Registry Operator control plane. The operator continues to run even when the registry is removed, which is the documented and supported behavior in OpenShift 4.19. Attempts to manually delete the `node-ca-*` pods result in their automatic recreation by the operator, confirming that they are continuously reconciled and cannot be permanently removed through manual deletion.
Steps so far:
- Customer inquired about removing the `image-registry` and its associated `node-ca` daemonset.
- RH explained that setting managementState to "Removed" does not eliminate the `node-ca` daemonset, as it is a cluster-managed component essential for node authentication.
- RH confirmed that the `node-ca` pods are automatically recreated after manual deletion, reinforcing their critical role in the OpenShift cluster.
Next steps:
- RH needs to investigate alternative methods to disable or suppress the `node-ca` daemonset without compromising cluster functionality.
- Explore potential configuration options or workarounds to address the customer's concern about unnecessary pods running on their clusters.
- Consult relevant OpenShift documentation and engage with the OpenShift product team for further insights or potential updates to accommodate such use cases.
3. Why does the customer need this? (List the business requirements here)
The customer aims to eliminate unnecessary OpenShift resources, including these pods, as they manage their image registry CA separately. The presence of these pods, though minimal in resources, is considered excessive as they are not needed for the customer's use cases.
4. List any affected packages or components.
N/A
- is blocked by
-
RFE-5213 Provide the ability to disable Cluster Capabilities after initial deployment of the cluster
-
- Backlog
-
-
CNTRLPLANE-631 Install image registry CA via MCO in HyperShift
-
- To Do
-