Merge pull request #1314 from harche/OTA-1860-allow-signature-policy-override

openshift-merge-bot[bot] · web-flow · commit 91b11e27198c · 2026-03-10T17:08:27.000Z
OTA-1860: Stop blocking patch updates when cluster version overrides are set
diff --git a/pkg/cvo/cvo_test.go b/pkg/cvo/cvo_test.go
@@ -2876,7 +2876,7 @@ func TestOperator_upgradeableSync(t *testing.T) {
 					Type:    configv1.OperatorUpgradeable,
 					Status:  configv1.ConditionFalse,
 					Reason:  "ClusterVersionOverridesSet",
-					Message: "Disabling ownership via cluster version overrides prevents upgrades. Please remove overrides before continuing.",
+					Message: "Disabling ownership via cluster version overrides prevents upgrades between minor or major versions. Please remove overrides before requesting a minor or major version update.",
 				}},
 			},
 		},
@@ -3189,7 +3189,7 @@ func TestOperator_upgradeableSync(t *testing.T) {
 					Type:    configv1.OperatorUpgradeable,
 					Status:  configv1.ConditionFalse,
 					Reason:  "MultipleReasons",
-					Message: "Cluster should not be upgraded between minor or major versions for multiple reasons: ClusterVersionOverridesSet,ClusterOperatorsNotUpgradeable\n* Disabling ownership via cluster version overrides prevents upgrades. Please remove overrides before continuing.\n* Multiple cluster operators should not be upgraded between minor or major versions:\n* Cluster operator default-operator-1 should not be upgraded between minor or major versions: RandomReason: some random reason why upgrades are not safe.\n* Cluster operator default-operator-2 should not be upgraded between minor or major versions: RandomReason2: some random reason 2 why upgrades are not safe.",
+					Message: "Cluster should not be upgraded between minor or major versions for multiple reasons: ClusterVersionOverridesSet,ClusterOperatorsNotUpgradeable\n* Disabling ownership via cluster version overrides prevents upgrades between minor or major versions. Please remove overrides before requesting a minor or major version update.\n* Multiple cluster operators should not be upgraded between minor or major versions:\n* Cluster operator default-operator-1 should not be upgraded between minor or major versions: RandomReason: some random reason why upgrades are not safe.\n* Cluster operator default-operator-2 should not be upgraded between minor or major versions: RandomReason2: some random reason 2 why upgrades are not safe.",
 				}, {
 					Type:    "UpgradeableClusterOperators",
 					Status:  configv1.ConditionFalse,
@@ -3199,7 +3199,7 @@ func TestOperator_upgradeableSync(t *testing.T) {
 					Type:    "UpgradeableClusterVersionOverrides",
 					Status:  configv1.ConditionFalse,
 					Reason:  "ClusterVersionOverridesSet",
-					Message: "Disabling ownership via cluster version overrides prevents upgrades. Please remove overrides before continuing.",
+					Message: "Disabling ownership via cluster version overrides prevents upgrades between minor or major versions. Please remove overrides before requesting a minor or major version update.",
 				}},
 			},
 		},
diff --git a/pkg/cvo/upgradeable.go b/pkg/cvo/upgradeable.go
@@ -260,7 +260,7 @@ func (check *clusterVersionOverridesUpgradeable) Check() *configv1.ClusterOperat
 	}
 
 	cond.Reason = "ClusterVersionOverridesSet"
-	cond.Message = "Disabling ownership via cluster version overrides prevents upgrades. Please remove overrides before continuing."
+	cond.Message = "Disabling ownership via cluster version overrides prevents upgrades between minor or major versions. Please remove overrides before requesting a minor or major version update."
 	return cond
 }
 
diff --git a/pkg/payload/precondition/clusterversion/upgradeable.go b/pkg/payload/precondition/clusterversion/upgradeable.go
@@ -40,7 +40,7 @@ func ClusterVersionOverridesCondition(cv *configv1.ClusterVersion) *configv1.Clu
 				Type:    internal.UpgradeableClusterVersionOverrides,
 				Status:  configv1.ConditionFalse,
 				Reason:  "ClusterVersionOverridesSet",
-				Message: "Disabling ownership via cluster version overrides prevents upgrades. Please remove overrides before continuing.",
+				Message: "Disabling ownership via cluster version overrides prevents upgrades between minor or major versions. Please remove overrides before requesting a minor or major version update.",
 			}
 			return &condition
 		}
@@ -100,15 +100,17 @@ func (pf *Upgradeable) Run(ctx context.Context, releaseContext precondition.Rele
 	klog.V(4).Infof("The current version is %s parsed from %s and the target version is %s parsed from %s", currentVersion.String(), cv.Status.Desired.Version, targetVersion.String(), releaseContext.DesiredVersion)
 	patchOnly := targetVersion.Major == currentVersion.Major && targetVersion.Minor == currentVersion.Minor
 	if targetVersion.LTE(currentVersion) || patchOnly {
-		// When Upgradeable==False, a patch level update with the same minor version is allowed unless overrides are set.
+		// When Upgradeable==False, a patch level update with the same minor version is allowed.
 		// However, minor or major version updates are blocked when Upgradeable==False.
 		// This Upgradeable precondition is only concerned about moving forward, i.e., do not care about downgrade which is taken care of by the Rollback precondition
 		if condition := ClusterVersionOverridesCondition(cv); condition != nil {
-			klog.V(2).Infof("Retarget from %s to %s is blocked by %s: %s", currentVersion.String(), targetVersion.String(), condition.Reason, condition.Message)
+			message := fmt.Sprintf("Retarget from %s to %s is not blocked by %s. But the cluster-version operator is not managing these resources; they are currently the responsibility of the agent that set the overrides: %s", currentVersion.String(), targetVersion.String(), condition.Reason, condition.Message)
+			klog.V(2).Info(message)
 			return &precondition.Error{
-				Reason:  condition.Reason,
-				Message: condition.Message,
-				Name:    pf.Name(),
+				Reason:             condition.Reason,
+				Message:            message,
+				Name:               pf.Name(),
+				NonBlockingWarning: true,
 			}
 		} else {
 			if completedVersion, majorOrMinor := majorOrMinorUpdateFrom(cv.Status, currentVersion); completedVersion != "" && patchOnly {
diff --git a/pkg/payload/precondition/clusterversion/upgradeable_test.go b/pkg/payload/precondition/clusterversion/upgradeable_test.go
@@ -27,6 +27,7 @@ func TestUpgradeableRun(t *testing.T) {
 	tests := []struct {
 		name             string
 		upgradeable      *configv1.ConditionStatus
+		overrides        []configv1.ComponentOverride
 		completedVersion string
 		currVersion      string
 		desiredVersion   string
@@ -80,6 +81,31 @@ func TestUpgradeableRun(t *testing.T) {
 			currVersion:    "4.1.3",
 			desiredVersion: "4.1.4",
 		},
+		{
+			name:           "move-z, with false condition and overrides, is non-blocking warning",
+			upgradeable:    ptr(configv1.ConditionFalse),
+			currVersion:    "4.1.3",
+			desiredVersion: "4.1.4",
+			overrides: []configv1.ComponentOverride{
+				{Kind: "Deployment", Group: "apps", Namespace: "openshift-monitoring", Name: "prometheus", Unmanaged: true},
+			},
+			expected: &precondition.Error{
+				NonBlockingWarning: true,
+				Name:               "ClusterVersionUpgradeable",
+				Message:            "Retarget from 4.1.3 to 4.1.4 is not blocked by ClusterVersionOverridesSet. But the cluster-version operator is not managing these resources; they are currently the responsibility of the agent that set the overrides: Disabling ownership via cluster version overrides prevents upgrades between minor or major versions. Please remove overrides before requesting a minor or major version update.",
+				Reason:             "ClusterVersionOverridesSet",
+			},
+		},
+		{
+			name:           "move-y, with false condition and overrides, is still blocking",
+			upgradeable:    ptr(configv1.ConditionFalse),
+			currVersion:    "4.1.1",
+			desiredVersion: "4.2.1",
+			overrides: []configv1.ComponentOverride{
+				{Kind: "Deployment", Group: "apps", Namespace: "openshift-monitoring", Name: "prometheus", Unmanaged: true},
+			},
+			expected: &precondition.Error{Name: "ClusterVersionUpgradeable", Message: "set to False", Reason: "bla"},
+		},
 		{
 			name: "empty target",
 		},
@@ -167,7 +193,9 @@ func TestUpgradeableRun(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			clusterVersion := &configv1.ClusterVersion{
 				ObjectMeta: metav1.ObjectMeta{Name: "version"},
-				Spec:       configv1.ClusterVersionSpec{},
+				Spec: configv1.ClusterVersionSpec{
+					Overrides: tc.overrides,
+				},
 				Status: configv1.ClusterVersionStatus{
 					Desired: configv1.Release{Version: tc.currVersion},
 					History: []configv1.UpdateHistory{{State: configv1.CompletedUpdate, Version: tc.completedVersion}},

Original file line number	Diff line number	Diff line change
`@@ -260,7 +260,7 @@ func (check clusterVersionOverridesUpgradeable) Check() configv1.ClusterOperat`
`260`	`260`	`}`
`261`	`261`
`262`	`262`	`cond.Reason = "ClusterVersionOverridesSet"`
`263`		`- cond.Message = "Disabling ownership via cluster version overrides prevents upgrades. Please remove overrides before continuing."`
	`263`	`+ cond.Message = "Disabling ownership via cluster version overrides prevents upgrades between minor or major versions. Please remove overrides before requesting a minor or major version update."`
`264`	`264`	`return cond`
`265`	`265`	`}`
`266`	`266`