Skip to content

OSPRH-25976: prevent openstack operator from forcing Galera Secret#1851

Merged
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
zzzeek:OSPRH-25976
Mar 17, 2026
Merged

OSPRH-25976: prevent openstack operator from forcing Galera Secret#1851
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
zzzeek:OSPRH-25976

Conversation

@zzzeek

@zzzeek zzzeek commented Mar 11, 2026

Copy link
Copy Markdown
Contributor

Remove the webhook rule that forces the Galera template to be copied from the top level openstack control plane secret field when blank, instead allowing the Galera level secret to be blank. This allows the Galera operator to use newer "automatic root password generation" logic delivered as part of OSPRH-14916.

Workflows include deployment of an openstack control plane with no galera secret (blank or omitted) which will fully auto-generate a mariadb root password for the new install, or modifying an existing deployment's secret to be blank, which will generate a mariadb root password and update the existing galera DB to use the new root pw.

References: OSPRH-25976

Remove the webhook rule that forces the Galera template to be
copied from the top level openstack control plane secret field
when blank, instead allowing the Galera level secret to be
blank.  This allows the Galera operator to use newer
"automatic root password generation" logic delivered as
part of OSPRH-14916.

Workflows include deployment of an openstack control plane
with no galera secret (blank or omitted) which will fully auto-generate
a mariadb root password for the new install, or modifying an existing
deployment's secret to be blank, which will generate a mariadb root
password and update the existing galera DB to use the new root pw.

References: OSPRH-25976
@openshift-ci-robot

openshift-ci-robot commented Mar 11, 2026

Copy link
Copy Markdown

@zzzeek: This pull request references OSPRH-25976 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Remove the webhook rule that forces the Galera template to be copied from the top level openstack control plane secret field when blank, instead allowing the Galera level secret to be blank. This allows the Galera operator to use newer "automatic root password generation" logic delivered as part of OSPRH-14916.

Workflows include deployment of an openstack control plane with no galera secret (blank or omitted) which will fully auto-generate a mariadb root password for the new install, or modifying an existing deployment's secret to be blank, which will generate a mariadb root password and update the existing galera DB to use the new root pw.

References: OSPRH-25976

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot requested review from rabi and rebtoor March 11, 2026 17:42
@zzzeek zzzeek requested a review from dciabrin March 11, 2026 17:42
@github-actions

Copy link
Copy Markdown

OpenStackControlPlane CRD Size Report

Metric Value
CRD JSON size 322062 bytes (315KB)
Base branch size 322062 bytes
Change +0.00%
Status yellow — growing
Threshold reference
Color Range Meaning
🟢 green < 300KB Comfortable
🟡 yellow 300–400KB Growing
🟠 orange 400–750KB Concerning
🔴 red > 750KB Approaching 1.5MB etcd limit (cut in half to allow space for update)

@zzzeek

zzzeek commented Mar 12, 2026

Copy link
Copy Markdown
Contributor Author

/retest

1 similar comment
@zzzeek

zzzeek commented Mar 13, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@zzzeek

zzzeek commented Mar 16, 2026

Copy link
Copy Markdown
Contributor Author

/refresh

@zzzeek zzzeek requested review from abays, fmount, lmiccini and stuggi March 16, 2026 19:10
@stuggi

stuggi commented Mar 17, 2026

Copy link
Copy Markdown
Contributor

@zzzeek is there anything else using the root pwd? just thinking about backup/restore and if we have to restore the old root pwd. or if it is ok to get a new root password as we create a new galera cluster on restore

@zzzeek

zzzeek commented Mar 17, 2026

Copy link
Copy Markdown
Contributor Author

@zzzeek is there anything else using the root pwd? just thinking about backup/restore and if we have to restore the old root pwd. or if it is ok to get a new root password as we create a new galera cluster on restore

everything in the galera operator that needs the DB root password uses this script: https://github.com/openstack-k8s-operators/mariadb-operator/blob/main/templates/galera/bin/mysql_root_auth.sh (e.g. here's backup: https://github.com/openstack-k8s-operators/mariadb-operator/blob/5c473d96472788c3d0f87a474a8d9598a7fa1a63/templates/galerabackup/bin/backup_galera#L86 ) to access it; this retrieves the PW from Galera->Status->Secret. The moment you upgrade to FR5 and galera reconciles, it creates this new secret which for existing installs would be copied from Galera->Spec->Secret (e.g. osp-secret)->DbRootPassword.

if the question refers to "what happens if we restore an old DB that had a different root password" that is actually taken care of inside of mysql_bootstrap.sh now: https://github.com/openstack-k8s-operators/mariadb-operator/blob/5c473d96472788c3d0f87a474a8d9598a7fa1a63/templates/galera/bin/mysql_bootstrap.sh#L6-L96 since as soon as we started playing with changing the root PW, bootstrapping galeras onto volumes that already existed introduced this problem, so that should be good now.

@stuggi

stuggi commented Mar 17, 2026

Copy link
Copy Markdown
Contributor

thanks, lgtm

@stuggi stuggi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci

openshift-ci Bot commented Mar 17, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stuggi, zzzeek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@stuggi

stuggi commented Mar 17, 2026

Copy link
Copy Markdown
Contributor

@zzzeek

zzzeek commented Mar 17, 2026

Copy link
Copy Markdown
Contributor Author

yes if we all go forward with "DB root passwords are auto-generated now" we would want to change those samples too.

@openshift-merge-bot openshift-merge-bot Bot merged commit 181f852 into openstack-k8s-operators:main Mar 17, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants