Skip to content

Added Knative CRDs and Knative CR creation logic#117

Merged
openshift-merge-bot[bot] merged 12 commits intoredhat-developer:mainfrom
elai-shalev:import-crds
Apr 2, 2025
Merged

Added Knative CRDs and Knative CR creation logic#117
openshift-merge-bot[bot] merged 12 commits intoredhat-developer:mainfrom
elai-shalev:import-crds

Conversation

@elai-shalev
Copy link
Copy Markdown

Description of the change

This PR will add Knative Eventing and Serving CRDs to the Orchestrator Infra helm chart. This will allow an admin to install Knative resources in the knative-eventing and knative-serving namespaces, as part of pre-requisite steps necessary for installing RHDH with the Orchestrator flavor.

These changes are related to the issues from this PR.

This PR also adds logic for creating the Knative namespaces on a cluster, and creating the relevant Knative CRs.

Knative CR creation logic

Existing or Associated Issue(s)

Additional Information

Checklist

  • Chart version bumped in Chart.yaml according to semver.
  • Variables are documented in the values.yaml and added to the README.md. The pre-commit utility can be used to generate the necessary content. Use pre-commit run -a to apply changes.
  • JSON Schema template updated and re-generated the raw schema via pre-commit hook.
  • List tests pass for Chart using the Chart Testing tool and the ct lint command.

@openshift-ci openshift-ci Bot requested review from coreydaley and gazarenkov March 24, 2025 15:43
Comment thread charts/orchestrator-infra/templates/serverless/knatives.yaml Outdated
Comment thread charts/orchestrator-infra/templates/serverless/knatives.yaml Outdated
@masayag
Copy link
Copy Markdown

masayag commented Mar 24, 2025

Can you add to the README.md the version of the CRDs and where to download them from so it will simplify the maintenance of the chart.

@masayag
Copy link
Copy Markdown

masayag commented Mar 24, 2025

also, chart version bump is needed.

Copy link
Copy Markdown
Member

@rm3l rm3l left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR will add Knative Eventing and Serving CRDs to the Orchestrator Infra helm chart.

Probably dumb question, but I might be missing something.. Shouldn't these CRDs be actually installed after the InstallPlans of the Serverless and Serverless Logic Operators are approved.
At least, that's what I noticed with the current orchestrator-infra chart from the main branch (I was able to see new Knative* CRDs, unless the ones this PR adds are different?):

# Before installing the orchestrator-infra chart
$ oc get crd | grep -i knative 
$ oc get knativeeventings -A  
error: the server doesn't have a resource type "knativeeventings"
$ oc get knativeservings -A 
error: the server doesn't have a resource type "knativeservings"

# Install the orchestrator-infra chart and manually approve the InstallPlans
# ...

# After a few seconds/minutes
$ oc get crd | grep -i knative
knativeeventings.operator.knative.dev                             2025-03-24T17:18:45Z
knativekafkas.operator.serverless.openshift.io                    2025-03-24T17:18:46Z
knativeservings.operator.knative.dev                              2025-03-24T17:18:44Z
$ oc get knativeservings -A   
No resources found
$ oc get knativeeventings -A
No resources found

@masayag
Copy link
Copy Markdown

masayag commented Mar 25, 2025

This PR will add Knative Eventing and Serving CRDs to the Orchestrator Infra helm chart.

Probably dumb question, but I might be missing something.. Shouldn't these CRDs be actually installed after the InstallPlans of the Serverless and Serverless Logic Operators are approved. At least, that's what I noticed with the current orchestrator-infra chart from the main branch (I was able to see new Knative* CRDs, unless the ones this PR adds are different?):

# Before installing the orchestrator-infra chart
$ oc get crd | grep -i knative 
$ oc get knativeeventings -A  
error: the server doesn't have a resource type "knativeeventings"
$ oc get knativeservings -A 
error: the server doesn't have a resource type "knativeservings"

# Install the orchestrator-infra chart and manually approve the InstallPlans
# ...

# After a few seconds/minutes
$ oc get crd | grep -i knative
knativeeventings.operator.knative.dev                             2025-03-24T17:18:45Z
knativekafkas.operator.serverless.openshift.io                    2025-03-24T17:18:46Z
knativeservings.operator.knative.dev                              2025-03-24T17:18:44Z
$ oc get knativeservings -A   
No resources found
$ oc get knativeeventings -A
No resources found

@rm3l you are correct that the infra chart will deliver all of the required CRDs, however, the issue is with the timing.
Since we'd like to create the cluster-scope (or the external to release namespace custom resources), all of the CRDs required for it should be installed on the cluster before we attempt to apply the CRs.

When the chart installs the subscription for the openshift-serverless operator, it will not immediately create the CRDs. There will be some time before the CRDs are created. During that time, the chart will attempt to apply the knativeservice and knativeeventing CRs and will fail since the CRDs will not be available.
The way to overcome it is to provide the CRDs upfront, in which case that will be the first thing the chart will deploy on the cluster and by that we will not fail.

@rm3l
Copy link
Copy Markdown
Member

rm3l commented Mar 25, 2025

This PR will add Knative Eventing and Serving CRDs to the Orchestrator Infra helm chart.

Probably dumb question, but I might be missing something.. Shouldn't these CRDs be actually installed after the InstallPlans of the Serverless and Serverless Logic Operators are approved. At least, that's what I noticed with the current orchestrator-infra chart from the main branch (I was able to see new Knative* CRDs, unless the ones this PR adds are different?):

# Before installing the orchestrator-infra chart
$ oc get crd | grep -i knative 
$ oc get knativeeventings -A  
error: the server doesn't have a resource type "knativeeventings"
$ oc get knativeservings -A 
error: the server doesn't have a resource type "knativeservings"

# Install the orchestrator-infra chart and manually approve the InstallPlans
# ...

# After a few seconds/minutes
$ oc get crd | grep -i knative
knativeeventings.operator.knative.dev                             2025-03-24T17:18:45Z
knativekafkas.operator.serverless.openshift.io                    2025-03-24T17:18:46Z
knativeservings.operator.knative.dev                              2025-03-24T17:18:44Z
$ oc get knativeservings -A   
No resources found
$ oc get knativeeventings -A
No resources found

@rm3l you are correct that the infra chart will deliver all of the required CRDs, however, the issue is with the timing. Since we'd like to create the cluster-scope (or the external to release namespace custom resources), all of the CRDs required for it should be installed on the cluster before we attempt to apply the CRs.

When the chart installs the subscription for the openshift-serverless operator, it will not immediately create the CRDs. There will be some time before the CRDs are created. During that time, the chart will attempt to apply the knativeservice and knativeeventing CRs and will fail since the CRDs will not be available. The way to overcome it is to provide the CRDs upfront, in which case that will be the first thing the chart will deploy on the cluster and by that we will not fail.

Thanks for clarifying, @masayag!

Could the CRDs here potentially conflict with the ones that are coming from the bundles from the InstallPlans? Asking because, based on the README, it is not clear to me which versions of the CRDs the maintainers would have to keep an eye out on, based on the Subscriptions channels (alpha for Serverless Logic and stable for Serverless)..

Thinking out loud, but since the cluster admin would anyway need to manually approve the InstallPlans in order to deploy the Operators, wouldn't it make sense to document that they need to create the CRs as well (or do so by running an additional helm upgrade of the same infra chart that just creates the CRs or errors out if the CRDs are not installed yet)?

@elai-shalev
Copy link
Copy Markdown
Author

Could the CRDs here potentially conflict with the ones that are coming from the bundles from the InstallPlans? Asking because, based on the README, it is not clear to me which versions of the CRDs the maintainers would have to keep an eye out on, based on the Subscriptions channels (alpha for Serverless Logic and stable for Serverless)..

Thinking out loud, but since the cluster admin would anyway need to manually approve the InstallPlans in order to deploy the Operators, wouldn't it make sense to document that they need to create the CRs as well (or do so by running an additional helm upgrade of the same infra chart that just creates the CRs or errors out if the CRDs are not installed yet)?

Hey @rm3l, Moti and I discussed this and we believe the best approach is to have the chart shipped with having the CRD versions matching between the ones the chart installs, and the ones the subscription's CSV is trying to install. The chart will be in alignment, and if the subscription version will need to change, the README will document how to verify the correct CRD version and download it for the chart to be updated. There will be no runtime validation for the versions, rather each chart release will have to verify this (and a pre-release / CI test can be added).
This will allow us to solve this versioning issue, have the infra chart install Knative CRs, and not have a third chart
what do you think?

@rm3l
Copy link
Copy Markdown
Member

rm3l commented Mar 31, 2025

Could the CRDs here potentially conflict with the ones that are coming from the bundles from the InstallPlans? Asking because, based on the README, it is not clear to me which versions of the CRDs the maintainers would have to keep an eye out on, based on the Subscriptions channels (alpha for Serverless Logic and stable for Serverless)..
Thinking out loud, but since the cluster admin would anyway need to manually approve the InstallPlans in order to deploy the Operators, wouldn't it make sense to document that they need to create the CRs as well (or do so by running an additional helm upgrade of the same infra chart that just creates the CRs or errors out if the CRDs are not installed yet)?

Hey @rm3l, Moti and I discussed this and we believe the best approach is to have the chart shipped with having the CRD versions matching between the ones the chart installs, and the ones the subscription's CSV is trying to install. The chart will be in alignment, and if the subscription version will need to change, the README will document how to verify the correct CRD version and download it for the chart to be updated. There will be no runtime validation for the versions, rather each chart release will have to verify this (and a pre-release / CI test can be added). This will allow us to solve this versioning issue, have the infra chart install Knative CRs, and not have a third chart what do you think?

Sounds good. Thanks.

There will be no runtime validation for the versions, rather each chart release will have to verify this (and a pre-release / CI test can be added).

Could you please capture this in a JIRA task, so it is not forgotten? Thanks.

Copy link
Copy Markdown
Member

@rm3l rm3l left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ElaiShalevRH Could you rebase your PR branch and fix the Git conflicts?

@elai-shalev
Copy link
Copy Markdown
Author

elai-shalev commented Mar 31, 2025

@rm3l
I've opened the new issue here:
https://issues.redhat.com/browse/RHIDP-6694

And sure, let me rebase and push with the versioning disclaimer

(*) I still need to add the actual steps for retrieving the CRD version from the subscription, so that the maintainer / future CI task has a reference for that

@elai-shalev
Copy link
Copy Markdown
Author

@rm3l
Hey, I've added the correct CRDs and the guide to update them. The chart should be shipped with these CRDs in accordance to the subscription.
Once this change is merged we can return to the backstage chart PR and remove the creation of the Knative resources from there
btw, the CI here is failing on upgrade, which works fine for me on an OpenShift cluster. Do you see why?

Copy link
Copy Markdown
Member

@rm3l rm3l left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey, I've added the correct CRDs and the guide to update them. The chart should be shipped with these CRDs in accordance to the subscription.
Once this change is merged we can return to the backstage chart PR and remove the creation of the Knative resources from there

Sounds good.

btw, the CI here is failing on upgrade, which works fine for me on an OpenShift cluster. Do you see why?

As I understand it, this is how Helm handles CRDs defined in the crds directory. They are supposed to be installed once with helm install, but helm upgrade will not install them. I guess that's why we are seeing this issue in CI.

Maybe you approved the InstallPlans in your OpenShift cluster before, and the CRDs got installed? I was able to reproduce the CI issue in my local CRC cluster by simulating what ct does:

  1. running helm install from the main branch
  2. and then running helm upgrade <release-name> from your PR branch
$ helm upgrade my-orchestrator-infra-1 charts/orchestrator-infra        
Error: UPGRADE FAILED: [resource mapping not found for name: "knative-eventing" namespace: "knative-eventing" from "": no matches for kind "KnativeEventing" in version "operator.knative.dev/v1beta1"
ensure CRDs are installed first, resource mapping not found for name: "knative-serving" namespace: "knative-serving" from "": no matches for kind "KnativeServing" in version "operator.knative.dev/v1beta1"
ensure CRDs are installed first]

We are purposely testing in-place upgrades to catch potential issues that we had in the past with the RHDH chart. And I think it makes sense too for the orchestrator-infra chart.
As a potential workaround, maybe we can temporarily change the CI job to explicitly kubectl apply the CRDs here, before running ct install.
And revert this once this PR is merged, so that the base chart would be the one with the CRDs. Thoughts?

Comment thread charts/orchestrator-infra/README.md
Comment thread charts/orchestrator-infra/README.md Outdated
Comment thread charts/orchestrator-infra/README.md Outdated
@elai-shalev
Copy link
Copy Markdown
Author

As I understand it, this is how Helm handles CRDs defined in the crds directory. They are supposed to be installed once with helm install, but helm upgrade will not install them. I guess that's why we are seeing this issue in CI.
Maybe you approved the InstallPlans in your OpenShift cluster before, and the CRDs got installed? I was able to reproduce the CI issue in my local CRC cluster by simulating what ct does:

I believe you are correct. After the InstallPlan was approved the new CRDs took place and then were included for the upgrade.

We are purposely testing in-place upgrades to catch potential issues that we had in the past with the RHDH chart. And I think it makes sense too for the orchestrator-infra chart. As a potential workaround, maybe we can temporarily change the CI job to explicitly kubectl apply the CRDs here, before running ct install. And revert this once this PR is merged, so that the base chart would be the one with the CRDs. Thoughts?

I think adding an apply command for the CRDs would work for the update, yes. But at what stage do you intend to move the CRDs to the backstage chart?

@elai-shalev elai-shalev requested a review from a team as a code owner April 2, 2025 06:50
@rm3l
Copy link
Copy Markdown
Member

rm3l commented Apr 2, 2025

As I understand it, this is how Helm handles CRDs defined in the crds directory. They are supposed to be installed once with helm install, but helm upgrade will not install them. I guess that's why we are seeing this issue in CI.
Maybe you approved the InstallPlans in your OpenShift cluster before, and the CRDs got installed? I was able to reproduce the CI issue in my local CRC cluster by simulating what ct does:

I believe you are correct. After the InstallPlan was approved the new CRDs took place and then were included for the upgrade.

We are purposely testing in-place upgrades to catch potential issues that we had in the past with the RHDH chart. And I think it makes sense too for the orchestrator-infra chart. As a potential workaround, maybe we can temporarily change the CI job to explicitly kubectl apply the CRDs here, before running ct install. And revert this once this PR is merged, so that the base chart would be the one with the CRDs. Thoughts?

I think adding an apply command for the CRDs would work for the update, yes. But at what stage do you intend to move the CRDs to the backstage chart?

I didn't mean to move the CRDs to the backstage chart. They should remain part of the orchestrator-infra chart, IMO, no?
I meant:

  1. Add a new step in the GH job that runs kubectl apply for the CRDs just before the ct install step, so that the CI checks would pass on this PR.
  2. Merge this PR, so that version 0.0.3 (with the CRDs) would be the baseline for the orchestrator-infra upgrade checks.
  3. In a subsequent PR, revert the kubectl apply done in step 1. This, IMO, should not affect the CI checks.

This way, I think the upgrade checks would pass (and would reflect what the orchestrator-infra user would likely do).

@rm3l rm3l removed the request for review from a team April 2, 2025 07:24
Comment thread .github/workflows/test.yml Outdated
@elai-shalev
Copy link
Copy Markdown
Author

@rm3l Hey, any idea why only the Test Latest Release failing?
Creating namespace "orchestrator-infra-cbxh0a3yjb"... kubectl --request-timeout=30s create namespace orchestrator-infra-cbxh0a3yjb namespace/orchestrator-infra-cbxh0a3yjb created helm install orchestrator-infra-cbxh0a3yjb charts/orchestrator-infra --namespace orchestrator-infra-cbxh0a3yjb --wait --values charts/orchestrator-infra/ci/upstream-olm-values.yaml --timeout 500s --set upstream.backstage.image.tag=latest --set upstream.ingress.enabled=true --set global.host=rhdh.127.0.0.1.sslip.io Error: INSTALLATION FAILED: namespaces "knative-eventing" not found

@rm3l
Copy link
Copy Markdown
Member

rm3l commented Apr 2, 2025

@rm3l Hey, any idea why only the Test Latest Release failing? Creating namespace "orchestrator-infra-cbxh0a3yjb"... kubectl --request-timeout=30s create namespace orchestrator-infra-cbxh0a3yjb namespace/orchestrator-infra-cbxh0a3yjb created helm install orchestrator-infra-cbxh0a3yjb charts/orchestrator-infra --namespace orchestrator-infra-cbxh0a3yjb --wait --values charts/orchestrator-infra/ci/upstream-olm-values.yaml --timeout 500s --set upstream.backstage.image.tag=latest --set upstream.ingress.enabled=true --set global.host=rhdh.127.0.0.1.sslip.io Error: INSTALLATION FAILED: namespaces "knative-eventing" not found

🤔 Not sure why it passed on next, but not latest..

I wonder if the way the resources are being declared in the knatives.yaml template (namespaces + resources in that namespace) could not potentially lead to a race condition where Helm attempts to create resources in a namespace that is not fully available in the Kubernetes API (a small delay might happen)..
Maybe you can separate the namespaces creation into a pre-install/pre-upgrade Helm hook, to ensure that the namespaces are created before other resources?

@elai-shalev
Copy link
Copy Markdown
Author

@rm3l
I think we're seeing this behavior because of the CRDs not being deleted with the helm uninstall command. The Knative-eventing and Knative-serving namespaces are not getting deleted because of the CRDs acting as finalizers ( I think?) and that's why they are stuck in terminating, and can't be re-created.

Comment thread charts/orchestrator-infra/templates/serverless/knatives.yaml Outdated
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Apr 2, 2025

Copy link
Copy Markdown
Member

@rm3l rm3l left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci Bot added the lgtm label Apr 2, 2025
@openshift-merge-bot openshift-merge-bot Bot merged commit 4526502 into redhat-developer:main Apr 2, 2025
6 checks passed
rm3l added a commit to rm3l/rhdh-chart that referenced this pull request Apr 3, 2025
As discussed in [1], now that 0.0.3 (with the CRDs) is the baseline for the upgrade
checks, this is no longer needed.

[1] redhat-developer#117 (comment)
rm3l added a commit that referenced this pull request Apr 3, 2025
…rt (#122)

* ci: Revert manually applying the CRDs from the orchestrator-infra chart

As discussed in [1], now that 0.0.3 (with the CRDs) is the baseline for the upgrade
checks, this is no longer needed.

[1] #117 (comment)

* [TO REMOVE] Test the changes by bumping the orchestrator-chart version

* Revert "[TO REMOVE] Test the changes by bumping the orchestrator-chart version"

This reverts commit 2a284d9.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants