OCPBUGS-32887: Allow operator to update Route spec.subdomain

[Miciah]

Before this change, cluster-ingress-operator did not have permission to update spec.host or spec.subdomain on an existing route as the operator's serviceaccount did not have the necessary "routes/custom-host" permission. #965 added logic to the operator to clear spec.host and instead set spec.subdomain, but without the required permission, the update would fail with the following error message:

ERROR   operator.init   controller/controller.go:265    Reconciler error {"controller": "canary_controller", "object": {"name":"default","namespace":"openshift-ingress-operator"}, "namespace": "openshift-ingress-operator", "name": "default", "reconcileID": "463061e3-93a1-4067-802e-03e3f1f8cdd0", "error": "failed to ensure canary route: failed to update canary route openshift-ingress-canary/canary: Route.route.openshift.io \"canary\" is invalid: spec.subdomain: Invalid value: \"canary-openshift-ingress-canary\": field is immutable"}

This PR adds the needed permission to the clusterrole for the operator's serviceaccount so that the update can succeed.

[openshift-ci-robot]

@Miciah: This pull request references Jira Issue OCPBUGS-32887, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Before this change, cluster-ingress-operator did not have permission to update spec.host or spec.subdomain on an existing route as the operator's serviceaccount did not have the necessary "routes/custom-host" permission. #965 added logic to the operator to clear spec.host and instead set spec.subdomain, but without the required permission, the update would fail with the following error message:

ERROR operator.init controller/controller.go:265 Reconciler error {"controller": "canary_controller", "object": {"name":"default","namespace":"openshift-ingress-operator"}, "namespace": "openshift-ingress-operator", "name": "default", "reconcileID": "463061e3-93a1-4067-802e-03e3f1f8cdd0", "error": "failed to ensure canary route: failed to update canary route openshift-ingress-canary/canary: Route.route.openshift.io "canary" is invalid: spec.subdomain: Invalid value: "canary-openshift-ingress-canary": field is immutable"}

This PR adds the needed permission to the clusterrole for the operator's serviceaccount so that the update can succeed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[Miciah]

The e2e-aws-operator, e2e-gcp-operator, and e2e-azure-operator jobs all failed on TestRouteAdmissionPolicy, but e2e-aws-operator passed in #1048, so I'm not sure whether we have a new flake, or an extremely rare old flake, or what.
/test e2e-aws-operator
/test e2e-azure-operator
/test e2e-gcp-operator

[Miciah]

The TestRouteAdmissionPolicy failure is being tracked as part of OCPBUGS-26498.

[Miciah]

ci/prow/e2e-azure-operator failed because these tests failed:

• TestRouteAdmissionPolicy — this is OCPBUGS-26498.
• TestManagedDNSToUnmanagedDNSIngressController — I see this failing on 1 other PR.
• TestAllowedSourceRanges — failing on other PRs.
• TestSourceRangesProgressingAndEvaluationConditionsDetectedStatuses — only failed on this PR; I'll watch for a re-occurrence of this failure.
• TestAllowedSourceRangesStatus — only failed on this PR; I'll watch for this one too.
• TestUnmanagedDNSToManagedDNSInternalIngressController — failing on other PRs.

/test e2e-azure-operator

[frobware]

/lgtm
/approve
/hold
Adding hold for the current CI failures.
Please feel free to remove the hold if the CI failures (clear up and) are unrelated to the change.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: frobware

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [frobware]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[frobware]

/assign

[candita]

/assign

[candita]

/retest-required

[frobware]

/hold cancel

[openshift-ci]

@Miciah: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[openshift-ci-robot]

@Miciah: Jira Issue OCPBUGS-32887: All pull requests linked via external trackers have merged:

• openshift/cluster-ingress-operator#1047

Jira Issue OCPBUGS-32887 has been moved to the MODIFIED state.

In response to this:

Before this change, cluster-ingress-operator did not have permission to update spec.host or spec.subdomain on an existing route as the operator's serviceaccount did not have the necessary "routes/custom-host" permission. #965 added logic to the operator to clear spec.host and instead set spec.subdomain, but without the required permission, the update would fail with the following error message:

ERROR operator.init controller/controller.go:265 Reconciler error {"controller": "canary_controller", "object": {"name":"default","namespace":"openshift-ingress-operator"}, "namespace": "openshift-ingress-operator", "name": "default", "reconcileID": "463061e3-93a1-4067-802e-03e3f1f8cdd0", "error": "failed to ensure canary route: failed to update canary route openshift-ingress-canary/canary: Route.route.openshift.io "canary" is invalid: spec.subdomain: Invalid value: "canary-openshift-ingress-canary": field is immutable"}

This PR adds the needed permission to the clusterrole for the operator's serviceaccount so that the update can succeed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-cluster-ingress-operator-container-v4.16.0-202405100946.p0.g5b4f628.assembly.stream.el9 for distgit ose-cluster-ingress-operator.
All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-05-14-095225

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-07-13-011932