fix(apis): remove deprecated flightrecorder/recording apis

[tthvo]

Fixes #436
Fixes #387
Related to #430
Depends on https://github.com/cryostatio/cryostat/pull/1042
Depends on #440

Removed deprecated flight/recording apis and their resources.
Updated CSV (i.e. remove deprecated apis and bump operator-sdk version to 1.22.2).

[tthvo]

Run into:

WARNING: HTTP 401: HTTP Authorization Failure
io.vertx.ext.web.handler.HttpException: Unauthorized
Caused by: java.util.concurrent.ExecutionException: java.util.concurrent.ExecutionException: io.cryostat.net.PermissionDeniedException: Requesting client in namespace "default" cannot get recordings.operator.cryostat.io: scopes [user:check-access role:cryostat-operator-oauth-client:default] prevent this action
	at java.base/java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:396)
	at java.base/java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2073)
	at io.cryostat.net.web.http.AbstractAuthenticatedRequestHandler.handle(AbstractAuthenticatedRequestHandler.java:92)
	at io.cryostat.net.web.http.AbstractAuthenticatedRequestHandler.handle(AbstractAuthenticatedRequestHandler.java:69)
	at io.vertx.ext.web.impl.BlockingHandlerDecorator.lambda$handle$0(BlockingHandlerDecorator.java:48)
	at io.vertx.core.impl.ContextImpl.lambda$null$0(ContextImpl.java:159)
	at io.vertx.core.impl.AbstractContext.dispatch(AbstractContext.java:100)
	at io.vertx.core.impl.ContextImpl.lambda$executeBlocking$1(ContextImpl.java:157)
	at io.vertx.core.impl.TaskQueue.run(TaskQueue.java:76)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: java.util.concurrent.ExecutionException: io.cryostat.net.PermissionDeniedException: Requesting client in namespace "default" cannot get recordings.operator.cryostat.io: scopes [user:check-access role:cryostat-operator-oauth-client:default] prevent this action
	at java.base/java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:396)
	at java.base/java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2096)
	at io.cryostat.net.openshift.OpenShiftAuthManager.validateToken(OpenShiftAuthManager.java:263)
	at io.cryostat.net.openshift.OpenShiftAuthManager.validateHttpHeader(OpenShiftAuthManager.java:359)
	at io.cryostat.net.web.http.AbstractAuthenticatedRequestHandler.validateRequestAuthorization(AbstractAuthenticatedRequestHandler.java:120)
	... 11 more
Caused by: io.cryostat.net.PermissionDeniedException: Requesting client in namespace "default" cannot get recordings.operator.cryostat.io: scopes [user:check-access role:cryostat-operator-oauth-client:default] prevent this action
	at io.cryostat.net.openshift.OpenShiftAuthManager.lambda$validateAction$4(OpenShiftAuthManager.java:337)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.HashMap$KeySpliterator.forEachRemaining(HashMap.java:1707)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
	at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:276)
	at java.base/java.util.Iterator.forEachRemaining(Iterator.java:133)
	at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1845)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at io.cryostat.net.openshift.OpenShiftAuthManager.validateToken(OpenShiftAuthManager.java:260)
	... 13 more

Looking into cryostat OAuth setup for check its rbac resource requirements.

[ebaron]

@tthvo oh right. This ends up being blocked by https://github.com/cryostatio/cryostat/issues/979. We'll have to come up with some alternative resource mapping to permissions that do not use these APIs being removed.

[tthvo]

Oh yehh make senses! I can try looking into that and trace back how we setup OAuth to get a better idea then :D

[github-actions]

This PR/issue depends on:

• cryostatio/cryostat#1042
• feat(auth-properties): allow users to specific cryostat permission mappings #440
  By Dependent Issues (🤖). Happy coding!

[tthvo]

Images available for testing:

quay.io/thvo/cryostat-operator-bundle:0.0.0-depr-api and quay.io/thvo/cryostat-operator:0.0.0-depr-api

[tthvo]

I believe this PR can also resolve #387?

[ebaron]

I believe this PR can also resolve #387?

That's correct.

[ebaron]

Hey @tthvo, looks good at a glance. I'm going to try it out and see if I can test upgrading the bundle to make sure nothing breaks.

[ebaron]

Finally managed to do an upgrade test and it succeeded. I ended up creating a catalog image with 2.1.1 and this PR, but OLM didn't attempt an upgrade. I think this might be because 2.1.1 is in the stable channel and this (and all development versions) is in the alpha channel. Using 2.1.2-dev and then this PR (2.2.0-dev), I was able to get the upgrade to work.

If you're interested in how I did it, I made the bundle image with:

make catalog-build CATALOG_IMG=quay.io/ebaron/cryostat-operator-catalog:latest \
BUNDLE_IMGS='quay.io/cryostat/cryostat-operator-bundle:2.1.2-dev,quay.io/ebaron/cryostat-operator-bundle:latest'

You can then install the 2.1.2-dev version specifically using these instructions:
https://docs.openshift.com/container-platform/4.10/operators/user/olm-installing-operators-in-namespace.html#olm-installing-specific-version-cli_olm-installing-operators-in-namespace

[tthvo]

Great! Thanks @ebaron a lot for showing me how to do this test. I tried out and worked out nicely!!

1. Built the controller image (tagged 2.2.0-dev) and bundle image (tagged latest).
2. Built catalog image with cryostat-operator 2.1.2-dev and my above image.
3. All images pushed to my quay.io/thvo registry in public mode.
4. Created a CatalogSource pointing to that index image and channel set to alpha,
5. Created a OperatorGroup with targetNamespace to default.
6. Created a Subscription with Manual approval plan in default namespace and startingCSV to 2.1.2-dev.

From there, I could see the InstallPlan awaiting approval. I could change its spec to spec.approved to true. On Openshift console, I saw a upgrade-available notification. After approval, operator is installed sucessfully with latest version (2.2.0-dev).

Source:

• https://olm.operatorframework.io/docs/tasks/install-operator-with-olm/#example-install-a-specific-version-of-an-operator
• https://docs.openshift.com/container-platform/4.10/operators/user/olm-installing-operators-in-namespace.html#olm-installing-specific-version-cli_olm-installing-operators-in-namespace

[ebaron]

Glad it worked for you, and thanks for documenting these steps in more detail!