Skip to content

HIVE-2302, HIVE-2644: Pass metadata.json through opaquely #2729

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 3 commits into from
Nov 4, 2025
Merged

HIVE-2302, HIVE-2644: Pass metadata.json through opaquely #2729

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
899e2c9
HIVE-2302: Save metadata.json opaquely
2uasimojo Aug 1, 2025
e147330
HIVE-2302, HIVE-2644: Destroyers use metadata.json
2uasimojo Sep 9, 2025
42c37de
HIVE-2302: Refactor ConfigureCreds to modify installer metadata
2uasimojo Oct 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions apis/hive/v1/aws/metadata.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,7 @@ package aws
type Metadata struct {
// HostedZoneRole is the role to assume when performing operations
// on a hosted zone owned by another account.
// Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
// may stop populating this section in the future.
HostedZoneRole *string `json:"hostedZoneRole,omitempty"`
}
2 changes: 2 additions & 0 deletions apis/hive/v1/azure/metadata.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,7 @@ package azure
// Metadata contains Azure metadata (e.g. for uninstalling the cluster).
type Metadata struct {
// ResourceGroupName is the name of the resource group in which the cluster resources were created.
// Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
// may stop populating this section in the future.
ResourceGroupName *string `json:"resourceGroupName"`
}
8 changes: 7 additions & 1 deletion apis/hive/v1/clusterdeployment_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,7 +308,13 @@ type ClusterMetadata struct {
// +optional
AdminPasswordSecretRef *corev1.LocalObjectReference `json:"adminPasswordSecretRef,omitempty"`

// Platform holds platform-specific cluster metadata
// MetadataJSONSecretRef references the secret containing the metadata.json emitted by the
// installer, potentially scrubbed for sensitive data.
MetadataJSONSecretRef *corev1.LocalObjectReference `json:"metadataJSONSecretRef,omitempty"`

// Platform holds platform-specific cluster metadata.
// Deprecated. Use the Secret referenced by MetadataJSONSecretRef instead. We may stop
// populating this section in the future.
// +optional
Platform *ClusterPlatformMetadata `json:"platform,omitempty"`
}
Expand Down
4 changes: 4 additions & 0 deletions apis/hive/v1/clusterdeprovision_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,10 @@ type ClusterDeprovisionSpec struct {
// BaseDomain is the DNS base domain.
BaseDomain string `json:"baseDomain,omitempty"`

// MetadataJSONSecretRef references the secret containing the metadata.json emitted by the
// installer, potentially scrubbed for sensitive data.
MetadataJSONSecretRef *corev1.LocalObjectReference `json:"metadataJSONSecretRef,omitempty"`

// Platform contains platform-specific configuration for a ClusterDeprovision
Platform ClusterDeprovisionPlatform `json:"platform,omitempty"`
}
Expand Down
2 changes: 2 additions & 0 deletions apis/hive/v1/gcp/metadata.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@ package gcp
// Metadata contains GCP metadata (e.g. for uninstalling the cluster).
type Metadata struct {
// NetworkProjectID is used for shared VPC setups
// Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
// may stop populating this section in the future.
// +optional
NetworkProjectID *string `json:"networkProjectID,omitempty"`
}
10 changes: 10 additions & 0 deletions apis/hive/v1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

33 changes: 30 additions & 3 deletions config/crds/hive.openshift.io_clusterdeployments.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,8 +180,27 @@ spec:
infraID:
description: InfraID is an identifier for this cluster generated during installation and used for tagging/naming resources in cloud providers.
type: string
metadataJSONSecretRef:
description: |-
MetadataJSONSecretRef references the secret containing the metadata.json emitted by the
installer, potentially scrubbed for sensitive data.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
platform:
description: Platform holds platform-specific cluster metadata
description: |-
Platform holds platform-specific cluster metadata.
Deprecated. Use the Secret referenced by MetadataJSONSecretRef instead. We may stop
populating this section in the future.
properties:
aws:
description: AWS holds AWS-specific cluster metadata
Expand All @@ -190,13 +209,18 @@ spec:
description: |-
HostedZoneRole is the role to assume when performing operations
on a hosted zone owned by another account.
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
may stop populating this section in the future.
type: string
type: object
azure:
description: Azure holds azure-specific cluster metadata
properties:
resourceGroupName:
description: ResourceGroupName is the name of the resource group in which the cluster resources were created.
description: |-
ResourceGroupName is the name of the resource group in which the cluster resources were created.
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
may stop populating this section in the future.
type: string
required:
- resourceGroupName
Expand All @@ -205,7 +229,10 @@ spec:
description: GCP holds GCP-specific cluster metadata
properties:
networkProjectID:
description: NetworkProjectID is used for shared VPC setups
description: |-
NetworkProjectID is used for shared VPC setups
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
may stop populating this section in the future.
type: string
type: object
type: object
Expand Down
16 changes: 16 additions & 0 deletions config/crds/hive.openshift.io_clusterdeprovisions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,22 @@ spec:
infraID:
description: InfraID is the identifier generated during installation for a cluster. It is used for tagging/naming resources in cloud providers.
type: string
metadataJSONSecretRef:
description: |-
MetadataJSONSecretRef references the secret containing the metadata.json emitted by the
installer, potentially scrubbed for sensitive data.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
platform:
description: Platform contains platform-specific configuration for a ClusterDeprovision
properties:
Expand Down
33 changes: 30 additions & 3 deletions config/crds/hiveinternal.openshift.io_fakeclusterinstalls.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,8 +92,27 @@ spec:
infraID:
description: InfraID is an identifier for this cluster generated during installation and used for tagging/naming resources in cloud providers.
type: string
metadataJSONSecretRef:
description: |-
MetadataJSONSecretRef references the secret containing the metadata.json emitted by the
installer, potentially scrubbed for sensitive data.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
platform:
description: Platform holds platform-specific cluster metadata
description: |-
Platform holds platform-specific cluster metadata.
Deprecated. Use the Secret referenced by MetadataJSONSecretRef instead. We may stop
populating this section in the future.
properties:
aws:
description: AWS holds AWS-specific cluster metadata
Expand All @@ -102,13 +121,18 @@ spec:
description: |-
HostedZoneRole is the role to assume when performing operations
on a hosted zone owned by another account.
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
may stop populating this section in the future.
type: string
type: object
azure:
description: Azure holds azure-specific cluster metadata
properties:
resourceGroupName:
description: ResourceGroupName is the name of the resource group in which the cluster resources were created.
description: |-
ResourceGroupName is the name of the resource group in which the cluster resources were created.
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
may stop populating this section in the future.
type: string
required:
- resourceGroupName
Expand All @@ -117,7 +141,10 @@ spec:
description: GCP holds GCP-specific cluster metadata
properties:
networkProjectID:
description: NetworkProjectID is used for shared VPC setups
description: |-
NetworkProjectID is used for shared VPC setups
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
may stop populating this section in the future.
type: string
type: object
type: object
Expand Down
19 changes: 17 additions & 2 deletions contrib/pkg/createcluster/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,7 @@ type Options struct {
AdoptAdminKubeConfig string
AdoptInfraID string
AdoptClusterID string
AdoptMetadataJSON string
AdoptAdminUsername string
AdoptAdminPassword string
MachineNetwork string
Expand Down Expand Up @@ -337,6 +338,7 @@ OpenShift Installer publishes all the services of the cluster like API server an
flags.StringVar(&opt.AdoptAdminKubeConfig, "adopt-admin-kubeconfig", "", "Path to a cluster admin kubeconfig file for a cluster being adopted. (required if using --adopt)")
flags.StringVar(&opt.AdoptInfraID, "adopt-infra-id", "", "Infrastructure ID for this cluster's cloud provider. (required if using --adopt)")
flags.StringVar(&opt.AdoptClusterID, "adopt-cluster-id", "", "Cluster UUID used for telemetry. (required if using --adopt)")
flags.StringVar(&opt.AdoptMetadataJSON, "adopt-metadata-json", "", "Path to a metadata.json file for a cluster being adopted. (optional)")
flags.StringVar(&opt.AdoptAdminUsername, "adopt-admin-username", "", "Username for cluster web console administrator. (optional)")
flags.StringVar(&opt.AdoptAdminPassword, "adopt-admin-password", "", "Password for cluster web console administrator. (optional)")

Expand Down Expand Up @@ -486,13 +488,19 @@ func (o *Options) Validate(cmd *cobra.Command) error {
return fmt.Errorf("--adopt-admin-kubeconfig does not exist: %s", o.AdoptAdminKubeConfig)
}

if o.AdoptMetadataJSON != "" {
if _, err := os.Stat(o.AdoptMetadataJSON); os.IsNotExist(err) {
return fmt.Errorf("--adopt-metadata-json does not exist: %s", o.AdoptMetadataJSON)
}
}

// Admin username and password must both be specified if either are.
if (o.AdoptAdminUsername != "" || o.AdoptAdminPassword != "") && !(o.AdoptAdminUsername != "" && o.AdoptAdminPassword != "") {
return fmt.Errorf("--adopt-admin-username and --adopt-admin-password must be used together")
}
} else {
if o.AdoptAdminKubeConfig != "" || o.AdoptInfraID != "" || o.AdoptClusterID != "" || o.AdoptAdminUsername != "" || o.AdoptAdminPassword != "" {
return fmt.Errorf("cannot use adoption options without --adopt: --adopt-admin-kube-config, --adopt-infra-id, --adopt-cluster-id, --adopt-admin-username, --adopt-admin-password")
if o.AdoptAdminKubeConfig != "" || o.AdoptInfraID != "" || o.AdoptClusterID != "" || o.AdoptMetadataJSON != "" || o.AdoptAdminUsername != "" || o.AdoptAdminPassword != "" {
return fmt.Errorf("cannot use adoption options without --adopt: --adopt-admin-kube-config, --adopt-infra-id, --adopt-cluster-id, --adopt-metadata-json, --adopt-admin-username, --adopt-admin-password")
}
}

Expand Down Expand Up @@ -638,6 +646,13 @@ func (o *Options) GenerateObjects() ([]runtime.Object, error) {
if err != nil {
return nil, err
}
if o.AdoptMetadataJSON != "" {
metadataJSONBytes, err := os.ReadFile(o.AdoptMetadataJSON)
if err != nil {
return nil, err
}
builder.AdoptMetadataJSON = metadataJSONBytes
}
builder.Adopt = o.Adopt
builder.AdoptInfraID = o.AdoptInfraID
builder.AdoptClusterID = o.AdoptClusterID
Expand Down
3 changes: 1 addition & 2 deletions contrib/pkg/deprovision/awstagdeprovision.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ import (
)

// NewDeprovisionAWSWithTagsCommand is the entrypoint to create the 'aws-tag-deprovision' subcommand
// TODO: Port to a sub-command of deprovision.
func NewDeprovisionAWSWithTagsCommand() *cobra.Command {
opt := &aws.ClusterUninstaller{}
var credsDir string
Expand Down Expand Up @@ -66,7 +65,7 @@ func completeAWSUninstaller(o *aws.ClusterUninstaller, logLevel string, args []s
"This is expected when in standalone mode. "+
"We expect to find your AWS credentials in one of the usual places.", err)
}
awsutils.ConfigureCreds(client)
awsutils.ConfigureCreds(client, nil)

return nil
}
Expand Down
9 changes: 5 additions & 4 deletions contrib/pkg/deprovision/azure.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,10 @@ type AzureOptions struct {
}

// NewDeprovisionAzureCommand is the entrypoint to create the azure deprovision subcommand
func NewDeprovisionAzureCommand() *cobra.Command {
opt := &AzureOptions{}
func NewDeprovisionAzureCommand(logLevel string) *cobra.Command {
opt := &AzureOptions{
logLevel: logLevel,
}
cmd := &cobra.Command{
Use: "azure INFRAID [--azure-cloud-name CLOUDNAME] [--azure-resource-group-name RG] [--azure-base-domain-resource-group-name BDRG]",
Short: "Deprovision Azure assets (as created by openshift-installer)",
Expand All @@ -46,7 +48,6 @@ func NewDeprovisionAzureCommand() *cobra.Command {
},
}
flags := cmd.Flags()
flags.StringVar(&opt.logLevel, "loglevel", "info", "log level, one of: debug, info, warn, error, fatal, panic")
flags.StringVar(&opt.cloudName, "azure-cloud-name", installertypesazure.PublicCloud.Name(), "The name of the Azure cloud environment used to configure the Azure SDK")
flags.StringVar(&opt.resourceGroupName, "azure-resource-group-name", "", "The name of the custom Azure resource group in which the cluster was created when not using the default installer-created resource group")
flags.StringVar(&opt.baseDomainResourceGroupName, "azure-base-domain-resource-group-name", "", "The name of the custom Azure resource group in which the cluster's DNS records were created when not using the default installer-created resource group or custom resource group")
Expand All @@ -73,7 +74,7 @@ func (opt *AzureOptions) completeAzureUninstaller(args []string) (providers.Dest
if err != nil {
return nil, errors.Wrap(err, "failed to get client")
}
azureutils.ConfigureCreds(client)
azureutils.ConfigureCreds(client, nil)

metadata := &types.ClusterMetadata{
InfraID: args[0],
Expand Down
Loading