Limit overlap detection to the same cluster

Otherwise, hosted mode runs into problems where it believes there will be an overlap, but actually the policies are for different clusters. Refs: - https://issues.redhat.com/browse/ACM-12032 Signed-off-by: Justin Kulikauskas <jkulikau@redhat.com>
stolostron · Jun 10, 2024 · 04184bc · 04184bc
1 parent 23e890e
commit 04184bc
Show file tree

Hide file tree

Showing 18 changed files with 61 additions and 1 deletion.
diff --git a/controllers/operatorpolicy_controller.go b/controllers/operatorpolicy_controller.go
@@ -53,6 +53,8 @@ const (
  olmGracePeriod = 30 * time.Second
  ManagedByLabel string = "operatorpolicy.policy.open-cluster-management.io/managed"
  ManagedByAnnotation string = ManagedByLabel
+ ClusterNameLabel string = "policy.open-cluster-management.io/cluster-name"
+ ClusterNamespaceLabel string = "policy.open-cluster-management.io/cluster-namespace"
 )
 
 var (
@@ -476,8 +478,15 @@ func (r *OperatorPolicyReconciler) checkSubOverlap(
  return statusChanged, nil, nil
  }
 
+ // limit to OperatorPolicies for the same cluster as the policy
+ // (this cluster might be hosting OperatorPolicies for other clusters)
+ sel := labels.SelectorFromSet(map[string]string{
+ ClusterNameLabel: policy.GetLabels()[ClusterNameLabel],
+ ClusterNamespaceLabel: policy.GetLabels()[ClusterNamespaceLabel],
+ })
+
  opList := &policyv1beta1.OperatorPolicyList{}
- if err := r.List(ctx, opList); err != nil {
+ if err := r.List(ctx, opList, &client.ListOptions{LabelSelector: sel}); err != nil {
  return statusChanged, nil, err
  }
 

diff --git a/test/resources/case38_operator_install/operator-policy-all-defaults.yaml b/test/resources/case38_operator_install/operator-policy-all-defaults.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-argocd.yaml b/test/resources/case38_operator_install/operator-policy-argocd.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-authorino.yaml b/test/resources/case38_operator_install/operator-policy-authorino.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-defaults-invalid-source.yaml b/test/resources/case38_operator_install/operator-policy-defaults-invalid-source.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-manual-upgrades.yaml b/test/resources/case38_operator_install/operator-policy-manual-upgrades.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-mustnothave-any-version.yaml b/test/resources/case38_operator_install/operator-policy-mustnothave-any-version.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-mustnothave.yaml b/test/resources/case38_operator_install/operator-policy-mustnothave.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-no-exist-enforce.yaml b/test/resources/case38_operator_install/operator-policy-no-exist-enforce.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-no-group-csv-fail.yaml b/test/resources/case38_operator_install/operator-policy-no-group-csv-fail.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-no-group-enforce-one-version.yaml b/test/resources/case38_operator_install/operator-policy-no-group-enforce-one-version.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-no-group-enforce.yaml b/test/resources/case38_operator_install/operator-policy-no-group-enforce.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-no-group-one-version.yaml b/test/resources/case38_operator_install/operator-policy-no-group-one-version.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-no-group.yaml b/test/resources/case38_operator_install/operator-policy-no-group.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-strimzi-kafka-operator.yaml b/test/resources/case38_operator_install/operator-policy-strimzi-kafka-operator.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-validity-test.yaml b/test/resources/case38_operator_install/operator-policy-validity-test.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-with-group.yaml b/test/resources/case38_operator_install/operator-policy-with-group.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy

diff --git a/test/resources/case38_operator_install/operator-policy-with-templates.yaml b/test/resources/case38_operator_install/operator-policy-with-templates.yaml
@@ -5,6 +5,9 @@ metadata:
  annotations:
  policy.open-cluster-management.io/parent-policy-compliance-db-id: "124"
  policy.open-cluster-management.io/policy-compliance-db-id: "64"
+ labels:
+ policy.open-cluster-management.io/cluster-name: "managed"
+ policy.open-cluster-management.io/cluster-namespace: "managed"
  ownerReferences:
  - apiVersion: policy.open-cluster-management.io/v1
  kind: Policy