OCPBUGS-25758: fix router on 4.14 y-stream upgrade

[sjenning]

In 4.13, we used the OCP router for HCP ingress. The OCP router watches the endpoints of the target service and loads them directly into the haproxy config. Thus a service with clusterIP: None works because the OCP router send traffic directly to pods, bypassing the service network.

In 4.14, we switched away from the OCP router to a simple haproxy pod with a fixed config file that routed to Service clusterIPs. Because the ovnkube-master-external Services have clusterIP: None, the string None is loaded into the haproxy config template where the ovnkube-master-external service IP is expected. The results in the router pod crash looping.

However, we don't use the ovnkube-sbdb Route in 4.14. The failure is caused by lack of cleanup by the CNO which creates the internal and external Services and the Route as well.

This PR cleans up those unused resources and explicitly unsets the router serviceAccountName as the router ServiceAccount is also removed in 4.14.

[openshift-ci-robot]

@sjenning: This pull request references Jira Issue OCPBUGS-25758, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

In 4.13, we used the OCP router for HCP ingress. The OCP router watches the endpoints of the target service and loads them directly into the haproxy config. Thus a service with clusterIP: None works because the OCP router send traffic directly to pods, bypassing the service network.

In 4.14, we switched away from the OCP router to a simple haproxy pod with a fixed config file that routed to Service clusterIPs. Because the ovnkube-master-external Services have clusterIP: None, the string None is loaded into the haproxy config template where the ovnkube-master-external service IP is expected. The results in the router pod crash looping.

However, we don't use the ovnkube-sbdb Route in 4.14. The failure is caused by lack of cleanup by the CNO which creates the internal and external Services and the Route.

This PR cleans up those unused resources and explicitly unsets the router serviceAccountName as the router ServiceAccount is also removed in 4.14.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sjenning

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sjenning]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[csrwng]

/lgtm

[openshift-ci-robot]

@sjenning: This pull request references Jira Issue OCPBUGS-25758, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

In response to this:

In 4.13, we used the OCP router for HCP ingress. The OCP router watches the endpoints of the target service and loads them directly into the haproxy config. Thus a service with clusterIP: None works because the OCP router send traffic directly to pods, bypassing the service network.

In 4.14, we switched away from the OCP router to a simple haproxy pod with a fixed config file that routed to Service clusterIPs. Because the ovnkube-master-external Services have clusterIP: None, the string None is loaded into the haproxy config template where the ovnkube-master-external service IP is expected. The results in the router pod crash looping.

However, we don't use the ovnkube-sbdb Route in 4.14. The failure is caused by lack of cleanup by the CNO which creates the internal and external Services and the Route as well.

This PR cleans up those unused resources and explicitly unsets the router serviceAccountName as the router ServiceAccount is also removed in 4.14.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 6bf4672 and 2 for PR HEAD af12fd8 in total

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 83d120a and 1 for PR HEAD af12fd8 in total

[bryan-cox]

/lgtm

[sjenning]

/cherry-pick release-4.15 release-4.14

[openshift-cherrypick-robot]

@sjenning: once the present PR merges, I will cherry-pick it on top of release-4.15 in a new PR and assign it to you.

In response to this:

/cherry-pick release-4.15 release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 82db100 and 2 for PR HEAD 1bec55e in total

[openshift-bot]

/jira refresh

The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity.

[openshift-ci-robot]

@openshift-bot: This pull request references Jira Issue OCPBUGS-25758, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

In response to this:

/jira refresh

The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

/jira refresh

The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity.

[openshift-ci-robot]

@openshift-bot: This pull request references Jira Issue OCPBUGS-25758, which is invalid:

• expected the bug to target either version "4.17." or "openshift-4.17.", but it targets "4.16.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sjenning]

/hold cancel
/retest

[sjenning]

/jira refresh

[openshift-ci-robot]

@sjenning: This pull request references Jira Issue OCPBUGS-25758, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.17.0) matches configured target version for branch (4.17.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 630c4d8 and 2 for PR HEAD 1bec55e in total

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD c698d1d and 1 for PR HEAD 1bec55e in total

[sjenning]

/override ci/prow/e2e-kubevirt-aws-ovn

[openshift-ci]

@sjenning: Overrode contexts on behalf of sjenning: ci/prow/e2e-kubevirt-aws-ovn

In response to this:

/override ci/prow/e2e-kubevirt-aws-ovn

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD c5401ca and 0 for PR HEAD 1bec55e in total

[openshift-ci-robot]

/hold

Revision 1bec55e was retested 3 times: holding

[sjenning]

/retest-required

[sjenning]

/hold cancel

[openshift-ci]

@sjenning: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azure	1bec55e	link	false	/test e2e-azure

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 0dc5bc4 and 2 for PR HEAD 1bec55e in total

[openshift-ci-robot]

@sjenning: Jira Issue OCPBUGS-25758: All pull requests linked via external trackers have merged:

• openshift/hypershift#4033

Jira Issue OCPBUGS-25758 has been moved to the MODIFIED state.

In response to this:

In 4.13, we used the OCP router for HCP ingress. The OCP router watches the endpoints of the target service and loads them directly into the haproxy config. Thus a service with clusterIP: None works because the OCP router send traffic directly to pods, bypassing the service network.

In 4.14, we switched away from the OCP router to a simple haproxy pod with a fixed config file that routed to Service clusterIPs. Because the ovnkube-master-external Services have clusterIP: None, the string None is loaded into the haproxy config template where the ovnkube-master-external service IP is expected. The results in the router pod crash looping.

However, we don't use the ovnkube-sbdb Route in 4.14. The failure is caused by lack of cleanup by the CNO which creates the internal and external Services and the Route as well.

This PR cleans up those unused resources and explicitly unsets the router serviceAccountName as the router ServiceAccount is also removed in 4.14.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@sjenning: new pull request created: #4077

In response to this:

/cherry-pick release-4.15 release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-hypershift-container-v4.17.0-202405221214.p0.g9e84188.assembly.stream.el9 for distgit hypershift.
All builds following this will include this PR.