Skip to content

fix: disambiguate OLM Subscription from ACM Subscription in oc calls - #212

Open
coreywan wants to merge 1 commit into
splunk:mainfrom
coreywan:fix/olm-subscription-resource-ambiguity
Open

coreywan wants to merge 1 commit into
splunk:mainfrom
coreywan:fix/olm-subscription-resource-ambiguity

Conversation

@coreywan

@coreywan coreywan commented Sep 1, 2026

Copy link
Copy Markdown

Problem

tools/cluster_setup/openshift_with_stack.sh calls oc get subscription / oc delete subscription using the short resource name, which assumes it resolves to subscriptions.operators.coreos.com.

On a cluster that also runs Red Hat Advanced Cluster Management, ACM registers a second CRD under the same plural name, and oc resolves the ambiguity to the ACM group:

$ oc api-resources | grep '^subscriptions'
subscriptions   appsub     apps.open-cluster-management.io/v1   true   Subscription
subscriptions   sub,subs   operators.coreos.com/v1alpha1        true   Subscription

$ oc get subscription nfd -n openshift-nfd
Error from server (NotFound): subscriptions.apps.open-cluster-management.io "nfd" not found

Impact

1. Install hangs, then fails with a misleading error. wait_for_subscription_csv() discards the NotFound via 2>/dev/null || true, so current_csv and installed_csv come back empty on every poll. csv_name stays empty, the CSV phase check is never reached, and the loop spins for the full timeout:

[INFO] Waiting for OLM Subscription openshift-nfd/nfd (timeout: 600s)...
<600s of nothing>
[ERROR] Timed out waiting for OLM Subscription openshift-nfd/nfd
        (currentCSV=not-created, installedCSV=not-installed, target phase=unknown)

The operator had in fact installed correctly the whole time:

$ oc get subscriptions.operators.coreos.com nfd -n openshift-nfd     -o jsonpath='{.status.installedCSV}{"\n"}{.status.state}'
nfd.4.21.0-202608241535
AtLatestKnown

$ oc get csv -n openshift-nfd
nfd.4.21.0-202608241535   Node Feature Discovery Operator   Succeeded

$ oc get pods -n openshift-nfd
nfd-controller-manager-689844599c-vpbvs   1/1   Running   0   3h15m

This blocks step 2 (NFD, 600s) and would block step 3 again (GPU Operator, 900s).

2. Teardown leaves orphans. main_delete() pairs the same lookup with --ignore-not-found=true, so the OLM Subscription and its CSV are silently left behind on delete.

Fix

Pin all nine call sites to the fully qualified subscriptions.operators.coreos.com. No logic changes.

This is a no-op on clusters without ACM, where the short name already resolves to the OLM group. openshift_with_stack.sh is the only file in the repo using the ambiguous short name.

Testing

  • Reproduced on OpenShift 4.21.30 with ACM present: install blocked at step 2 with NFD fully healthy.
  • With the patch applied, wait_for_subscription_csv returns on its first poll and the install proceeds to step 3.
  • bash -n tools/cluster_setup/openshift_with_stack.sh passes.

🤖 Generated with Claude Code

`oc get subscription` relies on the short resource name resolving to
subscriptions.operators.coreos.com. On any cluster that also runs Red Hat
Advanced Cluster Management, ACM registers subscriptions.apps.open-cluster-
management.io under the same plural name, and oc resolves the ambiguity to
the ACM group instead:

    $ oc get subscription nfd -n openshift-nfd
    Error from server (NotFound):
      subscriptions.apps.open-cluster-management.io "nfd" not found

Two consequences on such clusters:

1. wait_for_subscription_csv() discards that error via `2>/dev/null || true`,
   so current_csv and installed_csv are empty on every poll, csv_name stays
   empty, and the CSV phase check never runs. The loop spins for the full
   timeout and then fails with a misleading "currentCSV=not-created" even
   though the operator installed successfully. This blocks the installer at
   step 2 for 600s (NFD) and would again at step 3 for 900s (GPU Operator).

2. main_delete() pairs the same lookup with `--ignore-not-found=true`, so
   teardown silently leaves the OLM Subscription and its CSV behind.

Pin all nine call sites to the fully qualified
subscriptions.operators.coreos.com. This is a no-op on clusters without ACM,
where the short name already resolves to the OLM group.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1b78cd500f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +1582 to +1584
current_csv=$(oc get subscriptions.operators.coreos.com "${subscription}" -n "${namespace}" \
-o jsonpath='{.status.currentCSV}' 2>/dev/null || true)
installed_csv=$(oc get subscription "${subscription}" -n "${namespace}" \
installed_csv=$(oc get subscriptions.operators.coreos.com "${subscription}" -n "${namespace}" \

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the OLM readiness mock for the qualified resource

When tools/cluster_setup/test_openshift_with_stack.sh runs, its oc mock at lines 603–606 only returns CSV names when ${2:-} equals subscription. These qualified lookups therefore return nothing, causing wait_for_subscription_csv to exhaust all three mocked polls; the assertion at lines 616–617 receives 3 instead of 1, and the test suite exits nonzero. Update the mock to recognize subscriptions.operators.coreos.com alongside this production change.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant