Skip to content

Add OCP version compatibility check before installation #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
p-rog wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add OCP version compatibility check before installation #163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f93e6b
Adding compatibility matrix validation functionality
p-rog Jul 21, 2026
5362473
known_issues list update
p-rog Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions compatibility.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
{
"pattern": "layered-zero-trust",
"compatibility": {
"ocp": {
"supported": ["4.20", "4.21"],
"tested": ["4.20", "4.21"],
"known_issues": {
"4.22": "ZTWIM operator (openshift-zero-trust-workload-identity-manager) is not available in redhat-marketplace:v4.22.",

@mlorenzofr mlorenzofr Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of a string, we could use a list. This way, we could add multiple messages to the same version if needed.

"4.19": "Not tested. Operator channels may not align."
}
}
}
}
73 changes: 73 additions & 0 deletions pattern.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,77 @@ function version {
echo "$1" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'
}

function check_compatibility {
if [ "${SKIP_COMPATIBILITY_CHECK:-}" = "true" ]; then
return 0
fi

local compat_file="$(pwd -P)/compatibility.json"
if [ ! -f "$compat_file" ]; then
return 0
fi

local cluster_version=""
if command -v oc &>/dev/null; then
cluster_version=$(oc get clusterversion version \
-o jsonpath='{.status.desired.version}' 2>/dev/null) || true
elif command -v kubectl &>/dev/null; then

@mlorenzofr mlorenzofr Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The clusterversion resource is specific to OpenShift (CVO). This doesn't mean it won't work with kubectl, it's a CRD, but I don't know how many people will actually use kubectl with OpenShift instead of using oc.

Perhaps it would detect which CLI is being used and then use it, thus avoiding this if statement and the repetition of cluster_version=.... which is the same in both cases except for the CLI:

local kube_cli
kube_cli=$(command -v oc 2>/dev/null) || kube_cli=$(command -v kubectl 2>/dev/null) || true

if [ -n "$kube_cli" ]; then
  cluster_version=$($kube_cli get clusterversion ...
fi

cluster_version=$(kubectl get clusterversion version \
-o jsonpath='{.status.desired.version}' 2>/dev/null) || true
fi

if [ -z "$cluster_version" ]; then
echo "INFO: Could not detect OCP cluster version. Skipping compatibility check."
return 0
fi

local ocp_minor="${cluster_version%.*}"

if ! command -v python3 &>/dev/null; then
echo "INFO: python3 not found. Skipping compatibility check."
return 0
fi

if python3 - "$compat_file" "$ocp_minor" "$cluster_version" <<'PYEOF'
import json, sys

@mlorenzofr mlorenzofr Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps instead of using an inline script within bash, it would be better to separate it into a separate script. This way, we can take a more development-oriented approach, such as ensuring that linters are passed, controlling its style, and so on.

The other option is to implement the same functionality via shell scripting using jq. However, as I mentioned in the review message, perhaps the appropriate place for this functionality, and for better integration with VP, would be the rhvp.cluster_utils collection.

@p-rog p-rog Jul 22, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's discuss where to put this functionality as the best place.


compat_file, ocp_minor, cluster_version = sys.argv[1], sys.argv[2], sys.argv[3]

with open(compat_file) as f:

@mlorenzofr mlorenzofr Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
with open(compat_file) as f:
with open(compat_file, encoding="utf-8") as f:

data = json.load(f)

ocp = data.get("compatibility", {}).get("ocp", {})
supported = ocp.get("supported", [])

if ocp_minor in supported:
print(f"\033[32m✓ Compatibility check passed: OCP {cluster_version} (stream {ocp_minor}) is supported.\033[0m")
sys.exit(0)
else:
print(f"\n\033[1;33m{'=' * 72}")
print(f" WARNING: OCP {cluster_version} (stream {ocp_minor}) is NOT supported")
print(f"{'=' * 72}\033[0m\n")
print(f" Supported OCP versions: {', '.join(supported)}")
issues = ocp.get("known_issues", {}).get(ocp_minor, "")
if issues:
print(f"\n Known issues for {ocp_minor}:")
for line in issues.split(". "):
line = line.strip().rstrip(".")
if line:
print(f" - {line}")
print()
sys.exit(1)
PYEOF
then
return 0
else
read -r -p "Do you want to proceed with an unsupported OCP version? [y/N] " response
case "$response" in
[Yy]*) echo "Proceeding with unsupported OCP version..."; return 0 ;;
*) echo "Installation aborted."; exit 1 ;;
esac
fi
}

if [ -z "${PATTERN_UTILITY_CONTAINER:-}" ]; then
PATTERN_UTILITY_CONTAINER="quay.io/validatedpatterns/utility-container"
fi
Expand Down Expand Up @@ -96,6 +167,8 @@ fi
# $HOME is mounted as itself for any files that are referenced with absolute paths
# $HOME is mounted to /root because the UID in the container is 0 and that's where SSH looks for credentials

check_compatibility

podman run -it --rm --pull=newer \
--security-opt label=disable \
-e ANSIBLE_STDOUT_CALLBACK \
Expand Down
Loading