Merge pull request #1499 from hj-johannes-lee/PR-2023-026

operator: add image upgrade with env vars

Author: mythi

DEVEL.md

@@ -132,6 +132,8 @@ Check if the fields mentioned below in the [base CSV manifest file](deployments/
 - metadata.annotations.containerImage
 - metadata.annotations.createdAT
 
+Check if [manager yaml file](deployments/operator/manager/manager.yaml) `spec.template.spec.containers.env` has correct sha256 digest for each plugin image.
+
 Fork the [Community Operators](https://github.com/k8s-operatorhub/community-operators) repo and clone it:
 ```
 $ git clone https://github.com/<GitHub Username>/community-operators

Makefile

@@ -24,6 +24,7 @@ BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
 endif
 BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
 OLM_MANIFESTS = deployments/operator/manifests
+BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(TAG) $(BUNDLE_METADATA_OPTS) --kustomize-dir $(OLM_MANIFESTS) --output-dir . --use-image-digests
 BUNDLE_DIR = community-operators/operators/intel-device-plugins-operator/$(TAG)
 
 TESTDATA_DIR = pkg/topology/testdata
@@ -120,7 +121,7 @@ bundle:
 	rm -rf $(BUNDLE_DIR)
 	mkdir -p $(BUNDLE_DIR)
 	$(OPERATOR_SDK) generate kustomize manifests -q --input-dir $(OLM_MANIFESTS) --output-dir $(OLM_MANIFESTS) --apis-dir pkg/apis
-	$(KUSTOMIZE) build $(OLM_MANIFESTS) | sed "s|intel-deviceplugin-operator:devel|intel-deviceplugin-operator:$(TAG)|" | $(OPERATOR_SDK) generate bundle -q --overwrite --kustomize-dir $(OLM_MANIFESTS) --version $(TAG) $(BUNDLE_METADATA_OPTS) --output-dir .
+	$(KUSTOMIZE) build $(OLM_MANIFESTS) | sed "s|intel-deviceplugin-operator:devel|intel-deviceplugin-operator:$(TAG)|" | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
 	# Remove unneeded resources
 	rm manifests/*service.yaml
 	rm manifests/*clusterrole.yaml

cmd/operator/README.md

@@ -109,11 +109,13 @@ The upgrade of the deployed plugins can be done by simply installing a new relea
 
 The operator auto-upgrades operator-managed plugins (CR images and thus corresponding deployed daemonsets) to the current release of the operator.
 
-During upgrade the tag in the image path is updated (e.g. docker.io/intel/intel-sgx-plugin:tag), but the rest of the path is left intact.
+From `0.28.0` release, each version of the operator can have a set of images in `deployments/operator/manager/manager.yaml` as env variables.
 
-No upgrade is done for:
-- Non-operator managed deployments
-- Operator deployments without numeric tags
+When env variables are set for specific plugins (and their initcontainers), plugins are upgraded to the images set as env variables and all user input is ignored.
+
+The name of env variables is capitalized image with '_SHA' ending (e.g. in case of the image for `intel-sgx-plugin`, the env variable is `INTEL_SGX_PLUGIN_SHA`).
+
+The value of env variables is the full path of the image (e.g. `docker.io/intel/intel-sgx-plugin@sha256:<digest>`).
 
 ## Limiting Supported Devices
 

pkg/controllers/dlb/controller.go

@@ -68,7 +68,7 @@ func (c *controller) CreateEmptyObject() client.Object {
 
 func (c *controller) Upgrade(ctx context.Context, obj client.Object) bool {
 	dp := obj.(*devicepluginv1.DlbDevicePlugin)
-	return controllers.UpgradeImages(&dp.Spec.Image, &dp.Spec.InitImage)
+	return controllers.UpgradeImages(ctx, &dp.Spec.Image, &dp.Spec.InitImage)
 }
 
 func (c *controller) GetTotalObjectCount(ctx context.Context, clnt client.Client) (int, error) {

pkg/controllers/dsa/controller.go

@@ -71,7 +71,7 @@ func (c *controller) CreateEmptyObject() client.Object {
 
 func (c *controller) Upgrade(ctx context.Context, obj client.Object) bool {
 	dp := obj.(*devicepluginv1.DsaDevicePlugin)
-	return controllers.UpgradeImages(&dp.Spec.Image, &dp.Spec.InitImage)
+	return controllers.UpgradeImages(ctx, &dp.Spec.Image, &dp.Spec.InitImage)
 }
 
 func (c *controller) GetTotalObjectCount(ctx context.Context, clnt client.Client) (int, error) {

pkg/controllers/fpga/controller.go

@@ -67,7 +67,7 @@ func (c *controller) CreateEmptyObject() client.Object {
 
 func (c *controller) Upgrade(ctx context.Context, obj client.Object) bool {
 	dp := obj.(*devicepluginv1.FpgaDevicePlugin)
-	return controllers.UpgradeImages(&dp.Spec.Image, &dp.Spec.InitImage)
+	return controllers.UpgradeImages(ctx, &dp.Spec.Image, &dp.Spec.InitImage)
 }
 
 func (c *controller) GetTotalObjectCount(ctx context.Context, clnt client.Client) (int, error) {

pkg/controllers/gpu/controller.go

@@ -72,7 +72,7 @@ func (c *controller) CreateEmptyObject() client.Object {
 
 func (c *controller) Upgrade(ctx context.Context, obj client.Object) bool {
 	dp := obj.(*devicepluginv1.GpuDevicePlugin)
-	return controllers.UpgradeImages(&dp.Spec.Image, &dp.Spec.InitImage)
+	return controllers.UpgradeImages(ctx, &dp.Spec.Image, &dp.Spec.InitImage)
 }
 
 func (c *controller) GetTotalObjectCount(ctx context.Context, clnt client.Client) (int, error) {

pkg/controllers/iaa/controller.go

@@ -69,7 +69,7 @@ func (c *controller) CreateEmptyObject() client.Object {
 
 func (c *controller) Upgrade(ctx context.Context, obj client.Object) bool {
 	dp := obj.(*devicepluginv1.IaaDevicePlugin)
-	return controllers.UpgradeImages(&dp.Spec.Image, &dp.Spec.InitImage)
+	return controllers.UpgradeImages(ctx, &dp.Spec.Image, &dp.Spec.InitImage)
 }
 
 func (c *controller) GetTotalObjectCount(ctx context.Context, clnt client.Client) (int, error) {

pkg/controllers/qat/controller.go

@@ -72,7 +72,7 @@ func (c *controller) CreateEmptyObject() client.Object {
 
 func (c *controller) Upgrade(ctx context.Context, obj client.Object) bool {
 	dp := obj.(*devicepluginv1.QatDevicePlugin)
-	return controllers.UpgradeImages(&dp.Spec.Image, &dp.Spec.InitImage)
+	return controllers.UpgradeImages(ctx, &dp.Spec.Image, &dp.Spec.InitImage)
 }
 
 func (c *controller) GetTotalObjectCount(ctx context.Context, clnt client.Client) (int, error) {

pkg/controllers/reconciler.go

@@ -17,6 +17,8 @@ package controllers
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 
@@ -167,14 +169,26 @@ func (r *reconciler) createObjects(ctx context.Context,
 	return result, nil
 }
 
-func UpgradeImages(image *string, initimage *string) (upgrade bool) {
+func UpgradeImages(ctx context.Context, image *string, initimage *string) (upgrade bool) {
 	for _, s := range []*string{image, initimage} {
 		if s == nil {
 			continue
 		}
 
 		if parts := strings.SplitN(*s, ":", 2); len(parts) == 2 && len(parts[0]) > 0 {
 			name, version := parts[0], parts[1]
+
+			envVarValue := os.Getenv(strings.ReplaceAll(strings.ToUpper(filepath.Base(name)), "-", "_") + "_SHA")
+
+			if envVarValue != "" && *s != envVarValue {
+				log.FromContext(ctx).Info("env var for the image: " + name + " is already set; user input of the image is ignored")
+
+				*s = envVarValue
+				upgrade = true
+
+				continue
+			}
+
 			if ver, err := versionutil.ParseSemantic(version); err == nil && ver.LessThan(ImageMinVersion) {
 				*s = name + ":" + ImageMinVersion.String()
 				upgrade = true