STOR-2962: Add SELinuxMount GA Upgrade Readiness for 5.0

[jsafrane]

This enhancement prepares OpenShift 5.0 for the SELinuxMount feature going GA in Kubernetes 1.37 / OpenShift 5.1.

SELinuxMount introduces a breaking change and we'll need to mark a 5.0 cluster un-upgradeable until the cluster admin fixes their workloads or opts -out from the SELinuxMount. This enhancement proposes how to detect such workloads and how to pass the information from the component that knows it (a <carry> patch in kube-controller-manager) to a component that marks the cluster un-upgradeable (cluster-storage-operator).

See metric cluster:selinux_warning_controller_selinux_volume_conflict:count in telemetry for nr. of affected clusters. It's a very low number (not commenting publicly ;-)). Most clusters will upgrade just fine.

There are some open questions about the actual API used to pass the info. Just circulating the idea about a <carry> patch first before we dive into implementation details.

[openshift-ci-robot]

@jsafrane: This pull request references STOR-2962 which is a valid jira issue.

Details

In response to this:

This enhancement prepares OpenShift 5.0 for the SELinuxMount feature going GA in Kubernetes 1.37 / OpenShift 5.1.

SELinuxMount introduces a breaking change and we'll need to mark a 5.0 cluster un-upgradeable until the cluster admin fixes their workloads or opts -out from the SELinuxMount. This enhancement proposes how to detect such workloads and how to pass the information from the component that knows it (a <carry> patch in kube-controller-manager) to a component that marks the cluster un-upgradeable (cluster-storage-operator).

See metric cluster:selinux_warning_controller_selinux_volume_conflict:count in telemetry for nr. of affected clusters. It's a very low number (not commenting publicly ;-)). Most clusters will upgrade just fine.

There are some open question about the actual API used to pass the info. Just circulating the idea about a <carry> patch first before we dive into implementation details.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign frobware for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jsafrane: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.