OCPBUGS-38335: Revert "use update only secret-apply for cert rotation logic"

[vrutkovs]

This reverts commit 96e8597.

All SecretTypeTLS secrets have been migrated to kubernetes.io/tls type on 4.15 upgrade, time to remove the deprecated setting which enables this migration. This also prevents us from landing #1772

[openshift-ci-robot]

@vrutkovs: This pull request references Jira Issue OCPBUGS-38335, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.18.0) matches configured target version for branch (4.18.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @wangke19

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This reverts commit 96e8597.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[p0lyn0mial]

All SecretTypeTLS secrets have been migrated to kubernetes.io/tls type on 4.15 upgrade, time to remove the deprecated setting which enables this migration.

Have we also fixed the issue of new secrets being created with the old type and then immediately migrated to the new type ? IIRC there were at least 2 secrets (etcd-o, kcm-o).

The other question is what is the plan for the carry we have in o/k?

[p0lyn0mial]

All SecretTypeTLS secrets have been migrated to kubernetes.io/tls type on 4.15 upgrade, time to remove the deprecated setting which enables this migration.

Also how do we know that all secrets were migrated ? To we have a metrics for that ?

[openshift-ci]

@vrutkovs: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[vrutkovs]

Have we also fixed the issue of new secrets being created with the old type and then immediately migrated to the new type ? IIRC there were at least 2 secrets (etcd-o, kcm-o).

Yes - in https://issues.redhat.com/browse/API-1800:

• API-1800: manifests: convert SecretTypeTLS secrets to kubernetes.io/tls cluster-etcd-operator#1247
• API-1800: bindata: convert SecretTypeTLS secrets cluster-kube-controller-manager-operator#804

[vrutkovs]

Also how do we know that all secrets were migrated ? To we have a metrics for that ?

This was tested by QE by upgrading 4.6 -> 4.15 and checking if old type still exists. Telemetry won't be helpful - this issue is applicable to secrets we own and manage only

[p0lyn0mial]

OK, if we are sure that there are no new secrets that start with the old type then we can also remove the carry in o/k

[p0lyn0mial]

/lgtm

[p0lyn0mial]

/assign @deads2k @soltysh

for approval.

[soltysh]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: p0lyn0mial, soltysh, vrutkovs

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/operator/OWNERS [soltysh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@vrutkovs: Jira Issue OCPBUGS-38335: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

• openshift/library-go#1772 is open

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-38335 has not been moved to the MODIFIED state.

In response to this:

This reverts commit 96e8597.

All SecretTypeTLS secrets have been migrated to kubernetes.io/tls type on 4.15 upgrade, time to remove the deprecated setting which enables this migration. This also prevents us from landing #1772

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[vrutkovs]

/cherrypick release-4.17

[openshift-cherrypick-robot]

@vrutkovs: new pull request created: #1774

In response to this:

/cherrypick release-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.