NETOBSERV-2101: remove CAP_SYS_RESOURCE, allow override

[jotak]

Description

When testing, we need to make sure CAP_SYS_RESOURCE wasn't needed e.g. in older openshifts and/or for some specific features. From my tests on ocp 4.18, it doesn't seem needed...

If we find some cases where it's still needed, we might introduce more logic to enable it conditionally.

I added the ability to override the capabilities, so that if we miss something, users won't be stuck.

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

• [x] Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
• [ ] Does this PR require product documentation?
  • [ ] If so, make sure the JIRA epic is labeled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
• [ ] Does this PR require a product release notes entry?
  • [ ] If so, fill in "Release Note Text" in the JIRA.
• [x] Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
  • [x] If so, make sure it is described in the JIRA ticket.
• QE requirements (check 1 from the list):
  • [ ] Standard QE validation, with pre-merge tests unless stated otherwise.
  • [x] Regression tests only (e.g. refactoring with no user-facing change).
  • [ ] No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

[openshift-ci-robot]

@jotak: This pull request references NETOBSERV-2101 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

• [ ] Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
• [ ] Does this PR require product documentation?
• [ ] If so, make sure the JIRA epic is labeled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
• [ ] Does this PR require a product release notes entry?
• [ ] If so, fill in "Release Note Text" in the JIRA.
• [ ] Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
• [ ] If so, make sure it is described in the JIRA ticket.
• QE requirements (check 1 from the list):
• [ ] Standard QE validation, with pre-merge tests unless stated otherwise.
• [ ] Regression tests only (e.g. refactoring with no user-facing change).
• [ ] No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci[bot]]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign kalmanmeth for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@jotak: This pull request references NETOBSERV-2101 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

• [x] Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
• [ ] Does this PR require product documentation?
• [ ] If so, make sure the JIRA epic is labeled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
• [ ] Does this PR require a product release notes entry?
• [ ] If so, fill in "Release Note Text" in the JIRA.
• [ ] Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
• [ ] If so, make sure it is described in the JIRA ticket.
• QE requirements (check 1 from the list):
• [ ] Standard QE validation, with pre-merge tests unless stated otherwise.
• [ ] Regression tests only (e.g. refactoring with no user-facing change).
• [ ] No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jotak: This pull request references NETOBSERV-2101 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

• [x] Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
• [ ] Does this PR require product documentation?
• [ ] If so, make sure the JIRA epic is labeled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
• [ ] Does this PR require a product release notes entry?
• [ ] If so, fill in "Release Note Text" in the JIRA.
• [x] Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
• [x] If so, make sure it is described in the JIRA ticket.
• QE requirements (check 1 from the list):
• [ ] Standard QE validation, with pre-merge tests unless stated otherwise.
• [x] Regression tests only (e.g. refactoring with no user-facing change).
• [ ] No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jotak: This pull request references NETOBSERV-2101 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

When testing, we need to make sure CAP_SYS_RESOURCE wasn't needed e.g. in older openshifts and/or for some specific features. From my tests on ocp 4.18, it doesn't seem needed...

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

• [x] Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
• [ ] Does this PR require product documentation?
• [ ] If so, make sure the JIRA epic is labeled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
• [ ] Does this PR require a product release notes entry?
• [ ] If so, fill in "Release Note Text" in the JIRA.
• [x] Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
• [x] If so, make sure it is described in the JIRA ticket.
• QE requirements (check 1 from the list):
• [ ] Standard QE validation, with pre-merge tests unless stated otherwise.
• [x] Regression tests only (e.g. refactoring with no user-facing change).
• [ ] No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jotak: This pull request references NETOBSERV-2101 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

When testing, we need to make sure CAP_SYS_RESOURCE wasn't needed e.g. in older openshifts and/or for some specific features. From my tests on ocp 4.18, it doesn't seem needed...

If we find some cases where it's still needed, we might introduce more logic to enable it conditionally.

I added the ability to override the capabilities, so that if we miss something, users won't be stuck.

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

• [x] Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
• [ ] Does this PR require product documentation?
• [ ] If so, make sure the JIRA epic is labeled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
• [ ] Does this PR require a product release notes entry?
• [ ] If so, fill in "Release Note Text" in the JIRA.
• [x] Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
• [x] If so, make sure it is described in the JIRA ticket.
• QE requirements (check 1 from the list):
• [ ] Standard QE validation, with pre-merge tests unless stated otherwise.
• [x] Regression tests only (e.g. refactoring with no user-facing change).
• [ ] No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[memodi]

/ok-to-test

[github-actions[bot]]

New images:

• quay.io/netobserv/network-observability-operator:97c02d0
• quay.io/netobserv/network-observability-operator-bundle:v0.0.0-sha-97c02d0
• quay.io/netobserv/network-observability-operator-catalog:v0.0.0-sha-97c02d0

They will expire after two weeks.

To deploy this build:

# Direct deployment, from operator repo
IMAGE=quay.io/netobserv/network-observability-operator:97c02d0 make deploy

# Or using operator-sdk
operator-sdk run bundle quay.io/netobserv/network-observability-operator-bundle:v0.0.0-sha-97c02d0

Or as a Catalog Source:

apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: netobserv-dev
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-sha-97c02d0
  displayName: NetObserv development catalog
  publisher: Me
  updateStrategy:
    registryPoll:
      interval: 1m

[openshift-ci[bot]]

@jotak: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-operator	d486bbe629e1a934a09c345571fc03292ab3dbe0	link	false	/test e2e-operator

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[memodi]

/label qe-approved

verified on older kernel 4.12 and 4.14 OCP versions, all sanity tests passes.

[openshift-ci-robot]

@jotak: This pull request references NETOBSERV-2101 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

When testing, we need to make sure CAP_SYS_RESOURCE wasn't needed e.g. in older openshifts and/or for some specific features. From my tests on ocp 4.18, it doesn't seem needed...

If we find some cases where it's still needed, we might introduce more logic to enable it conditionally.

I added the ability to override the capabilities, so that if we miss something, users won't be stuck.

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

• [x] Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
• [ ] Does this PR require product documentation?
• [ ] If so, make sure the JIRA epic is labeled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
• [ ] Does this PR require a product release notes entry?
• [ ] If so, fill in "Release Note Text" in the JIRA.
• [x] Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
• [x] If so, make sure it is described in the JIRA ticket.
• QE requirements (check 1 from the list):
• [ ] Standard QE validation, with pre-merge tests unless stated otherwise.
• [x] Regression tests only (e.g. refactoring with no user-facing change).
• [ ] No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.