DOCS-2992: Add a pre-upgrade step to delete the Compliance resource - #2905
Open
caseydavenport wants to merge 3 commits into
Open
DOCS-2992: Add a pre-upgrade step to delete the Compliance resource#2905caseydavenport wants to merge 3 commits into
caseydavenport wants to merge 3 commits into
Conversation
The Compliance resource owns the compliance workloads and RBAC, so deleting it before upgrade lets Kubernetes garbage collect them.
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds explicit pre-upgrade guidance to remove the now-orphaned Compliance custom resource when upgrading Calico Enterprise, ensuring Kubernetes can garbage-collect associated compliance workloads/RBAC and preventing GitOps from recreating the resource.
Changes:
- Added a new “Compliance” pre-upgrade section to the OpenShift upgrade guide.
- Added the same pre-upgrade “Compliance” deletion step to the Kubernetes operator and Helm upgrade guides.
- Included GitOps-specific guidance to remove the CR from source manifests to prevent recreation.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| calico-enterprise/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx | Adds a pre-upgrade Compliance CR deletion step for OpenShift upgrades. |
| calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx | Adds the Compliance CR deletion step for operator-based Kubernetes upgrades. |
| calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx | Adds the Compliance CR deletion step for Helm-based Kubernetes upgrades. |
| oc delete compliance tigera-secure | ||
| ``` | ||
|
|
||
| If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. |
| kubectl delete compliance tigera-secure | ||
| ``` | ||
|
|
||
| If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. |
| kubectl delete compliance tigera-secure | ||
| ``` | ||
|
|
||
| If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. |
This reverts commit 5cbfd21.
Collaborator
|
Version-specific upgrade notes like this might fit better in the release notes, particularly when it's such a small procedure. If you don't have objections, I can hold this and include this there until the versions with compliance are EOL. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Neither pass of the compliance removal (#2896 and the one before it) added an upgrade step, so anyone upgrading keeps a Compliance resource that nothing manages any more. This adds a pre-upgrade step to the Enterprise operator, Helm, and OpenShift upgrade pages: delete the resource, and remove it from any GitOps tooling so it does not come back. Deleting it before the upgrade is what lets Kubernetes garbage collect the compliance workloads and RBAC that the resource owns, while the operator still has a compliance controller around to clean up its status entry.
Applied to Calico Enterprise next only. The code removal went to master, and compliance still ships in the v3.24-1 and v3.24-2 release branches, so the versioned docs for those releases should keep describing it as present.
Jira: https://tigera.atlassian.net/browse/DOCS-2992