Description
When migrating applications from one OpenShift cluster to another using crane, the export phase captures OpenShift auto-injected namespace resources that cause kubectl apply failures with annotation warnings.
These issues occur regardless of whether export/apply is done as cluster-admin or non-admin, because OpenShift automatically injects these resources into every namespace.
OpenShift Auto-Injected Resources
OpenShift automatically creates the following resources in every namespace:
- ConfigMap:
openshift-service-ca.crt (injected by service-ca-operator)
- RoleBindings:
system:deployers (created by namespace controller)system:image-builderssystem:image-pullers
- ServiceAccounts:
Current Behavior
When crane exports a namespace, it captures all resources including these auto-injected ones. When applying to the target cluster, kubectl apply generates warnings:
Warning: resource configmaps/openshift-service-ca.crt is missing the
kubectl.kubernetes.io/last-applied-configuration annotation which is
required by kubectl apply. kubectl apply should only be used on resources
created declaratively by either kubectl create --save-config or kubectl apply.
The missing annotation will be patched automatically.
Warning: resource rolebindings/system:deployers is missing the
kubectl.kubernetes.io/last-applied-configuration annotation...
Warning: resource rolebindings/system:image-builders is missing...
Warning: resource rolebindings/system:image-pullers is missing...
Warning: resource serviceaccounts/builder is missing...
Warning: resource serviceaccounts/deployer is missing...
Depending on kubectl version and flags, these warnings may cause the apply to fail with exit code 1.
Expected Behavior
The crane-plugin-openshift plugin should filter these resources during the transform phase
Description
When migrating applications from one OpenShift cluster to another using crane, the export phase captures OpenShift auto-injected namespace resources that cause
kubectl applyfailures with annotation warnings.These issues occur regardless of whether export/apply is done as cluster-admin or non-admin, because OpenShift automatically injects these resources into every namespace.
OpenShift Auto-Injected Resources
OpenShift automatically creates the following resources in every namespace:
openshift-service-ca.crt(injected by service-ca-operator)system:deployers(created by namespace controller)system:image-builderssystem:image-pullersbuilderdeployerCurrent Behavior
When crane exports a namespace, it captures all resources including these auto-injected ones. When applying to the target cluster,
kubectl applygenerates warnings:Depending on kubectl version and flags, these warnings may cause the apply to fail with exit code 1.
Expected Behavior
The
crane-plugin-openshiftplugin should filter these resources during the transform phase