OCPBUGS-62307: Remove orphaned console-conversion-webhook deployment and related resource by jhadvig · Pull Request #1053 · openshift/console-operator

jhadvig · 2025-10-06T14:43:24Z

Problem

The console-conversion-webhook deployment was shipped in OCP 4.16 as part of the console-operator manifests but was removed in 4.17. After upgrading from 4.16 → 4.17, the deployment and its related resources (service, secret) remain on the cluster as orphaned resources.

Solution

Adds a new MigrationCleanupController that runs at operator startup to clean up the orphaned resources:

Deployment: console-conversion-webhook
Service: webhook
Secret: webhook-serving-cert

Implementation Details

Controller runs on every startup (idempotent - safe to run multiple times)
Uses standard Kubernetes cascade deletion (deployment deletion automatically cleans up ReplicaSets and Pods)
Only logs when resources are actually deleted to avoid noise
Integrated into main controller startup sequence in pkg/console/starter/starter.go
The MigrationCleanupController will run only once when the operator starts up, and then never run again unless the operator is restarted.

Files Changed

pkg/console/controllers/migration/cleanup_controller.go - New migration cleanup controller
pkg/console/starter/starter.go - Integration into startup sequence

This ensures clean upgrades from 4.16 → 4.17 without leaving orphaned resources on the cluster.

/assign @TheRealJon

openshift-ci-robot · 2025-10-06T14:43:32Z

@jhadvig: This pull request references Jira Issue OCPBUGS-62307, which is invalid:

expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

…

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jhadvig · 2025-10-06T14:53:33Z

/jira refresh

openshift-ci-robot · 2025-10-06T14:53:41Z

@jhadvig: This pull request references Jira Issue OCPBUGS-62307, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.21.0) matches configured target version for branch (4.21.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jiajliu

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-10-07T14:42:43Z

@jhadvig: This pull request references Jira Issue OCPBUGS-62307, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.21.0) matches configured target version for branch (4.21.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jiajliu

Details

In response to this:

Problem

The console-conversion-webhook deployment was shipped in OCP 4.16 as part of the console-operator manifests but was removed in 4.17. After upgrading from 4.16 → 4.17, the deployment and its related resources (service, secret) remain on the cluster as orphaned resources.

Solution

Adds a new MigrationCleanupController that runs at operator startup to clean up the orphaned resources:

Deployment: console-conversion-webhook

Service: webhook

Secret: webhook-serving-cert

Implementation Details

Controller runs on every startup (idempotent - safe to run multiple times)

Uses standard Kubernetes cascade deletion (deployment deletion automatically cleans up ReplicaSets and Pods)

Only logs when resources are actually deleted to avoid noise

Integrated into main controller startup sequence in pkg/console/starter/starter.go

The MigrationCleanupController will run only once when the operator starts up, and then never run again unless the operator is restarted.

Files Changed

pkg/console/controllers/migration/cleanup_controller.go - New migration cleanup controller

pkg/console/starter/starter.go - Integration into startup sequence

This ensures clean upgrades from 4.16 → 4.17 without leaving orphaned resources on the cluster.

/assign @TheRealJon

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jhadvig · 2025-10-08T11:22:13Z

/retest

jhadvig · 2025-10-29T15:31:31Z

/retest

openshift-bot · 2026-01-28T01:00:37Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

yanpzhan · 2026-01-30T13:13:38Z

Upgrade 4.16 cluster with path: 4.16->4.17->4.18->4.19->4.20->4.22 image from pr1053, the console-conversion-webhook deployment and related resources still exist.

# oc get service -n openshift-console-operator --kubeconfig 416.kubeconfig  | grep webhook
webhook   ClusterIP   172.30.185.252   <none>        9443/TCP   10h
# oc get secret -n openshift-console-operator --kubeconfig 416.kubeconfig | grep webhook
webhook-serving-cert               kubernetes.io/tls         2      10h
# oc get deployment -n openshift-console-operator --kubeconfig 416.kubeconfig
NAME                         READY   UP-TO-DATE   AVAILABLE   AGE
console-conversion-webhook   1/1     1            1           10h
console-operator             1/1     1            1           10h
# oc get clusterversion --kubeconfig 416.kubeconfig
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.22.0-0-2026-01-30-015109-test-ci-ln-p69n2ct-latest   True        False         22m     Cluster version is 4.22.0-0-2026-01-30-015109-test-ci-ln-p69n2ct-latest

…and related resource

openshift-ci · 2026-02-03T14:31:15Z

@jhadvig: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	`5d76137`	link	false	`/test okd-scos-e2e-aws-ovn`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

TheRealJon

I just had a couple of optimization questions, but it seems like a solid fix.

/lgtm

TheRealJon · 2026-02-03T15:01:15Z

pkg/console/controllers/migration/cleanup_controller.go

+
+	return factory.New().
+		WithSync(c.Sync).
+		WithPostStartHooks(c.runCleanupOnce).


Is there any advantage of runCleanupOnce? It seems like the end result would be the same if we just removed it.

TheRealJon · 2026-02-03T15:04:10Z

pkg/console/starter/starter.go

 		controllerContext.EventRecorder,
 	)

+	migrationCleanupController := migration.NewMigrationCleanupController(


Do we need the full overhead of a controller here? If it’s a one-and-done action at startup, a simple init function might be cleaner than a permanent sync loop.

openshift-ci · 2026-02-03T15:12:23Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhadvig, TheRealJon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [TheRealJon,jhadvig]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

yanpzhan · 2026-02-04T10:02:09Z

Upgraded 4.16 cluster with path: 4.16->4.17->4.18->4.19->4.20->4.22 image from pr1053, the console-conversion-webhook deployment and related resources were removed successfully.
before upgrade to 4.22 image:

# oc get secret -n openshift-console-operator  | grep webhook
webhook-serving-cert               kubernetes.io/tls         2      6h19m
# oc get service -n openshift-console-operator | grep webhook
webhook   ClusterIP   172.30.65.175    <none>        9443/TCP   6h19m
# oc get deployment -n openshift-console-operator | grep webhook
console-conversion-webhook   1/1     1            1           6h19m

after upgrade to 4.22 image:

# oc get deployment -n openshift-console-operator | grep webhook
# oc get service -n openshift-console-operator | grep webhook
# oc get secret -n openshift-console-operator  | grep webhook
# oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.22.0-0-2026-02-04-014727-test-ci-ln-2my3ktt-latest   True        False         19m     Cluster version is 4.22.0-0-2026-02-04-014727-test-ci-ln-2my3ktt-latest

/verified by yanpzhan

openshift-ci-robot · 2026-02-04T10:02:22Z

@yanpzhan: This PR has been marked as verified by yanpzhan.

Details

In response to this:

Upgraded 4.16 cluster with path: 4.16->4.17->4.18->4.19->4.20->4.22 image from pr1053, the console-conversion-webhook deployment and related resources were removed successfully.
before upgrade to 4.22 image:

# oc get secret -n openshift-console-operator  | grep webhook
webhook-serving-cert               kubernetes.io/tls         2      6h19m
# oc get service -n openshift-console-operator | grep webhook
webhook   ClusterIP   172.30.65.175    <none>        9443/TCP   6h19m
# oc get deployment -n openshift-console-operator | grep webhook
console-conversion-webhook   1/1     1            1           6h19m

after upgrade to 4.22 image:

# oc get deployment -n openshift-console-operator | grep webhook
# oc get service -n openshift-console-operator | grep webhook
# oc get secret -n openshift-console-operator  | grep webhook
# oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.22.0-0-2026-02-04-014727-test-ci-ln-2my3ktt-latest   True        False         19m     Cluster version is 4.22.0-0-2026-02-04-014727-test-ci-ln-2my3ktt-latest

/verified by yanpzhan

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-02-04T10:51:00Z

/retest-required

Remaining retests: 0 against base HEAD 562a178 and 2 for PR HEAD d234957 in total

openshift-ci-robot · 2026-02-04T12:50:46Z

@jhadvig: Jira Issue Verification Checks: Jira Issue OCPBUGS-62307
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-62307 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Problem

The console-conversion-webhook deployment was shipped in OCP 4.16 as part of the console-operator manifests but was removed in 4.17. After upgrading from 4.16 → 4.17, the deployment and its related resources (service, secret) remain on the cluster as orphaned resources.

Solution

Adds a new MigrationCleanupController that runs at operator startup to clean up the orphaned resources:

Deployment: console-conversion-webhook

Service: webhook

Secret: webhook-serving-cert

Implementation Details

Controller runs on every startup (idempotent - safe to run multiple times)

Uses standard Kubernetes cascade deletion (deployment deletion automatically cleans up ReplicaSets and Pods)

Only logs when resources are actually deleted to avoid noise

Integrated into main controller startup sequence in pkg/console/starter/starter.go

The MigrationCleanupController will run only once when the operator starts up, and then never run again unless the operator is restarted.

Files Changed

pkg/console/controllers/migration/cleanup_controller.go - New migration cleanup controller

pkg/console/starter/starter.go - Integration into startup sequence

This ensures clean upgrades from 4.16 → 4.17 without leaving orphaned resources on the cluster.

/assign @TheRealJon

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

jhadvig changed the title ~~OCPBUGS-62307: Remove orphaned console-conversion-webhook deployment …~~ OCPBUGS-62307: Remove orphaned console-conversion-webhook deployment and related resource Oct 6, 2025

openshift-ci bot requested review from TheRealJon and spadgett October 6, 2025 14:44

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 6, 2025

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 6, 2025

openshift-ci bot requested a review from jiajliu October 6, 2025 14:53

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 28, 2026

jhadvig removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 29, 2026

jhadvig force-pushed the OCPBUGS-62307 branch from 5d76137 to 9a25489 Compare February 2, 2026 09:48

OCPBUGS-62307: Remove orphaned console-conversion-webhook deployment …

d234957

…and related resource

jhadvig force-pushed the OCPBUGS-62307 branch from 9a25489 to d234957 Compare February 3, 2026 10:25

TheRealJon approved these changes Feb 3, 2026

View reviewed changes

openshift-ci bot assigned TheRealJon Feb 3, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 3, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Feb 4, 2026

openshift-merge-bot bot merged commit cfd48a0 into openshift:main Feb 4, 2026
10 checks passed

Conversation

jhadvig commented Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Implementation Details

Files Changed

Uh oh!

openshift-ci-robot commented Oct 6, 2025

Uh oh!

jhadvig commented Oct 6, 2025

Uh oh!

openshift-ci-robot commented Oct 6, 2025

Uh oh!

openshift-ci-robot commented Oct 7, 2025

Problem

Solution

Implementation Details

Files Changed

Uh oh!

jhadvig commented Oct 8, 2025

Uh oh!

jhadvig commented Oct 29, 2025

Uh oh!

openshift-bot commented Jan 28, 2026

Uh oh!

yanpzhan commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheRealJon left a comment

Choose a reason for hiding this comment

Uh oh!

TheRealJon Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

TheRealJon Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Feb 3, 2026

Uh oh!

yanpzhan commented Feb 4, 2026

Uh oh!

openshift-ci-robot commented Feb 4, 2026

Uh oh!

openshift-ci-robot commented Feb 4, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 4, 2026

Problem

Solution

Implementation Details

Files Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jhadvig commented Oct 6, 2025 •

edited

Loading

yanpzhan commented Jan 30, 2026 •

edited

Loading

openshift-ci bot commented Feb 3, 2026 •

edited

Loading