fix: treat OCM4001 inflight check failure as non-terminal during cluster create - #6463
Open
Cliff Schomburg (cssjr) wants to merge 2 commits into
Open
Conversation
…ter create When Cluster Service reports ClusterStateError with error code OCM4001 (inflight MI permission checks failed), the backend now keeps the operation in Provisioning state instead of marking it as terminal Failed during CREATE operations. This allows the operation controller to continue polling CS, giving time for delayed role assignments to propagate through Azure RBAC. The 60-minute CreateOperationCompletionDeadline provides a hard backstop if CS never recovers. The inflight check error details are still captured in the operation message for observability. Scoped to CREATE only — UPDATE and DELETE operations continue to treat OCM4001 as terminal Failed. Resolves: ARO-28755 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
openshift-ci
Bot
requested review from
Jan-Hendrik Boll (janboll) and
Miguel Soriano (miguelsorianod)
August 6, 2026 17:54
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: cssjr The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Collaborator
Author
|
/test lint |
12 tasks
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Collaborator
Author
|
/test e2e-parallel |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ClusterStateErrorwith error codeOCM4001(inflight MI permission checks failed) during a CREATE operation, the backend now keeps the operation inProvisioningstate instead of marking it as terminalFailedCreateOperationCompletionDeadlineprovides a hard backstop if CS never recoversFailedRoot Cause (ARO-28755)
The E2E test
cluster_delayed_role_assignments.gofails ~7% of the time because of a timing race: when Managed Identity role assignments are deployed after cluster creation begins, CS's inflight MI permission checks may exhaust their retry window before the role assignments propagate through Azure RBAC. Once CS reportsClusterStateError, the backend unconditionally mapped this to terminalProvisioningStateFailed, preventing any recovery even after role assignments were in place.Test plan
TestConvertClusterStatuscovering OCM4001 during CREATE (stays Provisioning), OCM4001 during UPDATE (stays Failed), and non-OCM4001 during CREATE (stays Failed)prod/parallelsuite validates the delayed role assignment test passesResolves: https://redhat.atlassian.net/browse/ARO-28755
🤖 Generated with Claude Code