[AI] OSAC-3886: Installer labels StorageClass osac.openshift.io/tenant=Default but default Tenant CR name is shared

[osac-jira-ai-issue-solver]

Resolves OSAC-3886

Summary

• Remove orphaned Helm pre-install/pre-upgrade hook (label-storageclass.yaml) that stamped osac.openshift.io/tenant=Default on the cluster default StorageClass
• The sentinel code consuming this label was removed in OSAC-3011 (PR OSAC-3011: add LVMS local storage provider for dev/CI environments #131); the hook was left behind
• This mismatch caused Tenant shared to have ClusterStorageReady=False on demo installs with Ceph, and the hook silently reverted any manual fix on every Helm upgrade

Test plan

• make fmt lint test passes (osac-operator)
• make helm-crds passes — CRD sync unaffected
• Verified no Go code, Helm templates, or installer configs reference tenant=Default or label-sc
• Verified helm.sh/hook-delete-policy: before-hook-creation ensures old hook resources are cleaned up on upgrade
• Deploy to a cluster with Ceph StorageClass and verify tenant=Default label is no longer applied on install/upgrade

[openshift-ci-robot]

@osac-jira-ai-issue-solver[bot]: This pull request references OSAC-3886 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Resolves OSAC-3886

Summary

• Remove orphaned Helm pre-install/pre-upgrade hook (label-storageclass.yaml) that stamped osac.openshift.io/tenant=Default on the cluster default StorageClass
• The sentinel code consuming this label was removed in OSAC-3011 (PR OSAC-3011: add LVMS local storage provider for dev/CI environments #131); the hook was left behind
• This mismatch caused Tenant shared to have ClusterStorageReady=False on demo installs with Ceph, and the hook silently reverted any manual fix on every Helm upgrade

Test plan

• make fmt lint test passes (osac-operator)
• make helm-crds passes — CRD sync unaffected
• Verified no Go code, Helm templates, or installer configs reference tenant=Default or label-sc
• Verified helm.sh/hook-delete-policy: before-hook-creation ensures old hook resources are cleaned up on upgrade
• Deploy to a cluster with Ceph StorageClass and verify tenant=Default label is no longer applied on install/upgrade

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[osac-jira-ai-issue-solver]

AI Session Costs

Session	Cost
New ticket	$1.09
Feedback (1) (no changes)	$1.02
Feedback (1) retry 1 (no changes)	$0.68
Feedback (1) retry 2 (no changes)	$0.45
Feedback (1) retry 3 (unable)	$0.50
Feedback (2) (no changes)	$0.46
Feedback (2) retry 1 (no changes)	$0.57
Feedback (2) retry 2 (no changes)	$0.73
Feedback (2) retry 3 (unable)	$0.68
Feedback (3) (no changes)	$0.45
Feedback (3) retry 1 (no changes)	$0.39
Feedback (3) retry 2 (no changes)	$0.52
Feedback (3) retry 3 (unable)	$0.55
Feedback (4) (no changes)	$0.42
Feedback (4) retry 1 (no changes)	$0.41
Feedback (4) retry 2 (no changes)	$0.46
Feedback (4) retry 3 (unable)	$0.36
Feedback (5) (no changes)	$0.43
Feedback (5) retry 1 (no changes)	$0.37
Feedback (5) retry 2 (no changes)	$0.44
Feedback (5) retry 3 (unable)	$0.45
Feedback (6) (no changes)	$0.43
Feedback (6) retry 1 (no changes)	$0.37
Feedback (6) retry 2 (no changes)	$0.41
Feedback (6) retry 3 (unable)	$0.38
Feedback (7) (no changes)	$0.42
Feedback (7) retry 1 (no changes)	$0.32
Feedback (7) retry 2	$1.01
Feedback (8) (no changes)	$0.74
Feedback (8) retry 1 (no changes)	$0.41
Feedback (8) retry 2 (no changes)	$0.42
Feedback (8) retry 3 (unable)	$0.98
Feedback (9) (no changes)	$0.72
Feedback (9) retry 1 (no changes)	$0.66
Feedback (9) retry 2 (no changes)	$0.60
Feedback (9) retry 3 (unable)	$0.48
Feedback (10) (no changes)	$0.40
Feedback (10) retry 1 (no changes)	$0.35
Feedback (10) retry 2 (no changes)	$0.42
Feedback (10) retry 3 (unable)	$0.43
Feedback (11) (no changes)	$0.43
Feedback (12) (no changes)	$0.40
Feedback (12) retry 1 (no changes)	$0.71
Feedback (12) retry 2 (no changes)	$0.60
Feedback (12) retry 3 (unable)	$0.61
Feedback (13) (no changes)	$0.40
Feedback (13) retry 1 (no changes)	$0.41
Feedback (13) retry 2 (no changes)	$0.37
Feedback (13) retry 3 (unable)	$0.36
Feedback (14) (no changes)	$0.37
Feedback (14) retry 1 (no changes)	$1.00
Feedback (14) retry 2 (no changes)	$0.83
Feedback (15) (no changes)	$0.82
Feedback (15) retry 1 (no changes)	$0.82
Feedback (15) retry 2 (no changes)	$0.73
Total	$30.24

[zszabo-rh]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: osac-jira-ai-issue-solver[bot], zszabo-rh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• osac-operator/OWNERS [zszabo-rh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[zszabo-rh]

/ok-to-test

[github-actions]

Labeled ok-to-test. Re-ran 5 failed run(s).

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:29 AM UTC · Completed 11:40 AM UTC

Commit: b21af28 · View workflow run →

[fullsend-ai-review]

Looks good to me

---

Labels: PR removes an orphaned Helm hook related to StorageClass labeling, fixing a storage bug

Previous run

Review

Findings

Low

• [removal staleness] osac-operator/charts/operator/values.yaml:58 — After removing label-storageclass.yaml, the bootstrap section (lines 58–59) in values.yaml becomes orphaned — no template in the osac-operator chart references .Values.bootstrap.cliImage anymore. This is dead configuration that will never be consumed.
  Remediation: Remove the bootstrap: block (lines 58–59) from osac-operator/charts/operator/values.yaml.

• [permission-reduction] osac-operator/charts/operator/templates/hooks/label-storageclass.yaml — Orphaned RBAC resources will persist in existing clusters after upgrade. The deleted hook used helm.sh/hook-delete-policy: before-hook-creation, which only cleans up old hook resources when Helm creates replacement resources. Since the template is entirely removed, Helm will never render new hook resources, so the cleanup policy will never trigger. Old ServiceAccount, ClusterRole, ClusterRoleBinding, and completed Job will remain as orphans.
  Remediation: Document in PR or release notes that operators should manually delete orphaned hook resources after upgrading, or add a one-time post-upgrade cleanup hook.

[osac-jira-ai-issue-solver]

In comment, @fullsend-ai-review[bot] said:

🤖 Finished Review · ✅ Success · Started 11:29 AM UTC · Completed 11:40 AM UTC

Commit: b21af28 · View workflow run →

Automated review status notification — no action needed.

Addressed in 641bab3.

[osac-jira-ai-issue-solver]

In comment, @fullsend-ai-review[bot] said:

Review

Findings

Low

• [removal staleness] osac-operator/charts/operator/values.yaml:58 — After removing label-storageclass.yaml, the bootstrap section (lines 58–59) in values.yaml becomes orphaned — no template in the osac-operator chart references .Values.bootstrap.cliImage anymore. This is dead configuration that will never be consumed.
  Remediation: Remove the bootstrap: block (lines 58–59) from osac-operator/charts/operator/values.yaml.

• [permission-reduction] osac-operator/charts/operator/templates/hooks/label-storageclass.yaml — Orphaned RBAC resources will persist in existing clusters after upgrade. The deleted hook used helm.sh/hook-delete-policy: before-hook-creation, which only cleans up old hook resources when Helm creates replacement resources. Since the template is entirely removed, Helm will never render new hook resources, so the cleanup policy will never trigger. Old ServiceAccount, ClusterRole, ClusterRoleBinding, and completed Job will remain as orphans.
  Remediation: Document in PR or release notes that operators should manually delete orphaned hook resources after upgrading, or add a one-time post-upgrade cleanup hook.

Addressed both findings: (1) Removed the orphaned bootstrap: block from osac-operator/charts/operator/values.yaml — no template references .Values.bootstrap.cliImage after the hook deletion. (2) Acknowledged the orphaned RBAC concern — the reviewer is correct that before-hook-creation only cleans up when Helm renders a replacement hook, which won't happen now. Existing clusters will retain the orphaned ServiceAccount, ClusterRole, ClusterRoleBinding, and completed Job (all named {release}-label-sc). These are inert (the ClusterRole only grants get/list/patch on StorageClasses) and can be removed manually. This should be noted in release documentation.

Addressed in 641bab3.

[osac-jira-ai-issue-solver]

CI failures addressed in 641bab3.

[github-actions]

Removed ok-to-test label due to new commits. An org member must re-approve with /ok-to-test.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:48 AM UTC · Completed 12:01 PM UTC

Commit: 641bab3 · View workflow run →

[osac-jira-ai-issue-solver]

In comment, @fullsend-ai-review[bot] said:

🤖 Finished Review · ✅ Success · Started 11:48 AM UTC · Completed 12:01 PM UTC

Commit: 641bab3 · View workflow run →

I was unable to produce code changes to address this comment after multiple attempts.

[ronniel1]

/lgtm