Check baremetal.openshift.io/owned before managing metal3 deployment

As per openshift/enhancements#212 MAO should stand down from managing
the metal3 deployment if cluster-baremetal-operator has claimed
ownership by setting the baremetal.openshift.io annotation.

This allows a smooth transition on upgrade of bare metal components to
a new Second Level Operator (SLO) for this platform.

Author: markmc

pkg/operator/baremetal_pod.go

@@ -10,6 +10,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	appsclientv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
 	coreclientv1 "k8s.io/client-go/kubernetes/typed/core/v1"
 	"k8s.io/utils/pointer"
 )
@@ -113,6 +114,21 @@ func createMariadbPasswordSecret(client coreclientv1.SecretsGetter, config *Oper
 	return err
 }
 
+// Return false on error or if "baremetal.openshift.io/owned" annotation set
+func checkMetal3DeploymentOwned(client appsclientv1.DeploymentsGetter, config *OperatorConfig) (bool, error) {
+	existing, err := client.Deployments(config.TargetNamespace).Get(context.Background(), "metal3", metav1.GetOptions{})
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			return true, nil
+		}
+		return false, err
+	}
+	if _, exists := existing.ObjectMeta.Annotations[cboOwnedAnnotation]; exists {
+		return false, nil
+	}
+	return true, nil
+}
+
 func newMetal3Deployment(config *OperatorConfig, baremetalProvisioningConfig BaremetalProvisioningConfig) *appsv1.Deployment {
 	replicas := int32(1)
 	template := newMetal3PodTemplateSpec(config, baremetalProvisioningConfig)

pkg/operator/operator.go

@@ -32,6 +32,9 @@ const (
 	// 5ms, 10ms, 20ms, 40ms, 80ms, 160ms, 320ms, 640ms, 1.3s, 2.6s, 5.1s, 10.2s, 20.4s, 41s, 82s
 	maxRetries         = 15
 	maoOwnedAnnotation = "machine.openshift.io/owned"
+
+	// Indicates that the metal3 deployment is being managed by cluster-baremetal-operator
+	cboOwnedAnnotation = "baremetal.openshift.io/owned"
 )
 
 // Operator defines machine api operator.

pkg/operator/sync.go

@@ -117,6 +117,15 @@ func (optr *Operator) syncTerminationHandler(config *OperatorConfig) error {
 }
 
 func (optr *Operator) syncBaremetalControllers(config *OperatorConfig) error {
+	owned, err := checkMetal3DeploymentOwned(optr.kubeClient.AppsV1(), config)
+	if err != nil {
+		return err
+	}
+	if !owned {
+		glog.Infof("cluster-baremetal-operator is managing the Metal3 deployment, standing down.")
+		return nil
+	}
+
 	// Try to get baremetal provisioning config from a CR
 	baremetalProvisioningConfig, err := getBaremetalProvisioningConfig(optr.dynamicClient, baremetalProvisioningCR)
 	if err != nil {