LI83054: REMOVE CP4I OVERRIDE ANNOTATION WEBHOOK CHECK FOR PORTAL/ANALYTICS/GATEWAY

APAR status

• Closed as program error.

Error description

• When upgrading from 10.0.1.12 to 10.0.5.4 using the
  '"apiconnect-operator/cp4i": "false" annotation as part of the
  top level API Connect CR, once upgraded the following error is
  hit:
  
  message: 'ERROR trying to update GATEWAY:
  SubsystemCRUpdateFailed (message: admission webhook
  "vgatewaycluster.kb.io" denied the request:
  GatewayCluster.gateway.apiconnect.ibm.com "apipoc-gw" is
  invalid: metadata.annotations: Invalid value: "":
  apiconnect-operator/cp4i override annotation cannot be changed
  after resource creation)'
  reason: GATEWAY:SubsystemCRUpdateFailed
  
  Post upgrade to 10.0.5.4, the top level CR is trying to
  propagate the cp4i annotation to portal/gateway/analytics
  subsystems but there is a webhook check which is denying the
  update.
  

Local fix

• Btw, we gave the following workaround
  
  change replicas for APIC operator pod to 0
  add the following annotation to gateway/portal/analytics CRs:
  apiconnect-operator/cp4i: "false"
  bring back the replicas for APIC operator pod and see that the
  warning goes away
  

Problem summary

• <p>A customer upgrading from 10.0.1.12 to 10.0.5.4 on OCP using
  top-level APIConnectCluster CR, where CP4i APIs are present
  using "apiconnect-operator/cp4i: annotation set to false on
  APIConnectCluster CR could hit the issue where upgrade fails,
  and they get a message such as the following in the
  APIConnectCluster status:
  'ERROR trying to update GATEWAY: SubsystemCRUpdateFailed
  (message: admission webhook "vgatewaycluster.kb.io" denied the
  request: GatewayCluster.gateway.apiconnect.ibm.com "apipoc-gw"
  is invalid: metadata.annotations: Invalid value: "":
  apiconnect-operator/cp4i override annotation cannot be changed
  after resource creation)' reason:
  GATEWAY:SubsystemCRUpdateFailed'</p><p> </p>
  

Problem conclusion

• <p>This issue was fixed in API Connect v10.0.5.5 by addressing
  validation for the gateway/portal/analytics webhooks checks.</p>
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  API CONNECT ENT

• Fixed component ID

  5725Z2201

Applicable component levels