From a41c8844635f02500e7c20f358ea24fb47de288a Mon Sep 17 00:00:00 2001
From: Jake Yip <jake.yip@ardc.edu.au>
Date: Mon, 19 Feb 2024 11:36:51 +1100
Subject: [PATCH] Update cloud-provider-openstack registry

cloud-provider-openstack has changed their image repo. To use the
plugins matching later versions of k8s, this needs to be updated.

Also update tags for CI test to match version being tested.

[1] https://github.com/kubernetes/cloud-provider-openstack/pull/2169

Change-Id: I9390db5e1aa357c17a39a7c208d837befafd3820
---
 .zuul.yaml                                     |  5 +++++
 .../fragments/enable-auto-healing.sh           |  2 +-
 .../kubernetes/fragments/enable-cinder-csi.sh  |  4 ++--
 .../fragments/enable-ingress-octavia.sh        |  2 +-
 .../fragments/enable-keystone-auth.sh          |  2 +-
 .../kube-apiserver-to-kubelet-role.sh          |  2 +-
 ...ovider-openstack-repo-e6209ce2e3986e12.yaml | 18 ++++++++++++++++++
 7 files changed, 29 insertions(+), 6 deletions(-)
 create mode 100644 releasenotes/notes/update-cloud-provider-openstack-repo-e6209ce2e3986e12.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index 73bb78d117..6f415c506d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -64,6 +64,11 @@
                 container_runtime: containerd
                 containerd_version: 1.6.28
                 containerd_tarball_sha256: f70736e52d61e5ad225f4fd21643b5ca1220013ab8b6c380434caeefb572da9b
+                cloud_provider_tag: v1.27.3
+                cinder_csi_plugin_tag: v1.27.3
+                k8s_keystone_auth_tag: v1.27.3
+                magnum_auto_healer_tag: v1.27.3
+                octavia_ingress_controller_tag: v1.27.3
 
 - job:
     name: magnum-tempest-plugin-tests-cluster-k8s_fcos_v1-1.27-calico
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-auto-healing.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-auto-healing.sh
index d14c449ed9..e889e00fc0 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-auto-healing.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-auto-healing.sh
@@ -239,7 +239,7 @@ EOF
 
 function enable_magnum_auto_healer {
     echo "Installing magnum_auto_healer"
-    image_prefix=${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}
+    image_prefix=${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}
     image_prefix=${image_prefix%/}
     magnum_auto_healer_manifest=/srv/magnum/kubernetes/manifests/magnum_auto_healer.yaml
 
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-cinder-csi.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-cinder-csi.sh
index 7321d130a0..de42b2d41f 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-cinder-csi.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-cinder-csi.sh
@@ -315,7 +315,7 @@ spec:
             - mountPath: /var/lib/csi/sockets/pluginproxy/
               name: socket-dir
         - name: cinder-csi-plugin
-          image: ${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}cinder-csi-plugin:${CINDER_CSI_PLUGIN_TAG}
+          image: ${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}cinder-csi-plugin:${CINDER_CSI_PLUGIN_TAG}
           args:
             - /bin/cinder-csi-plugin
             - "--endpoint=\$(CSI_ENDPOINT)"
@@ -451,7 +451,7 @@ spec:
             capabilities:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
-          image: ${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}cinder-csi-plugin:${CINDER_CSI_PLUGIN_TAG}
+          image: ${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}cinder-csi-plugin:${CINDER_CSI_PLUGIN_TAG}
           args:
             - /bin/cinder-csi-plugin
             - "--endpoint=\$(CSI_ENDPOINT)"
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-ingress-octavia.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-ingress-octavia.sh
index 8fef59a419..26f8c817aa 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-ingress-octavia.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-ingress-octavia.sh
@@ -51,7 +51,7 @@ EOF
 writeFile $OCTAVIA_INGRESS_CONTROLLER_CONFIGMAP "$OCTAVIA_INGRESS_CONTROLLER_CONFIGMAP_CONTENT"
 
 # octavia-ingress-controller deployment
-oic_image="${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}octavia-ingress-controller:${OCTAVIA_INGRESS_CONTROLLER_TAG}"
+oic_image="${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}octavia-ingress-controller:${OCTAVIA_INGRESS_CONTROLLER_TAG}"
 OCTAVIA_INGRESS_CONTROLLER=/srv/magnum/kubernetes/manifests/octavia-ingress-controller.yaml
 OCTAVIA_INGRESS_CONTROLLER_CONTENT=$(cat <<EOF
 ---
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
index 5205820f6e..365a97808c 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
@@ -4,7 +4,7 @@ step="enable-keystone-auth"
 printf "Starting to run ${step}\n"
 
 if [ "$(echo $KEYSTONE_AUTH_ENABLED | tr '[:upper:]' '[:lower:]')" != "false" ]; then
-    _prefix=${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}
+    _prefix=${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}
     CERT_DIR=/etc/kubernetes/certs
 
     # Create policy configmap for keystone auth
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/kube-apiserver-to-kubelet-role.sh b/magnum/drivers/common/templates/kubernetes/fragments/kube-apiserver-to-kubelet-role.sh
index 74a4146deb..9e989ba10e 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/kube-apiserver-to-kubelet-role.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/kube-apiserver-to-kubelet-role.sh
@@ -89,7 +89,7 @@ kubectl -n kube-system create secret generic os-trustee \
 
 #TODO: add heat variables for master count to determine leaderelect true/False ?
 if [ "$(echo "${CLOUD_PROVIDER_ENABLED}" | tr '[:upper:]' '[:lower:]')" = "true" ]; then
-    occm_image="${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}openstack-cloud-controller-manager:${CLOUD_PROVIDER_TAG}"
+    occm_image="${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}openstack-cloud-controller-manager:${CLOUD_PROVIDER_TAG}"
     OCCM=/srv/magnum/kubernetes/openstack-cloud-controller-manager.yaml
 
     [ -f ${OCCM} ] || {
diff --git a/releasenotes/notes/update-cloud-provider-openstack-repo-e6209ce2e3986e12.yaml b/releasenotes/notes/update-cloud-provider-openstack-repo-e6209ce2e3986e12.yaml
new file mode 100644
index 0000000000..0c58230a96
--- /dev/null
+++ b/releasenotes/notes/update-cloud-provider-openstack-repo-e6209ce2e3986e12.yaml
@@ -0,0 +1,18 @@
+---
+upgrade:
+  - |
+    The registry for cloud-provider-openstack has been updated from
+    `docker.io/k8scloudprovider` to `registry.k8s.io/provider-os/`.
+critical:
+  - |
+    Magnum Core Team has historically limit changing of defaults in labels.
+    This is because existing Cluster Templates in a deployment falls back to
+    using the defaults in code if a specific label is not specified. If
+    defaults change, an existing deployment's Cluster Templates may stop
+    working after a Magnum upgrade.
+
+    Magnum will now no longer keep image tag labels (e.g. cloud_provider_tag,
+    flannel_tag) static. Please specify explicitly all image tags for the
+    images your Cluster Templates will be using, to prevent a future change
+    breaking your Cluster Templates. Refer to the documentation under
+    'Supported Labels' for a list of labels Magnum is tested with.