OSDOCS-17704 updated create-only mode #104178

wgabor0427 · 2025-12-18T17:14:03Z

Version(s):
4.20+

Issue:
https://issues.redhat.com/browse/OSDOCS-17704

Link to docs preview:
https://104178--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/zero_trust_workload_identity_manager/zero-trust-manager-reconciliation.html

QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2025-12-18T17:22:43Z

🤖 Fri Jan 09 14:23:30 - Prow CI generated the docs preview:

https://104178--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/zero_trust_workload_identity_manager/zero-trust-manager-reconciliation.html

lunarwhite · 2025-12-23T11:08:19Z

Kindly

/cc @sayak-redhat @anirudhAgniRedhat

anirudhAgniRedhat · 2025-12-23T11:18:04Z

modules/zero-trust-manager-pause-reconciliation.adoc


-= Pausing Operator reconciliation by annotation
+[role="_abstract"]
+Pause reconciliation of the `SpireServer` by enabling `create-only` mode. This setting prevents the Operator from automatically reverting your manual changes to the desired state. You can enable this mode by updating the subscription object.


Suggested change

Pause reconciliation of the `SpireServer` by enabling `create-only` mode. This setting prevents the Operator from automatically reverting your manual changes to the desired state. You can enable this mode by updating the subscription object.

Pause reconciliation of the operands by enabling `create-only` mode. This setting prevents the Operator from automatically reverting your manual changes to the desired state. You can enable this mode by updating the operator's subscription object.

anirudhAgniRedhat · 2025-12-23T11:19:33Z

modules/zero-trust-manager-pause-reconciliation.adoc

 .Procedure

-* To pause reconciling the `SpireServer` custom resource, add the `create-only` annotation to the named `cluster` by running the following command:
+* To pause reconciling the `SpireServer`, add the environment variable `CREATE_ONLY_MODE`: `true` in the subscription object by running the following command:


Suggested change

* To pause reconciling the `SpireServer`, add the environment variable `CREATE_ONLY_MODE`: `true` in the subscription object by running the following command:

* To pause reconciling the operands resources managed by operator, add the environment variable `CREATE_ONLY_MODE`: `true` in the subscription object by running the following command:

anirudhAgniRedhat · 2025-12-23T11:21:25Z

modules/zero-trust-manager-restart-reconciliation.adoc

 = Resuming Operator reconciliation by annotation

+[role="_abstract"]
+Restart reconciliation of the `SpireServer` by disabling `create-only` mode. This helps to ensure that the `SpireServer` resource works correctly when you restart the controller. You can diable this mode by updating the subscription object.


Suggested change

Restart reconciliation of the `SpireServer` by disabling `create-only` mode. This helps to ensure that the `SpireServer` resource works correctly when you restart the controller. You can diable this mode by updating the subscription object.

Restart reconciliation of the operands by disabling `create-only` mode. This helps to ensure that the operator-managed resource works correctly when the controller gets restarted. You can disable this mode by updating the subscription object.

anirudhAgniRedhat · 2025-12-23T11:22:09Z

modules/zero-trust-manager-restart-reconciliation.adoc

 Follow these steps to restart the reconciliation process:

-. Run the `oc annotate` command, adding a hyphen (`-`) at the end of the annotation name. This removes the annotation from the cluster resource.
+. To restart reconciling the `SpireServer`, add the environment variable `CREATE_ONLY_MODE`: `false` in the subscription object by running the following command:


Suggested change

. To restart reconciling the `SpireServer`, add the environment variable `CREATE_ONLY_MODE`: `false` in the subscription object by running the following command:

. To restart reconciling the operator-managed resources, add the environment variable `CREATE_ONLY_MODE`: `false` in the subscription object by running the following command:

anirudhAgniRedhat · 2025-12-23T11:42:34Z

modules/zero-trust-manager-pause-reconciliation.adoc

    message: Create-only mode is enabled via ztwim.openshift.io/create-only annotation
    reason: CreateOnlyModeEnabled
    status: "True"
    type: CreateOnlyMode


.Verification

Check the status of the ZeroTrustWorkloadIdentityManager resource to confirm that the create-only mode is active. The status must be true and the reason must be CreateOnlyModeEnabled.

$ oc get zerotrustworkloadidentitymanager cluster -o yaml

.Example output

status: conditions: - lastTransitionTime: "2025-12-23T11:36:58Z" message: All components are ready reason: Ready status: "True" type: Ready - lastTransitionTime: "2025-12-23T11:36:58Z" message: All operand CRs are ready reason: Ready status: "True" type: OperandsAvailable - lastTransitionTime: "2025-12-23T11:36:58Z" message: create-only mode enabled reason: CreateOnlyModeEnabled status: "True" type: CreateOnlyMode

anirudhAgniRedhat · 2025-12-23T11:43:59Z

modules/zero-trust-manager-restart-reconciliation.adoc

+$ oc -n $OPERATOR_NAMESPACE patch subscription openshift-zero-trust-workload-identity-manager --type='merge' -p '{"spec":{"config":{"env":[{"name":"CREATE_ONLY_MODE","value":"false"}]}}}'
 ----

 . Restart the controller by running the following command:


remove the retart for the operator deployment.

this still needs to be removed

anirudhAgniRedhat · 2026-01-05T16:00:56Z

modules/zero-trust-manager-restart-reconciliation.adoc

+$ oc -n $OPERATOR_NAMESPACE patch subscription openshift-zero-trust-workload-identity-manager --type='merge' -p '{"spec":{"config":{"env":[{"name":"CREATE_ONLY_MODE","value":"false"}]}}}'
 ----

 . Restart the controller by running the following command:


this still needs to be removed

anirudhAgniRedhat · 2026-01-05T16:02:53Z

modules/zero-trust-manager-restart-reconciliation.adoc

 .Verification
-* Check the status of the `SpireServer` resource to confirm that the `create-only` mode is disabled. The `status` must be `false` and the `reason` must be `CreateOnlyModeDisabled`.
+
+* Check the status of the `ZeroTrustWorkloadIdentityManager` resource to confirm that the `create-only` mode is disabled. The `status` must be `false` and the `reason` must be `CreateOnlyModeDisabled`.
 +
 [source,terminal]
 ----
-$ oc get SpireServer cluster -o yaml
+$ oc get zerotrustworkloadidentitymanager cluster -o yaml
 ----

-.Example output
+The following example confirms that the 'create-only' mode is active.
+
 [source,yaml]
 ----
 status:
-  conditions:
-  - lastTransitionTime: "2025-09-03T12:13:39Z"
-    message: Create-only mode is enabled via ztwim.openshift.io/create-only annotation
-    reason: CreateOnlyModeDisabled
-    status: "False"
-    type: CreateOnlyMode
+ conditions:
+ - lastTransitionTime: "2025-09-03T12:13:39Z"
+   message: Create-only mode is disabled via ztwim.openshift.io/create-only annotation
+   reason: CreateOnlyModeDisabled
+   status: "False"
+   type: CreateOnlyMode
 ----


we might need to remove this as the revert status is not getting refected on the CR
CC: @lunarwhite @sayak-redhat any suggestion??

we should remove if we want only to use env variable through subscription to update the create-only-mode variable

@lunarwhite there is a question mark in the end => CC: @lunarwhite @sayak-redhat any suggestion??

lunarwhite

@sayak-redhat please be cautious when reviewing PRs, human should not solely trust AI generated "review reports" in any way.

In your comments: #104178 (comment), "ztwim.openshift.io/create-only annotation" is there surprisingly - but we have refactored it into patching subscription approach, not? I have no idea why you ignored the review comment #104178 (comment) from @anirudhAgniRedhat which is mentioning the same paragraph

lunarwhite · 2026-01-09T13:50:21Z

modules/zero-trust-manager-restart-reconciliation.adoc

 :_mod-docs-content-type: PROCEDURE
 [id="zero-trust-manager-restart-reconciliation_{context}"]

 = Resuming Operator reconciliation by annotation


Suggested change

= Resuming Operator reconciliation by annotation

= Resuming Operator reconciliation

@lunarwhite , @anirudhAgniRedhat asked there and i acknowledged , its not that i ignored

lunarwhite · 2026-01-09T14:17:20Z

modules/zero-trust-manager-pause-reconciliation.adoc

 [source,terminal]
 ----
-$ oc annotate SpireServer cluster -n zero-trust-workload-identity-manager ztwim.openshift.io/create-only=true
+$ oc -n $OPERATOR_NAMESPACE patch subscription openshift-zero-trust-workload-identity-manager --type='merge' -p '{"spec":{"config":{"env":[{"name":"CREATE_ONLY_MODE","value":"true"}]}}}'


Enhancement: Accept case-insensitive "TRUE"/"FALSE" for CREATE_ONLY_MODE env var using strings.EqualFold(). Any random/invalid value will default to false (disabled) for safety.

CREATE_ONLY_MODE env var handling

• Accepts: true/True/TRUE → Enables create-only mode • Accepts: false/False/FALSE → Disables create-only mode • Any other value (yes, 1, random, etc.) → Defaults to DISABLED

The check is case-insensitive. Recommend documenting "true" or "false" as accepted values.

@sayak-redhat Why putting these bits here? This PR is part of the 1.0.0 GA version only, obviously openshift/zero-trust-workload-identity-manager#89 hasn't merged && no release created yet. Have you mixed up the versioning which I told you early

openshift-ci · 2026-01-09T14:24:50Z

@wgabor0427: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Dec 18, 2025

wgabor0427 force-pushed the OSDOCS-17704 branch from 6479035 to fd9a42e Compare December 18, 2025 19:55

openshift-ci bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Dec 18, 2025

openshift-ci bot requested review from anirudhAgniRedhat and sayak-redhat December 23, 2025 11:08

anirudhAgniRedhat reviewed Dec 23, 2025

View reviewed changes

wgabor0427 force-pushed the OSDOCS-17704 branch 2 times, most recently from 80ca1e5 to 85d237f Compare January 5, 2026 14:06

anirudhAgniRedhat reviewed Jan 5, 2026

View reviewed changes

wgabor0427 force-pushed the OSDOCS-17704 branch 2 times, most recently from bb9383d to b5ebff1 Compare January 9, 2026 13:48

lunarwhite suggested changes Jan 9, 2026

View reviewed changes

wgabor0427 force-pushed the OSDOCS-17704 branch from b5ebff1 to 74e17df Compare January 9, 2026 14:00

OSDOCS-17704 updated modules

be02b38

wgabor0427 force-pushed the OSDOCS-17704 branch from 74e17df to be02b38 Compare January 9, 2026 14:16

lunarwhite reviewed Jan 9, 2026

View reviewed changes

	Pause reconciliation of the `SpireServer` by enabling `create-only` mode. This setting prevents the Operator from automatically reverting your manual changes to the desired state. You can enable this mode by updating the subscription object.
	Pause reconciliation of the operands by enabling `create-only` mode. This setting prevents the Operator from automatically reverting your manual changes to the desired state. You can enable this mode by updating the operator's subscription object.

	* To pause reconciling the `SpireServer`, add the environment variable `CREATE_ONLY_MODE`: `true` in the subscription object by running the following command:
	* To pause reconciling the operands resources managed by operator, add the environment variable `CREATE_ONLY_MODE`: `true` in the subscription object by running the following command:

	Restart reconciliation of the `SpireServer` by disabling `create-only` mode. This helps to ensure that the `SpireServer` resource works correctly when you restart the controller. You can diable this mode by updating the subscription object.
	Restart reconciliation of the operands by disabling `create-only` mode. This helps to ensure that the operator-managed resource works correctly when the controller gets restarted. You can disable this mode by updating the subscription object.

	. To restart reconciling the `SpireServer`, add the environment variable `CREATE_ONLY_MODE`: `false` in the subscription object by running the following command:
	. To restart reconciling the operator-managed resources, add the environment variable `CREATE_ONLY_MODE`: `false` in the subscription object by running the following command:

	= Resuming Operator reconciliation by annotation
	= Resuming Operator reconciliation

OSDOCS-17704 updated create-only mode #104178

Are you sure you want to change the base?

OSDOCS-17704 updated create-only mode #104178

Uh oh!

Conversation

wgabor0427 commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lunarwhite commented Dec 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lunarwhite left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Jan 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

wgabor0427 commented Dec 18, 2025 •

edited

Loading

ocpdocs-previewbot commented Dec 18, 2025 •

edited

Loading