Fix MinorUpdateOVNDataplane race when OVN image unchanged between versions

Commit 63fd705 removed the nodeset.IsReady() check from
DataplaneNodesetsOVNControllerImagesMatch to fix the minor update
workflow getting stuck when unrelated deployments were running. That
check was too strict — it blocked when any deployment was in progress,
even if the OVN update had already completed.

However, the remaining pure image comparison is too loose. When the
OVN controller image does not change between two OpenStack versions,
the nodeset already has the matching image from the previous update.
The OpenStackVersion controller then sets MinorUpdateOVNDataplane=True
immediately, before the edpm-ovn-update deployment finishes. This
causes the subsequent minor update steps (controlplane update, edpm
services update) to proceed while the OVN dataplane deployment is
still running — resulting in both dataplane deployments running
concurrently.

Fix this by adding a new check before the image comparison:
IsDataplaneDeploymentRunningForContainerImage lists all in-progress
OpenStackDataPlaneDeployment resources, resolves which services each
deploys (from ServicesOverride or the nodeset's service list), and
inspects each service's ContainerImageFields to determine if it
manages the specified container image (e.g. "OvnControllerImage").

This approach is generic and does not rely on deployment or service
naming conventions. It correctly identifies OVN-related deployments
even when using custom services, by checking what container image
fields the service declares.

The MinorUpdateOVNDataplane condition now requires both:
- No in-progress deployment managing OvnControllerImage
- OVN controller image on all nodesets matches the target version

Related: OSPRH-25860

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Martin Schuppert <mschuppert@redhat.com>

Author: stuggi

internal/controller/core/openstackversion_controller.go

@@ -282,7 +282,18 @@ func (r *OpenStackVersionReconciler) Reconcile(ctx context.Context, req ctrl.Req
 		// minor update for Dataplane OVN
 		// Only check OVN when enabled to avoid hanging on a removed condition
 		if controlPlane.Spec.Ovn.Enabled {
-			if !openstack.DataplaneNodesetsOVNControllerImagesMatch(instance, dataplaneNodesets) {
+			// First check if any deployment that manages OvnControllerImage is
+			// still running. This prevents a race condition where the OVN image
+			// hasn't changed between versions: the nodeset already has the
+			// matching image from a previous update, so the image comparison
+			// alone would return true before the OVN deployment finishes.
+			ovnDeploymentRunning, err := openstack.IsDataplaneDeploymentRunningForContainerImage(
+				ctx, versionHelper, instance.Namespace, dataplaneNodesets, "OvnControllerImage")
+			if err != nil {
+				return ctrl.Result{}, err
+			}
+			if ovnDeploymentRunning ||
+				!openstack.DataplaneNodesetsOVNControllerImagesMatch(instance, dataplaneNodesets) {
 				instance.Status.Conditions.Set(condition.FalseCondition(
 					corev1beta1.OpenStackVersionMinorUpdateOVNDataplane,
 					condition.RequestedReason,

internal/openstack/dataplane.go

@@ -2,11 +2,13 @@ package openstack
 
 import (
 	"context"
+	"slices"
 
 	"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
 	corev1beta1 "github.com/openstack-k8s-operators/openstack-operator/api/core/v1beta1"
 
 	dataplanev1 "github.com/openstack-k8s-operators/openstack-operator/api/dataplane/v1beta1"
+	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -58,6 +60,84 @@ func DataplaneNodesetsOVNControllerImagesMatch(version *corev1beta1.OpenStackVer
 	return true
 }
 
+// IsDataplaneDeploymentRunningForContainerImage checks whether any in-progress
+// OpenStackDataPlaneDeployment is deploying a service that manages the given
+// containerImageField (e.g. "OvnControllerImage"). It resolves which services
+// each deployment runs (from ServicesOverride or the nodeset's service list)
+// and inspects the service's ContainerImageFields to determine if it manages
+// the specified container image.
+func IsDataplaneDeploymentRunningForContainerImage(
+	ctx context.Context,
+	h *helper.Helper,
+	namespace string,
+	dataplaneNodesets *dataplanev1.OpenStackDataPlaneNodeSetList,
+	containerImageField string,
+) (bool, error) {
+	// List all deployments in the namespace
+	deployments := &dataplanev1.OpenStackDataPlaneDeploymentList{}
+	opts := []client.ListOption{
+		client.InNamespace(namespace),
+	}
+	err := h.GetClient().List(ctx, deployments, opts...)
+	if err != nil {
+		return false, err
+	}
+
+	// Build a map of nodeset name -> nodeset for quick lookup
+	nodesetMap := make(map[string]*dataplanev1.OpenStackDataPlaneNodeSet, len(dataplaneNodesets.Items))
+	for i := range dataplaneNodesets.Items {
+		nodesetMap[dataplaneNodesets.Items[i].Name] = &dataplaneNodesets.Items[i]
+	}
+
+	// Cache service lookups to avoid repeated API calls
+	serviceCache := make(map[string]*dataplanev1.OpenStackDataPlaneService)
+
+	for _, deployment := range deployments.Items {
+		// Skip completed deployments
+		if deployment.Status.Deployed {
+			continue
+		}
+
+		// Determine which services this deployment runs for each of its nodesets
+		for _, nodesetName := range deployment.Spec.NodeSets {
+			nodeset, exists := nodesetMap[nodesetName]
+			if !exists {
+				continue
+			}
+
+			var services []string
+			if len(deployment.Spec.ServicesOverride) != 0 {
+				services = deployment.Spec.ServicesOverride
+			} else {
+				services = nodeset.Spec.Services
+			}
+
+			for _, serviceName := range services {
+				svc, cached := serviceCache[serviceName]
+				if !cached {
+					foundService := &dataplanev1.OpenStackDataPlaneService{}
+					err := h.GetClient().Get(ctx, types.NamespacedName{
+						Name:      serviceName,
+						Namespace: namespace,
+					}, foundService)
+					if err != nil {
+						// Service not found — skip it
+						continue
+					}
+					svc = foundService
+					serviceCache[serviceName] = svc
+				}
+
+				if slices.Contains(svc.Spec.ContainerImageFields, containerImageField) {
+					return true, nil
+				}
+			}
+		}
+	}
+
+	return false, nil
+}
+
 // DataplaneNodesetsDeployed returns true if all nodesets are deployed with the latest version
 func DataplaneNodesetsDeployed(version *corev1beta1.OpenStackVersion, dataplaneNodesets *dataplanev1.OpenStackDataPlaneNodeSetList) bool {
 	for _, nodeset := range dataplaneNodesets.Items {