@openshift-cherrypick-robot: Jira Issue OCPBUGS-53179 has been cloned as Jira Issue OCPBUGS-53242. Will retitle bug to link to clone.
/retitle [release-4.16] OCPBUGS-53242: Ensure that PSA label is latest instead of pinning versions

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: openshift-cherrypick-robot
Once this PR has been reviewed and has the lgtm label, please assign joelanford for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-53242, which is invalid:

• expected dependent Jira Issue OCPBUGS-53179 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

/jira refresh

@camilamacedo86: This pull request references Jira Issue OCPBUGS-53242, which is valid.

No GitHub users were found matching the public email listed for the QA contact in Jira (jiazha@redhat.com), skipping review request.

Test pass, details: https://issues.redhat.com/browse/OCPBUGS-53242
/label qe-approved
/label cherry-pick-approved

/hold

@camilamacedo86 https://issues.redhat.com/browse/OCPBUGS-41849 has "Affects version: 4.17", are we sure we want this in 4.16 too?

That's a good point! That's OK if we backport it to 4.16.z. However, it's better to align with the Auth team, + @camilamacedo86 What do you think?

Hi @jianzhangbjz, @anik120

Do we really need to fix this for 4.16?
What Kubernetes version is used for the OCP 4.16 release?

Regarding your comment: "However, it's better to align with the Auth team,"—why do you think alignment with the Auth team is necessary?

So, what would be the key difference between setting the latest version for higher releases but not for 4.16? Why do you think it's acceptable from 4.17 onwards but not for 4.16? What is your specific concern?

PS: I do not understand why you think that is fine we have latest from 4.17 and not at 4.16, could you please help me understand it ?

@camilamacedo86 see the comments by Xingxing Xia in https://issues.redhat.com/browse/OCPBUGS-41849. Looks like a 4.16 cluster had 1.24 pinned to it, was upgraded to 4.17 and latest was seen, which passed the test.

Going by just the paperwork there, it looks like the intention is to go only as far back as 4.17.

Is there any restrictions technically from back porting this to 4.16? I don't know. Just going with the paper work here, which as a reviewer is easier to adhere to, than verify if things will break if this is back ported to 4.16.

Hi @anik120 @jianzhangbjz

Thank you both a lot that is my question:

• what is the concern we have in cherry-pick to 4.16? That is not was requested by QE?
• what do we need to check with Auth-Team exactly?

As https://issues.redhat.com/browse/OCPBUGS-41849 mentioned We kept it at "v1.24" due to potential issues with HyperShift.. Now, that bug has been fixed. However, they didn't backport it since there is no strong requirement.
So, as I mentioned above, whether backporting it to 4.16.z or not is ok for me.

After discussion, it was decided that we will not backport to 4.16 
more info: https://redhat-internal.slack.com/archives/C06KP34REFJ/p1744735179579959

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-53242. The bug has been updated to no longer refer to the pull request using the external bug tracker.