Replace the sed-based generation of pkg/apis/go.mod and copied go.sum with a Go workspace.
Each module is now tidied independently and kept in sync via go work sync.
Signed-off-by: Malay Kumar Parida <mparida@redhat.com>
The chart package rule captures find output over the chart directory as
its prerequisite list when make parses the makefile, including any
dependency archives already sitting in charts/. The
helm.dependency.update recipe then runs helm dependency update, which
deletes archives that no longer match the Chart.yaml pins. An archive
left by an earlier build at a different ref — an older version pin, or
another branch — is thus frozen as a prerequisite and deleted mid-run,
and make stops with "No rule to make target
.../charts/ceph-csi-operator-1.0.1.tgz" (seen after the csi-operator
pin moved from 1.0.1 to 1.0.4).
Exclude *.tgz files from the prerequisite find. The archives never
carried staleness information anyway because helm.dependency.update is
a non-file target that is always considered remade, so the package
target re-runs every build regardless.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
When neither docker nor podman is available and usable,
`make build`, `make lint.yaml`, and `lint.markdown` used to fail
with confusing unhelpful error messages like `run: command not found`
or `build: command not found` and in the case of build fail rather late
in the process.
This change lets make fail imuch more early and with a clear error message that a
working installation of container runtime with podman or docker is required.
The new logic is this:
If docker is present and usable, use it
otherwise, if podman is present and usable, use it
otherwise, if DOCKERCMD is explicitly set to a usable command, use it.
otherwise, error out at corresponding targets.
In order to avoid adding new confusions, `make clean` and `make build` are additionally made robust to
gracefully skip the image cleanup and image cleanuop steps, respectively, with an informational message
instead of
failingi hard when no usable container command is provided or detected.
Assisted-by: GitHub Copilot
Signed-off-by: Michael Adam <obnox@samba.org>
kubernetes/code-generator is versioned alongside the core k8s.io modules, so codegen should logically stay in sync with the Kubernetes version in go.mod.
So we now resolve KUBE_CODEGEN_TAG from k8s.io/apimachinery with go list instead of maintaining a separate
pin that can silently fall behind dependency bumps. This removes manual version upkeep entirely. Bumping k8s modules in
go.mod automatically picks the matching code-generator release on the next make codegen.
Also rename CODE_GENERATOR_VERSION to KUBE_CODEGEN_TAG to align with the kube_codegen.sh tooling and the CODE_GENERATOR path used by codegen.sh.
Add the generated files for latest codegen run as well.
Signed-off-by: Malay Kumar Parida <mparida@redhat.com>
The go.mod.check target generates pkg/apis/go.mod from the root go.mod
and must remove the root-only replace directive that points
github.com/rook/rook/pkg/apis to ./pkg/apis. The sed pattern expected
the line to start with "replace", but the actual line is tab-indented
inside the replace block, so the directive was never removed.
Update the sed pattern to match optional leading whitespace and remove
the incorrect self-replace from pkg/apis/go.mod.
Signed-off-by: Malay Kumar Parida <mparida@redhat.com>
Add a step to the release process, when creating a new release branch,
to add a row for the new release series to the support matrix in the
Maintenance and Support page. This keeps the matrix current as new
minor versions are released.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Removed the leading v from the Helm OCI chart version tag so that helm pull can auto-resolve the latest version without specifying the tag explicitly.
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
updated the external cluster doc, and helm and manifest
install to make use of csi operator as it is the default
offering now
Signed-off-by: parth-gr <partharora1010@gmail.com>
this commit update the link which refere the csi-driver
chart value.yaml to update it dynamically when release
is done from master to release or release to release tag.
Signed-off-by: subhamkrai <srai@redhat.com>
Going forward, admin will manage the csi operator
CR's and rook will only manage Ceph Connection cr
and client Profile cr.
The old csi driver is completely removed from Rook
and can no longer be used starting in Rook v1.20.
The upgrade guide will contain the needed transition steps
for managing the csi operator settings.
Signed-off-by: subhamkrai <srai@redhat.com>
The yamllint make target required yamllint to be installed
in the PATH.
This change renders it self-contained
by using a container image instead.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
running make shellcheck required shellcheck to be
installed locally in the $PATH.
This change renders make shellcheck self-contained
by installing shellcheck in the local tools cache directory
likeit is already done with other tools.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
The definition of a newline withe name '\n' was invalid and broke
introduced commands-before-first-target syntax errors in the
Makefile.
This change fixes the poblem by changing the name to the valid name
NEWLINE.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
the markdownlint and markdownlint.fix make targets
required markdownlint-cli2 to be installed locally
in the $PATH.
This change renders them self-contained by running
markdownlint from the official markdownlint-cli2
docker image.
Also clean the development-flow guide for linting tools
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
make helm.lint depended on the chart-testing tool ct as well as helm and kustomize being available in
the PATH.
This makes the target self-contained by
- running ct via go run
- using the cached version of helm used elswhere in the
build system
- caching kustomize in the tools dir and using that
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
A target was recently introduced for creating the host-specific tools
cache directory.
Several helmng-related tools installation targets depended on the directory implicitly or
created it as part of their recipe.
This change makes the dependency explicit by using the new target as a
prerequisite.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
A target was recently introduced for creating the host-specific tools
cache directory.
Several golang-related tools install targets depended on the directory implicitly or
created it as part of their recipe.
This change makes the dependency explicit by using the new targett as a
prerequisite. This also simplifies some recipes by removing now unneeded
mkdir operations.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
The go-junit-reporttool used to be installed into the general tools cache dir.
For consistency, this changes it to be into the host-specific tools
cache directory like the other cached tools
Signed-off-by: Michael Adam <obnox@samba.org>
actions/checkout v6 changed how credentials are persisted. Instead of writing GITHUB_TOKEN as an extraheader in .git/config, it now stores a pointer to a credential helper file in $RUNNER_TEMP. The Makefile's `git config --unset http.https://github.com/.extraheader` no longer clears the token, so the cross-repo push to rook.github.io was failing.
I have updated the checkout action to v6.0.2, set the persist-credentials field to false and removed the unset line from releases/Makefile.
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
Tool binaries were installed to a host-specific cache for that was eforced to the linux platform.
This change fixes the mechanism to install the tool binaries to the cache directory for the real
detected platform
Signed-off-by: Michael Adam <obnox@samba.org>
the target for installing helm to the local
host-specific tools cache and a few other targets are
using the tools cache directory and depend on it
implicitly.
This change is a preparation for making this dependency explicit
by adding a new target for creating the tools cache directory
that can be use as a target prerequisite in subsequent changes.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
instead of using of using manifest-tool and updating
it's version, we can use docker buildx which works like
manifest-tool only and based on manifest-tool working.
Signed-off-by: subhamkrai <srai@redhat.com>
Kubernetes has begun releasing a kube-api-linter application for linting
Kubernetes APIs to match against common best-practices. (a.k.a., KAL).
Of note: KAL is still new and has no semver releases.
I believe this linter is helpful in encouraging Rook devs to think
deeply about how end-users consume the API. It ensures that new APIs
account for set/unset status, zero values, upper/lower bounds, and
possibly others in the future.
This commit adds initial support to Rook, without making the results a
requirement. Maintainers still need to evaluate rule configuration and
determine how tightly Rook wants to hold to the results.
As of this commit, I observe around 650 "issues" with the current Rook APIs.
This doesn't mean that Rook is in danger of breaking. Issues with API
types are often just indications that upper/lower bounds are missing, or
that there is ambiguity between set-empty and unset-empty values.
This commit uses `--new` in CI to ensure only new API issues are
flagged.
Also of note, KAL is a golangci-lint plugin. It is possible to locally
build KAL (from source) into golangci-lint to run both at the same time.
However, this is time-consuming, and it's harder to coordinate tool
binary caching this way when it's related to 2 different versions.
Treating KAL as a standalone binary allows for simpler make scripting
and maintenance.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This PR addresses ArgoCD drift detection issues by adding consistent
metadata labels to RBAC resources in Rook Ceph Helm charts. The problem
occurs because many RBAC resources lack metadata labels, causing ArgoCD
to interpret them as 'labels: null' and report continuous drift.
Changes made:
- Added consistent labels to all RBAC templates in rook-ceph and library charts
- Created _recommended-labels.tpl template for standardized labeling
- Removed app.kubernetes.io/component label per consideRatio feedback to avoid scope creep
- Suppressed Helm-specific labels (version, instance, managed-by, created-by, chart) from static RBAC files
- Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml
Labels added to RBAC resources:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/name: rook-ceph
- app.kubernetes.io/part-of: rook-ceph-operator
Impact:
- Resolves ArgoCD 'OutOfSync' issues for Rook RBAC resources
- Improves resource identification and management
- Provides consistent labeling across all Rook Helm charts
- No functional changes to RBAC permissions
- Focuses on essential labels to avoid over-engineering
This addresses review feedback from travisn and consideRatio to maintain
scope and ensure static RBAC files only contain meaningful labels.
Signed-off-by: fullstackjam <fullstackjam@outlook.com>
I failed to save a file before making the commit becomign PR #16558.
This small change should also have been part of it.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The helm charts allowed rendering a PodSecurityPolicy resource via the
configuration `pspEnable`. This option is removed and all references to
psp, PodSecurityPolicy, and Pod Security Policy have been cleaned up.
The PSP resource was only rendered if k8s version was lower than 1.25
when it was still supported. It has been deprecated since k8s 1.21.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
this commit added changes to use cosign to sign the
docker images and the helm charts being published to
different the oci repos. This will enhance software supply
chain security by enabling signing and verification of
container images, ensuring their authenticity and integrity
Signed-off-by: subhamkrai <srai@redhat.com>
this commit add check to pull helm chart dependency
only when the charts are not available locally on the
system. This reduces overall make build other make
command completion time.
Signed-off-by: subhamkrai <srai@redhat.com>
This touches a lot where a typo could cause issues for someone, so I have self-
reviewed it many times line-by-line already.
There are a few types of changes:
- All resources get tied to their own YAML document separator (`---`)
before their definition, reducing the risk of not separating resources
correctly when rendering multiple into a file. I think the changes
will fix edge case bugs for people with mutiple items listed in
`cephFileSystems` and similar configuration.
- `toYaml ...` is made into `... | toYaml` consistently.
- `default A B` is made into `B | default A` consistently.
- Consistent whitespace chomping, so instead of `{{ end }}` you would
find `{{- end }}` typically. The system is that you should chomp left
almost all the time, and almost all the time _not_ chomp right. You
would chomp right in the beginning of a file or helper function in
order to clear some initial whitespace, otherwise not.
- Multiline helm template comments `{{- /* ... */ }}` get their content
indented 2 spaces.
- List items are consistently rendered with two spaces of indentation.
- `kind` is put before `apiVersion` consistently, to follow a practice
observed partially in the repo.
- Calls to the helm `template` function have been replaced with
`include` to be consistent and to stick with modern practices.
- Use of `indent` have been replaced with `nindent #` and a left
whitespace chomp for a consistent easy to follow practice that gets
good result.
- Several `if` statements like `if X -> render X` have been replaced
with `with X -> render .` to avoid repetition. The `with` statement
won't render if the provided context, making it function also like an
`if` statement.
- Fixed a bug with `if .Values.revisionHistoryLimit`, which should
really be `if not (typeIs "<nil>" .Values.revisionHistoryLimit)` to
handle situations when its set to `0`.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The error message issued by `make` when the available golang was ont one
of the supported versions was somewhat confusion or even broken.
This change fixes the message.
Signed-off-by: Michael Adam <obnox@samba.org>
this commits enable the csi-operator by default,
moving it from experimental to stable.
Also, disable the csi-operator chart from generating
rbac in common.yaml
Signed-off-by: subhamkrai <srai@redhat.com>
This commit test csi-operator helm chart as a dependencies with rook-ceph operator helm chart.
With these changes csi-operator will be installed as a part of rook-ceph operator helm chart.
Signed-off-by: subhamkrai <srai@redhat.com>
A new helm repo index was created from scratch for every new release
which meant that the release timestamps in the index were basically all
identical.
This change intends to fix that by merging the new index with the
existing one
The first attempt to fix this (PR #16033) did not work properly.
This change is intended to fix the issue for good by closing the gap the
previuous PR has left.
Fixes: #15604
Co-Authored-By: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: Michael Adam <obnox@samba.org>
A new helm repo index was created from scratch for every new release
which meant that the release timestamps in the index were basically all
identical.
This change intends to fix that by merging the new index with the
existing one
Fixes: #15604
Signed-off-by: Michael Adam <obnox@samba.org>
Until now, docs have been published for every master and
release branch build. This can lead to confusion if a new
feature is backported to the release branch and the docs
are published to the website, even though the feature will
not be available until the next tagged release.
This does have the effect that small doc-only fixes will
not be in the latest release docs until we actually tag
a release.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Travis Nielsen
Malay Kumar Parida
subham rai
Joshua Hoblitt
Michael Adam
Prabhala Tara Aasrita
dependabot[bot]
parth-gr
subhamkrai
Blaine Gardner
fullstackjam
Erik Sundell
Oded Viner