This adds markdown link checking in th documentation sources
to the daily-nightly CI jobs.
The purpose of this is to catch breaking external links to help
keep out documentation clean.
Catching breaking external links is best done in the daily CI runs
instead of checking links in PRs. link checking in PRs would prevent
changes in PRs from newly introducing broken links.
Signed-off-by: Michael Adam <obnox@samba.org>
The minikube-to-kind conversion moved the master/release integration
tests to kind, which selects the Kubernetes version via the
kindest/node:<version> image tag. There is no published
kindest/node:v1.32.13 image (Docker Hub returns 404); the latest 1.32
node image kind ever built is v1.32.11, since later kind releases
advanced to 1.33+ and never produced a newer 1.32 patch.
Pin the on-release matrix's 1.32 entry to v1.32.11 so the 1.32-line
coverage keeps a node image that actually exists. The other matrix
versions (v1.31.14, v1.34.8, v1.36.1) already have published images.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Bump the most recent kubernetes version exercised by the integration and
canary matrices from v1.35.5 to v1.36.1. The kindest/node image for 1.36 is
provided by the kind v0.32.0 pinned by the kind-conversion commit. The older
matrix versions are unchanged.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The integration and canary suites ran on a single-node minikube
`driver: none` cluster, where the kubelet ran directly on the GitHub
runner, so the host docker daemon doubled as the cluster runtime and
host block devices and host paths were directly visible to pods. Replace
that with a kind cluster.
Every suite creates its cluster through the shared
integration-test-setup-cluster-resources composite action, so the
conversion is centralized there and converts the smoke, object, helm,
keystone, multi-cluster, upgrade, on-release, nightly, encryption-KMS and
all canary jobs at once.
- Replace the setup-minikube step with helm/kind-action, selecting the
kubernetes version via the kindest/node image tag and creating a
single-node cluster from a new kind config (kind pinned to v0.32.0 for
reproducibility).
- Drop the cri-dockerd install; kind nodes use their built-in containerd.
- Add a kind config that bind-mounts the host /dev, /var/lib/rook and
/run/udev into the node so the existing host-based disk-prep helpers
(use_local_disk*, create_partitions_for_osds, blockDevicePV.sh,
localPathPV.sh, ...) keep working unchanged: devices and partitions
created on the host appear in the node and in the OSD pods that
hostPath-mount the node /dev, and ceph-volume can read the host udev
database it needs to inventory disks.
- Prepare the kind node for the host-level operations rook runs against the
underlying host: remount /sys read-write so CSI's kernel RBD mapping
(`rbd map --device-type krbd`, which writes /sys/bus/rbd) works, and install
lvm2 and cryptsetup, which rook runs in the node's mount namespace to
provision LVM- and encryption-backed OSDs. kindest/node images provide none
of this; the minikube driver:none runner host did.
- Route the Service and pod CIDRs from the runner to the kind node so
host-side tests (the `go test` process runs on the runner) can reach
in-cluster ClusterIPs, e.g. an S3 request to the RGW service. With minikube
driver:none the runner already shared the cluster network.
- Load locally built images into the cluster. Under minikube `driver: none`
the built image was already in the cluster runtime; under kind it must be
imported, so build_rook and create_helm_tag now import their images into
each node's containerd through a new load_image_into_cluster helper (via the
node's ctr, which avoids the kind/kindest-node containerd-config version
skew that breaks `kind load docker-image`).
- Point Vault's kubernetes-auth at the in-cluster API endpoint
(kubernetes.default.svc) instead of the kubeconfig server URL: kind exposes
that as https://127.0.0.1:<port>, unreachable from the in-cluster Vault pod,
so OSD encryption-key retrieval via k8s-auth failed.
- Replace the remaining direct minikube references in the canary workflow: a
`minikube kubectl` call and the external-cluster topology values.
- Adapt host-name assumptions that only held under driver:none: resolve the
disk-cleanup job by the k8s node name rather than the runner hostname, and
let kind-action ignore post-job cluster-teardown failures (the runner is
ephemeral; nvme/multus devices can wedge `docker rm` of the node).
- Update stale comments that described the CI environment as minikube.
- Move the multus integration test's kind config under tests/config too, so
both kind cluster configs live in one place.
create-dev-cluster.sh and other local-dev tooling are intentionally left on
minikube.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The raw-disk-with-object, osd-with-metadata-device, and pvc canary jobs
used loopback devices to supply an extra block device beyond the single
spare disk a GitHub runner provides. Loop devices behave differently
from real block devices -- Rook gates them behind
ROOK_CEPH_ALLOW_LOOP_DEVICES and special-cases them in the OSD daemon --
so exercising core scenarios on them is less realistic than using real
SCSI disks.
Provision the extra device(s) over iSCSI (LIO) instead, reusing the
existing create_extra_disk helper: it now creates N LUNs, the new
find_extra_block_devs and find_second_block_dev helpers enumerate them,
and deploy_cluster gains a two_raw_disks mode. The three jobs now run
entirely on real disks, and the canary CI no longer creates loop devices
or relies on the loop-device test helpers.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
CephMgrSuite (ceph_mgr_test.go) exercised the Rook orchestrator mgr
module through `ceph orch` commands. Remove the suite together with its
GitHub Actions workflow (integration-test-mgr-suite.yaml), whose sole
purpose was to run this suite, gated behind the run-mgr-suite label and
a nightly cron.
No other code references the deleted suite. Its helpers (logBytesInfo,
the defaultTries constant, and the host/service/serviceStatus types)
were all local to the file, so nothing is left orphaned.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The reusable canary workflow declares a default ceph_images value that is never used: both callers always pass an explicit image list. A stale default is a drift hazard because a new caller could silently exercise the wrong image. Drop the default and mark the input required so callers must choose deliberately.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Canary jobs upload their logs under an artifact named by job and ceph image, but the job matrix also varies kubernetes-version. When more than one kubernetes version is exercised the upload-artifact step fails on a duplicate artifact name. Append the kubernetes version so each matrix cell produces a unique artifact.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The validate-rgw-endpoint step gave each validation loop only 15
seconds. A single attempt of the external script can exceed that
budget when the RGW is slow to respond right after the object store
was created, killing the step before any retry could happen. This
showed up as sporadic canary job failures with exit code 124 and no
diagnostics.
Validation failures are also reported on stderr while the script exits
0, so the until loop never actually retried them. Retry until the
script succeeds with no stderr output, give the loops a generous
timeout, and print the captured stderr when validation does not
succeed in time.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
actionlint only understands workflow files, so the .github/actionlint.yaml
ignore keeps the composite action definitions out of `make lint.workflows`.
Apply the same shellcheck fixes there anyway, found by running shellcheck over
their run: blocks directly:
- quote unquoted variable expansions (SC2086): the $GITHUB_ENV writes in
collect-logs, tmate_debug and upterm_debug, and ${ARCH} in the cri-dockerd
install in integration-test-setup-cluster-resources
- split `export BLOCK=$(...)` into a separate assignment and export so a
failing command substitution is not masked (SC2155) in
encryption-pvc-kms-ibm-kp
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Resolve the shellcheck findings actionlint reports so that
`make lint.workflows` passes:
- quote unquoted variable expansions (SC2086) and command substitutions
(SC2046)
- split `export VAR=$(...)` into a separate assignment and export so a
failing command substitution is not masked by export's exit status
(SC2155)
- double-quote kubectl jsonpath arguments inside `sh -c '...'` loops so
the single quotes no longer break out of the wrapper (SC1083)
- annotate intentional deferred-expansion `sh -c '...'` bodies and the
intentional `for ... in $sockets` word splitting with targeted
`# shellcheck disable` directives (SC2016, SC2086)
- drop unused command-output captures (SC2034), simplify a `\! -z` test
(SC2236) and fix nested same-type quoting (SC2140)
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Run actionlint over the workflow files through the `make lint.workflows`
target (added in PR 17795) so the check behaves identically when run
locally and in CI, and narrow the workflow's path filter to the
lint-relevant files.
Add .github/actionlint.yaml to ignore the composite action definitions
under .github/workflows/<name>/action.{yml,yaml}: actionlint only
understands workflow files and otherwise mis-parses composite actions as
malformed workflows.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Several callers pass a github-token input to composite actions that do not declare it, so it is silently ignored and emits a runner warning at run time. The integration-test-setup-cluster-resources action (called from the nightly jobs and the keystone-auth suite) and the encryption-pvc-kms-ibm-kp action (called from the canary suite) declare only their real inputs. Remove the dead github-token from every such call. If a token is ever needed it should be declared and consumed by the action itself.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
The workflow already sets defaults.run.shell, yet several steps in the rgw-multisite-testing and two-object-one-zone jobs re-declare the identical shell. Remove the per-step overrides; the workflow default already applies to every run step.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
It is intended that the CI test the latest patch release of each
kubernetes version that is tested.
The canary integration test tested v1.35.0 however, while
the latest v1.35 patch releaase is v1.35.5.
This change updates the integration-test CI workflow
to test k8s v1.35.5 instead of v1.35.0 to match the intention.
Signed-off-by: Michael Adam <obnox@samba.org>
Rook supports six versions of kubernetes but we only want to spend CI
resources for testing four of them.
In order to align with this commitment, this change lets rook run
integration test suites on kubernetes v1.34 instead of v1.33 for release
testing.
As a result, the latest patch releases of kubernetes v1.31, v1.32,
v1.34, and v1.35 are tested for rook releases.
In addition, k8s version specification is made more systematic to
use the pattern v1.3X.Y instead of 1.3X.Y.
Signed-off-by: Michael Adam <obnox@samba.org>
The CephUpgradeSuite workflow failed ~31% of PR runs vs the ~19%
broken-PR baseline of the other integration suites. Classifying the
failing step of every failed run from the last ~400 PR runs and the
logs of every failure on non-dependabot branches shows the excess
comes from a handful of too-tight waits, unretried network fetches,
and environment races rather than from the upgrade logic itself:
- The biggest class (21 of 44 genuine test-phase failure runs):
"giving up waiting for deployment(s) with label
app=rook-ceph-{rgw,osd},ceph-version!=..." during the
Squid->Tentacle upgrade. The operator updates daemons sequentially
(mons, mgr, osds with PG health gates between them, mds, rgw), so
each later daemon's fixed 275s wait also absorbs the time spent on
every daemon before it; rgw, last in the sequence, failed most
often. The mon wait was already extended for slow image pulls in
98bd03a42; extend the same retry count to all the daemon waits.
- ~7 runs: "snapshot controller is not ready" in the Helm upgrade
path. WaitForSnapshotController(30) allows only 150s, and the logs
show the deployment still converging (readyreplicas 1 < replicas 2)
on the final poll. Raise to 90 retries.
- InstallOrUpgradeHelmRepoChart ran helm with no retry; an observed
failure fetched the ceph-csi-drivers chart tarball from GitHub
release assets and got a 504. Retry up to 5 times, as
InstallLocalHelmChart already does.
- Raise the go test timeouts (2400s->3600s rook, 1800s->2700s helm).
Failed runs ended in "panic: test timed out" during teardown, which
aborts cleanup and log collection; the longer daemon waits above
also need the headroom.
- The "setup cluster resources" composite action (shared by all
suites) accounted for half of all failed jobs. The one steady class
there (8 distinct runs across 7 different days): minikube exits with
K8S_FAIL_CONNECT (code 40) when the requested kubernetes version is
missing from its bundled version list, because it then validates the
version with an anonymous GitHub API request (GITHUB_TOKEN is not
honored on that code path), and anonymous requests from shared
runner IPs are regularly rate-limited. minikube 1.38.x predates
v1.35.5, so only the v1.35.5 jobs hit this class. Pass --force to
minikube start to skip that check: the kubernetes versions used in
CI are pinned constants already validated by the PRs that bump
them, and an invalid version would still fail fast at the kubeadm
download. Also seen twice: dpkg failing on a corrupt cri-dockerd .deb
because curl ran without --fail and saved an HTTP error page as the
package; add --fail and retries.
- On runners without the /mnt resource disk, the fallback OSD disk is
an iSCSI (LIO) device and use_local_disk_for_integration_test
returned early on those runners, skipping the udev nowatch
workaround for the device re-probe storms of rook issue 8975. A burn-in
failure on this PR captured the consequence with full kernel
forensics: ~100 udev change events on the OSD disk, and ceph-volume
activate wedged in uninterruptible sleep on the block device lock
(blkdev_llseek -> rwsem_down_write_slowpath) for 18+ minutes during
the ceph version upgrade while the cluster's only OSD stayed down.
Install the nowatch rule before the early return so it applies to
every runner type, and before the disk is first written rather than
after.
- One burn-in round failed before the upgrade even began: the
pre-upgrade PVC create on the Helm path expired WaitUntilPVCIsBound
(RetryLoop, 275s) while the CSI provisioner pods were still
starting. Set RETRY_MAX=110 for this workflow to double the
framework's base wait budget, instead of extending individual waits
one flake at a time.
- minikube also exits with GUEST_START (code 80) when its internal 6
minute node-ready wait expires on slow runners (5 runs in the
dataset, two more observed while burning in this PR, one of them on
another suite). Pass --wait-timeout=15m to minikube start.
Not addressed (small or episodic classes): OSDs never coming up on
initial deploy (3 runs, possibly the same udev/iSCSI wedge), the
filesystem not becoming active (2 runs), and several day-clustered
minikube incidents (exit codes 65/67/90).
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Michael Adam
Joshua Hoblitt
subham rai
dependabot[bot]
Joshua Hoblitt
Travis Nielsen
Parth Arora