PR https://github.com/rook/rook/pull/14473
tried to improve the token-permissions score of the OpenSSF scorecard
report.
https://scorecard.dev/viewer/?uri=github.com/rook/rook
The latest scorecard run however shows that this score has not improved.
It still shows two warbnings about missing top level permissions.
The rest looks good (just Info entries).
This change aims at finally improving the token-permissions score
by adding top level permissions to the two warned-about workflow files.
Signed-off-by: Michael Adam <obnox@samba.org>
For the specification see:
<https://github.com/rook/rook/blob/master/design/ceph/object/swift-and-keystone-integration.md>
* extend the API object specs for swift and keystone integration
* adapt rgw to the new go-ceph version
- The parameter lists of the API call have changes, as parameters
ignored by the RGW Admin Ops API are no longer serialized, therefore
the mock has to be adapted.
- There is now validation for the user keys that are passed to the
User get API, therefore things failed when we had empty keys in our
User proxy object.
* expand the reconcile loop for the swift and keystone integration
* fix minor mistakes in design document
* add env var to pass extra args to minikube
Minikube decides CPU cores and memory automatically based on the
available resources on the machine which may be insufficient to
run rook. This commit adds an environment variable to add arbitrary
arguments to the minikube command, so both can be specified if
desired.
* integration tests for swift and keystone
The new integration of swift or s3 and keystone support by rook
does not have any integration tests yet.
This commit introduces integration tests for swift and keystone. The
tests are done against a minimal keystone setup (keystone container
image from Yaook-project (https://yaook.cloud), sqlite as database
backend, cert-manager and trust-manager for test certificate setup).
To prevent hardcoded credentials, passwords are generated
by the tests. The integration tests use the openstack client
(keystone- and swift-functionality) (https://docs.openstack.org/
python-openstackclient/ latest/). This was a concious design decision
to use client tooling as close as possible to the end user instead of
using other go-libraries (such as gophercloud).
* add documentation on swift and keystone
Currently there is no documentation on the use of Swift to access
an object store as well as the use of OpenStack keystone for
authentication.
This commit adds documentation on the use of Swift and OpenStack
keystone, as well as CRD-related documentation and an example setup.
* add integration tests for S3 via keystone
This commit introduces integration tests for s3 and keystone. The
tests are run against the same minimal keystone setup that the tests
for swift and keystone use.
The integration tests use the aws s3 client to use client tooling as
close as possible to the end user instead of using other go-libraries.
Co-authored-by: Jan Klippel <jan.klippel@uhurutec.com>
Co-authored-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Signed-off-by: Jan Klippel <jan.klippel@uhurutec.com>
Signed-off-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
adding the CSI-operator manifest files
inside rook repo naming deploy/examples/csi-operator-manifests.yaml.
Also, let's skip running any lint check on file `deploy/examples/csi-operator.yaml` as this is owned by CSI-operator.
Signed-off-by: subhamkrai <srai@redhat.com>
Fixes: #14518
The previous attempt to fix the auto-assign action
has introduced an indentation error in the workflow yaml file.
This should finally fix it, hopefully.
Signed-off-by: Michael Adam <obnox@samba.org>
Fixes: #14518
A recent change seems to have broken the permissions of the auto-assign
action.
This tries to fix this by making permissions more specific.
Signed-off-by: Michael Adam <obnox@samba.org>
Fixes: #14466
The OpenSSF scorecard report
https://scorecard.dev/viewer/?uri=github.com/rook/rook
warns about excessive token-permissions in the rook project's github CI
workflows.
This bulk change aims at improving this by
1. adding top-level read permissions where missing for integration tests.
2. adding write permissions as needed for the auto-assign workflow.
3. removing the warned-about and unused create-tag workflow
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
With the release of the first squid RC, we add squid
to the supported versions and add tests to run
Rook against the squid release.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In order to help users check that they have implemented the newly-added
Multus host configuration prerequisites, add a check to the validation
tool to verify connectivity.
Because users who are already running clusters with Multus enabled, add
a flag that allows users to only check for host configuration
prerequisites. This mode will not start the large number of clients that
would normally be started because those clients could disrupt a running
Rook cluster negatively.
Host checking pods require host network access. Many Kubernetes
distributions have pod security features enabled. In order to allow
non-Vanilla distros to run this tool, allow specifying a service account
that pods will run as, which can be configured by the admin to allow
test pods.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
govulcheck requires go 1.22.5 and even if `check-latest` is `true`
with go `1.22` it is failing so setting specific version go `1.22.5`
Signed-off-by: subhamkrai <srai@redhat.com>
Now user can pass the cli flags using config file and
also command line argument,
if mentioned at both the place priority is given to
command line argument
Signed-off-by: parth-gr <partharora1010@gmail.com>
The CI step that runs markdown lint accidentally got removed as part of
PR updates. Add the CI step back in.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
this commits updates the go version to 1.22.2 in govulncheck ci and
also updates golang.org/x/net to v0.23.0 to fix the ci
Signed-off-by: subhamkrai <srai@redhat.com>
The test names must match exactly for the mergify
auto merge to complete successfully. Update two of
the test names to match the latest CI.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Few day's back go 1.22 is release. Let's add that
as valid version to build on. Also, adding 1.22 as
test matric for linux build CI.
https://tip.golang.org/doc/go1.22
Signed-off-by: subhamkrai <srai@redhat.com>
Add new CSI_DISABLE_HOLDER_PODS option for rook-ceph-operator.
This option will disable holder pods when set to "true".
In the long term, Rook plans to deprecate the holder pods entirely.
This new option will allow users to choose to migrate their clusters to
non-holder clusters when they are ready and able, giving them time to
gracefully migrate before the holders are permanently removed.
This option is set to "false" by default so that upgrading users don't
have their CSI pods modified unexpectedly.
Example manifests are modified to set this value to true so that new
clusters will not deploy holder pods.
Migrating users are provided with documentation to instruct them about
the new requirements they need to satisfy to successfully remove holder
pods, a procedure for migrating pods from holder to non-holder mounts,
and a way to delete holder pods once they are no longer in use.
When users set CSI_DISABLE_HOLDER_PODS="true", the CSI controller will
no longer deploy or update the holder pod Daemonsets, but it does not
delete any existing Daemonsets. This allows already-attached PVCs to
continue operating normally with their network connection continuing to
exist in the current holder pod. This is critical to avoid causing
ia cluster-wide storage outage.
More info: https://github.com/rook/rook/issues/13055
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Until now, an object store would create all the necessary
metadata pools and the data pool that were exclusively
for its own object store. When isolation between object
stores is necessary, this would cause many pools and
PGs to be created in the cluster, which was not
manageable.
Now one set of pools can be created to be shared
by any number of object stores. The metadata and data
between each object store is isolated by
RADOS namespaces, which by design will keep the
data safe for multi-tenancy.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The patch version was pinned which caused problems
with security patches. Unpin it and always check
for new patch version
Signed-off-by: NymanRobin <nyman.robin@gmail.com>
For nightly jobs, canary tests are all running with the same job IDs,
making the last-run jobs cancel previous runs. Add a workflow-id
parameter to canary jobs that can be used to give each job in a canary
suite a unique job ID to prevent this.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
upgrading minimum kubernetes supported version to v1.24.17
and also upgrading other kubernetes version to their latest
respective version.
Signed-off-by: subhamkrai <srai@redhat.com>
Michael Adam
Blaine Gardner
subhamkrai
dependabot[bot]
Travis Nielsen
harshitasao
parth-gr
NymanRobin
subham rai
Liang Zheng
Santosh Pillai
NymanRobin