instead of using of using manifest-tool and updating
it's version, we can use docker buildx which works like
manifest-tool only and based on manifest-tool working.
Signed-off-by: subhamkrai <srai@redhat.com>
Kubernetes has begun releasing a kube-api-linter application for linting
Kubernetes APIs to match against common best-practices. (a.k.a., KAL).
Of note: KAL is still new and has no semver releases.
I believe this linter is helpful in encouraging Rook devs to think
deeply about how end-users consume the API. It ensures that new APIs
account for set/unset status, zero values, upper/lower bounds, and
possibly others in the future.
This commit adds initial support to Rook, without making the results a
requirement. Maintainers still need to evaluate rule configuration and
determine how tightly Rook wants to hold to the results.
As of this commit, I observe around 650 "issues" with the current Rook APIs.
This doesn't mean that Rook is in danger of breaking. Issues with API
types are often just indications that upper/lower bounds are missing, or
that there is ambiguity between set-empty and unset-empty values.
This commit uses `--new` in CI to ensure only new API issues are
flagged.
Also of note, KAL is a golangci-lint plugin. It is possible to locally
build KAL (from source) into golangci-lint to run both at the same time.
However, this is time-consuming, and it's harder to coordinate tool
binary caching this way when it's related to 2 different versions.
Treating KAL as a standalone binary allows for simpler make scripting
and maintenance.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This PR addresses ArgoCD drift detection issues by adding consistent
metadata labels to RBAC resources in Rook Ceph Helm charts. The problem
occurs because many RBAC resources lack metadata labels, causing ArgoCD
to interpret them as 'labels: null' and report continuous drift.
Changes made:
- Added consistent labels to all RBAC templates in rook-ceph and library charts
- Created _recommended-labels.tpl template for standardized labeling
- Removed app.kubernetes.io/component label per consideRatio feedback to avoid scope creep
- Suppressed Helm-specific labels (version, instance, managed-by, created-by, chart) from static RBAC files
- Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml
Labels added to RBAC resources:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/name: rook-ceph
- app.kubernetes.io/part-of: rook-ceph-operator
Impact:
- Resolves ArgoCD 'OutOfSync' issues for Rook RBAC resources
- Improves resource identification and management
- Provides consistent labeling across all Rook Helm charts
- No functional changes to RBAC permissions
- Focuses on essential labels to avoid over-engineering
This addresses review feedback from travisn and consideRatio to maintain
scope and ensure static RBAC files only contain meaningful labels.
Signed-off-by: fullstackjam <fullstackjam@outlook.com>
I failed to save a file before making the commit becomign PR #16558.
This small change should also have been part of it.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The helm charts allowed rendering a PodSecurityPolicy resource via the
configuration `pspEnable`. This option is removed and all references to
psp, PodSecurityPolicy, and Pod Security Policy have been cleaned up.
The PSP resource was only rendered if k8s version was lower than 1.25
when it was still supported. It has been deprecated since k8s 1.21.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
this commit added changes to use cosign to sign the
docker images and the helm charts being published to
different the oci repos. This will enhance software supply
chain security by enabling signing and verification of
container images, ensuring their authenticity and integrity
Signed-off-by: subhamkrai <srai@redhat.com>
this commit add check to pull helm chart dependency
only when the charts are not available locally on the
system. This reduces overall make build other make
command completion time.
Signed-off-by: subhamkrai <srai@redhat.com>
This touches a lot where a typo could cause issues for someone, so I have self-
reviewed it many times line-by-line already.
There are a few types of changes:
- All resources get tied to their own YAML document separator (`---`)
before their definition, reducing the risk of not separating resources
correctly when rendering multiple into a file. I think the changes
will fix edge case bugs for people with mutiple items listed in
`cephFileSystems` and similar configuration.
- `toYaml ...` is made into `... | toYaml` consistently.
- `default A B` is made into `B | default A` consistently.
- Consistent whitespace chomping, so instead of `{{ end }}` you would
find `{{- end }}` typically. The system is that you should chomp left
almost all the time, and almost all the time _not_ chomp right. You
would chomp right in the beginning of a file or helper function in
order to clear some initial whitespace, otherwise not.
- Multiline helm template comments `{{- /* ... */ }}` get their content
indented 2 spaces.
- List items are consistently rendered with two spaces of indentation.
- `kind` is put before `apiVersion` consistently, to follow a practice
observed partially in the repo.
- Calls to the helm `template` function have been replaced with
`include` to be consistent and to stick with modern practices.
- Use of `indent` have been replaced with `nindent #` and a left
whitespace chomp for a consistent easy to follow practice that gets
good result.
- Several `if` statements like `if X -> render X` have been replaced
with `with X -> render .` to avoid repetition. The `with` statement
won't render if the provided context, making it function also like an
`if` statement.
- Fixed a bug with `if .Values.revisionHistoryLimit`, which should
really be `if not (typeIs "<nil>" .Values.revisionHistoryLimit)` to
handle situations when its set to `0`.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The error message issued by `make` when the available golang was ont one
of the supported versions was somewhat confusion or even broken.
This change fixes the message.
Signed-off-by: Michael Adam <obnox@samba.org>
this commits enable the csi-operator by default,
moving it from experimental to stable.
Also, disable the csi-operator chart from generating
rbac in common.yaml
Signed-off-by: subhamkrai <srai@redhat.com>
This commit test csi-operator helm chart as a dependencies with rook-ceph operator helm chart.
With these changes csi-operator will be installed as a part of rook-ceph operator helm chart.
Signed-off-by: subhamkrai <srai@redhat.com>
A new helm repo index was created from scratch for every new release
which meant that the release timestamps in the index were basically all
identical.
This change intends to fix that by merging the new index with the
existing one
The first attempt to fix this (PR #16033) did not work properly.
This change is intended to fix the issue for good by closing the gap the
previuous PR has left.
Fixes: #15604
Co-Authored-By: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: Michael Adam <obnox@samba.org>
A new helm repo index was created from scratch for every new release
which meant that the release timestamps in the index were basically all
identical.
This change intends to fix that by merging the new index with the
existing one
Fixes: #15604
Signed-off-by: Michael Adam <obnox@samba.org>
Until now, docs have been published for every master and
release branch build. This can lead to confusion if a new
feature is backported to the release branch and the docs
are published to the website, even though the feature will
not be available until the next tagged release.
This does have the effect that small doc-only fixes will
not be in the latest release docs until we actually tag
a release.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The script sel-release-ver.sh was added in a somewhat unnatural place
tests/scripts .
This moves it to a more natural location build/release .
Signed-off-by: Michael Adam <obnox@samba.org>
This script updates examples and docs for a new release.
Invocation in principle: set-release-ver.sh NEW_VER
For example: set-release-ver.sh v1.16.8
Fixes: #15749
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
Reading the release process documentation, I found the description
of steps in one place to not quite match the intended effect of the
actual command steps due to a slight imprecision in used terminology.
This change improves and clarifies the corresponding wording to hopefully
prevent others from facing the same confusion.
Signed-off-by: Michael Adam <obnox@samba.org>
The helm charts will now only be published when it is
an officially tagged release build.
The images will only be published to all repos for
dockerhub, quay, and ghcr when it is a tagged release.
The images will be published only to dockerhub for all
master and interim release branch builds.
Remove obsolete makefile option for images.
Ceph is the only image Rook ever expects to build.
Simplify the makefile by removing the legacy option
to select which image to build.
Also included are other small improvements to clean up
the release scripts.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Resolves this warning:
WARN [runner/nolint_filter] Found unknown linters in //nolint directives: just configuration keys., value not credential
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
currently rook images are only available in docker,
let's start pushing rook images to quay.io and ghcr.io as well.
Signed-off-by: subhamkrai <srai@redhat.com>
The lint make target is not used anywhere in the codebase and is particular not run in the CI.
It was recently discovered that `make lint` does not even work at all.
It was subsequently suggested to remove the broken and unused target altogether.
This change settles that issue by removing the lint target and the preparatory
golint installation target.
Fixes: #15317
Signed-off-by: Michael Adam <obnox@samba.org>
make test was failing when running on arm macbooks. Fix it so that it
isn't running with hardcoded GOOS=linux.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
In order to help users check that they have implemented the newly-added
Multus host configuration prerequisites, add a check to the validation
tool to verify connectivity.
Because users who are already running clusters with Multus enabled, add
a flag that allows users to only check for host configuration
prerequisites. This mode will not start the large number of clients that
would normally be started because those clients could disrupt a running
Rook cluster negatively.
Host checking pods require host network access. Many Kubernetes
distributions have pod security features enabled. In order to allow
non-Vanilla distros to run this tool, allow specifying a service account
that pods will run as, which can be configured by the admin to allow
test pods.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
`make test` failed for me on MacOS with this error:
```console
$ make test
...
=== installing go-junit-report
tar: Error opening archive: Unrecognized archive format
make[2]: ***
$
```
So it seems the version v2.0.0 of go-junit-report has a broken source
tarball
Going to the latest version v2.1.0 fixes the problem for me.
Signed-off-by: Michael Adam <obnox@samba.org>
The last pr missed removing the extra comma after the platform
so, instead of ` linux/amd64,linux/arm64,` it should be
` linux/amd64,linux/arm64`.
Signed-off-by: subhamkrai <srai@redhat.com>
since we moved to ubuntu 22.04, ci push image build is failing
due wrong parameter `--platforms linux/amd64 linux/arm64,` it should
be instead `--platforms linux/amd64, linux/arm64`.
Signed-off-by: subhamkrai <srai@redhat.com>
Few day's back go 1.22 is release. Let's add that
as valid version to build on. Also, adding 1.22 as
test matric for linux build CI.
https://tip.golang.org/doc/go1.22
Signed-off-by: subhamkrai <srai@redhat.com>
subhamkrai
Blaine Gardner
dependabot[bot]
fullstackjam
Erik Sundell
Travis Nielsen
Michael Adam
Oded Viner
subham rai
Joshua Hoblitt
Allen Conlon