This PR addresses ArgoCD drift detection issues by adding consistent
metadata labels to RBAC resources in Rook Ceph Helm charts. The problem
occurs because many RBAC resources lack metadata labels, causing ArgoCD
to interpret them as 'labels: null' and report continuous drift.
Changes made:
- Added consistent labels to all RBAC templates in rook-ceph and library charts
- Created _recommended-labels.tpl template for standardized labeling
- Removed app.kubernetes.io/component label per consideRatio feedback to avoid scope creep
- Suppressed Helm-specific labels (version, instance, managed-by, created-by, chart) from static RBAC files
- Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml
Labels added to RBAC resources:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/name: rook-ceph
- app.kubernetes.io/part-of: rook-ceph-operator
Impact:
- Resolves ArgoCD 'OutOfSync' issues for Rook RBAC resources
- Improves resource identification and management
- Provides consistent labeling across all Rook Helm charts
- No functional changes to RBAC permissions
- Focuses on essential labels to avoid over-engineering
This addresses review feedback from travisn and consideRatio to maintain
scope and ensure static RBAC files only contain meaningful labels.
Signed-off-by: fullstackjam <fullstackjam@outlook.com>
I failed to save a file before making the commit becomign PR #16558.
This small change should also have been part of it.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The helm charts allowed rendering a PodSecurityPolicy resource via the
configuration `pspEnable`. This option is removed and all references to
psp, PodSecurityPolicy, and Pod Security Policy have been cleaned up.
The PSP resource was only rendered if k8s version was lower than 1.25
when it was still supported. It has been deprecated since k8s 1.21.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
this commits enable the csi-operator by default,
moving it from experimental to stable.
Also, disable the csi-operator chart from generating
rbac in common.yaml
Signed-off-by: subhamkrai <srai@redhat.com>
The rbac generation prints a lot of info that is not necessary
unless troubleshooting the rbac build, so we can comment it
out by default.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Due to an oversight, PSP resources were left in generation of
common.yaml from #10797. Resolve that by setting
pspEnable=false when generating common.yaml.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
build/rbac/rbac.yaml should have been removed when we started generating
common.yaml, but it was missed.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Because the NFS CSI driver is optional and rarely deployed, make RBAC
for this driver an optional example that is generated by the helm chart.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
finally, admission controller will be enabled default
without any script/manual step. But it still requires cert-manager
to be installed which I believe is already installed in clusters.
**Note**
Code doesn't return error it just logs the error since
we don't want to stop reconciling if the admission controller fails.
We can work on this once the admission controller is stable.
Signed-off-by: subhamkrai <srai@redhat.com>
This commit restrict csiaddons to open only 1 port
as per the requirement which is required for security.
Fixes: #9604
Signed-off-by: yati1998 <ypadia@redhat.com>
Simply applying `LC_ALL=C` will work for the current shell only. For all
the shells and sub-shell to use it, we must set it globally.
Making it the first thing in the Make entrypoint now so the CRD and RBAC
sorting works on all the platforms.
Signed-off-by: Sébastien Han <seb@redhat.com>
Linux doesn't guarantee file ordering, so when dealing with files in
order, we can use 'sort' to make sure the order is deterministic. For
yq's usage of files, we need to keep file names in an intermediate
variable, and this should be an array to support file paths with spaces.
'readarray' is not available on MacOS's built-in bash, so a longer
'while read' loop is needed for the array creation.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This commit adds CAP_MKNOD to PodSecurityPolicy to allow OSD-prepare job
creating pods under PSP-enabled Kubernetes cluster.
Signed-off-by: Yuichiro Ueno <ueno@preferred.jp>
Generate deploy/examples/common.yaml from Helm charts. There were still
a few differences between common.yaml and the Helm charts. Where there
were differences we assume common.yaml was the most up-to-date.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Adding Recommended Labels on the resources created by rook
and using Recommended Labels in the helm chart,
for better visuals and management of k8s object
Closes: https://github.com/rook/rook/issues/8400
Signed-off-by: parth-gr <paarora@redhat.com>
In anticipation of generating common.yaml from the Helm charts, sort
common.yaml using the same script used to sort the output from Helm
charts.
This was done using the flow here:
```
cat build/rbac/common.yaml.header > new-common.yaml
cat deploy/examples/common.yaml | build/rbac/keep-rbac-yaml.sh >> new-common.yaml
mv new-common.yaml deploy/examples/common.yaml
```
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
In order to generate common.yaml from Helm charts, we have to have a
different way of generating CSV than from meta-comments in common.yaml.
This implementation changes what appears in the CSV's RBAC somewhat, but
these changes could be considered bugs fixed by using the new Helm
generation method.
- a few PSP related resources are removed from CSV
- resources related to 'rook-ceph-purge-osd' Job are added to CSV
- ClusterRoleBinding 'rook-ceph-object-bucket' is added to CSV
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Use yq instead of Python for parsing RBAC from the Helm chart. We need
to use yq v4.14.1 or higher to fix yq's handling of the yaml header
markers ('---'). Update the Makefile's yq version to v4, which also
requires updating the script to update the CRDs. This was quite easy.
It is very difficult, however, to change the version of yq used by the
CSV generating/parsing scripts, which already used their own yq
download. Continue using yq v3 for this.
In order to make sure the scripts are using the right version of yq, add
basic validation to them to verify they are running v3 or v4 as required
for their operation.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
replaces all occurences of lduo/rduo quotation marks to make
sure that using the snippets in a k8s manifest will work
This fixes an issue with ArgoCD not being able
to apply `common.yaml` because of an encoding issue
Signed-off-by: PixelJonas <jonas@janz.digital>
Create a Helm library chart to share content between the Operator Helm
chart (rook-ceph) and the CephCluster (etc.) Helm chart
(rook-ceph-cluster).
This will ensure that when resources related to the CephCluster change,
notably RBAC resources, they will change for both charts.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Assume common.yaml is the right source of truth, and remove major
content from helm charts that does not exist in common.yaml.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
This is a starting step to be able to generate common.yaml from Helm
charts. For right now, we merely want to be able to determine when the
rendered output of the Helm chart changes.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
fullstackjam
Erik Sundell
subhamkrai
Allen Conlon
Travis Nielsen
Deepika Upadhyay
Blaine Gardner
Rakshith R
Shinya Hayashi
yati1998
Sébastien Han
Yuichiro Ueno
parth-grandBlaine Gardner blaine.gardner@redhat.com
PixelJonas