This PR addresses ArgoCD drift detection issues by adding consistent
metadata labels to RBAC resources in Rook Ceph Helm charts. The problem
occurs because many RBAC resources lack metadata labels, causing ArgoCD
to interpret them as 'labels: null' and report continuous drift.
Changes made:
- Added consistent labels to all RBAC templates in rook-ceph and library charts
- Created _recommended-labels.tpl template for standardized labeling
- Removed app.kubernetes.io/component label per consideRatio feedback to avoid scope creep
- Suppressed Helm-specific labels (version, instance, managed-by, created-by, chart) from static RBAC files
- Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml
Labels added to RBAC resources:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/name: rook-ceph
- app.kubernetes.io/part-of: rook-ceph-operator
Impact:
- Resolves ArgoCD 'OutOfSync' issues for Rook RBAC resources
- Improves resource identification and management
- Provides consistent labeling across all Rook Helm charts
- No functional changes to RBAC permissions
- Focuses on essential labels to avoid over-engineering
This addresses review feedback from travisn and consideRatio to maintain
scope and ensure static RBAC files only contain meaningful labels.
Signed-off-by: fullstackjam <fullstackjam@outlook.com>
(cherry picked from commit f635d96ae9)
This touches a lot where a typo could cause issues for someone, so I have self-
reviewed it many times line-by-line already.
There are a few types of changes:
- All resources get tied to their own YAML document separator (`---`)
before their definition, reducing the risk of not separating resources
correctly when rendering multiple into a file. I think the changes
will fix edge case bugs for people with mutiple items listed in
`cephFileSystems` and similar configuration.
- `toYaml ...` is made into `... | toYaml` consistently.
- `default A B` is made into `B | default A` consistently.
- Consistent whitespace chomping, so instead of `{{ end }}` you would
find `{{- end }}` typically. The system is that you should chomp left
almost all the time, and almost all the time _not_ chomp right. You
would chomp right in the beginning of a file or helper function in
order to clear some initial whitespace, otherwise not.
- Multiline helm template comments `{{- /* ... */ }}` get their content
indented 2 spaces.
- List items are consistently rendered with two spaces of indentation.
- `kind` is put before `apiVersion` consistently, to follow a practice
observed partially in the repo.
- Calls to the helm `template` function have been replaced with
`include` to be consistent and to stick with modern practices.
- Use of `indent` have been replaced with `nindent #` and a left
whitespace chomp for a consistent easy to follow practice that gets
good result.
- Several `if` statements like `if X -> render X` have been replaced
with `with X -> render .` to avoid repetition. The `with` statement
won't render if the provided context, making it function also like an
`if` statement.
- Fixed a bug with `if .Values.revisionHistoryLimit`, which should
really be `if not (typeIs "<nil>" .Values.revisionHistoryLimit)` to
handle situations when its set to `0`.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
(cherry picked from commit 039f158950)
With this change, rook supports the two most recent versions of golang,
v1.24 and v1.25.
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit ae3938d57d)
this commits enable the csi-operator by default,
moving it from experimental to stable.
Also, disable the csi-operator chart from generating
rbac in common.yaml
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 506ac2a3ff)
This commit test csi-operator helm chart as a dependencies with rook-ceph operator helm chart.
With these changes csi-operator will be installed as a part of rook-ceph operator helm chart.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit ee6f2e654a)
A new helm repo index was created from scratch for every new release
which meant that the release timestamps in the index were basically all
identical.
This change intends to fix that by merging the new index with the
existing one
The first attempt to fix this (PR #16033) did not work properly.
This change is intended to fix the issue for good by closing the gap the
previuous PR has left.
Fixes: #15604
Co-Authored-By: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: Michael Adam <obnox@samba.org>
A new helm repo index was created from scratch for every new release
which meant that the release timestamps in the index were basically all
identical.
This change intends to fix that by merging the new index with the
existing one
Fixes: #15604
Signed-off-by: Michael Adam <obnox@samba.org>
Until now, docs have been published for every master and
release branch build. This can lead to confusion if a new
feature is backported to the release branch and the docs
are published to the website, even though the feature will
not be available until the next tagged release.
This does have the effect that small doc-only fixes will
not be in the latest release docs until we actually tag
a release.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The script sel-release-ver.sh was added in a somewhat unnatural place
tests/scripts .
This moves it to a more natural location build/release .
Signed-off-by: Michael Adam <obnox@samba.org>
This script updates examples and docs for a new release.
Invocation in principle: set-release-ver.sh NEW_VER
For example: set-release-ver.sh v1.16.8
Fixes: #15749
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
Reading the release process documentation, I found the description
of steps in one place to not quite match the intended effect of the
actual command steps due to a slight imprecision in used terminology.
This change improves and clarifies the corresponding wording to hopefully
prevent others from facing the same confusion.
Signed-off-by: Michael Adam <obnox@samba.org>
The helm charts will now only be published when it is
an officially tagged release build.
The images will only be published to all repos for
dockerhub, quay, and ghcr when it is a tagged release.
The images will be published only to dockerhub for all
master and interim release branch builds.
Remove obsolete makefile option for images.
Ceph is the only image Rook ever expects to build.
Simplify the makefile by removing the legacy option
to select which image to build.
Also included are other small improvements to clean up
the release scripts.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Resolves this warning:
WARN [runner/nolint_filter] Found unknown linters in //nolint directives: just configuration keys., value not credential
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
currently rook images are only available in docker,
let's start pushing rook images to quay.io and ghcr.io as well.
Signed-off-by: subhamkrai <srai@redhat.com>
The lint make target is not used anywhere in the codebase and is particular not run in the CI.
It was recently discovered that `make lint` does not even work at all.
It was subsequently suggested to remove the broken and unused target altogether.
This change settles that issue by removing the lint target and the preparatory
golint installation target.
Fixes: #15317
Signed-off-by: Michael Adam <obnox@samba.org>
make test was failing when running on arm macbooks. Fix it so that it
isn't running with hardcoded GOOS=linux.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
In order to help users check that they have implemented the newly-added
Multus host configuration prerequisites, add a check to the validation
tool to verify connectivity.
Because users who are already running clusters with Multus enabled, add
a flag that allows users to only check for host configuration
prerequisites. This mode will not start the large number of clients that
would normally be started because those clients could disrupt a running
Rook cluster negatively.
Host checking pods require host network access. Many Kubernetes
distributions have pod security features enabled. In order to allow
non-Vanilla distros to run this tool, allow specifying a service account
that pods will run as, which can be configured by the admin to allow
test pods.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
`make test` failed for me on MacOS with this error:
```console
$ make test
...
=== installing go-junit-report
tar: Error opening archive: Unrecognized archive format
make[2]: ***
$
```
So it seems the version v2.0.0 of go-junit-report has a broken source
tarball
Going to the latest version v2.1.0 fixes the problem for me.
Signed-off-by: Michael Adam <obnox@samba.org>
The last pr missed removing the extra comma after the platform
so, instead of ` linux/amd64,linux/arm64,` it should be
` linux/amd64,linux/arm64`.
Signed-off-by: subhamkrai <srai@redhat.com>
since we moved to ubuntu 22.04, ci push image build is failing
due wrong parameter `--platforms linux/amd64 linux/arm64,` it should
be instead `--platforms linux/amd64, linux/arm64`.
Signed-off-by: subhamkrai <srai@redhat.com>
Few day's back go 1.22 is release. Let's add that
as valid version to build on. Also, adding 1.22 as
test matric for linux build CI.
https://tip.golang.org/doc/go1.22
Signed-off-by: subhamkrai <srai@redhat.com>
Reduce CRD size by removing some descriptions for things that
(a) are long, (b) are repeated, and (c) are commong kubernetes types.
Remove the `Status` field from VolumeClaimTemplates (a.k.a. PVCs) in
types.go to remove all unnecessary status-related fields.
Use `yq` to go through generated `crds.yaml` to strip out descriptions
for well-known k8s types that are long and repeated where we can't
remove them from types.go. This is mostly placement descriptions and
volumeSource descriptions.
The overall `crds.yaml` file is reduced to less than 60% of its original
size.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Signed-off-by: Redouane Kachach <rkachach@redhat.com>
Co-authored-by: Blaine Gardner <blaine.gardner@ibm.com>
Long CRD descriptions were pushing the size of the CRDs manifest
over 1MB, which causes issues when creating the CRDs. To shorten
the manifest, the descriptions are now limited to 100 chars.
This still gives some ability for dev tools to show a brief
description if needed. The generated CRD docs still contain
the full descriptions for reference.
Signed-off-by: travisn <tnielsen@redhat.com>
Update the release doc to include the latest process used to create the
new 1.13 release branch.
Make a few minor changes to the patch update process to keep formatting
the same between new-release-branch and new-patch processes.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
To keep the go dependencies minimal, add the go packages
just for the pkg/apis directory. Projects that only reference
the rook apis can then have a smaller footprint for Go
dependencies.
Signed-off-by: travisn <tnielsen@redhat.com>
mac build ci is failing during csv gen
when trying to move files to some folder.
Skipping csv gen for mac since it is not required.
Signed-off-by: subhamkrai <srai@redhat.com>
migrate to using mkdocs-material's material.extensions.emoji.twemoji
and material.extensions.emoji.to_svg in place of the respective
materialx.emoji.twemoji and materialx.emoji.to_svg. Also, this requires
latest version of mkdocs-material.
Signed-off-by: subhamkrai <srai@redhat.com>
fullstackjam
Erik Sundell
Michael Adam
subhamkrai
Oded Viner
subham rai
Joshua Hoblitt
Allen Conlon
Blaine Gardner
parth-gr
Redouane KachachandBlaine Gardner
Scott Miller
Alexander Trost