this commits updates the go version to 1.22.2 in govulncheck ci and
also updates golang.org/x/net to v0.23.0 to fix the ci
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit f063e8fe39)
Signed-off-by: subhamkrai <srai@redhat.com>
The patch version was pinned which caused problems
with security patches. Unpin it and always check
for new patch version
Signed-off-by: NymanRobin <nyman.robin@gmail.com>
(cherry picked from commit fdacd1e587)
Currently, when rook provisions OSDs(in the OSD prepare job), rook effectively run a
c-v command such as the following.
```console
ceph-volume lvm batch --prepare <deviceA> <deviceB> <deviceC> --db-devices <metadataDevice>
```
but c-v lvm batch only supports disk and lvm, instead of disk partitions.
We can resort to `ceph-volume lvm prepare` to implement it.
Signed-off-by: Liang Zheng <zhengliang0901@gmail.com>
(cherry picked from commit ee05e82cea)
This PR fixes the failure while running multicluster mirroring CI tests
Signed-off-by: sp98 <sapillai@redhat.com>
(cherry picked from commit 45adae1931)
The 'extra' block device attached to GH actions runners has changed size
twice in 3 months. The previous strategy of detecting the disk by size
is becoming harder to maintain. Additionally, the block size with recent
changes (75G) is now the same as the boot device (also 75G), making the
method inexact.
The method can now be summarized as, "find the boot disk and choose the
disk that isn't the boot disk to be the 'extra' one used."
Prior to this, we used a one-liner based on `lsblk`. While we could
still make this a one-liner, the method is now updated to 2 effective
lines, plus debug text output to stderr to help if we need to debug
further in the future.
Of note, the 'extra' disk has a mount point of "/mnt", but it is unclear
whether this is a reliable heuristic for detecting the extra disk. For
years now, GH action runners have had only 2 disks. Therefore, it seems
slightly more likely that a heuristic to "choose the non-boot disk" will
be a more robust long-term solution.
If this strategy proves to be unreliable in the future, it may be wise
to consider whether "the device with a partition mounted to '/mnt'"
would be a good alternative.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit feacb6424e)
the disk size in the github action machine has
increased from 64G to 75G. Now, we detech the version
automatically not fetching hard coded value.
Co-authored-by: Jan Klippel <jan.klippel@uhurutec.com>
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 6b0deb32d9)
This is needed because not all contributors may be using gomft to format
source code, and this could result in inconsistent usage over time.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit c98ce0a56b)
we have changed the --cluster-name flag to --k8s-cluster-name
but to support automation while upgrade we should support
the legacy flag
Signed-off-by: parth-gr <partharora1010@gmail.com>
(cherry picked from commit 8e4ec01cbb)
Currently, `wait_for_prepare_pod` only waits until 1 prepare pod and 1
OSD pod are in Running state.
So if `wait_for_ceph_to_be_ready` failed after `wait_for_prepare_pod`
succeeded, there are 4 possible cases:
1. some prepare pods didn't start correctly;
2. some prepare pods didn't finish correctly;
3. some OSD pods didn't start correctly; or
4. all prepare pods and OSD pods worked correctly, but some other
process failed.
As far as I understand, the number of prepare pods on the GitHub CI is
always 1, so cases 1 and 2 are not problematic. However, it is hard to
distinguish the other two cases from the CI log.
To solve the above problems, this patch makes wait_for_prepare_pod wait
for all OSD pods to become running state. If wait_for_prepare_pod
timeouts before the OSD pods become running state, this will be a strong
indication that the OSD pods didn't start properly (i.e., case 3).
Signed-off-by: Ryotaro Banno <ryotaro.banno@gmail.com>
(cherry picked from commit e9c1f81d79)
I was debugging helm tests, I noticed, the operator namespace
content is empty and operator is created in same namespace as
other pods. Also, let's collect the 'kube-system' namespace logs
in multus test only as that is the only test where we need to debug
cluster networking and require kube-system logs.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit 2d3e561a00)
use `sed` to update all the namespace in filesystem-test.yaml file.
Since with subvolumegroup CR added there are more than one `namespace: *`
present and only one was updating by yq command.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit c05578a019)
Loop variables cannot be reliably uses since they will
change with each iteration. Update these loop variable
uses to be safe by indexing the slice rather than
using the loop variable directly.
Also suppress the linter issues for passwords used
in tests.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit 6f8e42422d)
The K8s v1.25.17 release does not exist, which was mistakenly
set in the CI for the master and release tests. Now we revert
it back to v1.25.16.
Signed-off-by: travisn <tnielsen@redhat.com>
(cherry picked from commit 5fc7237339)
change the json output of storageclass to also inclusde rados namespace,
and also added the changes in the csi secret
Signed-off-by: parth-gr <paarora@redhat.com>
Upgrade minimum kubernetes support to 1.23.17 from 1.22.17.
Also, upgrade kubernetes version latest minor release.
Signed-off-by: subhamkrai <srai@redhat.com>
In, go 1.20 govulncheck ci is failing due to
some vulnerabilities which affects windows
machine and rook is not used in windows machine.
The solution is to update go version to 1.21.4
Signed-off-by: subhamkrai <srai@redhat.com>
github ci runner is allocating both 14 and 64 Gb disks to the setup.
Rook CI currently hard codes the lsblk with a 14G filter.
This PR updates the filter to use either 14G or 64G disks.
Signed-off-by: sp98 <sapillai@redhat.com>
Automatic PR from app.stepsecurity.io (initiated by BlaineEXE) to limit
permissions in github actions to only those needed.
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
govulncheck is a static code analyzer that scans more deeply than Snyk.
Additionally, because govulncheck checks the code itself, it can rule
out vulnerabilities that are present in dependencies but that are not
used in Rook's code path.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
Add the ability to specify node profiles in the multus validation test.
This addresses a few points of early feedback on the validation tool.
Statements below critique the tool's behavior before this patch.
1. The tool assumes all daemons are on public and cluster network, which
means users who have a significantly smaller cluster net (a
design choice) cannot run a single test to determine if Rook is
likely to install correctly.
2. The tool does not have placement options to select only a subset of
Kubernetes nodes to run validation on.
3. Users of multus seem to have a dedicated pool of storage nodes more
often than the average Rook install. This makes sense for security-
and perforance-minded users. The tool cannot run a single test to
verify storage-only and general-workload nodes at one time.
These points are addressed by allowing users to specify configurations
for different "NodeTypes."
Each NodeType config has options for selecting the number of OSDs as
well as the number of other (non-OSD) Ceph daemons. This limits the
unnecessary exhaustion of cluster network addresses from critique 1.
Each NodeType config has its own placement (critique 2).
Users can define as many NodeTypes as needed to test the network for
their planned CephCluster. Specifically, this allows the tool to test
storage-only nodes and generalized-workload nodes at the same time. An
arbitrary number of NodeTypes are allowed to support even more highly
specialized cluster setups, such as multiple tiers of storage nodes
where some storage-only nodes may run more OSDs than others.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
The GH action to set up Golang (actions/setup-go) has cache
functionality. For cache hits, this saves ~2 minutes for each run. In
order for the cache to hit, caching must not be disabled, and the code
must be checked out before setting up Golang.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
The issues are fixed from the clean disk action
repo and we shouldn't require any workaround. Also,
I'm not using git revert to revert the commit is earlier
clean disk action was mentioned in every CI which was
duplicate and now we have placed the action to composite yaml
Signed-off-by: subhamkrai <srai@redhat.com>
Since `google-cloud-sdk` is renamed with `google-cloud-cli`,
the github action is failing to remove the older name and this
is causing ci issues. Applying changes suggested by community to
manually remove some packages to resolve the issue.
Signed-off-by: subhamkrai <srai@redhat.com>
Fixes: #12930
This patch introduces a .snyk policy file that lets snyk suppress the warnings
about the MPL license in projects pulled in as dependencies.
Additinally, this fixes a typo in the name of the snyk workflow
file
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
Update the multus canary test to reflect modern knowledge about how it
should be configured.
No longer test for the network device in OSD pods. Pods will utterly
fail to start if Multus is unable to attach interfaces.
Instead, look to the OSD map to test the connections more wholistically.
OSDs must have map IPs that include both public and cluster network.
This implicitly tests that the interfaces exist in the Pod, and it
additionally verifies other details, like Ceph `*_network` configs are
set propertly.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This is the latest available version.
The previously used version v2.0.0 was very outdated.
Fixes: #12883
Co-authored-by: subham rai subhamkrai <srai@redhat.com>
Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Subham Rai subhamkrai <srai@redhat.com>
signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
subhamkrai
NymanRobin
Liang Zheng
sp98
Blaine Gardner
parth-gr
Ryotaro Banno
Travis Nielsen
dependabot[bot]
Anthony D'Atri
parth-gr
StepSecurity Bot
Redouane Kachach
