The yamllint make target required yamllint to be installed
in the PATH.
This change renders it self-contained
by using a container image instead.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
running make shellcheck required shellcheck to be
installed locally in the $PATH.
This change renders make shellcheck self-contained
by installing shellcheck in the local tools cache directory
likeit is already done with other tools.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
The definition of a newline withe name '\n' was invalid and broke
introduced commands-before-first-target syntax errors in the
Makefile.
This change fixes the poblem by changing the name to the valid name
NEWLINE.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
the markdownlint and markdownlint.fix make targets
required markdownlint-cli2 to be installed locally
in the $PATH.
This change renders them self-contained by running
markdownlint from the official markdownlint-cli2
docker image.
Also clean the development-flow guide for linting tools
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
make helm.lint depended on the chart-testing tool ct as well as helm and kustomize being available in
the PATH.
This makes the target self-contained by
- running ct via go run
- using the cached version of helm used elswhere in the
build system
- caching kustomize in the tools dir and using that
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
A target was recently introduced for creating the host-specific tools
cache directory.
Several helmng-related tools installation targets depended on the directory implicitly or
created it as part of their recipe.
This change makes the dependency explicit by using the new target as a
prerequisite.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
A target was recently introduced for creating the host-specific tools
cache directory.
Several golang-related tools install targets depended on the directory implicitly or
created it as part of their recipe.
This change makes the dependency explicit by using the new targett as a
prerequisite. This also simplifies some recipes by removing now unneeded
mkdir operations.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
The go-junit-reporttool used to be installed into the general tools cache dir.
For consistency, this changes it to be into the host-specific tools
cache directory like the other cached tools
Signed-off-by: Michael Adam <obnox@samba.org>
actions/checkout v6 changed how credentials are persisted. Instead of writing GITHUB_TOKEN as an extraheader in .git/config, it now stores a pointer to a credential helper file in $RUNNER_TEMP. The Makefile's `git config --unset http.https://github.com/.extraheader` no longer clears the token, so the cross-repo push to rook.github.io was failing.
I have updated the checkout action to v6.0.2, set the persist-credentials field to false and removed the unset line from releases/Makefile.
Signed-off-by: Prabhala Tara Aasrita <taraasrita@ibm.com>
Tool binaries were installed to a host-specific cache for that was eforced to the linux platform.
This change fixes the mechanism to install the tool binaries to the cache directory for the real
detected platform
Signed-off-by: Michael Adam <obnox@samba.org>
the target for installing helm to the local
host-specific tools cache and a few other targets are
using the tools cache directory and depend on it
implicitly.
This change is a preparation for making this dependency explicit
by adding a new target for creating the tools cache directory
that can be use as a target prerequisite in subsequent changes.
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
instead of using of using manifest-tool and updating
it's version, we can use docker buildx which works like
manifest-tool only and based on manifest-tool working.
Signed-off-by: subhamkrai <srai@redhat.com>
Kubernetes has begun releasing a kube-api-linter application for linting
Kubernetes APIs to match against common best-practices. (a.k.a., KAL).
Of note: KAL is still new and has no semver releases.
I believe this linter is helpful in encouraging Rook devs to think
deeply about how end-users consume the API. It ensures that new APIs
account for set/unset status, zero values, upper/lower bounds, and
possibly others in the future.
This commit adds initial support to Rook, without making the results a
requirement. Maintainers still need to evaluate rule configuration and
determine how tightly Rook wants to hold to the results.
As of this commit, I observe around 650 "issues" with the current Rook APIs.
This doesn't mean that Rook is in danger of breaking. Issues with API
types are often just indications that upper/lower bounds are missing, or
that there is ambiguity between set-empty and unset-empty values.
This commit uses `--new` in CI to ensure only new API issues are
flagged.
Also of note, KAL is a golangci-lint plugin. It is possible to locally
build KAL (from source) into golangci-lint to run both at the same time.
However, this is time-consuming, and it's harder to coordinate tool
binary caching this way when it's related to 2 different versions.
Treating KAL as a standalone binary allows for simpler make scripting
and maintenance.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
This PR addresses ArgoCD drift detection issues by adding consistent
metadata labels to RBAC resources in Rook Ceph Helm charts. The problem
occurs because many RBAC resources lack metadata labels, causing ArgoCD
to interpret them as 'labels: null' and report continuous drift.
Changes made:
- Added consistent labels to all RBAC templates in rook-ceph and library charts
- Created _recommended-labels.tpl template for standardized labeling
- Removed app.kubernetes.io/component label per consideRatio feedback to avoid scope creep
- Suppressed Helm-specific labels (version, instance, managed-by, created-by, chart) from static RBAC files
- Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml
Labels added to RBAC resources:
- operator: rook
- storage-backend: ceph
- app.kubernetes.io/name: rook-ceph
- app.kubernetes.io/part-of: rook-ceph-operator
Impact:
- Resolves ArgoCD 'OutOfSync' issues for Rook RBAC resources
- Improves resource identification and management
- Provides consistent labeling across all Rook Helm charts
- No functional changes to RBAC permissions
- Focuses on essential labels to avoid over-engineering
This addresses review feedback from travisn and consideRatio to maintain
scope and ensure static RBAC files only contain meaningful labels.
Signed-off-by: fullstackjam <fullstackjam@outlook.com>
I failed to save a file before making the commit becomign PR #16558.
This small change should also have been part of it.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The helm charts allowed rendering a PodSecurityPolicy resource via the
configuration `pspEnable`. This option is removed and all references to
psp, PodSecurityPolicy, and Pod Security Policy have been cleaned up.
The PSP resource was only rendered if k8s version was lower than 1.25
when it was still supported. It has been deprecated since k8s 1.21.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
this commit added changes to use cosign to sign the
docker images and the helm charts being published to
different the oci repos. This will enhance software supply
chain security by enabling signing and verification of
container images, ensuring their authenticity and integrity
Signed-off-by: subhamkrai <srai@redhat.com>
this commit add check to pull helm chart dependency
only when the charts are not available locally on the
system. This reduces overall make build other make
command completion time.
Signed-off-by: subhamkrai <srai@redhat.com>
This touches a lot where a typo could cause issues for someone, so I have self-
reviewed it many times line-by-line already.
There are a few types of changes:
- All resources get tied to their own YAML document separator (`---`)
before their definition, reducing the risk of not separating resources
correctly when rendering multiple into a file. I think the changes
will fix edge case bugs for people with mutiple items listed in
`cephFileSystems` and similar configuration.
- `toYaml ...` is made into `... | toYaml` consistently.
- `default A B` is made into `B | default A` consistently.
- Consistent whitespace chomping, so instead of `{{ end }}` you would
find `{{- end }}` typically. The system is that you should chomp left
almost all the time, and almost all the time _not_ chomp right. You
would chomp right in the beginning of a file or helper function in
order to clear some initial whitespace, otherwise not.
- Multiline helm template comments `{{- /* ... */ }}` get their content
indented 2 spaces.
- List items are consistently rendered with two spaces of indentation.
- `kind` is put before `apiVersion` consistently, to follow a practice
observed partially in the repo.
- Calls to the helm `template` function have been replaced with
`include` to be consistent and to stick with modern practices.
- Use of `indent` have been replaced with `nindent #` and a left
whitespace chomp for a consistent easy to follow practice that gets
good result.
- Several `if` statements like `if X -> render X` have been replaced
with `with X -> render .` to avoid repetition. The `with` statement
won't render if the provided context, making it function also like an
`if` statement.
- Fixed a bug with `if .Values.revisionHistoryLimit`, which should
really be `if not (typeIs "<nil>" .Values.revisionHistoryLimit)` to
handle situations when its set to `0`.
Signed-off-by: Erik Sundell <erik@sundellopensource.se>
The error message issued by `make` when the available golang was ont one
of the supported versions was somewhat confusion or even broken.
This change fixes the message.
Signed-off-by: Michael Adam <obnox@samba.org>
this commits enable the csi-operator by default,
moving it from experimental to stable.
Also, disable the csi-operator chart from generating
rbac in common.yaml
Signed-off-by: subhamkrai <srai@redhat.com>
This commit test csi-operator helm chart as a dependencies with rook-ceph operator helm chart.
With these changes csi-operator will be installed as a part of rook-ceph operator helm chart.
Signed-off-by: subhamkrai <srai@redhat.com>
A new helm repo index was created from scratch for every new release
which meant that the release timestamps in the index were basically all
identical.
This change intends to fix that by merging the new index with the
existing one
The first attempt to fix this (PR #16033) did not work properly.
This change is intended to fix the issue for good by closing the gap the
previuous PR has left.
Fixes: #15604
Co-Authored-By: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: Michael Adam <obnox@samba.org>
A new helm repo index was created from scratch for every new release
which meant that the release timestamps in the index were basically all
identical.
This change intends to fix that by merging the new index with the
existing one
Fixes: #15604
Signed-off-by: Michael Adam <obnox@samba.org>
Until now, docs have been published for every master and
release branch build. This can lead to confusion if a new
feature is backported to the release branch and the docs
are published to the website, even though the feature will
not be available until the next tagged release.
This does have the effect that small doc-only fixes will
not be in the latest release docs until we actually tag
a release.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
The script sel-release-ver.sh was added in a somewhat unnatural place
tests/scripts .
This moves it to a more natural location build/release .
Signed-off-by: Michael Adam <obnox@samba.org>
This script updates examples and docs for a new release.
Invocation in principle: set-release-ver.sh NEW_VER
For example: set-release-ver.sh v1.16.8
Fixes: #15749
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
Reading the release process documentation, I found the description
of steps in one place to not quite match the intended effect of the
actual command steps due to a slight imprecision in used terminology.
This change improves and clarifies the corresponding wording to hopefully
prevent others from facing the same confusion.
Signed-off-by: Michael Adam <obnox@samba.org>
The helm charts will now only be published when it is
an officially tagged release build.
The images will only be published to all repos for
dockerhub, quay, and ghcr when it is a tagged release.
The images will be published only to dockerhub for all
master and interim release branch builds.
Remove obsolete makefile option for images.
Ceph is the only image Rook ever expects to build.
Simplify the makefile by removing the legacy option
to select which image to build.
Also included are other small improvements to clean up
the release scripts.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Resolves this warning:
WARN [runner/nolint_filter] Found unknown linters in //nolint directives: just configuration keys., value not credential
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
Michael AdamandBlaine Gardner
subham rai
Prabhala Tara Aasrita
subhamkrai
Blaine Gardner
dependabot[bot]
fullstackjam
Erik Sundell
Oded Viner
Joshua Hoblitt
Allen Conlon