The docker.io/rook/ceph image contains vulnerabilities in the s5cmd binary.
A new version of s5cmd was released on 16th December which resolves these issues.
Signed-off-by: TomHellier <me@tomhellier.com>
(cherry picked from commit a87843de62)
Add test to canary-integration-test scenarios which removes
osd auth and then recovers it on osd activation from keyring
file.
Resolves: #14825
Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>
(cherry picked from commit 12613bc2fa)
`encryption-pvc-kms-ibm-kp` workflow replaces the name of ceph-image.
Since the dest value is always empty by mistake, this workflow
always fails.
Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
(cherry picked from commit 36721edae8)
PR #14883 fixed the codegen workflow but introduced a comment
that is simply wrong.
This change rectifies this mistake by removing the comment.
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 714f80a80a)
The codegen workflow recently sometimes failed to detect files modified
by codegen. This has been analysed in a test PR:
https://github.com/rook/rook/pull/14723
The result of the analysis is the insight that the codegen tooling did not work
as expcted because the git checkout was not located in the src/github.com
directory under the GOPATH.
This change fixes the codegen workflow by post-processing the git checkout
action by copying the git checkout directory to the expected location.
Co-authored-by: Travis Nielsen <tnielsen@redhat.com>
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit f32d3df995)
Fix ceph image tag string passed to replica_ceph_image. Previously, the
result was "" was being passed in most cases.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 84694397bc)
Merge/inline.github/workflows/rgw-multisite-test/action.yml into
.github/workflows/canary-integration-test.yml as the step from the
"composite" action are not displayed in the console. The absence of the
step names may make it difficult to determine where a failure is
occurring.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit b4ac943b62)
Factor out most of the CRs used by various canary tests to a new
deploy_cluster_full_of_cruft_please_stop_using_this() function.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 31d55b90fe)
this commit upgrade the minikube, k8s, crictl versions
in CI and also fix permission error in the github runner.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit f647444515)
adding the CSI-operator manifest files
inside rook repo naming deploy/examples/csi-operator-manifests.yaml.
Also, let's skip running any lint check on file `deploy/examples/csi-operator.yaml` as this is owned by CSI-operator.
Signed-off-by: subhamkrai <srai@redhat.com>
(cherry picked from commit c30b8a527b)
Ceph image no longer has `ip` tool installed. Use a different container
image for the daemonset which sets host IPs and routes for multus hosts.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
(cherry picked from commit 5773132d7f)
With the release of K8s v1.31.0, we update the minimum
supported version to v1.26, and add v1.31 to the CI
so we can test the most recent six versions of K8s.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit e157bb5a56)
PR https://github.com/rook/rook/pull/14473
tried to improve the token-permissions score of the OpenSSF scorecard
report.
https://scorecard.dev/viewer/?uri=github.com/rook/rook
The latest scorecard run however shows that this score has not improved.
It still shows two warbnings about missing top level permissions.
The rest looks good (just Info entries).
This change aims at finally improving the token-permissions score
by adding top level permissions to the two warned-about workflow files.
Signed-off-by: Michael Adam <obnox@samba.org>
(cherry picked from commit 2d292976a6)
For the specification see:
<https://github.com/rook/rook/blob/master/design/ceph/object/swift-and-keystone-integration.md>
* extend the API object specs for swift and keystone integration
* adapt rgw to the new go-ceph version
- The parameter lists of the API call have changes, as parameters
ignored by the RGW Admin Ops API are no longer serialized, therefore
the mock has to be adapted.
- There is now validation for the user keys that are passed to the
User get API, therefore things failed when we had empty keys in our
User proxy object.
* expand the reconcile loop for the swift and keystone integration
* fix minor mistakes in design document
* add env var to pass extra args to minikube
Minikube decides CPU cores and memory automatically based on the
available resources on the machine which may be insufficient to
run rook. This commit adds an environment variable to add arbitrary
arguments to the minikube command, so both can be specified if
desired.
* integration tests for swift and keystone
The new integration of swift or s3 and keystone support by rook
does not have any integration tests yet.
This commit introduces integration tests for swift and keystone. The
tests are done against a minimal keystone setup (keystone container
image from Yaook-project (https://yaook.cloud), sqlite as database
backend, cert-manager and trust-manager for test certificate setup).
To prevent hardcoded credentials, passwords are generated
by the tests. The integration tests use the openstack client
(keystone- and swift-functionality) (https://docs.openstack.org/
python-openstackclient/ latest/). This was a concious design decision
to use client tooling as close as possible to the end user instead of
using other go-libraries (such as gophercloud).
* add documentation on swift and keystone
Currently there is no documentation on the use of Swift to access
an object store as well as the use of OpenStack keystone for
authentication.
This commit adds documentation on the use of Swift and OpenStack
keystone, as well as CRD-related documentation and an example setup.
* add integration tests for S3 via keystone
This commit introduces integration tests for s3 and keystone. The
tests are run against the same minimal keystone setup that the tests
for swift and keystone use.
The integration tests use the aws s3 client to use client tooling as
close as possible to the end user instead of using other go-libraries.
Co-authored-by: Jan Klippel <jan.klippel@uhurutec.com>
Co-authored-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Signed-off-by: Jan Klippel <jan.klippel@uhurutec.com>
Signed-off-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
(cherry picked from commit ee8bcad49d)
Fixes: #14518
A recent change seems to have broken the permissions of the auto-assign
action.
This tries to fix this by making permissions more specific.
Signed-off-by: Michael Adam <obnox@samba.org>
Fixes: #14466
The OpenSSF scorecard report
https://scorecard.dev/viewer/?uri=github.com/rook/rook
warns about excessive token-permissions in the rook project's github CI
workflows.
This bulk change aims at improving this by
1. adding top-level read permissions where missing for integration tests.
2. adding write permissions as needed for the auto-assign workflow.
3. removing the warned-about and unused create-tag workflow
Signed-off-by: Michael Adam <obnox@samba.org>
Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
With the release of the first squid RC, we add squid
to the supported versions and add tests to run
Rook against the squid release.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
In order to help users check that they have implemented the newly-added
Multus host configuration prerequisites, add a check to the validation
tool to verify connectivity.
Because users who are already running clusters with Multus enabled, add
a flag that allows users to only check for host configuration
prerequisites. This mode will not start the large number of clients that
would normally be started because those clients could disrupt a running
Rook cluster negatively.
Host checking pods require host network access. Many Kubernetes
distributions have pod security features enabled. In order to allow
non-Vanilla distros to run this tool, allow specifying a service account
that pods will run as, which can be configured by the admin to allow
test pods.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
govulcheck requires go 1.22.5 and even if `check-latest` is `true`
with go `1.22` it is failing so setting specific version go `1.22.5`
Signed-off-by: subhamkrai <srai@redhat.com>
Now user can pass the cli flags using config file and
also command line argument,
if mentioned at both the place priority is given to
command line argument
Signed-off-by: parth-gr <partharora1010@gmail.com>
The CI step that runs markdown lint accidentally got removed as part of
PR updates. Add the CI step back in.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
this commits updates the go version to 1.22.2 in govulncheck ci and
also updates golang.org/x/net to v0.23.0 to fix the ci
Signed-off-by: subhamkrai <srai@redhat.com>
The test names must match exactly for the mergify
auto merge to complete successfully. Update two of
the test names to match the latest CI.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Few day's back go 1.22 is release. Let's add that
as valid version to build on. Also, adding 1.22 as
test matric for linux build CI.
https://tip.golang.org/doc/go1.22
Signed-off-by: subhamkrai <srai@redhat.com>
TomHellier
Peter Razumovsky
Satoru Takeuchi
Praveen M
Michael Adam
Joshua Hoblitt
subhamkrai
Alexander Trost
Blaine Gardner
Travis Nielsen
Sebastian Riese
parth-gr
NymanRobin
dependabot[bot]
subham rai
Liang Zheng
Santosh Pillai