The openSSF scorecard report warns that the github actions are not pinned by hash.
This PR aims at improving this by pinning the github actions by hash.
Signed-off-by: harshitasao <harshitasao@gmail.com>
With the release of K8s v1.31.0, we update the minimum
supported version to v1.26, and add v1.31 to the CI
so we can test the most recent six versions of K8s.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Update Rook and Ceph upgrade docs for upcoming v1.15 release.
Tidy up pending release notes in the working text as well as official
doc texts.
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
PR https://github.com/rook/rook/pull/14473
tried to improve the token-permissions score of the OpenSSF scorecard
report.
https://scorecard.dev/viewer/?uri=github.com/rook/rook
The latest scorecard run however shows that this score has not improved.
It still shows two warbnings about missing top level permissions.
The rest looks good (just Info entries).
This change aims at finally improving the token-permissions score
by adding top level permissions to the two warned-about workflow files.
Signed-off-by: Michael Adam <obnox@samba.org>
For the specification see:
<https://github.com/rook/rook/blob/master/design/ceph/object/swift-and-keystone-integration.md>
* extend the API object specs for swift and keystone integration
* adapt rgw to the new go-ceph version
- The parameter lists of the API call have changes, as parameters
ignored by the RGW Admin Ops API are no longer serialized, therefore
the mock has to be adapted.
- There is now validation for the user keys that are passed to the
User get API, therefore things failed when we had empty keys in our
User proxy object.
* expand the reconcile loop for the swift and keystone integration
* fix minor mistakes in design document
* add env var to pass extra args to minikube
Minikube decides CPU cores and memory automatically based on the
available resources on the machine which may be insufficient to
run rook. This commit adds an environment variable to add arbitrary
arguments to the minikube command, so both can be specified if
desired.
* integration tests for swift and keystone
The new integration of swift or s3 and keystone support by rook
does not have any integration tests yet.
This commit introduces integration tests for swift and keystone. The
tests are done against a minimal keystone setup (keystone container
image from Yaook-project (https://yaook.cloud), sqlite as database
backend, cert-manager and trust-manager for test certificate setup).
To prevent hardcoded credentials, passwords are generated
by the tests. The integration tests use the openstack client
(keystone- and swift-functionality) (https://docs.openstack.org/
python-openstackclient/ latest/). This was a concious design decision
to use client tooling as close as possible to the end user instead of
using other go-libraries (such as gophercloud).
* add documentation on swift and keystone
Currently there is no documentation on the use of Swift to access
an object store as well as the use of OpenStack keystone for
authentication.
This commit adds documentation on the use of Swift and OpenStack
keystone, as well as CRD-related documentation and an example setup.
* add integration tests for S3 via keystone
This commit introduces integration tests for s3 and keystone. The
tests are run against the same minimal keystone setup that the tests
for swift and keystone use.
The integration tests use the aws s3 client to use client tooling as
close as possible to the end user instead of using other go-libraries.
Co-authored-by: Jan Klippel <jan.klippel@uhurutec.com>
Co-authored-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
Signed-off-by: Sebastian Riese <sebastian.riese@cloudandheat.com>
Signed-off-by: Jan Klippel <jan.klippel@uhurutec.com>
Signed-off-by: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
adding annotation to existing CSI driver resource so that
csi-operator can take ownership of existing CSI driver resources.
Signed-off-by: subhamkrai <srai@redhat.com>
adding the CSI-operator manifest files
inside rook repo naming deploy/examples/csi-operator-manifests.yaml.
Also, let's skip running any lint check on file `deploy/examples/csi-operator.yaml` as this is owned by CSI-operator.
Signed-off-by: subhamkrai <srai@redhat.com>
adding code changes,rbac changes required for create the new
Ceph-CSI operator CR named cephCluster in api group 'csi.ceph.io'.
Signed-off-by: subhamkrai <srai@redhat.com>
RGW can only serve a single certificate. This limitation means that the
prior behavior of using the default service for admin ops when TLS is
enabled may mean it requires additional complex certificate management
to make sure the object store uses a certificate valid for Rook internal
admin ops and user connections.
This is needlessly complex for users. Instead, change Rook's behavior
and documentation to clarify that it will use the same endpoint intended
for S3 client applications. This means that users have a more
straightforward path to enabling both Rook and consuming applications.
More info: https://github.com/rook/rook/issues/14530
Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
With the creation of the 1.15 branch, add the branch
to the mergify rules. Also remove the 1.10 backport
rules since no longer needed.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
Fixes: #14518
The previous attempt to fix the auto-assign action
has introduced an indentation error in the workflow yaml file.
This should finally fix it, hopefully.
Signed-off-by: Michael Adam <obnox@samba.org>
Fixes: #14518
A recent change seems to have broken the permissions of the auto-assign
action.
This tries to fix this by making permissions more specific.
Signed-off-by: Michael Adam <obnox@samba.org>
issue:
external-provisioner (v5) enabled topology feature-gate by default
and the current implementation in Rook uses a conditional block to
enable the topology feature gate. This approach now does not directly
reflect the state of the `CSI_ENABLE_TOPOLOGY`.
fix:
replacing the conditional block with a direct use of the
`CSI_ENABLE_TOPOLOGY` for flag value.
Signed-off-by: Praveen M <m.praveen@ibm.com>
Create new topic in the troubleshooting guide to explain how to fix a new rook-ceph deployment that could remain in an unhealthy state or fails to config because of the LimitNOFILE value specified in the containerd.service configuration.
Signed-off-by: Nicola Fantacuzzi <nfantacuzzi@gmail.com>
The daily upgrade tests were checking for a specific
version of the rook image instead of the local_build tag
that is set as the rook base image since 14486.
Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
harshitasao
Travis Nielsen
Blaine Gardner
Michael Adam
Zuhair AlSader
subham rai
subhamkrai
Rakshith R
dependabot[bot]
Artem Torubarov
Praveen M
sp98
nicofnt