Due to a bug in LH which was fixed in devel, but not yet backported, we
have to preload the LH images to get latest versions (and operator due
to a similar reason).
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
When releasing, since the job pushes to the git repository, it needs
to have write permission on "contents".
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The release frequency of some GHAs means we end up with daily
dependabot PRs, which results in lots of not-particularly-useful
review work. Reducing the update cadence to weekly shouldn't expose us
to much risk and will reduce PR churn.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Set the GitHub Actions token permission to null in most workflows.
This results in:
GITHUB_TOKEN Permissions
Metadata: read
The default permissions, used without the null override, are either
GITHUB_TOKEN Permissions
Actions: write
Checks: write
Contents: write
Deployments: write
Discussions: write
Issues: write
Metadata: read
Packages: write
Pages: write
PullRequests: write
RepositoryProjects: write
SecurityEvents: write
Statuses: write
or
GITHUB_TOKEN Permissions
Actions: read
Checks: read
Contents: read
Deployments: read
Discussions: read
Issues: read
Metadata: read
Packages: read
Pages: read
PullRequests: read
RepositoryProjects: read
SecurityEvents: read
Statuses: read
Jobs triggered by PRs get read permissions, other jobs get write.
One job requires non-null permissions to function.
The dependent issues GHA needs PR/issues write permissions to add/remove
`dependent` labels. It needs status write permission to block/unblock
PRs when dependencies are missing/met. Fails with HttpError otherwise.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Instead of using a copy of the deploy file, use Shipyard's deploy as it
could (and does) diverge.
This also obviates the need for a copy of `Dockerfile.dapper` which
can now be taken directly from Shipyard.
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
This will ensure that we deploy the current development version of
Submariner and that our artifacts are considered the latest (currently
our latest is 0.11.2!).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Use Kubernetes 1.24 as the default version for end-to-end tests.
Remove Kubernetes 1.21 end-to-end tests as it's end of life.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
We don't really need to run the entire E2E suite anymore since we're
deploying the operator and it takes care of the entire deployment cycle.
Hence, the testing on operator should suffice and the helm testing can
be much slimmer and only use 2 single-node clusters.
This won't run the non-gw node tests, but as it's all tested on the
operator anyhow, there's no need to re-test it here.
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Starting with Kubernetes 1.24, secrets are no longer automatically
created for SAs. This adds secrets to the relevant templates; creating
secrets in this way is supported in all Kubernetes versions.
This also enables testing with 1.24 in CI, to make sure that the fix
actually works.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
See https://github.blog/2022-04-12-git-security-vulnerability-announced/
for context. git now refuses to handle repositories which don't belong
to the current user by default; such repositories need to be
explicitly marked as safe, in the global configuration for the current user.
This fixes the failing release job.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
Add Dependabot configuration to automatically update GitHub Actions on
the release-0.12 branch.
This will facilitate quick updates while using SHA-based versions.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
All docs.github.com URLs return 403 Forbidden, although they work.
This seems to be a new behavior, as it was working less than a week ago.
This happens in CI across submariner-io repos and locally.
$ curl -I https://docs.github.com/
HTTP/2 403
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
For quicker updates and easier, more consistent maintenance.
SHA-based versions should always be used to be sure the code we pull in
can't be changed without us, for security reasons at least. Dependabot
now supports SHA-based versions for GHAs. This patch should facilitate
their continued use.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Use the yamlint make target provided by Shipyard instead of a third
party GitHub action for running the same tool.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
This adds a feature, but nothing that seems relevant to us.
github.com/tim-actions/get-pr-commits/compare/v1.1.0...v1.2.0
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Bumps the version of markdown-link-check from 3.8.7 to 3.9.3.
Changes base image from node:alpine to node:lts-alpine.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Remove tests for Kubernetes 1.20, as it is End of Life and Submariner
supports all versions upstream-Kubernetes supports and no EOL versions.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Commits produced using "git commit --fix" are great for review, but
must be squashed before a PR is merged.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Update the versions of Kubernetes tested in the E2E CI. Add 1.23 as the
new default for most tests, remove 1.19 as it is now EOL.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Globalnet controller now uses internal services with external-ips
to support exported services. On OCP Clusters, we require an explicit
RBAC to create services with external-ips, this PR includes the
necessary RBAC for Globalnet pods.
Related to: https://github.com/submariner-io/submariner/issues/1166
Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
As part of Globalnet enhancement where kubeproxy dependency
is removed, the Globalnet Pod will now create internal
services for every exported service in the respective
namespace where the original service resides. This PR
adds the necessary clusterRole to allow Globalnet pod
to create/delete such internal services.
Related to: https://github.com/submariner-io/submariner/issues/1166
Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
