- Add consistent spacing to table separator row in submariner-operator/README.md
- Disable MD060 rule in .markdownlint.yml as tables use padded style with
empty cells that the rule incorrectly flags
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
The setup-python apparently installs the latest python version
which is not the recently releases 3.14.0. However this is
incompatible with the helm chart linter so retrict the python version.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
...from submariner-operator in lieu of using Go embed functionality.
The charts project needs to obtain the RBAC and CRD yaml files from the
submariner, submariner-operator and mcs-api projects. To achieve this,
define a simple Go file that statically references the packages
containing the desired embed.go and yaml files. The generate-yamls.sh
script uses 'go mod' commands to create the go.mod file and vendor
directory, which also downloads the yaml files.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
These all default to true and there doesn't seem to be any reason
a user would want to set any to false as Submariner woild not work
without these resources. Removing them simplifies the charts.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
The submariner-operator repo is the source of truth for the
CRD and RBAC resource yaml used by subctl and the ACM add-on so
we should use it for the helm charts as well. This will avoid
having to duplicate changes from the submariner-operator repo.
All the yaml is assembled in the pkg/embeddedyamls/yamls.go file
in submariner-operator so download and extract the yaml into
template files in the chart templates directories which can then
be included in other manifest files.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
The operator no longer runs leader-for-life election so enable
leader-with-lease via the CLI arg in the pod spec.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
On Openshift, the operator failed with error
"\"submariner-gateway\" is forbidden: cannot set blockOwnerDeletion
if an ownerReference refers to a resource you can't set finalizers on"
Openshift enables OwnerReferencesPermissionEnforcement, so
in order to set blockOwnerDeletion for an object, the user needs
update permission for the finalizers subresource of the referenced
owner. In this case the owner is the Submariner object.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
Bump to the latest commit, which updates node from 12 to 16 in addition
to an actions/core update.
Relates-to: submariner-io/subctl#537
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Use the '--app-version' parameter to 'helm package' to dynamically
set the chart 'appVersion' field. We can then omit the hardcoded
'appVersion' field in the Chart.yaml file.
The chart 'version' field is also set by 'helm package' but we still
need to define it in the Chart.yaml file since 'help dep update'
requires it. The placeholder 'version' field is now set to 0.0.0 just
to give it some value.
For E2E, since the version fields are no longer hardcoded, it now
simulates a release by running 'helm package' and extracting the tar
files to HELM_REPO_LOCATION, now set to ./helm_repo.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
There's no mention in the upstream helm docs about this file nor is
there any docs about interactive user prompting at all (that I can see).
Nor do we document any mechanism for user prompting. It would seem this
is an obsolete remnant from an earlier version of helm so let's remove
it. This also eliminates hard-coded image versions that need to be
updated.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
...from the top shield banner. I don't see any reason why we
need that. This eliminate places we need to update when we release a
new chart version. The other places where it references a version is
in the sample values. I changed those to just 0.14.0 but we don't
really need to update these as they're intended to be examples.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.
> Error: Resource not accessible by integration
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Due to a bug in LH which was fixed in devel, but not yet backported, we
have to preload the LH images to get latest versions (and operator due
to a similar reason).
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
When releasing, since the job pushes to the git repository, it needs
to have write permission on "contents".
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The release frequency of some GHAs means we end up with daily
dependabot PRs, which results in lots of not-particularly-useful
review work. Reducing the update cadence to weekly shouldn't expose us
to much risk and will reduce PR churn.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Set the GitHub Actions token permission to null in most workflows.
This results in:
GITHUB_TOKEN Permissions
Metadata: read
The default permissions, used without the null override, are either
GITHUB_TOKEN Permissions
Actions: write
Checks: write
Contents: write
Deployments: write
Discussions: write
Issues: write
Metadata: read
Packages: write
Pages: write
PullRequests: write
RepositoryProjects: write
SecurityEvents: write
Statuses: write
or
GITHUB_TOKEN Permissions
Actions: read
Checks: read
Contents: read
Deployments: read
Discussions: read
Issues: read
Metadata: read
Packages: read
Pages: read
PullRequests: read
RepositoryProjects: read
SecurityEvents: read
Statuses: read
Jobs triggered by PRs get read permissions, other jobs get write.
One job requires non-null permissions to function.
The dependent issues GHA needs PR/issues write permissions to add/remove
`dependent` labels. It needs status write permission to block/unblock
PRs when dependencies are missing/met. Fails with HttpError otherwise.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Instead of using a copy of the deploy file, use Shipyard's deploy as it
could (and does) diverge.
This also obviates the need for a copy of `Dockerfile.dapper` which
can now be taken directly from Shipyard.
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
This will ensure that we deploy the current development version of
Submariner and that our artifacts are considered the latest (currently
our latest is 0.11.2!).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Use Kubernetes 1.24 as the default version for end-to-end tests.
Remove Kubernetes 1.21 end-to-end tests as it's end of life.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
We don't really need to run the entire E2E suite anymore since we're
deploying the operator and it takes care of the entire deployment cycle.
Hence, the testing on operator should suffice and the helm testing can
be much slimmer and only use 2 single-node clusters.
This won't run the non-gw node tests, but as it's all tested on the
operator anyhow, there's no need to re-test it here.
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Starting with Kubernetes 1.24, secrets are no longer automatically
created for SAs. This adds secrets to the relevant templates; creating
secrets in this way is supported in all Kubernetes versions.
This also enables testing with 1.24 in CI, to make sure that the fix
actually works.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
See https://github.blog/2022-04-12-git-security-vulnerability-announced/
for context. git now refuses to handle repositories which don't belong
to the current user by default; such repositories need to be
explicitly marked as safe, in the global configuration for the current user.
This fixes the failing release job.
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
Add Dependabot configuration to automatically update GitHub Actions on
the release-0.12 branch.
This will facilitate quick updates while using SHA-based versions.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
All docs.github.com URLs return 403 Forbidden, although they work.
This seems to be a new behavior, as it was working less than a week ago.
This happens in CI across submariner-io repos and locally.
$ curl -I https://docs.github.com/
HTTP/2 403
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
For quicker updates and easier, more consistent maintenance.
SHA-based versions should always be used to be sure the code we pull in
can't be changed without us, for security reasons at least. Dependabot
now supports SHA-based versions for GHAs. This patch should facilitate
their continued use.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Use the yamlint make target provided by Shipyard instead of a third
party GitHub action for running the same tool.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
This adds a feature, but nothing that seems relevant to us.
github.com/tim-actions/get-pr-commits/compare/v1.1.0...v1.2.0
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Bumps the version of markdown-link-check from 3.8.7 to 3.9.3.
Changes base image from node:alpine to node:lts-alpine.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Remove tests for Kubernetes 1.20, as it is End of Life and Submariner
supports all versions upstream-Kubernetes supports and no EOL versions.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Commits produced using "git commit --fix" are great for review, but
must be squashed before a PR is merged.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Update the versions of Kubernetes tested in the E2E CI. Add 1.23 as the
new default for most tests, remove 1.19 as it is now EOL.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Globalnet controller now uses internal services with external-ips
to support exported services. On OCP Clusters, we require an explicit
RBAC to create services with external-ips, this PR includes the
necessary RBAC for Globalnet pods.
Related to: https://github.com/submariner-io/submariner/issues/1166
Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
As part of Globalnet enhancement where kubeproxy dependency
is removed, the Globalnet Pod will now create internal
services for every exported service in the respective
namespace where the original service resides. This PR
adds the necessary clusterRole to allow Globalnet pod
to create/delete such internal services.
Related to: https://github.com/submariner-io/submariner/issues/1166
Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
connectionHealthCheck in submariner CR is a nested field
but is being added as a variable. This means it is ignored
and the field isn't set correctly in gateway pods.
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
Right now auto release logic updates `devel` to the stable branch name
when creating stable branches. This leads to this job "sharding" into
multiple jobs, and messes up branch protections.
To keep things simple, the main job name will remain the same so that
there's no "PR targets X" and "PR targets Y" jobs, just the one "PR
targets branch" job
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Per GitHub's security guidelines, GHAs should be pinned using full
length commit SHAs instead of tags.
The SHAs are of the commits currently resolved by the versions.
Even "trusted" GHAs from GitHub developers are pinned because it's
possible their repo rights could be compromised and a malicious GHA
published. These core repos are not frequently substantially updated.
Submariner-internal GHAs are left pinned at devel because we want
automatic updates from Shipyard's shared tooling.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
As we do with the Flake Finder and other periodic jobs, skip the checks
for PR dependencies on forks.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Submariner, k8s, OS and kernel information
are collected as part of `subctl gather`. Don't
ask for them explicitly in bug report.
Signed-off-by: Janki Chhatbar <jchhatba@redhat.com>
This job marks a PR `dependent` whenever a dependent PR
is mentioned via `Depends on/ depends on` keyword.
The job fails until the dependent PR is not merged. This
helps in properly managing merging of dependent PRs.
Signed-off-by: Janki Chhatbar <jchhatba@redhat.com>
description:ServiceExport declares that the Service with the same name and
namespace as this export should be consumable from other clusters.
type:object
properties:
apiVersion:
description:'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type:string
kind:
description:'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type:string
metadata:
type:object
status:
description:status describes the current state of an exported service.
Service configuration comes from the Service that had the same name
and namespace as this ServiceExport. Populated by the multi-cluster
service implementation's controller.
type:object
properties:
conditions:
type:array
items:
description:"ServiceExportCondition contains details for the current
condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions)
is implemented, this will be replaced by metav1.Condition."
type:object
required:
- status
- type
properties:
lastTransitionTime:
type:string
format:date-time
message:
type:string
reason:
type:string
status:
description:Status is one of {"True", "False", "Unknown"}
type:string
enum:
- "True"
- "False"
- Unknown
type:
description:ServiceExportConditionType identifies a specific
condition.
type:string
x-kubernetes-list-map-keys:
- type
x-kubernetes-list-type:map
---
apiVersion:apiextensions.k8s.io/v1
kind:CustomResourceDefinition
metadata:
name:serviceimports.multicluster.x-k8s.io
spec:
group:multicluster.x-k8s.io
scope:Namespaced
names:
plural:serviceimports
singular:serviceimport
kind:ServiceImport
shortNames:
- svcim
versions:
- name:v1alpha1
served:true
storage:true
subresources:
status:{}
additionalPrinterColumns:
- name:Type
type:string
description:The type of this ServiceImport
jsonPath:.spec.type
- name:IP
type:string
description:The VIP for this ServiceImport
jsonPath:.spec.ips
- name:Age
type:date
jsonPath:.metadata.creationTimestamp
"schema":
"openAPIV3Schema":
description:ServiceImport describes a service imported from clusters in a
ClusterSet.
type:object
properties:
apiVersion:
description:'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type:string
kind:
description:'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type:string
metadata:
type:object
spec:
description:spec defines the behavior of a ServiceImport.
type:object
required:
- ports
- type
properties:
ips:
description:ip will be used as the VIP for this service when type
is ClusterSetIP.
type:array
maxItems:1
items:
type:string
ports:
type:array
items:
description:ServicePort represents the port on which the service
is exposed
type:object
required:
- port
properties:
appProtocol:
description:The application protocol for this port. This field
follows standard Kubernetes label syntax. Un-prefixed names
are reserved for IANA standard service names (as per RFC-6335
and http://www.iana.org/assignments/service-names). Non-standard
protocols should use prefixed names such as mycompany.com/my-custom-protocol.
Field can be enabled with ServiceAppProtocol feature gate.
type:string
name:
description:The name of this port within the service. This
must be a DNS_LABEL. All ports within a ServiceSpec must have
unique names. When considering the endpoints for a Service,
this must match the 'name' field in the EndpointPort. Optional
if only one ServicePort is defined on this service.
type:string
port:
description:The port that will be exposed by this service.
type:integer
format:int32
protocol:
description:The IP protocol for this port. Supports "TCP",
"UDP",and "SCTP". Default is TCP.
type:string
x-kubernetes-list-type:atomic
sessionAffinity:
description:'Supports "ClientIP" and "None". Used to maintain session
affinity. Enable client IP based session affinity. Must be ClientIP
or None. Defaults to None. Ignored when type is Headless More info:
description:Submariner is the Schema for the submariners API
properties:
apiVersion:
description:'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type:string
kind:
description:'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type:string
metadata:
type:object
spec:
description:SubmarinerSpec defines the desired state of Submariner
properties:
broker:
type:string
brokerK8sApiServer:
type:string
brokerK8sApiServerToken:
type:string
brokerK8sCA:
type:string
brokerK8sRemoteNamespace:
type:string
cableDriver:
type:string
ceIPSecDebug:
type:boolean
ceIPSecIKEPort:
type:integer
ceIPSecNATTPort:
type:integer
ceIPSecPSK:
type:string
clusterCIDR:
type:string
clusterID:
type:string
colorCodes:
type:string
customDomains:
items:
type:string
type:array
x-kubernetes-list-type:set
debug:
type:boolean
globalCIDR:
type:string
namespace:
type:string
natEnabled:
type:boolean
repository:
type:string
serviceCIDR:
type:string
serviceDiscoveryEnabled:
type:boolean
version:
type:string
required:
- broker
- brokerK8sApiServer
- brokerK8sApiServerToken
- brokerK8sCA
- brokerK8sRemoteNamespace
- ceIPSecDebug
- ceIPSecPSK
- clusterCIDR
- clusterID
- debug
- namespace
- natEnabled
- serviceCIDR
type:object
status:
description:SubmarinerStatus defines the observed state of Submariner
properties:
clusterCIDR:
type:string
clusterID:
type:string
colorCodes:
type:string
gatewayDaemonSetStatus:
properties:
lastResourceVersion:
type:string
mismatchedContainerImages:
type:boolean
nonReadyContainerStates:
items:
description:ContainerState holds a possible state of container.
Only one of its members may be specified. If none of them is
specified, the default one is ContainerStateWaiting.
properties:
running:
description:Details about a running container
properties:
startedAt:
description:Time at which the container was last (re-)started
format:date-time
type:string
type:object
terminated:
description:Details about a terminated container
properties:
containerID:
description:Container's ID in the format 'docker://<container_id>'
type:string
exitCode:
description:Exit status from the last termination of
the container
format:int32
type:integer
finishedAt:
description:Time at which the container last terminated
format:date-time
type:string
message:
description:Message regarding the last termination of
the container
type:string
reason:
description:(brief) reason from the last termination
of the container
type:string
signal:
description:Signal from the last termination of the container
format:int32
type:integer
startedAt:
description:Time at which previous execution of the container
started
format:date-time
type:string
required:
- exitCode
type:object
waiting:
description:Details about a waiting container
properties:
message:
description:Message regarding why the container is not
yet running.
type:string
reason:
description:(brief) reason the container is not yet running.
type:string
type:object
type:object
type:array
status:
description:DaemonSetStatus represents the current status of a
daemon set.
properties:
collisionCount:
description:Count of hash collisions for the DaemonSet. The
DaemonSet controller uses this field as a collision avoidance
mechanism when it needs to create the name for the newest
ControllerRevision.
format:int32
type:integer
conditions:
description:Represents the latest available observations of
a DaemonSet's current state.
items:
description:DaemonSetCondition describes the state of a DaemonSet
at a certain point.
properties:
lastTransitionTime:
description:Last time the condition transitioned from
one status to another.
format:date-time
type:string
message:
description:A human readable message indicating details
about the transition.
type:string
reason:
description:The reason for the condition's last transition.
type:string
status:
description:Status of the condition, one of True, False,
Unknown.
type:string
type:
description:Type of DaemonSet condition.
type:string
required:
- status
- type
type:object
type:array
currentNumberScheduled:
description:'The number of nodes that are running at least
1 daemon pod and are supposed to run the daemon pod. More
description:The number of nodes that should be running the
daemon pod and have one or more of the daemon pod running
and ready.
format:int32
type:integer
numberUnavailable:
description:The number of nodes that should be running the
daemon pod and have none of the daemon pod running and available
(ready for at least spec.minReadySeconds)
format:int32
type:integer
observedGeneration:
description:The most recent generation observed by the daemon
set controller.
format:int64
type:integer
updatedNumberScheduled:
description:The total number of nodes that are running updated
daemon pod
format:int32
type:integer
required:
- currentNumberScheduled
- desiredNumberScheduled
- numberMisscheduled
- numberReady
type:object
required:
- mismatchedContainerImages
type:object
serviceCIDR:
type:string
required:
- clusterID
- natEnabled
type:object
type:object
version:v1alpha1
versions:
- name:v1alpha1
served:true
storage:true
status:
acceptedNames:
kind:""
plural:""
conditions:[]
storedVersions:[]
---
apiVersion:apiextensions.k8s.io/v1
kind:CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version:v0.3.0
creationTimestamp:null
name:servicediscoveries.submariner.io
spec:
group:submariner.io
names:
kind:ServiceDiscovery
listKind:ServiceDiscoveryList
plural:servicediscoveries
singular:servicediscovery
scope:Namespaced
versions:
- name:v1alpha1
schema:
openAPIV3Schema:
description:ServiceDiscovery is the Schema for the servicediscoveries API
properties:
apiVersion:
description:'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type:string
kind:
description:'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type:string
metadata:
type:object
spec:
description:ServiceDiscoverySpec defines the desired state of ServiceDiscovery
properties:
brokerK8sApiServer:
type:string
brokerK8sApiServerToken:
type:string
brokerK8sCA:
type:string
brokerK8sRemoteNamespace:
type:string
clusterID:
type:string
customDomains:
items:
type:string
type:array
x-kubernetes-list-type:set
debug:
type:boolean
globalnetEnabled:
type:boolean
imageOverrides:
additionalProperties:
type:string
type:object
namespace:
type:string
repository:
type:string
version:
type:string
required:
- brokerK8sApiServer
- brokerK8sApiServerToken
- brokerK8sCA
- brokerK8sRemoteNamespace
- clusterID
- debug
- namespace
type:object
status:
description:ServiceDiscoveryStatus defines the observed state of ServiceDiscovery
type:object
type:object
served:true
storage:true
subresources:
status:{}
status:
acceptedNames:
kind:""
plural:""
conditions:[]
storedVersions:[]
---
apiVersion:apiextensions.k8s.io/v1
kind:CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version:v0.3.0
creationTimestamp:null
name:brokers.submariner.io
spec:
group:submariner.io
names:
kind:Broker
listKind:BrokerList
plural:brokers
singular:broker
scope:Namespaced
versions:
- name:v1alpha1
schema:
openAPIV3Schema:
description:Broker is the Schema for the brokers API
properties:
apiVersion:
description:'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type:string
kind:
description:'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type:string
metadata:
type:object
spec:
description:BrokerSpec defines the desired state of Broker
properties:
components:
items:
type:string
type:array
defaultCustomDomains:
items:
type:string
type:array
defaultGlobalnetClusterSize:
type:integer
globalnetCIDRRange:
type:string
globalnetEnabled:
type:boolean
type:object
status:
description:BrokerStatus defines the observed state of Broker
If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
{{- end }}
By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool.
By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
