-
-
Notifications
You must be signed in to change notification settings - Fork 191
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add flux-image-test workflow #6646
Closed
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Owner
onedr0p
commented
Dec 24, 2023
Signed-off-by: Devin Buhl <[email protected]>
bot-ross
bot
added
area/github
Changes made in the github directory
area/kubernetes
Changes made in the kubernetes directory
cluster/main
labels
Dec 24, 2023
--- kubernetes/main/apps/cert-manager/cert-manager/app Kustomization: flux-system/cert-manager HelmRelease: cert-manager/cert-manager
+++ kubernetes/main/apps/cert-manager/cert-manager/app Kustomization: flux-system/cert-manager HelmRelease: cert-manager/cert-manager
@@ -13,13 +13,13 @@
spec:
chart: cert-manager
sourceRef:
kind: HelmRepository
name: jetstack
namespace: flux-system
- version: v1.13.3
+ version: v1.13.2
install:
remediation:
retries: 3
interval: 30m
uninstall:
keepHistory: false
--- kubernetes/main/apps/network/nginx/external Kustomization: flux-system/nginx-external HelmRelease: network/nginx-external
+++ kubernetes/main/apps/network/nginx/external Kustomization: flux-system/nginx-external HelmRelease: network/nginx-external
@@ -13,13 +13,13 @@
spec:
chart: ingress-nginx
sourceRef:
kind: HelmRepository
name: ingress-nginx
namespace: flux-system
- version: 4.9.0
+ version: 4.8.3
install:
remediation:
retries: 3
interval: 30m
uninstall:
keepHistory: false
--- kubernetes/main/apps/network/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: network/nginx-internal
+++ kubernetes/main/apps/network/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: network/nginx-internal
@@ -13,13 +13,13 @@
spec:
chart: ingress-nginx
sourceRef:
kind: HelmRepository
name: ingress-nginx
namespace: flux-system
- version: 4.9.0
+ version: 4.8.3
install:
remediation:
retries: 3
interval: 30m
uninstall:
keepHistory: false
--- kubernetes/main/apps/rook-ceph/rook-ceph/cluster Kustomization: flux-system/rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster
+++ kubernetes/main/apps/rook-ceph/rook-ceph/cluster Kustomization: flux-system/rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster
@@ -13,13 +13,13 @@
spec:
chart: rook-ceph-cluster
sourceRef:
kind: HelmRepository
name: rook-ceph
namespace: flux-system
- version: v1.13.1
+ version: v1.12.10
dependsOn:
- name: rook-ceph-operator
namespace: rook-ceph
- name: snapshot-controller
namespace: storage
install:
--- kubernetes/main/apps/rook-ceph/rook-ceph/app Kustomization: flux-system/rook-ceph HelmRelease: rook-ceph/rook-ceph-operator
+++ kubernetes/main/apps/rook-ceph/rook-ceph/app Kustomization: flux-system/rook-ceph HelmRelease: rook-ceph/rook-ceph-operator
@@ -13,13 +13,13 @@
spec:
chart: rook-ceph
sourceRef:
kind: HelmRepository
name: rook-ceph
namespace: flux-system
- version: v1.13.1
+ version: v1.12.10
dependsOn:
- name: snapshot-controller
namespace: storage
install:
remediation:
retries: 3 |
--- HelmRelease: network/nginx-internal Deployment: network/nginx-internal-controller
+++ HelmRelease: network/nginx-internal Deployment: network/nginx-internal-controller
@@ -28,13 +28,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: controller
spec:
dnsPolicy: ClusterFirst
containers:
- name: controller
- image: registry.k8s.io/ingress-nginx/controller:v1.9.5@sha256:b3aba22b1da80e7acfc52b115cae1d4c687172cbf2b742d5b502419c25ff340e
+ image: registry.k8s.io/ingress-nginx/controller:v1.9.4@sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
imagePullPolicy: IfNotPresent
lifecycle:
preStop:
exec:
command:
- /wait-shutdown
@@ -47,23 +47,19 @@
- --configmap=$(POD_NAMESPACE)/nginx-internal-controller
- --validating-webhook=:8443
- --validating-webhook-certificate=/usr/local/certificates/cert
- --validating-webhook-key=/usr/local/certificates/key
- --default-ssl-certificate=network/devbu-io-tls
securityContext:
- runAsNonRoot: true
- runAsUser: 101
- allowPrivilegeEscalation: false
- seccompProfile:
- type: RuntimeDefault
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
- readOnlyRootFilesystem: false
+ runAsUser: 101
+ allowPrivilegeEscalation: true
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
--- HelmRelease: network/nginx-internal ValidatingWebhookConfiguration: network/nginx-internal-admission
+++ HelmRelease: network/nginx-internal ValidatingWebhookConfiguration: network/nginx-internal-admission
@@ -25,14 +25,14 @@
failurePolicy: Fail
sideEffects: None
admissionReviewVersions:
- v1
clientConfig:
service:
+ namespace: network
name: nginx-internal-controller-admission
- namespace: network
path: /networking/v1/ingresses
objectSelector:
matchExpressions:
- key: ingress-class
operator: In
values:
--- HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-create
+++ HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-create
@@ -37,19 +37,15 @@
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
securityContext:
allowPrivilegeEscalation: false
- capabilities:
- drop:
- - ALL
- readOnlyRootFilesystem: true
- runAsNonRoot: true
- runAsUser: 65532
- seccompProfile:
- type: RuntimeDefault
restartPolicy: OnFailure
serviceAccountName: nginx-internal-admission
nodeSelector:
kubernetes.io/os: linux
+ securityContext:
+ fsGroup: 2000
+ runAsNonRoot: true
+ runAsUser: 2000
--- HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-patch
+++ HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-patch
@@ -39,19 +39,15 @@
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
securityContext:
allowPrivilegeEscalation: false
- capabilities:
- drop:
- - ALL
- readOnlyRootFilesystem: true
- runAsNonRoot: true
- runAsUser: 65532
- seccompProfile:
- type: RuntimeDefault
restartPolicy: OnFailure
serviceAccountName: nginx-internal-admission
nodeSelector:
kubernetes.io/os: linux
+ securityContext:
+ fsGroup: 2000
+ runAsNonRoot: true
+ runAsUser: 2000
--- HelmRelease: network/nginx-internal NetworkPolicy: network/nginx-internal-admission
+++ HelmRelease: network/nginx-internal NetworkPolicy: network/nginx-internal-admission
@@ -0,0 +1,27 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: nginx-internal-admission
+ namespace: network
+ annotations:
+ helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
+ helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+ labels:
+ app.kubernetes.io/name: ingress-nginx
+ app.kubernetes.io/instance: nginx-internal
+ app.kubernetes.io/part-of: ingress-nginx
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/component: admission-webhook
+spec:
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: ingress-nginx
+ app.kubernetes.io/instance: nginx-internal
+ app.kubernetes.io/component: admission-webhook
+ policyTypes:
+ - Ingress
+ - Egress
+ egress:
+ - {}
+
--- HelmRelease: rook-ceph/rook-ceph-cluster Deployment: rook-ceph/rook-ceph-tools
+++ HelmRelease: rook-ceph/rook-ceph-cluster Deployment: rook-ceph/rook-ceph-tools
@@ -87,19 +87,12 @@
write_endpoints
# continuously update the mon endpoints if they fail over
watch_endpoints
imagePullPolicy: IfNotPresent
tty: true
- securityContext:
- capabilities:
- drop:
- - ALL
- runAsGroup: 2016
- runAsNonRoot: true
- runAsUser: 2016
env:
- name: ROOK_CEPH_USERNAME
valueFrom:
secretKeyRef:
name: rook-ceph-mon
key: ceph-username
--- HelmRelease: rook-ceph/rook-ceph-cluster CephFilesystemSubVolumeGroup: rook-ceph/ceph-filesystem-csi
+++ HelmRelease: rook-ceph/rook-ceph-cluster CephFilesystemSubVolumeGroup: rook-ceph/ceph-filesystem-csi
@@ -1,12 +0,0 @@
----
-apiVersion: ceph.rook.io/v1
-kind: CephFilesystemSubVolumeGroup
-metadata:
- name: ceph-filesystem-csi
- namespace: rook-ceph
-spec:
- name: csi
- filesystemName: ceph-filesystem
- pinning:
- distributed: 1
-
--- HelmRelease: network/nginx-external Deployment: network/nginx-external-controller
+++ HelmRelease: network/nginx-external Deployment: network/nginx-external-controller
@@ -28,13 +28,13 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: controller
spec:
dnsPolicy: ClusterFirst
containers:
- name: controller
- image: registry.k8s.io/ingress-nginx/controller:v1.9.5@sha256:b3aba22b1da80e7acfc52b115cae1d4c687172cbf2b742d5b502419c25ff340e
+ image: registry.k8s.io/ingress-nginx/controller:v1.9.4@sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
imagePullPolicy: IfNotPresent
lifecycle:
preStop:
exec:
command:
- /wait-shutdown
@@ -47,23 +47,19 @@
- --configmap=$(POD_NAMESPACE)/nginx-external-controller
- --validating-webhook=:8443
- --validating-webhook-certificate=/usr/local/certificates/cert
- --validating-webhook-key=/usr/local/certificates/key
- --default-ssl-certificate=network/devbu-io-tls
securityContext:
- runAsNonRoot: true
- runAsUser: 101
- allowPrivilegeEscalation: false
- seccompProfile:
- type: RuntimeDefault
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
- readOnlyRootFilesystem: false
+ runAsUser: 101
+ allowPrivilegeEscalation: true
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
--- HelmRelease: network/nginx-external ValidatingWebhookConfiguration: network/nginx-external-admission
+++ HelmRelease: network/nginx-external ValidatingWebhookConfiguration: network/nginx-external-admission
@@ -25,14 +25,14 @@
failurePolicy: Fail
sideEffects: None
admissionReviewVersions:
- v1
clientConfig:
service:
+ namespace: network
name: nginx-external-controller-admission
- namespace: network
path: /networking/v1/ingresses
objectSelector:
matchExpressions:
- key: ingress-class
operator: In
values:
--- HelmRelease: network/nginx-external Job: network/nginx-external-admission-create
+++ HelmRelease: network/nginx-external Job: network/nginx-external-admission-create
@@ -37,19 +37,15 @@
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
securityContext:
allowPrivilegeEscalation: false
- capabilities:
- drop:
- - ALL
- readOnlyRootFilesystem: true
- runAsNonRoot: true
- runAsUser: 65532
- seccompProfile:
- type: RuntimeDefault
restartPolicy: OnFailure
serviceAccountName: nginx-external-admission
nodeSelector:
kubernetes.io/os: linux
+ securityContext:
+ fsGroup: 2000
+ runAsNonRoot: true
+ runAsUser: 2000
--- HelmRelease: network/nginx-external Job: network/nginx-external-admission-patch
+++ HelmRelease: network/nginx-external Job: network/nginx-external-admission-patch
@@ -39,19 +39,15 @@
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
securityContext:
allowPrivilegeEscalation: false
- capabilities:
- drop:
- - ALL
- readOnlyRootFilesystem: true
- runAsNonRoot: true
- runAsUser: 65532
- seccompProfile:
- type: RuntimeDefault
restartPolicy: OnFailure
serviceAccountName: nginx-external-admission
nodeSelector:
kubernetes.io/os: linux
+ securityContext:
+ fsGroup: 2000
+ runAsNonRoot: true
+ runAsUser: 2000
--- HelmRelease: network/nginx-external NetworkPolicy: network/nginx-external-admission
+++ HelmRelease: network/nginx-external NetworkPolicy: network/nginx-external-admission
@@ -0,0 +1,27 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: nginx-external-admission
+ namespace: network
+ annotations:
+ helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
+ helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+ labels:
+ app.kubernetes.io/name: ingress-nginx
+ app.kubernetes.io/instance: nginx-external
+ app.kubernetes.io/part-of: ingress-nginx
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/component: admission-webhook
+spec:
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: ingress-nginx
+ app.kubernetes.io/instance: nginx-external
+ app.kubernetes.io/component: admission-webhook
+ policyTypes:
+ - Ingress
+ - Egress
+ egress:
+ - {}
+
--- HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-cainjector
+++ HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-cainjector
@@ -31,13 +31,13 @@
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
containers:
- name: cert-manager-cainjector
- image: quay.io/jetstack/cert-manager-cainjector:v1.13.3
+ image: quay.io/jetstack/cert-manager-cainjector:v1.13.2
imagePullPolicy: IfNotPresent
args:
- --v=2
- --leader-election-namespace=kube-system
env:
- name: POD_NAMESPACE
--- HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager
+++ HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager
@@ -31,19 +31,19 @@
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
containers:
- name: cert-manager-controller
- image: quay.io/jetstack/cert-manager-controller:v1.13.3
+ image: quay.io/jetstack/cert-manager-controller:v1.13.2
imagePullPolicy: IfNotPresent
args:
- --v=2
- --cluster-resource-namespace=$(POD_NAMESPACE)
- --leader-election-namespace=kube-system
- - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.13.3
+ - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.13.2
- --max-concurrent-challenges=60
- --dns01-recursive-nameservers-only=true
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
ports:
- containerPort: 9402
name: http-metrics
--- HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-webhook
+++ HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-webhook
@@ -31,13 +31,13 @@
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
containers:
- name: cert-manager-webhook
- image: quay.io/jetstack/cert-manager-webhook:v1.13.3
+ image: quay.io/jetstack/cert-manager-webhook:v1.13.2
imagePullPolicy: IfNotPresent
args:
- --v=2
- --secure-port=10250
- --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
- --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
--- HelmRelease: cert-manager/cert-manager Job: cert-manager/cert-manager-startupapicheck
+++ HelmRelease: cert-manager/cert-manager Job: cert-manager/cert-manager-startupapicheck
@@ -31,13 +31,13 @@
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
containers:
- name: cert-manager-startupapicheck
- image: quay.io/jetstack/cert-manager-ctl:v1.13.3
+ image: quay.io/jetstack/cert-manager-ctl:v1.13.2
imagePullPolicy: IfNotPresent
args:
- check
- api
- --wait=1m
securityContext:
--- HelmRelease: rook-ceph/rook-ceph-operator ConfigMap: rook-ceph/rook-ceph-operator-config
+++ HelmRelease: rook-ceph/rook-ceph-operator ConfigMap: rook-ceph/rook-ceph-operator-config
@@ -6,12 +6,13 @@
namespace: rook-ceph
data:
ROOK_LOG_LEVEL: INFO
ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: '15'
ROOK_OBC_WATCH_OPERATOR_NAMESPACE: 'true'
ROOK_CEPH_ALLOW_LOOP_DEVICES: 'false'
+ ROOK_DISABLE_ADMISSION_CONTROLLER: 'true'
ROOK_ENABLE_DISCOVERY_DAEMON: 'false'
ROOK_CSI_ENABLE_RBD: 'true'
ROOK_CSI_ENABLE_CEPHFS: 'true'
CSI_ENABLE_CEPHFS_SNAPSHOTTER: 'true'
CSI_ENABLE_NFS_SNAPSHOTTER: 'true'
CSI_ENABLE_RBD_SNAPSHOTTER: 'true'
@@ -23,15 +24,16 @@
CSI_PLUGIN_PRIORITY_CLASSNAME: system-node-critical
CSI_PROVISIONER_PRIORITY_CLASSNAME: system-cluster-critical
CSI_RBD_FSGROUPPOLICY: File
CSI_CEPHFS_FSGROUPPOLICY: File
CSI_NFS_FSGROUPPOLICY: File
CSI_CEPHFS_KERNEL_MOUNT_OPTIONS: ms_mode=prefer-crc
+ ROOK_CSI_ENABLE_GRPC_METRICS: 'false'
ROOK_CSI_IMAGE_PULL_POLICY: IfNotPresent
CSI_ENABLE_CSIADDONS: 'false'
- ROOK_CSIADDONS_IMAGE: quay.io/csiaddons/k8s-sidecar:v0.8.0
+ ROOK_CSIADDONS_IMAGE: quay.io/csiaddons/k8s-sidecar:v0.7.0
CSI_ENABLE_TOPOLOGY: 'false'
CSI_ENABLE_READ_AFFINITY: 'false'
ROOK_CSI_ENABLE_NFS: 'false'
CSI_ENABLE_LIVENESS: 'true'
CSI_FORCE_CEPHFS_KERNEL_CLIENT: 'true'
CSI_GRPC_TIMEOUT_SECONDS: '150'
--- HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-system
+++ HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-system
@@ -22,12 +22,21 @@
- ''
resources:
- pods/exec
verbs:
- create
- apiGroups:
+ - admissionregistration.k8s.io
+ resources:
+ - validatingwebhookconfigurations
+ verbs:
+ - create
+ - get
+ - delete
+ - update
+- apiGroups:
- csiaddons.openshift.io
resources:
- networkfences
verbs:
- create
- get
--- HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-global
+++ HelmRelease: rook-ceph/rook-ceph-operator ClusterRole: rook-ceph/rook-ceph-global
@@ -13,12 +13,13 @@
- apiGroups:
- ''
resources:
- pods
- nodes
- nodes/proxy
+ - services
- secrets
- configmaps
verbs:
- get
- list
- watch
@@ -26,13 +27,12 @@
- ''
resources:
- events
- persistentvolumes
- persistentvolumeclaims
- endpoints
- - services
verbs:
- get
- list
- watch
- patch
- create
--- HelmRelease: rook-ceph/rook-ceph-operator Deployment: rook-ceph/rook-ceph-operator
+++ HelmRelease: rook-ceph/rook-ceph-operator Deployment: rook-ceph/rook-ceph-operator
@@ -19,36 +19,34 @@
type: Recreate
template:
metadata:
labels:
app: rook-ceph-operator
spec:
- tolerations:
- - effect: NoExecute
- key: node.kubernetes.io/unreachable
- operator: Exists
- tolerationSeconds: 5
containers:
- name: rook-ceph-operator
- image: rook/ceph:v1.13.1
+ image: rook/ceph:v1.12.10
imagePullPolicy: IfNotPresent
args:
- ceph
- operator
securityContext:
- capabilities:
- drop:
- - ALL
- runAsGroup: 2016
runAsNonRoot: true
runAsUser: 2016
+ runAsGroup: 2016
volumeMounts:
- mountPath: /var/lib/rook
name: rook-config
- mountPath: /etc/ceph
name: default-config-dir
+ - mountPath: /etc/webhook
+ name: webhook-cert
+ ports:
+ - containerPort: 9443
+ name: https-webhook
+ protocol: TCP
env:
- name: ROOK_CURRENT_NAMESPACE_ONLY
value: 'false'
- name: ROOK_HOSTPATH_REQUIRES_PRIVILEGED
value: 'false'
- name: ROOK_DISABLE_DEVICE_HOTPLUG
@@ -77,7 +75,9 @@
serviceAccountName: rook-ceph-system
volumes:
- name: rook-config
emptyDir: {}
- name: default-config-dir
emptyDir: {}
+ - name: webhook-cert
+ emptyDir: {}
|
Signed-off-by: Devin Buhl <[email protected]>
Signed-off-by: Devin Buhl <[email protected]>
Signed-off-by: Devin Buhl <[email protected]>
Signed-off-by: Devin Buhl <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
area/github
Changes made in the github directory
area/kubernetes
Changes made in the kubernetes directory
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.