Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* common automatic update (#84) * Updated namespaces template to include labels and annotations functionality * Added schema validation to support additional formal for labels and annotations * Updated the values-example.yaml to include new format for namespaces * Updated Changes.md to include new namespaces functionality. * Updating CI tests * Fixed Markdown errors * Add an experimental letsencypt chart This change adds an experimental letsencrypt chart that allows a pattern user/developer to have all routes and the API endpoint use signed certificates by letsencrypt. At this stage only AWS is supported. The full documentation is contained in the chart's README.md file * Do not run kubeconform on the certificate stuff just yet * Fix up kustomize example In the same vein as Industrial Edge 57f41dc135f72011d3796fe42d9cbf05d2b82052 we call kustomize build. Newer gitops versions dropped the openshift-clients rpm by default which contained kubectl. Let's just invoke "kustomize" directly as the binary is present in both old and new gitops versions Since "kubectl kustomize" builds the set of resources by default, we need to switch to "kubectl build" by default We also use the same naming conventions used in Industrial Edge while we're at it. * Upgrade vault-helm to v0.24.0 Tested on MCG with hub and spoke * Add a hello-world ansible playbook example Just a simple example that reads a helm value and puts it in a configmap * Inject ANSIBLE_CONFIG in make ansible-lint * Use new ansible-lint action * Fix some ansible-lint warnings * Fix up python versions * Skip cannot find role error Avoid checking those two playbooks the action seems to be too limited to understand where the ansible.cfg is * Added health check for pvc resource in argocd.yaml This allows argo to continue rolling out the rest of the applications. Without the health check the application is stuck in a progressing state and will not continue thus preventing any downstream application from deploying. * adding tests * Update super-linter image to latest * Update super-linter image to latest * Update CI workflows * updated template with why implemented comment * Add dependabot settings for github actions * adding tests * - Added functionality to support the following format for labels and annotations: labels: openshift.io/node-selector: "" annotations: openshift.io/cluster-monitoring: "true" * Fixed CI Issues * Applying @claudiol recommendation * make test * Avoid exited containers proliferation When running the `pattern.sh` script multiple times, a lot of podman exited containers will be left on the machine, adding `--rm` parameter to `podman run` makes podman automatically delete the exited containers leaving the machine cleaner. * Handling of pre-release builds is too complex for a helm chart Generating the ICSP and allowing insecure registries is best done prior to helm upgrade, and requires VPN access to registry-proxy.engineering.redhat.com * Fixing issues with operator groups * Adding CI test * Updated operator group template * Updating CI issues * Removed duplicate code for operatorgroup by using multiple conditions * Allow overriding the pattern's name This is especially useful when multiple people are working on a pattern an have been using different names: $ make help |grep Pattern: Pattern: multicloud-gitops $ make NAME=foobar help |grep Pattern: Pattern: foobar * Add precise instruction to upgrade the vault subchart * Upgrade vault-helm to v0.24.1 * Add an item to README.md * Fix up common/ tests * Fix super linter * Set gitOpsSpec.operatorSource After merging validatedpatterns/patterns-operator@235b303 it is now effectively possible to pick a different catalogSource for the gitops operator. This is needed in order to allow CI to install the gitops operator from an IIB * Introduce EXTRA_HELM_OPTS This variable can be set in order to pass additional helm arguments from the the command line. I.e. we can set things without having to tweak values files So it is now possible to run something like the following: ./pattern.sh make install \ EXTRA_HELM_OPTS="--set main.gitops.operatorSource=iib-49232" * Disable var-naming[no-role-prefix] in ansible lint * Add new ansible role to deal with IIBs * Simplify load-iib target * Add templates folder * Fix a couple of linting warnings * Fix some super-linter complaints * Skip the iib-ci playbook * Drop var-naming[no-role-prefix] linter * Allow for multiple images when calling load-iib * Add help for load-iib * Output index_image in make * Output index_image in make (2) * Set facts later in the playbook not in defaults/ * Fix how we export vars in make load-iib * Fix how we export vars in make load-iib (2) * Use machineCount to register the number of nodes that need to be ready * Add helpful debug messages * Add | on shell now that we call pipefail * Test dropping nevercontact source * Skip insecure tls when logging in * Also allow gchr.io * Revert "Test dropping nevercontact source" This reverts commit d8746a37fce2663018f52203c892f00b825e32a7. * Fix typo * Clarify instructions in the README file * Automate the channel example * Find out KUBEADMINAPI programmatically * Use command instead of shell * Do not grep for operator bundle unless it is the gitops operator * Also whitelist ghcr.io * Fetch the operator bundle itself in a more robust way It seems that the operator bundle image itself is nowhere to be found inside any OCP cluster object (it's not in packagemanifests nor catalogsource). Resorting to parsing the IIB via opm alpha commands to fetch the exact image. * Add more mirrors * Some more work to support MCE * Cleanup spacing * Fix super-linter * Move task in right folder * Drop last mention of operator instead of item * Improve the grepping for the operator bundle Without also grepping for the default_channel we can end up getting multiple results, which breaks everything. Tested this and it fixed the issue I was seeing with the openshift-gitops-operator this morning * Drop display_skipped_hosts display_skipped_hosts=False has a horrible side-effect: When a task takes a long time, it is always the *next* task and not the one printed on the screen/log. That is because ansible has to wait for the task to finish before printing it as it does not know before hand if the host will be skipped and hence the task should not be displayed at all * Be more specific about the steps in the README * Upgrade ESO to v0.8.2 * Update README.md * Update tests after eso 0.8.2 upgrade * Move to new spec format for dex/sso Via https://issues.redhat.com/browse/GITOPS-2761 we are told that the dex configuration has a new format. Old format: spec: dex: openShiftOAuth: true resources: ... New format: spec: sso: provider: dex dex: openShiftOAuth: true resources: ... This format is only supported starting with gitops-1.8.0, so we should merge this only when we are absolutely sure that no pattern in no situation needs an older gitops version. Tested on MCG with gitops-1.8.2 Note: with this change gitops < 1.8 is not supported. Starting with gitops-1.9 the old format will be unsupported. * Disable ArgoCD from kubeconform The reason is that most of the tools we used to generate the json schema, seem to be unmaintained, so it is getting hard to update our schemas in our GH org. We'll need to revisit this in the future. * Add a short line about username/token for the iib role on OCP <= 4.12 * Drop https:// from podman login Seems we hit https://www.github.com/containers/podman/issues/13691 at least with older podman versions. If this turns out to break podman 4.5.0 I will special case it later * Set the mce-subscription-spec annotation We set it by default to "redhat-operators" and if defined to .Values.clusterGroup.subscriptions.acm.source The reason we do this is the following: 1. In a default deployment scenario MCE has to be deployed as normal from the redhat-operators catalogSource just as ACM is 2. When we deploy gitops-operator from an IIB instead, MCE would be installed trying to get it from the IIB because https://www.github.com/stolostron/multiclusterhub-operator/pull/975 made it so that it picks the latest version looking at all catalog sources. But since we only mirrored the gitops operator in the cluster, this breaks as the images for MCE from the IIB are not there By setting the default to "redhat-operators" we fix this case 3. Now in the case where we want to install ACM from an IIB we need to be able to override this and we will pick whatever value is set in .Values.clusterGroup.subscriptions.acm.source, which will need to be defined for this to work when testing ACM+MCE from an IIB Note: Currently point 3. works only if you set it in a values file. Setting .Values.clusterGroup.subscriptions.acm.source via extraParams won't be passed down from the clusterGroup app to the applications. It's a bug that we need to fix. Note(2): We surround this with an 'if kindIs "map" .Values.clusterGroup.subscriptions' because we do not want to break things if subscription is a list and not a map. If we ever manage to drop subscriptions as list, then we can remove that if * Fix typo in README for iib * Simplify the README a bit * Add support for extraParams being passed down to all applications Via validatedpatterns/patterns-operator#74 we add the extraParams in an extraParametersNested dictionary that holds the extraParams key/value pairs. If they exist, let's add them as parameters. This allows them to end up in the applications. * Add a lookup playbook to figure out IIB numbers * Allow overriding channel and source when installing the patterns-operator This will allow us to test the patterns-operator using a different catalogsource (potentially installed via an IIB). So we can run: make EXTRA_HELM_OPTS="\ --set main.extraParameters[0].name=main.patternsOperator.channel --set main.extraParameters[0].value=slow \ --set main.extraParameters[1].name=main.patternsOperator.source --set main.extraParameters[1].value=patten-index" install * Fix small typo in iib instructions * Drop a redirect and up retries when pushing the IIB to the internal registry * Update ESO to v0.8.3 * WIP add presync for eso that waits for vault to be up * Add tests * Fix image and comment * Adding rbac to support the vault sa checking on the vault-0 pod status. * Make Test * Revert "Make Test" This reverts commit 64e9dc7. * Revert "Adding rbac to support the vault sa checking on the vault-0 pod status." This reverts commit 598bc74. * Revert "Fix image and comment" This reverts commit d4d3fe1. * Revert "Add tests" This reverts commit ab5532a. * Revert "WIP add presync for eso that waits for vault to be up" This reverts commit 2797699. * Increase the default retry limit when syncing ArgoCD will retry 5 times by default to sync an application in case of errors and then will give up. So if an application contains a reference to a CRD that has not been installed yet (say because it will be installed by another application), it will error out and retry later. This happens by default for a maximum of 5 times [1]. After those 5 times the application will give up and will stay in Degraded moded and eventually move to Failed. In this case a manual sync will usually fix the application just fine (i.e. as long as the missing CRD has been installed in the meantime). Now to solve this issue we can add complex preSync Jobs that wait for the needed resources, but this fundamentally breaks the simplicity of things and introduces unneeded dependencies. In this change we just increase the default retry limit to something larger (20) that should cover most cases. The retry limit functionality is rather undocumented currently in the docs but is defined at [2] and also shown at [3]. In our patterns' case the concrete issue happened as follows: 1. ESO ClusterSecrets were often not synced/degraded 2. We introduced a Job in a preSync hook for the ESO chart that would wait on vault to be ready before applying the rest of ESO 3. MCG started failing because the config-demo app had already tried to sync 5 times and failed everytime because the ESO CRDs were not installed yet (due to ESO waiting on vault) So instead of adding yet another job, let's just try a lot more often. We picked 20 as a sane default because that should have argo try for about 60 minutes (3min is the default maximum backoff limit) Tested with two MCG installations (with the ESO Job hook included) and both worked out of the box. Whereas before I managed to get three failures out of three installs. [1] https://github.com/argoproj/argo-cd/blob/master/controller/appcontroller.go#L1680 [2] https://github.com/argoproj/argo-cd/blob/master/manifests/crds/application-crd.yaml#L1476 [3] https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/application.yaml#L202C18-L202C100 * Add Changes.md entry * Fix up tests after common rebase --------- Co-authored-by: Lester Claudio <claudiol@redhat.com> Co-authored-by: day0hero <jonny@redhat.com> Co-authored-by: Lorenzo Dalrio <ldalrio@redhat.com> Co-authored-by: Andrew Beekhof <andrew@beekhof.net> Co-authored-by: Martin Jackson <mhjacks@redhat.com> Co-authored-by: jonny <65790298+day0hero@users.noreply.github.com> * Odf update (#85) * Updated namespaces template to include labels and annotations functionality * Added schema validation to support additional formal for labels and annotations * Updated the values-example.yaml to include new format for namespaces * Updated Changes.md to include new namespaces functionality. * Updating CI tests * Fixed Markdown errors * Add an experimental letsencypt chart This change adds an experimental letsencrypt chart that allows a pattern user/developer to have all routes and the API endpoint use signed certificates by letsencrypt. At this stage only AWS is supported. The full documentation is contained in the chart's README.md file * Do not run kubeconform on the certificate stuff just yet * Fix up kustomize example In the same vein as Industrial Edge 57f41dc135f72011d3796fe42d9cbf05d2b82052 we call kustomize build. Newer gitops versions dropped the openshift-clients rpm by default which contained kubectl. Let's just invoke "kustomize" directly as the binary is present in both old and new gitops versions Since "kubectl kustomize" builds the set of resources by default, we need to switch to "kubectl build" by default We also use the same naming conventions used in Industrial Edge while we're at it. * Upgrade vault-helm to v0.24.0 Tested on MCG with hub and spoke * Add a hello-world ansible playbook example Just a simple example that reads a helm value and puts it in a configmap * Inject ANSIBLE_CONFIG in make ansible-lint * Use new ansible-lint action * Fix some ansible-lint warnings * Fix up python versions * Skip cannot find role error Avoid checking those two playbooks the action seems to be too limited to understand where the ansible.cfg is * Added health check for pvc resource in argocd.yaml This allows argo to continue rolling out the rest of the applications. Without the health check the application is stuck in a progressing state and will not continue thus preventing any downstream application from deploying. * adding tests * Update super-linter image to latest * Update super-linter image to latest * Update CI workflows * updated template with why implemented comment * Add dependabot settings for github actions * adding tests * - Added functionality to support the following format for labels and annotations: labels: openshift.io/node-selector: "" annotations: openshift.io/cluster-monitoring: "true" * Fixed CI Issues * Applying @claudiol recommendation * make test * Avoid exited containers proliferation When running the `pattern.sh` script multiple times, a lot of podman exited containers will be left on the machine, adding `--rm` parameter to `podman run` makes podman automatically delete the exited containers leaving the machine cleaner. * Handling of pre-release builds is too complex for a helm chart Generating the ICSP and allowing insecure registries is best done prior to helm upgrade, and requires VPN access to registry-proxy.engineering.redhat.com * Fixing issues with operator groups * Adding CI test * Updated operator group template * Updating CI issues * Removed duplicate code for operatorgroup by using multiple conditions * Allow overriding the pattern's name This is especially useful when multiple people are working on a pattern an have been using different names: $ make help |grep Pattern: Pattern: multicloud-gitops $ make NAME=foobar help |grep Pattern: Pattern: foobar * Add precise instruction to upgrade the vault subchart * Upgrade vault-helm to v0.24.1 * Add an item to README.md * Fix up common/ tests * Fix super linter * Set gitOpsSpec.operatorSource After merging validatedpatterns/patterns-operator@235b303 it is now effectively possible to pick a different catalogSource for the gitops operator. This is needed in order to allow CI to install the gitops operator from an IIB * Introduce EXTRA_HELM_OPTS This variable can be set in order to pass additional helm arguments from the the command line. I.e. we can set things without having to tweak values files So it is now possible to run something like the following: ./pattern.sh make install \ EXTRA_HELM_OPTS="--set main.gitops.operatorSource=iib-49232" * Disable var-naming[no-role-prefix] in ansible lint * Add new ansible role to deal with IIBs * Simplify load-iib target * Add templates folder * Fix a couple of linting warnings * Fix some super-linter complaints * Skip the iib-ci playbook * Drop var-naming[no-role-prefix] linter * Allow for multiple images when calling load-iib * Add help for load-iib * Output index_image in make * Output index_image in make (2) * Set facts later in the playbook not in defaults/ * Fix how we export vars in make load-iib * Fix how we export vars in make load-iib (2) * Use machineCount to register the number of nodes that need to be ready * Add helpful debug messages * Add | on shell now that we call pipefail * Test dropping nevercontact source * Skip insecure tls when logging in * Also allow gchr.io * Revert "Test dropping nevercontact source" This reverts commit d8746a37fce2663018f52203c892f00b825e32a7. * Fix typo * Clarify instructions in the README file * Automate the channel example * Find out KUBEADMINAPI programmatically * Use command instead of shell * Do not grep for operator bundle unless it is the gitops operator * Also whitelist ghcr.io * Fetch the operator bundle itself in a more robust way It seems that the operator bundle image itself is nowhere to be found inside any OCP cluster object (it's not in packagemanifests nor catalogsource). Resorting to parsing the IIB via opm alpha commands to fetch the exact image. * Add more mirrors * Some more work to support MCE * Cleanup spacing * Fix super-linter * Move task in right folder * Drop last mention of operator instead of item * Improve the grepping for the operator bundle Without also grepping for the default_channel we can end up getting multiple results, which breaks everything. Tested this and it fixed the issue I was seeing with the openshift-gitops-operator this morning * Drop display_skipped_hosts display_skipped_hosts=False has a horrible side-effect: When a task takes a long time, it is always the *next* task and not the one printed on the screen/log. That is because ansible has to wait for the task to finish before printing it as it does not know before hand if the host will be skipped and hence the task should not be displayed at all * Be more specific about the steps in the README * Upgrade ESO to v0.8.2 * Update README.md * Update tests after eso 0.8.2 upgrade * Move to new spec format for dex/sso Via https://issues.redhat.com/browse/GITOPS-2761 we are told that the dex configuration has a new format. Old format: spec: dex: openShiftOAuth: true resources: ... New format: spec: sso: provider: dex dex: openShiftOAuth: true resources: ... This format is only supported starting with gitops-1.8.0, so we should merge this only when we are absolutely sure that no pattern in no situation needs an older gitops version. Tested on MCG with gitops-1.8.2 Note: with this change gitops < 1.8 is not supported. Starting with gitops-1.9 the old format will be unsupported. * Disable ArgoCD from kubeconform The reason is that most of the tools we used to generate the json schema, seem to be unmaintained, so it is getting hard to update our schemas in our GH org. We'll need to revisit this in the future. * Add a short line about username/token for the iib role on OCP <= 4.12 * Drop https:// from podman login Seems we hit https://www.github.com/containers/podman/issues/13691 at least with older podman versions. If this turns out to break podman 4.5.0 I will special case it later * Set the mce-subscription-spec annotation We set it by default to "redhat-operators" and if defined to .Values.clusterGroup.subscriptions.acm.source The reason we do this is the following: 1. In a default deployment scenario MCE has to be deployed as normal from the redhat-operators catalogSource just as ACM is 2. When we deploy gitops-operator from an IIB instead, MCE would be installed trying to get it from the IIB because https://www.github.com/stolostron/multiclusterhub-operator/pull/975 made it so that it picks the latest version looking at all catalog sources. But since we only mirrored the gitops operator in the cluster, this breaks as the images for MCE from the IIB are not there By setting the default to "redhat-operators" we fix this case 3. Now in the case where we want to install ACM from an IIB we need to be able to override this and we will pick whatever value is set in .Values.clusterGroup.subscriptions.acm.source, which will need to be defined for this to work when testing ACM+MCE from an IIB Note: Currently point 3. works only if you set it in a values file. Setting .Values.clusterGroup.subscriptions.acm.source via extraParams won't be passed down from the clusterGroup app to the applications. It's a bug that we need to fix. Note(2): We surround this with an 'if kindIs "map" .Values.clusterGroup.subscriptions' because we do not want to break things if subscription is a list and not a map. If we ever manage to drop subscriptions as list, then we can remove that if * Fix typo in README for iib * Simplify the README a bit * Add support for extraParams being passed down to all applications Via validatedpatterns/patterns-operator#74 we add the extraParams in an extraParametersNested dictionary that holds the extraParams key/value pairs. If they exist, let's add them as parameters. This allows them to end up in the applications. * Add a lookup playbook to figure out IIB numbers * Allow overriding channel and source when installing the patterns-operator This will allow us to test the patterns-operator using a different catalogsource (potentially installed via an IIB). So we can run: make EXTRA_HELM_OPTS="\ --set main.extraParameters[0].name=main.patternsOperator.channel --set main.extraParameters[0].value=slow \ --set main.extraParameters[1].name=main.patternsOperator.source --set main.extraParameters[1].value=patten-index" install * Fix small typo in iib instructions * Drop a redirect and up retries when pushing the IIB to the internal registry * Update ESO to v0.8.3 * WIP add presync for eso that waits for vault to be up * Add tests * Fix image and comment * Adding rbac to support the vault sa checking on the vault-0 pod status. * Make Test * Removed previous version of common to convert to subtree from https://github.com/hybrid-cloud-patterns/common.git main * updated script to check for new status * make test * make test and remove presync checks for eso * make test * make test --------- Co-authored-by: Lester Claudio <claudiol@redhat.com> Co-authored-by: Michele Baldessari <michele@acksyn.org> Co-authored-by: Lorenzo Dalrio <ldalrio@redhat.com> Co-authored-by: Andrew Beekhof <andrew@beekhof.net> Co-authored-by: Martin Jackson <mhjacks@redhat.com> --------- Co-authored-by: Michele Baldessari <michele@acksyn.org> Co-authored-by: Lester Claudio <claudiol@redhat.com> Co-authored-by: Lorenzo Dalrio <ldalrio@redhat.com> Co-authored-by: Andrew Beekhof <andrew@beekhof.net> Co-authored-by: Martin Jackson <mhjacks@redhat.com>
- Loading branch information
6 people
authored
Jul 21, 2023
1 parent
10eaac8
commit 009dc4b