Skip to content

Commit 9ac57f7

Browse files
mbaldessarimbaldessari
committed
Merge remote-tracking branch 'common-upstream/main' into common-automatic-update
2 parents 84ac25d + 9ef16ba commit 9ac57f7

60 files changed

Lines changed: 3622 additions & 1007 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎common/.github/workflows/ansible-unittest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
fetch-depth: 0
3939

4040
- name: Set up Python ${{ matrix.python-version }}
41-
uses: actions/setup-python@v4
41+
uses: actions/setup-python@v5
4242
with:
4343
python-version: ${{ matrix.python-version }}
4444

‎common/.github/workflows/jsonschema.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
fetch-depth: 0
3939

4040
- name: Set up Python ${{ matrix.python-version }}
41-
uses: actions/setup-python@v4
41+
uses: actions/setup-python@v5
4242
with:
4343
python-version: ${{ matrix.python-version }}
4444

‎common/Makefile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,13 @@ help: ## This help message
4444
show: ## show the starting template without installing it
4545
helm template common/operator-install/ --name-template $(NAME) $(HELM_OPTS)
4646

47+
preview-all:
48+
@common/scripts/preview-all.sh $(TARGET_REPO) $(TARGET_BRANCH)
49+
50+
preview-%:
51+
CLUSTERGROUP?=$(shell yq ".main.clusterGroupName" values-global.yaml)
52+
@common/scripts/preview.sh $(CLUSTERGROUP) $* $(TARGET_REPO) $(TARGET_BRANCH)
53+
4754
.PHONY: operator-deploy
4855
operator-deploy operator-upgrade: validate-prereq validate-origin validate-cluster ## runs helm install
4956
@set -e -o pipefail

‎common/acm/.github/workflows/update-helm-repo.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ on:
1818

1919
jobs:
2020
helmlint:
21-
uses: validatedpatterns/helm-charts/.github/workflows/helmlint.yml@main
21+
uses: validatedpatterns/helm-charts/.github/workflows/helmlint.yml@985ba37e0eb50b1b35ec194fc999eae2d0ae1486
2222
permissions:
2323
contents: read
2424

2525
update-helm-repo:
2626
needs: [helmlint]
27-
uses: validatedpatterns/helm-charts/.github/workflows/update-helm-repo.yml@main
27+
uses: validatedpatterns/helm-charts/.github/workflows/update-helm-repo.yml@985ba37e0eb50b1b35ec194fc999eae2d0ae1486
2828
permissions: read-all
2929
secrets: inherit

‎common/acm/templates/policies/private-repo-policies.yaml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
# We copy the vp-private-repo-credentials from the "openshift-gitops" namespace
2+
# to the "open-cluster-management" via the "private-hub-policy"
3+
#
4+
# Then we copy the secret from the "open-cluster-management" namespace to the
5+
# managed clusters "openshift-gitops" instance
6+
#
7+
# And we also copy the same secret to the namespaced argo's namespace
8+
{{ if $.Values.global.privateRepo }}
9+
{{ if .Values.clusterGroup.isHubCluster }}
10+
---
11+
apiVersion: policy.open-cluster-management.io/v1
12+
kind: Policy
13+
metadata:
14+
name: private-hub-policy
15+
annotations:
16+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
17+
argocd.argoproj.io/compare-options: IgnoreExtraneous
18+
spec:
19+
remediationAction: enforce
20+
disabled: false
21+
policy-templates:
22+
- objectDefinition:
23+
apiVersion: policy.open-cluster-management.io/v1
24+
kind: ConfigurationPolicy
25+
metadata:
26+
name: private-hub-config
27+
spec:
28+
remediationAction: enforce
29+
severity: medium
30+
namespaceSelector:
31+
include:
32+
- default
33+
object-templates:
34+
- complianceType: mustonlyhave
35+
objectDefinition:
36+
kind: Secret
37+
apiVersion: v1
38+
type: Opaque
39+
metadata:
40+
name: vp-private-repo-credentials
41+
namespace: open-cluster-management
42+
labels:
43+
argocd.argoproj.io/secret-type: repository
44+
data: '{{ `{{copySecretData "openshift-gitops" "vp-private-repo-credentials"}}` }}'
45+
---
46+
apiVersion: policy.open-cluster-management.io/v1
47+
kind: PlacementBinding
48+
metadata:
49+
name: private-hub-placement-binding
50+
annotations:
51+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
52+
placementRef:
53+
name: private-hub-placement
54+
kind: PlacementRule
55+
apiGroup: apps.open-cluster-management.io
56+
subjects:
57+
- name: private-hub-policy
58+
kind: Policy
59+
apiGroup: policy.open-cluster-management.io
60+
---
61+
apiVersion: apps.open-cluster-management.io/v1
62+
kind: PlacementRule
63+
metadata:
64+
name: private-hub-placement
65+
annotations:
66+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
67+
spec:
68+
clusterConditions:
69+
- status: 'True'
70+
type: ManagedClusterConditionAvailable
71+
clusterSelector:
72+
matchExpressions:
73+
- key: local-cluster
74+
operator: In
75+
values:
76+
- 'true'
77+
---
78+
{{ end }}{{- /* if .Values.clusterGroup.isHubCluster */}}
79+
{{- range .Values.clusterGroup.managedClusterGroups }}
80+
{{- $group := . }}
81+
{{- if not .hostedArgoSites }}
82+
apiVersion: policy.open-cluster-management.io/v1
83+
kind: Policy
84+
metadata:
85+
name: private-{{ .name }}-policy
86+
annotations:
87+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
88+
argocd.argoproj.io/compare-options: IgnoreExtraneous
89+
spec:
90+
remediationAction: enforce
91+
disabled: false
92+
policy-templates:
93+
- objectDefinition:
94+
apiVersion: policy.open-cluster-management.io/v1
95+
kind: ConfigurationPolicy
96+
metadata:
97+
name: private-{{ .name }}-config
98+
spec:
99+
remediationAction: enforce
100+
severity: medium
101+
namespaceSelector:
102+
include:
103+
- default
104+
object-templates:
105+
- complianceType: mustonlyhave
106+
objectDefinition:
107+
kind: Secret
108+
apiVersion: v1
109+
type: Opaque
110+
metadata:
111+
name: vp-private-repo-credentials
112+
namespace: openshift-gitops
113+
labels:
114+
argocd.argoproj.io/secret-type: repository
115+
data: '{{ `{{hub copySecretData "open-cluster-management" "vp-private-repo-credentials" hub}}` }}'
116+
- complianceType: mustonlyhave
117+
objectDefinition:
118+
kind: Secret
119+
apiVersion: v1
120+
type: Opaque
121+
metadata:
122+
name: vp-private-repo-credentials
123+
namespace: {{ $.Values.global.pattern }}-{{ .name }}
124+
labels:
125+
argocd.argoproj.io/secret-type: repository
126+
data: '{{ `{{hub copySecretData "open-cluster-management" "vp-private-repo-credentials" hub}}` }}'
127+
---
128+
apiVersion: policy.open-cluster-management.io/v1
129+
kind: PlacementBinding
130+
metadata:
131+
name: private-{{ .name }}-placement-binding
132+
annotations:
133+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
134+
placementRef:
135+
name: private-{{ .name }}-placement
136+
kind: PlacementRule
137+
apiGroup: apps.open-cluster-management.io
138+
subjects:
139+
- name: private-{{ .name }}-policy
140+
kind: Policy
141+
apiGroup: policy.open-cluster-management.io
142+
---
143+
apiVersion: apps.open-cluster-management.io/v1
144+
kind: PlacementRule
145+
metadata:
146+
name: private-{{ .name }}-placement
147+
annotations:
148+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
149+
spec:
150+
clusterConditions:
151+
- status: 'True'
152+
type: ManagedClusterConditionAvailable
153+
clusterSelector:
154+
matchExpressions:
155+
- key: local-cluster
156+
operator: NotIn
157+
values:
158+
- 'true'
159+
{{- end }}{{- /* if not .hostedArgoSites */}}
160+
{{- end }}{{- /* range .Values.clusterGroup.managedClusterGroups */}}
161+
{{- end }}{{- /* if $.Values.global.privateRepo */}}

‎common/ansible/roles/iib_ci/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ export CHANNEL=$(oc get -n openshift-marketplace packagemanifests -l "catalog=ii
5454
make EXTRA_HELM_OPTS="--set main.extraParameters[0].name=clusterGroup.subscriptions.acm.source --set main.extraParameters[0].value=iib-${IIB} --set main.extraParameters[1].name=clusterGroup.subscriptions.acm.channel --set main.extraParameters[1].value=${CHANNEL}" install
5555
```
5656

57-
*Note*: This needs VP operator version >= 0.0.14
57+
*Note*: In this case `acm` is the name of the subscription in `values-hub.yaml`
5858

5959
### OCP 4.13 and onwards
6060

‎common/ansible/roles/iib_ci/tasks/mirror-related-images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@
8989
image_urls: "{{ image_urls | default({}) | combine({item:
9090
{'mirrordest': mirror_dest + item | basename,
9191
'mirrordest_nosha': (mirror_dest + item | basename) | regex_replace('@.*$', ''),
92-
'mirrordest_tag': iib}}, recursive=true) }}"
92+
'mirrordest_tag': 'tag-' + item | basename | regex_replace('^.*@sha256:', '')}}, recursive=true) }}"
9393
loop: "{{ all_images }}"
9494
when: use_internal_registry
9595

‎common/ansible/roles/iib_ci/templates/imageDigestMirror.yaml.j2‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ spec:
1010
- mirrors:
1111
- {{ item.mirrordest_nosha }}
1212
source: {{ item.source_nosha }}
13-
mirrorSourcePolicy: NeverContactSource
13+
mirrorSourcePolicy: AllowContactingSource
1414
- mirrors:
1515
- {{ item.mirrordest_nosha }}
1616
source: {{ item.image_nosha }}
17-
mirrorSourcePolicy: NeverContactSource
17+
mirrorSourcePolicy: AllowContactingSource
1818
{% endfor %}

‎common/ansible/roles/vault_utils/tasks/push_secrets.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,9 @@
3030
command:
3131
sh -c "vault list auth/{{ vault_hub }}/role | grep '{{ vault_hub }}-role'"
3232
register: vault_role_cmd
33-
until: vault_role_cmd.rc == 0
33+
until:
34+
- vault_role_cmd.rc is defined
35+
- vault_role_cmd.rc == 0
3436
retries: 20
3537
delay: 45
3638
changed_when: false

‎common/clustergroup/.github/workflows/update-helm-repo.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
# - Contents: r/w
1010
# - Deployments: r/w
1111
# - Pages: r/w
12+
#
1213

1314
name: vp-patterns/update-helm-repo
1415
on:
@@ -18,12 +19,12 @@ on:
1819

1920
jobs:
2021
helmlint:
21-
uses: validatedpatterns/helm-charts/.github/workflows/helmlint.yml@main
22+
uses: validatedpatterns/helm-charts/.github/workflows/helmlint.yml@985ba37e0eb50b1b35ec194fc999eae2d0ae1486
2223
permissions:
2324
contents: read
2425

2526
update-helm-repo:
2627
needs: [helmlint]
27-
uses: validatedpatterns/helm-charts/.github/workflows/update-helm-repo.yml@main
28+
uses: validatedpatterns/helm-charts/.github/workflows/update-helm-repo.yml@985ba37e0eb50b1b35ec194fc999eae2d0ae1486
2829
permissions: read-all
2930
secrets: inherit

0 commit comments

Comments
 (0)