Release 1.4.0 (#137)

* update 1.3.0 to 1.4.0 and ocp 4.12 to 4.13 (#121) * update 1.3.0 to 1.4.0 and ocp 4.12 to 4.13 * change channel + csi version * Update flashsystem-csi-cr_v1_configmap.yaml * Update flashsystemcluster-metrics_rbac.authorization.k8s.io_v1_role.yaml * Update flashystemcluster-metrics_rbac.authorization.k8s.io_v1_rolebinding.yaml * Update ibm-storage-odf-operator-metrics-service_v1_service.yaml * Update ibm-storage-odf-operator.clusterserviceversion.yaml * Update metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml * Update odf.ibm.com_flashsystemclusters.yaml * Update annotations.yaml * Update dependencies.yaml * Add must gaher image to iso github workflow (#124) * add must gather to iso workflows * change context for must gather in iso file * change dockerfile path for must gather in iso fil * Create build-images scripts and Jenks job (#123) * replace build with buildx and add more makefile vars * add build images script and Jenkins pipeline file * fix import python module * check script return code * extract strings to const and refactor build images script * fix indentation errors * add output file parameter * upload created images file to jenkins artifacts * add support for different tags of operator, driver and console * fix catalog build make command * run build-image script inside docker container and adjust jenkins accordingly * refactor build-image script * add seperate tags for console and driver * fix typo * fix output file path in Jenkinsfile * fix output file path and env variables assignment * handle env variables in Jenkinsfile * bump opm version to 1.19.5 * change make command for driver and console scripts * generate image tag according to israel timezone * Delete build_images.cpython-38.pyc * update CSV (#122) * update CSV * edit csv files * Update flashsystem-csi-cr_v1_configmap.yaml * Update annotations.yaml * Update manager_auth_proxy_patch.yaml * Update manager_config_patch.yaml * Update controller_manager_config.yaml * Update manager.yaml * Update monitor.yaml * Update monitor.yaml * Update auth_proxy_client_clusterrole.yaml * Update auth_proxy_role.yaml * Update auth_proxy_role_binding.yaml * Update auth_proxy_service.yaml * Update flashsystemcluster_editor_role.yaml * Update flashsystemcluster_viewer_role.yaml * Update leader_election_role.yaml * Update leader_election_role_binding.yaml * Update role_binding.yaml * Update service_account.yaml * Update csi.ibm.com_v1_ibmblockcsi_cr.yaml * Update odf_v1alpha1_flashsystemcluster.yaml * Add must gather image to iso github workflow (#124) * add must gather to iso workflows * change context for must gather in iso file * change dockerfile path for must gather in iso file * Create build-images scripts and Jenkins job (#123) * replace build with buildx and add more makefile vars * add build images script and Jenkins pipeline file * fix import python module * check script return code * extract strings to const and refactor build images script * fix indentation errors * add output file parameter * upload created images file to jenkins artifacts * add support for different tags of operator, driver and console * fix catalog build make command * run build-image script inside docker container and adjust jenkins accordingly * refactor build-image script * add seperate tags for console and driver * fix typo * fix output file path in Jenkinsfile * fix output file path and env variables assignment * handle env variables in Jenkinsfile * bump opm version to 1.19.5 * change make command for driver and console scripts * generate image tag according to israel timezone * Delete build_images.cpython-38.pyc * change watch_namespace variable name, change value to operatorNamespace instead of targetNamespace * remove platform var * remove empty line * update csi to 1.12.0 * Task/reconcile on cm deletion (#125) * watch configMap in case of deletion * watch configMap in case of deletion for storageclasses and flashsystemclusrers * add sc identifier * build file-based catalog image build bundle using opm command * build bundle using opm command * add opm import * add csi bunde build add csi bundle to internal odf catalog * split bundle build into functions * add empty line * rebuild ensure-opm * add prints * set export with full opm file path * set export with full opm file path * remove prints * chang to ODF user * update OWNERS file to current ODF-FS team members (#130) * update OWNERS file to current ODF-FS team members * add gyaozhou as an emeritus_approver - https://www.kubernetes.dev/docs/guide/owners/#emeritus * remove unsupported actions (#131) * remove unsupported actions * enable github action for PR (#132) * enable github action for PR * change codespell action version --------- * update csi verson to 1.11.1 * Revert "update csi version to 1.11.1" This reverts commit 843484d. * update csi version to 1.11.1 * fix volume group sidecar image in csi operator csv in case in develop mode (#134) * update override function name and add sed commands for volume group repo and tag * update variable names in common.sh file for csi volume group * add upgrade params * add image to catalog * set only one default channel on catalog * add upgrade flag to buid-images pipeline (#136) --------- Signed-off-by: Tal Yichye <[email protected]> Signed-off-by: 662962756 <[email protected]> Co-authored-by: tyichye19 <[email protected]> Co-authored-by: Alon Firestein <[email protected]>
IBM · Jun 8, 2023 · 7525dea · 7525dea
1 parent a62cc98
commit 7525dea
Show file tree

Hide file tree

Showing 39 changed files with 590 additions and 132 deletions.
diff --git a/.github/workflows/codespell.yaml b/.github/workflows/codespell.yaml
@@ -14,7 +14,7 @@ jobs:
     - uses: actions/checkout@v2
 
     - name: codespell
-      uses: codespell-project/actions-codespell@master
+      uses: codespell-project/actions-codespell@v1
       with:
         check_filenames: true
         check_hidden: true

diff --git a/.github/workflows/iso-ci.yaml b/.github/workflows/iso-ci.yaml
@@ -62,8 +62,11 @@ jobs:
 
     - name: get tag without v
       id: tag
+      shell: bash
       if: ${{ github.event_name == 'release' && github.event.action == 'published' }}
-      uses: battila7/get-version-action@v2
+      run: |
+        BUILD_VERSION=${{ github.event.release.tag_name }}
+        echo "BUILD_VERSION=${BUILD_VERSION:1}" >> $GITHUB_ENV
 
     # Build and (optionally) push the operator image
     - name: build the operator image
@@ -73,16 +76,16 @@ jobs:
         file: ./Dockerfile
         platforms: linux/amd64,linux/ppc64le,linux/s390x
         build-args: |
-          VCS_REF=${{ steps.tag.outputs.version-without-v || 'dev' }}-${{ steps.vars.outputs.sha_short }}
+          VCS_REF=${{ env.BUILD_VERSION || 'dev' }}-${{ steps.vars.outputs.sha_short }}
           VCS_URL=${{ env.VCS_URL }}
         # Only push if we are publishing a release
         push: ${{ github.event_name == 'release' && github.event.action == 'published' }}
         # Use a 'dev' tag, that won't be pushed, for non-release builds
-        tags: quay.io/ibmodffs/ibm-storage-odf-operator:${{ steps.tag.outputs.version-without-v || 'dev' }}
+        tags: quay.io/ibmodffs/ibm-storage-odf-operator:${{ env.BUILD_VERSION || 'dev' }}
 
     - name: generate bundle manifests and metadata
       run: |
-        export IMAGE_TAG=${{ steps.tag.outputs.version-without-v || 'dev' }}
+        export IMAGE_TAG=${{ env.BUILD_VERSION || 'dev' }}
         make bundle
         rm -rf ./bundle/manifests/ibm-storage-odf-operator_v1_serviceaccount.yaml
 
@@ -94,4 +97,13 @@ jobs:
         file: ./bundle.Dockerfile
         platforms: linux/amd64,linux/ppc64le,linux/s390x
         push: ${{ github.event_name == 'release' && github.event.action == 'published' }}
-        tags: quay.io/ibmodffs/ibm-storage-odf-operator-bundle:${{ steps.tag.outputs.version-without-v || 'dev' }}
+        tags: quay.io/ibmodffs/ibm-storage-odf-operator-bundle:${{ env.BUILD_VERSION || 'dev' }}
+
+      # Build and (optionally) push the operator must gather image
+    - name: build the operator must gather image
+      uses: docker/build-push-action@v2
+      with:
+        context: ./must-gather
+        file: ./must-gather/Dockerfile
+        push: ${{ github.event_name == 'release' && github.event.action == 'published' }}
+        tags: quay.io/ibmodffs/ibm-storage-odf-operator-must-gather:${{ env.BUILD_VERSION || 'dev' }}
diff --git a/Dockerfile b/Dockerfile
@@ -33,7 +33,7 @@ LABEL vendor="IBM" \
   org.label-schema.name="ibm storage odf operator" \
   org.label-schema.vcs-ref=$VCS_REF \
   org.label-schema.vcs-url=$VCS_URL \
-  org.label-schema.schema-version="1.3.0" \
+  org.label-schema.schema-version="1.4.0" \
   summary="IBM Storage ODF Operator" \
   description="operator and driver of ibm storage systems for openshift data foundation (ODF)"
 

diff --git a/OWNERS b/OWNERS
@@ -1,10 +1,16 @@
 reviewers:
-  - keslerzhu
-  - WangDanDan7
-  - lbscorpio
-  - likezhao-ibm
-  - jacklu1024
-  - shdn-ibm
-  - gyaozhou
+  - bvered
+  - alonfirestein
+  - tyichye19
+  - benmenachem
+  - hatsavar
+
 approvers:
+  - bvered
+  - alonfirestein
+  - tyichye19
+  - benmenachem
+  - hatsavar
+
+emeritus_approvers:
   - gyaozhou
diff --git a/README.md b/README.md
@@ -71,7 +71,6 @@ To install own development builds of ISO, first build and push the operator imag
 
 ```
 $ export IMAGE_REGISTRY=<add new registry url here>
-$ export REGISTRY_NAMESPACE=<add namespace here>
 $ export IMAGE_TAG=<some-tag>
 $ make docker-build
 ```

diff --git a/bundle.Dockerfile b/bundle.Dockerfile
@@ -5,8 +5,8 @@ LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
 LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
 LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
 LABEL operators.operatorframework.io.bundle.package.v1=ibm-storage-odf-operator
-LABEL operators.operatorframework.io.bundle.channels.v1=stable-v1.3
-LABEL operators.operatorframework.io.bundle.channel.default.v1=stable-v1.3
+LABEL operators.operatorframework.io.bundle.channels.v1=stable-v1.4
+LABEL operators.operatorframework.io.bundle.channel.default.v1=stable-v1.4
 LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.25.0
 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
 LABEL operators.operatorframework.io.metrics.project_layout=go.kubebuilder.io/v3
@@ -19,5 +19,5 @@ LABEL operators.operatorframework.io.test.config.v1=tests/scorecard/
 COPY bundle/manifests /manifests/
 COPY bundle/metadata /metadata/
 COPY bundle/tests/scorecard /tests/scorecard/
-LABEL com.redhat.openshift.versions="v4.12"
+LABEL com.redhat.openshift.versions="v4.13"
 LABEL com.redhat.delivery.operator.bundle=true
diff --git a/bundle/manifests/flashsystem-csi-cr_v1_configmap.yaml b/bundle/manifests/flashsystem-csi-cr_v1_configmap.yaml
@@ -1,23 +1,22 @@
----
 apiVersion: v1
 data:
   csi.ibm.com_v1_ibmblockcsi_cr.yaml: |
     apiVersion: csi.ibm.com/v1
     kind: IBMBlockCSI
     metadata:
       name: ibm-block-csi
-      namespace: openshift-storage
+      namespace: default
       labels:
         app.kubernetes.io/name: ibm-block-csi
         app.kubernetes.io/instance: ibm-block-csi
         app.kubernetes.io/managed-by: ibm-block-csi-operator
-        release: v1.11.0
+        release: v1.11.1
     spec:
       # controller is a statefulSet with ibm-block-csi-controller container
       # and csi-provisioner, csi-attacher, csi-snapshotter and livenessprobe sidecars.
       controller:
-        repository: quay.io/ibmcsiblock/ibm-block-csi-driver-controller
-        tag: "1.11.0"
+        repository: stg-artifactory.xiv.ibm.com:5030/ibm-block-csi-driver-controller-amd64
+        tag: "latest"
         imagePullPolicy: IfNotPresent
         affinity:
           nodeAffinity:
@@ -34,8 +33,8 @@ data:
       # node is a daemonSet with ibm-block-csi-node container
       # and csi-node-driver-registrar and livenessprobe sidecars.
       node:
-        repository: quay.io/ibmcsiblock/ibm-block-csi-driver-node
-        tag: "1.11.0"
+        repository: stg-artifactory.xiv.ibm.com:5030/ibm-block-csi-driver-node-amd64
+        tag: "latest"
         imagePullPolicy: IfNotPresent
         affinity:
           nodeAffinity:

diff --git a/bundle/manifests/flashsystemcluster-metrics_rbac.authorization.k8s.io_v1_role.yaml b/bundle/manifests/flashsystemcluster-metrics_rbac.authorization.k8s.io_v1_role.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:

diff --git a/bundle/manifests/flashsystemcluster-metrics_rbac.authorization.k8s.io_v1_rolebinding.yaml b/bundle/manifests/flashsystemcluster-metrics_rbac.authorization.k8s.io_v1_rolebinding.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:

diff --git a/bundle/manifests/ibm-storage-odf-operator-metrics-service_v1_service.yaml b/bundle/manifests/ibm-storage-odf-operator-metrics-service_v1_service.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: v1
 kind: Service
 metadata:

diff --git a/bundle/manifests/ibm-storage-odf-operator.clusterserviceversion.yaml b/bundle/manifests/ibm-storage-odf-operator.clusterserviceversion.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: operators.coreos.com/v1alpha1
 kind: ClusterServiceVersion
 metadata:
@@ -34,8 +33,8 @@ metadata:
     operators.operatorframework.io/builder: operator-sdk-v1.25.0
     operators.operatorframework.io/operator-type: non-standalone
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
-    olm.skipRange: '>=0.0.1 <1.3.0'
-  name: ibm-storage-odf-operator.v1.3.0
+    olm.skipRange: '>=0.0.1 <1.4.0'
+  name: ibm-storage-odf-operator.v1.4.0
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -299,13 +298,18 @@ spec:
                       - --secure-listen-address=0.0.0.0:8443
                       - --upstream=http://127.0.0.1:8080/
                       - --logtostderr=true
-                      - --v=10
-                    image: registry.redhat.io/openshift4/ose-kube-rbac-proxy:v4.9
+                      - --v=0
+                    image: registry.redhat.io/openshift4/ose-kube-rbac-proxy:v4.11
                     name: kube-rbac-proxy
                     ports:
                       - containerPort: 8443
                         name: https
                     resources: {}
+                    securityContext:
+                      allowPrivilegeEscalation: false
+                      capabilities:
+                        drop:
+                          - all
                   - args:
                       - --health-probe-bind-address=:8081
                       - --metrics-bind-address=127.0.0.1:8080
@@ -315,12 +319,12 @@ spec:
                       - /manager
                     env:
                       - name: EXPORTER_IMAGE
-                        value: quay.io/ibmodffs/ibm-storage-odf-block-driver:1.3.0
-                      - name: WATCH_NAMESPACE
+                        value: quay.io/ibmodffs/ibm-storage-odf-block-driver:1.4.0
+                      - name: RESOURCES_NAMESPACE
                         valueFrom:
                           fieldRef:
                             fieldPath: metadata.annotations['olm.operatorNamespace']
-                    image: registry.connect.redhat.com/ibm/ibm-storage-odf-operator:1.3.0
+                    image: registry.connect.redhat.com/ibm/ibm-storage-odf-operator:1.4.0
                     imagePullPolicy: Always
                     livenessProbe:
                       httpGet:
@@ -344,6 +348,9 @@ spec:
                         memory: 200Mi
                     securityContext:
                       allowPrivilegeEscalation: false
+                      capabilities:
+                        drop:
+                          - all
                     volumeMounts:
                       - mountPath: /config
                         name: manager-config
@@ -369,7 +376,7 @@ spec:
                   app: ibm-odf-console
               spec:
                 containers:
-                  - image: quay.io/ibmodffs/ibm-storage-odf-plugin:1.3.0
+                  - image: quay.io/ibmodffs/ibm-storage-odf-plugin:1.4.0
                     name: ibm-odf-console
                     ports:
                       - containerPort: 9003
@@ -378,10 +385,17 @@ spec:
                       limits:
                         cpu: 50m
                         memory: 100Mi
+                    securityContext:
+                      allowPrivilegeEscalation: false
+                      capabilities:
+                        drop:
+                          - all
                     volumeMounts:
                       - mountPath: /var/serving-cert
                         name: ibm-odf-console-serving-cert
                         readOnly: true
+                securityContext:
+                  runAsNonRoot: true
                 volumes:
                   - name: ibm-odf-console-serving-cert
                     secret:
@@ -441,4 +455,4 @@ spec:
   maturity: alpha
   provider:
     name: IBM
-  version: 1.3.0
+  version: 1.4.0
diff --git a/bundle/manifests/metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml b/bundle/manifests/metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

diff --git a/bundle/manifests/odf.ibm.com_flashsystemclusters.yaml b/bundle/manifests/odf.ibm.com_flashsystemclusters.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:

diff --git a/bundle/metadata/annotations.yaml b/bundle/metadata/annotations.yaml
@@ -1,12 +1,11 @@
----
 annotations:
   # Core bundle annotations.
   operators.operatorframework.io.bundle.mediatype.v1: registry+v1
   operators.operatorframework.io.bundle.manifests.v1: manifests/
   operators.operatorframework.io.bundle.metadata.v1: metadata/
   operators.operatorframework.io.bundle.package.v1: ibm-storage-odf-operator
-  operators.operatorframework.io.bundle.channels.v1: stable-v1.3
-  operators.operatorframework.io.bundle.channel.default.v1: stable-v1.3
+  operators.operatorframework.io.bundle.channels.v1: stable-v1.4
+  operators.operatorframework.io.bundle.channel.default.v1: stable-v1.4
   operators.operatorframework.io.metrics.builder: operator-sdk-v1.25.0
   operators.operatorframework.io.metrics.mediatype.v1: metrics+v1
   operators.operatorframework.io.metrics.project_layout: go.kubebuilder.io/v3
@@ -16,4 +15,4 @@ annotations:
   operators.operatorframework.io.test.config.v1: tests/scorecard/
 
   # OpenShift annotations:
-  com.redhat.openshift.versions: =v4.12
+  com.redhat.openshift.versions: =v4.13
diff --git a/bundle/metadata/dependencies.yaml b/bundle/metadata/dependencies.yaml
@@ -1,6 +1,5 @@
----
 dependencies:
   - type: olm.package
     value:
       packageName: ibm-block-csi-operator
-      version: ">=1.11.0"
+      version: ">=1.11.1"
diff --git a/bundle/tests/scorecard/config.yaml b/bundle/tests/scorecard/config.yaml
@@ -12,38 +12,59 @@ stages:
     labels:
       suite: basic
       test: basic-check-spec-test
+    storage:
+      spec:
+        mountPath: {}
   - entrypoint:
     - scorecard-test
     - olm-bundle-validation
     image: quay.io/operator-framework/scorecard-test:v1.5.0
     labels:
       suite: olm
       test: olm-bundle-validation-test
+    storage:
+      spec:
+        mountPath: {}
   - entrypoint:
     - scorecard-test
     - olm-crds-have-validation
     image: quay.io/operator-framework/scorecard-test:v1.5.0
     labels:
       suite: olm
       test: olm-crds-have-validation-test
+    storage:
+      spec:
+        mountPath: {}
   - entrypoint:
     - scorecard-test
     - olm-crds-have-resources
     image: quay.io/operator-framework/scorecard-test:v1.5.0
     labels:
       suite: olm
       test: olm-crds-have-resources-test
+    storage:
+      spec:
+        mountPath: {}
   - entrypoint:
     - scorecard-test
     - olm-spec-descriptors
     image: quay.io/operator-framework/scorecard-test:v1.5.0
     labels:
       suite: olm
       test: olm-spec-descriptors-test
+    storage:
+      spec:
+        mountPath: {}
   - entrypoint:
     - scorecard-test
     - olm-status-descriptors
     image: quay.io/operator-framework/scorecard-test:v1.5.0
     labels:
       suite: olm
       test: olm-status-descriptors-test
+    storage:
+      spec:
+        mountPath: {}
+storage:
+  spec:
+    mountPath: {}
diff --git a/config/console/console_init.yaml b/config/console/console_init.yaml
@@ -25,7 +25,14 @@ spec:
             - name: ibm-odf-console-serving-cert
               mountPath: /var/serving-cert
               readOnly: true
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - all
       volumes:
         - name: ibm-odf-console-serving-cert
           secret:
             secretName: ibm-odf-console-serving-cert
+      securityContext:
+        runAsNonRoot: true
diff --git a/config/console/kustomization.yaml b/config/console/kustomization.yaml
@@ -12,4 +12,4 @@ kind: Kustomization
 images:
   - name: ibm-console
     newName: quay.io/ibmodffs/ibm-storage-odf-plugin
-    newTag: 1.3.0
+    newTag: 1.4.0