Sync

assets/monitoring/grafana/v1alpha1/deployment.yaml

@@ -123,9 +123,9 @@ spec:
         securityContext:
           allowPrivilegeEscalation: false
           privileged: false
-          runAsNonRoot: true
-          runAsUser: 472
-          runAsGroup: 472
+#          runAsNonRoot: true
+#          runAsUser: 472
+#          runAsGroup: 472
           capabilities:
             drop:
             - ALL
@@ -158,9 +158,9 @@ spec:
         emptyDir:
           sizeLimit: 100Mi
       securityContext:
-        runAsNonRoot: true
-        runAsUser: 472
-        runAsGroup: 472
-        fsGroup: 472
+#        runAsNonRoot: true
+#        runAsUser: 472
+#        runAsGroup: 472
+#        fsGroup: 472
         seccompProfile:
           type: RuntimeDefault

deploy/manager/dev/50_scyllacluster.yaml

@@ -25,3 +25,9 @@ spec:
           requests:
             cpu: 10m
             memory: 100Mi
+        placement:
+          tolerations:
+          - key: role
+            operator: Equal
+            value: scylla-clusters
+            effect: NoSchedule

deploy/manager/prod/50_scyllacluster.yaml

@@ -25,3 +25,9 @@ spec:
         requests:
           cpu: 1
           memory: 200Mi
+      placement:
+        tolerations:
+        - key: role
+          operator: Equal
+          value: scylla-clusters
+          effect: NoSchedule

deploy/operator.yaml

@@ -61,6 +61,12 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods/finalizers
+  verbs:
+  - update
 - apiGroups:
   - ""
   resources:
@@ -96,6 +102,7 @@ rules:
   resources:
   - statefulsets
   - daemonsets
+  - daemonsets/finalizers
   - deployments
   verbs:
   - create
@@ -115,7 +122,9 @@ rules:
   - scylla.scylladb.com
   resources:
   - scyllaclusters
+  - scyllaclusters/finalizers
   - scylladbmonitorings
+  - scylladbmonitorings/finalizers
   verbs:
   - create
   - delete
@@ -139,6 +148,7 @@ rules:
   - ""
   resources:
   - configmaps
+  - configmaps/finalizers
   verbs:
   - create
   - delete
@@ -175,6 +185,8 @@ rules:
   - scylla.scylladb.com
   resources:
   - nodeconfigs
+  - nodeconfigs/status
+  - nodeconfigs/finalizers
   verbs:
   - create
   - delete
@@ -210,18 +222,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - scylla.scylladb.com
-  resources:
-  - nodeconfigs/status
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - batch
   resources:
@@ -284,6 +284,14 @@ rules:
   - patch
   - update
   - delete
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
 
 ---
 apiVersion: v1
@@ -5094,6 +5102,7 @@ rules:
   - ""
   resources:
   - configmaps
+  - configmaps/finalizers
   verbs:
   - get
   - list
@@ -5123,6 +5132,14 @@ rules:
   - scyllaclusters
   verbs:
   - get
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1

deploy/operator/00_clusterrole_def.yaml

@@ -51,6 +51,12 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods/finalizers
+  verbs:
+  - update
 - apiGroups:
   - ""
   resources:
@@ -86,6 +92,7 @@ rules:
   resources:
   - statefulsets
   - daemonsets
+  - daemonsets/finalizers
   - deployments
   verbs:
   - create
@@ -105,7 +112,9 @@ rules:
   - scylla.scylladb.com
   resources:
   - scyllaclusters
+  - scyllaclusters/finalizers
   - scylladbmonitorings
+  - scylladbmonitorings/finalizers
   verbs:
   - create
   - delete
@@ -129,6 +138,7 @@ rules:
   - ""
   resources:
   - configmaps
+  - configmaps/finalizers
   verbs:
   - create
   - delete
@@ -165,6 +175,8 @@ rules:
   - scylla.scylladb.com
   resources:
   - nodeconfigs
+  - nodeconfigs/status
+  - nodeconfigs/finalizers
   verbs:
   - create
   - delete
@@ -200,18 +212,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - scylla.scylladb.com
-  resources:
-  - nodeconfigs/status
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - batch
   resources:
@@ -274,3 +274,11 @@ rules:
   - patch
   - update
   - delete
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use

deploy/operator/00_scyllacluster_member_clusterrole_def.yaml

@@ -24,6 +24,7 @@ rules:
   - ""
   resources:
   - configmaps
+  - configmaps/finalizers
   verbs:
   - get
   - list
@@ -53,3 +54,11 @@ rules:
   - scyllaclusters
   verbs:
   - get
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use

examples/eks/nodeconfig-alpha.yaml

@@ -9,7 +9,7 @@ spec:
       type: xfs
     mounts:
     - device: /dev/md/nvmes
-      mountPoint: /mnt/persistent-volumes
+      mountPoint: /var/mnt/persistent-volumes
       unsupportedOptions:
       - prjquota
     raids:

examples/gke/nodeconfig-alpha.yaml

@@ -9,7 +9,7 @@ spec:
       type: xfs
     mounts:
     - device: /dev/md/nvmes
-      mountPoint: /mnt/persistent-volumes
+      mountPoint: /var/mnt/persistent-volumes
       unsupportedOptions:
       - prjquota
     raids:

examples/third-party/haproxy-ingress/10_haproxy-ingress.role.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: haproxy-ingress
+rules:
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use

examples/third-party/haproxy-ingress/20_haproxy-ingress.rolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: haproxy-ingress
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: haproxy-ingress
+subjects:
+- kind: ServiceAccount
+  name: haproxy-ingress
+  namespace: haproxy-ingress

hack/.ci/manifests/namespaces/local-csi-driver/10_provisioner_clusterrole.yaml

@@ -3,6 +3,14 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: scylladb:csi-external-provisioner
 rules:
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
 - apiGroups:
   - ""
   resources:

hack/ci-deploy.sh

@@ -31,7 +31,7 @@ cp ./examples/third-party/haproxy-ingress/*.yaml "${DEPLOY_DIR}/haproxy-ingress"
 cp ./examples/common/cert-manager.yaml "${DEPLOY_DIR}/"
 
 for f in $( find "${DEPLOY_DIR}"/ -type f -name '*.yaml' ); do
-    sed -i -E -e "s~docker.io/scylladb/scylla-operator(:|@sha256:)[^ ]*~${OPERATOR_IMAGE_REF}~" "${f}"
+    sed -i -E -e "s~docker.io/scylladb/scylla-operator:[^ ]*~${OPERATOR_IMAGE_REF}~" "${f}"
 done
 
 yq e --inplace '.spec.template.spec.containers[0].args += ["--qps=200", "--burst=400"]' "${DEPLOY_DIR}/operator/50_operator.deployment.yaml"
@@ -41,8 +41,8 @@ if [[ -n ${SCYLLA_OPERATOR_FEATURE_GATES+x} ]]; then
     yq e --inplace '.spec.template.spec.containers[0].args += "--feature-gates="+ strenv(SCYLLA_OPERATOR_FEATURE_GATES)' "${DEPLOY_DIR}/operator/50_operator.deployment.yaml"
 fi
 
-kubectl_create -n prometheus-operator -f "${DEPLOY_DIR}/prometheus-operator"
-kubectl_create -n haproxy-ingress -f "${DEPLOY_DIR}/haproxy-ingress"
+kubectl_create -n=prometheus-operator -f="${DEPLOY_DIR}/prometheus-operator"
+kubectl_create -n=haproxy-ingress -f="${DEPLOY_DIR}/haproxy-ingress"
 kubectl_create -f "${DEPLOY_DIR}"/cert-manager.yaml
 
 # Wait for cert-manager
@@ -69,6 +69,7 @@ if [[ -z "${SO_CSI_DRIVER_PATH:-}" ]]; then
   echo "Skipping CSI driver creation"
 else
   kubectl_create -n=local-csi-driver -f="${SO_CSI_DRIVER_PATH}"
+  kubectl -n=local-csi-driver rollout status -f="${SO_CSI_DRIVER_PATH}"
 fi
 
 if [[ -n "${SO_SCYLLACLUSTER_STORAGECLASS_NAME}" ]]; then
@@ -90,3 +91,6 @@ kubectl wait --for condition=established crd/nodeconfigs.scylla.scylladb.com
 kubectl wait --for condition=established crd/scyllaoperatorconfigs.scylla.scylladb.com
 kubectl wait --for condition=established crd/scylladbmonitorings.scylla.scylladb.com
 kubectl wait --for condition=established $( find "${DEPLOY_DIR}/prometheus-operator/" -name '*.crd.yaml' -printf '-f=%p\n' )
+
+kubectl -n=haproxy-ingress rollout status -f="${DEPLOY_DIR}/haproxy-ingress"
+kubectl -n=haproxy-ingress rollout status -f="${DEPLOY_DIR}/prometheus-operator"

hack/run-e2e-remote.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+#
+# Copyright (C) 2024 ScyllaDB
+#
+
+set -euExo pipefail
+shopt -s inherit_errexit
+
+source "$( dirname "${BASH_SOURCE[0]}" )/.ci/lib/e2e.sh"
+
+KUBECONFIG="${KUBECONFIGS[0]}" apply-e2e-workarounds
+KUBECONFIG="${KUBECONFIGS[0]}" run-e2e

helm/scylla-manager/values.yaml

@@ -90,6 +90,12 @@ scylla:
       requests:
         cpu: 1
         memory: 200Mi
+  placement:
+    tolerations:
+    - key: role
+      operator: Equal
+      value: scylla-clusters
+      effect: NoSchedule
 
 # Whether to create Prometheus ServiceMonitor
 serviceMonitor: