Merge branch 'main' into fix/user-roles-order-sensitive-comparison

Author: egegunes

.github/workflows/labeler.yml

@@ -1,8 +1,10 @@
 name: "PR Labeler"
+permissions:
+  contents: read
+  pull-requests: write
 on:
   pull_request:
     types: [opened, synchronize]
-
 jobs:
   label:
     runs-on: ubuntu-latest

.github/workflows/reviewdog.yml

@@ -1,4 +1,6 @@
 name: reviewdog
+permissions:
+  contents: read
 on: [pull_request]
 jobs:
   golangci-lint:
@@ -94,12 +96,12 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: check on release branch
-        if: ${{ contains(github.head_ref, 'release-') || contains(github.base_ref, 'release-') }}
+        if: ${{ contains(github.base_ref, 'release-') }}
         run: |
           make generate manifests VERSION="$(grep -Eo "[0-9]+\.[0-9]+\.[0-9]+" pkg/version/version.txt)" IMAGE_TAG_BASE="percona/percona-server-mongodb-operator"
           git diff --exit-code
       - name: check on non release branches
-        if: ${{ ! (contains(github.head_ref, 'release-') || contains(github.base_ref, 'release-')) }}
+        if: ${{ ! contains(github.base_ref, 'release-') }}
         run: |
           make generate manifests VERSION=main
           git diff --exit-code

.github/workflows/scan.yml

@@ -1,5 +1,7 @@
 name: Scan docker
 on: [pull_request]
+permissions:
+  contents: read
 
 env:
   # Use docker.io for Docker Hub if empty

.github/workflows/stale.yml

@@ -5,6 +5,9 @@ on:
 
 jobs:
   stale:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/stale@v10

.github/workflows/test.yml

@@ -1,4 +1,7 @@
 name: Run tests
+permissions:
+  contents: read
+  pull-requests: write
 on: [pull_request]
 jobs:
   test:

Jenkinsfile

@@ -1,6 +1,8 @@
-region = 'us-central1-a'
-testUrlPrefix = 'https://percona-jenkins-artifactory-public.s3.amazonaws.com/cloud-psmdb-operator'
-tests = []
+import groovy.transform.Field
+
+@Field def region = 'us-central1-a'
+@Field def testUrlPrefix = 'https://percona-jenkins-artifactory-public.s3.amazonaws.com/cloud-psmdb-operator'
+@Field def tests = []
 
 void createCluster(String CLUSTER_SUFFIX) {
     withCredentials([string(credentialsId: 'GCP_PROJECT_ID', variable: 'GCP_PROJECT'), file(credentialsId: 'gcloud-key-file', variable: 'CLIENT_SECRET_FILE')]) {
@@ -182,8 +184,8 @@ String formatTime(def time) {
     }
 }
 
-TestsReport = '| Test Name | Result | Time |\r\n| ----------- | -------- | ------ |'
-TestsReportXML = '<testsuite name=\\"PSMDB\\">\n'
+@Field def TestsReport = '| Test Name | Result | Time |\r\n| ----------- | -------- | ------ |'
+@Field def TestsReportXML = '<testsuite name=\\"PSMDB\\">\n'
 
 void makeReport() {
     def wholeTestAmount = tests.size()
@@ -290,7 +292,7 @@ void prepareNode() {
         sudo curl -sLo /usr/local/bin/kubectl https://dl.k8s.io/release/\$(curl -Ls https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl && sudo chmod +x /usr/local/bin/kubectl
         kubectl version --client --output=yaml
 
-        curl -fsSL https://get.helm.sh/helm-v3.19.0-linux-amd64.tar.gz | sudo tar -C /usr/local/bin --strip-components 1 -xzf - linux-amd64/helm
+        curl -fsSL https://get.helm.sh/helm-v3.20.0-linux-amd64.tar.gz | sudo tar -C /usr/local/bin --strip-components 1 -xzf - linux-amd64/helm
 
         sudo curl -fsSL https://github.com/mikefarah/yq/releases/download/v4.48.1/yq_linux_amd64 -o /usr/local/bin/yq && sudo chmod +x /usr/local/bin/yq
         sudo curl -fsSL https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux64 -o /usr/local/bin/jq && sudo chmod +x /usr/local/bin/jq
@@ -344,7 +346,7 @@ boolean isManualBuild() {
     return !causes.isEmpty()
 }
 
-needToRunTests = true
+@Field def needToRunTests = true
 void checkE2EIgnoreFiles() {
     if (isManualBuild()) {
         echo "This is a manual rebuild. Forcing pipeline execution."
@@ -423,9 +425,9 @@ pipeline {
         CLOUDSDK_CORE_DISABLE_PROMPTS = 1
         CLEAN_NAMESPACE = 1
         OPERATOR_NS = 'psmdb-operator'
-        GIT_SHORT_COMMIT = sh(script: 'git rev-parse --short HEAD', , returnStdout: true).trim()
+        GIT_SHORT_COMMIT = sh(script: 'git rev-parse --short HEAD', returnStdout: true).trim()
         VERSION = "${env.GIT_BRANCH}-${env.GIT_SHORT_COMMIT}"
-        CLUSTER_NAME = sh(script: "echo jen-psmdb-${env.CHANGE_ID}-${GIT_SHORT_COMMIT}-${env.BUILD_NUMBER} | tr '[:upper:]' '[:lower:]'", , returnStdout: true).trim()
+        CLUSTER_NAME = sh(script: "echo jen-psmdb-${env.CHANGE_ID}-${GIT_SHORT_COMMIT}-${env.BUILD_NUMBER} | tr '[:upper:]' '[:lower:]'", returnStdout: true).trim()
         AUTHOR_NAME = sh(script: "echo ${CHANGE_AUTHOR_EMAIL} | awk -F'@' '{print \$1}'", , returnStdout: true).trim()
         ENABLE_LOGGING = "true"
     }

Makefile

@@ -104,6 +104,9 @@ MOCKGEN = $(shell pwd)/bin/mockgen
 mockgen: ## Download mockgen locally if necessary.
 	$(call go-get-tool,$(MOCKGEN), github.com/golang/mock/mockgen@latest)
 
+update-version:
+	echo $(NEXT_VER) > pkg/version/version.txt
+
 # Prepare release
 include e2e-tests/release_versions
 CERT_MANAGER_VER := $(shell grep -Eo "cert-manager v.*" go.mod|grep -Eo "[0-9]+\.[0-9]+\.[0-9]+")
@@ -127,13 +130,13 @@ release: manifests
 		-e "s|perconalab/fluentbit:main-logcollector|$(IMAGE_LOGCOLLECTOR)|g" \
 		pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/*.yaml
 	$(SED) -i "s|cr.Spec.InitImage = \".*\"|cr.Spec.InitImage = \"${IMAGE_OPERATOR}\"|g" pkg/controller/perconaservermongodb/suite_test.go
+	$(SED) -i "s|perconalab/percona-server-mongodb-operator:main-mongod8.0|$(IMAGE_MONGOD80)|g" pkg/psmdb/mongos_test.go
 
 # Prepare main branch after release
 MAJOR_VER := $(shell grep -oE "crVersion: .*" deploy/cr.yaml|grep -oE "[0-9]+\.[0-9]+\.[0-9]+"|cut -d'.' -f1)
 MINOR_VER := $(shell grep -oE "crVersion: .*" deploy/cr.yaml|grep -oE "[0-9]+\.[0-9]+\.[0-9]+"|cut -d'.' -f2)
 NEXT_VER ?= $(MAJOR_VER).$$(($(MINOR_VER) + 1)).0
-after-release: manifests
-	echo $(NEXT_VER) > pkg/version/version.txt
+after-release: update-version manifests
 	$(SED) -i \
 		-e "s/crVersion: .*/crVersion: $(NEXT_VER)/" \
 		-e "/^spec:/,/^  image:/{s#image: .*#image: perconalab/percona-server-mongodb-operator:main-mongod8.0#}" deploy/cr-minimal.yaml
@@ -151,6 +154,7 @@ after-release: manifests
 		-e "s|$(IMAGE_LOGCOLLECTOR)|perconalab/fluentbit:main-logcollector|g" \
 		pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/*.yaml
 	$(SED) -i "s|cr.Spec.InitImage = \".*\"|cr.Spec.InitImage = \"perconalab/percona-server-mongodb-operator:main\"|g" pkg/controller/perconaservermongodb/suite_test.go
+	$(SED) -i "s|$(IMAGE_MONGOD80)|perconalab/percona-server-mongodb-operator:main-mongod8.0|g" pkg/psmdb/mongos_test.go
 
 version-service-client: swagger
 	curl https://raw.githubusercontent.com/Percona-Lab/percona-version-service/$(VS_BRANCH)/api/version.swagger.yaml \

build/physical-restore-ps-entry.sh

@@ -25,6 +25,11 @@ trap 'handle_sigterm' 15
 
 touch /opt/percona/restore-in-progress
 
+if [ -d /etc/s3/certs-in ] && [ -n "$(ls -A /etc/s3/certs-in/*.crt 2>/dev/null)" ]; then
+	cat /etc/s3/certs-in/*.crt > /etc/s3/certs/ca-bundle.crt
+	chmod 0644 /etc/s3/certs/ca-bundle.crt
+fi
+
 if [[ -z ${PBM_AGENT_TLS_ENABLED} ]] || [[ ${PBM_AGENT_TLS_ENABLED} == "true" ]]; then
 	MONGO_SSL_DIR=/etc/mongodb-ssl
 	if [[ -e "${MONGO_SSL_DIR}/tls.crt" ]] && [[ -e "${MONGO_SSL_DIR}/tls.key" ]]; then

cmd/manager/main.go

@@ -13,6 +13,7 @@ import (
 
 	certmgrscheme "github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/scheme"
 	"github.com/go-logr/logr"
+	volumesnapshotv1 "github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumesnapshot/v1"
 	uzap "go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
 	k8sruntime "k8s.io/apimachinery/pkg/runtime"
@@ -44,6 +45,7 @@ var (
 func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(apis.AddToScheme(scheme))
+	utilruntime.Must(volumesnapshotv1.AddToScheme(scheme))
 }
 
 func main() {

config/crd/bases/psmdb.percona.com_perconaservermongodbbackups.yaml

@@ -78,9 +78,12 @@ spec:
                 enum:
                 - logical
                 - physical
+                - external
                 - incremental
                 - incremental-base
                 type: string
+              volumeSnapshotClass:
+                type: string
             type: object
           status:
             properties:
@@ -255,6 +258,15 @@ spec:
                 type: object
               size:
                 type: string
+              snapshots:
+                items:
+                  properties:
+                    replsetName:
+                      type: string
+                    snapshotName:
+                      type: string
+                  type: object
+                type: array
               start:
                 format: date-time
                 type: string