Merge pull request #18 from ThinkParQ/finalize-migration

Finalize Migration Steps

.github/workflows/build-test-publish.yaml

@@ -10,6 +10,9 @@ on:
  pull_request:
  branches:
  - "master"
+ paths-ignore:
+ - "**/*.md"
+ - "**/*.txt" 
 
 env:
  # Container image registry to publish images to:
@@ -57,8 +60,13 @@ jobs:
  - name: Install test dependencies
  run: |
  go install github.com/onsi/ginkgo/v2/[email protected]
+ go install github.com/google/[email protected]
  timeout-minutes: 5
 
+ - name: Verify license compliance and the NOTICE file is updated
+ run: |
+ make test-licenses
+
  - name: Run unit tests
  run: |
  ACK_GINKGO_DEPRECATIONS=1.16.5 TESTARGS="-v -ginkgo.v" make test
@@ -172,11 +180,11 @@ jobs:
  echo -e "\nimages:\n - name: ${{ env.IMAGE_NAME }}\n newName: ${{ env.TEST_IMAGE_NAME }}\n newTag: ${{ github.sha }}" >> deploy/k8s/overlays/default/kustomization.yaml
  kubectl apply -k deploy/k8s/overlays/default
 
- # TODO (BCSI-7): Actually run e2e tests using Ginko with an appropriate timeout.
+ # TODO (https://github.com/ThinkParQ/beegfs-csi-driver/issues/21): Actually run e2e tests using Ginko with an appropriate timeout.
 
  - name: Deploy all examples to verify the driver is available
  run: |
- echo "${{ secrets.CONN_AUTH_SECRET }}" | sudo tee /etc/beegfs/connAuth
+ echo "${{ secrets.CONN_AUTH_SECRET }}" | sudo tee /etc/beegfs/connAuth > /dev/null
  sudo sed -i '0,/connAuthFile[[:space:]]*=[[:space:]]*/s//connAuthFile = \/etc\/beegfs\/connAuth/' /etc/beegfs/beegfs-client.conf
  sudo sed -i '0,/sysMgmtdHost[[:space:]]*=[[:space:]]*/s//sysMgmtdHost = localhost/' /etc/beegfs/beegfs-client.conf
  sudo beegfs-ctl --cfgFile=/etc/beegfs/beegfs-client.conf --unmounted --createdir /k8s
@@ -269,11 +277,13 @@ jobs:
  chmod +x install.sh
  ./install.sh v0.25.0
 
+ # Test using a base64 encoded secret for the Operator based deployment to
+ # ensure the broadest coverage for how we handle base64 encoded secrets.
  - name: Deploy BeeGFS ${{ matrix.beegfs-version }} for testing and expose as a service to the host OS
  run: |
  export BEEGFS_VERSION=$(echo ${{ matrix.beegfs-version }})
- export BEEGFS_SECRET=$(echo ${{ secrets.CONN_AUTH_SECRET }})
- envsubst < test/env/beegfs-ubuntu/beegfs-fs-1.yaml | kubectl apply -f -
+ export BEEGFS_SECRET=$(echo ${{ secrets.CONN_AUTH_BASE64_SECRET }})
+ envsubst < test/env/beegfs-ubuntu/beegfs-fs-2.yaml | kubectl apply -f -
 
  MAX_ATTEMPTS=36
  SLEEP_TIME=5
@@ -282,7 +292,7 @@ jobs:
  # If we try to expose the service to the host OS before the pod is ready we'll get an error.
  # Make sure the BeeGFS FS started before we continue.
  while [ $COUNTER -lt $MAX_ATTEMPTS ]; do
- POD_STATUS=$(kubectl get pods beegfs-fs-1-0 -o jsonpath='{.status.phase}')
+ POD_STATUS=$(kubectl get pods beegfs-fs-2-0 -o jsonpath='{.status.phase}')
  echo "Pod status: ${POD_STATUS}"
  if [ "${POD_STATUS}" == "Running" ]; then
  echo "Verified BeeGFS FS pod is running."
@@ -297,7 +307,7 @@ jobs:
  if [ $COUNTER -eq $MAX_ATTEMPTS ]; then
  echo "BeeGFS FS pod did not reach 'Running' status within the maximum allowed time. Outputting debug information and exiting with error..."
  kubectl get pods -A
- kubectl describe pod beegfs-fs-1-0
+ kubectl describe pod beegfs-fs-2-0
  docker images
  exit 1
  fi
@@ -306,7 +316,7 @@ jobs:
  # Exposes the service directly to the host operating system. 
  # This is required to mount BeeGFS since the kernel module is outside the container.
  # For some reason we don't need to override the ephemeral port and can use the actual 800* ports.
- minikube service beegfs-fs-1-svc
+ minikube service beegfs-fs-2-svc
 
  # TODO: Cache BeeGFS packages https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
  # https://stackoverflow.com/questions/59269850/caching-apt-packages-in-github-actions-workflow
@@ -331,19 +341,19 @@ jobs:
  run: |
  operator-sdk run bundle ${{ env.OPERATOR_TEST_BUNDLE_NAME }}:${{ github.sha }}
 
- # TODO (BCSI-7): Actually run e2e tests using Ginko with an appropriate timeout.
+ # TODO (https://github.com/ThinkParQ/beegfs-csi-driver/issues/21): Actually run e2e tests using Ginko with an appropriate timeout.
 
  - name: Deploy a BeeGFSDriver object
  run: |
  export CSI_IMAGE_NAME=$(echo ${{ env.TEST_IMAGE_NAME }})
  export CSI_IMAGE_TAG=$(echo ${{ github.sha }})
- export BEEGFS_SECRET=$(echo ${{ secrets.CONN_AUTH_SECRET }})
+ export BEEGFS_SECRET=$(echo ${{ secrets.CONN_AUTH_BASE64_SECRET }})
  export BEEGFS_MGMTD=$(kubectl get nodes -o=jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
  envsubst < test/env/beegfs-ubuntu/csi-beegfs-cr.yaml | kubectl apply -f -
 
  - name: Deploy all examples to verify the driver is available
  run: |
- minikube ssh "sudo echo ${{ secrets.CONN_AUTH_SECRET }} | sudo tee /etc/beegfs/connAuth"
+ minikube ssh "sudo echo ${{ secrets.CONN_AUTH_BASE64_SECRET }} | base64 --decode | sudo tee /etc/beegfs/connAuth > /dev/null"
  minikube ssh "sudo sed -i '0,/connAuthFile[[:space:]]*=[[:space:]]*/s//connAuthFile = \/etc\/beegfs\/connAuth/' /etc/beegfs/beegfs-client.conf"
  minikube ssh "sudo sed -i '0,/sysMgmtdHost[[:space:]]*=[[:space:]]*/s//sysMgmtdHost = localhost/' /etc/beegfs/beegfs-client.conf"
  minikube ssh "sudo beegfs-ctl --cfgFile=/etc/beegfs/beegfs-client.conf --unmounted --createdir /k8s"
@@ -407,17 +417,17 @@ jobs:
  with:
  cosign-release: "v2.1.1"
 
- - name: Pull tested CSI driver image from ghcr.io
- run: |
- docker pull ${{ env.TEST_IMAGE_NAME }}:${{ github.sha }}
-
  - name: Log in to the GitHub Container Registry
  uses: docker/login-action@v2
  with:
  registry: ${{ env.REGISTRY }}
  username: ${{ github.actor }}
  password: ${{ secrets.GITHUB_TOKEN }}
 
+ - name: Pull tested CSI driver image from ghcr.io
+ run: |
+ docker pull ${{ env.TEST_IMAGE_NAME }}:${{ github.sha }}
+
  # This uses the semantic versioning option for https://github.com/docker/metadata-action#semver
  - name: Extract metadata for CSI driver container image
  id: meta
@@ -507,7 +517,7 @@ jobs:
  cleanup-test-images:
  runs-on: ubuntu-22.04
  timeout-minutes: 3
- needs: publish-images
+ needs: [publish-images, e2e-tests, operator-e2e-tests]
  if: always()
  steps:
  - name: Extract CSI driver test package name

CHANGELOG.md

@@ -1,12 +1,13 @@
 # Changelog
 Notable changes to the BeeGFS CSI driver will be documented in this file. 
 
-[1.5.0] - PRERELEASE
+[1.5.0] - 2023-09-11
 --------------------
 
 ### Added
 - Support for Kubernetes 1.26 and 1.27.
 - Support for BeeGFS v7.3.4 and v7.4.0.
+- Support for binary connAuthFile secrets utilizing base64 encoding.
 
 ### Changed
 - Migrated project to the ThinkParQ GitHub organization.

Makefile

@@ -26,6 +26,10 @@ all: build
 check-go-version:
  ./hack/check-go-version.sh
 
+.PHONY: generate-notices
+generate-notices:
+ @go-licenses report ./cmd/beegfs-csi-driver ./cmd/chwrap --template hack/notice.tpl > NOTICE.md --ignore github.com/thinkparq
+
 # The kubernetes-csi/csi-release-tools project does not include an easy way to build a binary that doesn't need its
 # own container image and include it in a different image. This build-% recipe mirrors an analogous recipe in
 # release-tools/buildmake and allows us to explicitly build the binary specified by %.
@@ -52,6 +56,20 @@ bin/chwrap.tar: build-chwrap cmd/chwrap/chwrap.sh
 container: build-chwrap bin/chwrap.tar
 push: container # not explicitly executed in release-tools/build.make
 
+# For details on what licenses are disallowed see
+# https://github.com/google/go-licenses#check 
+#
+# IMPORTANT: Any exceptions (using --ignore) such as the one for HCL must be
+# manually added AFTER the NOTICE file has been updated and/or other appropriate
+# steps have been taken based on the license requirements.
+test-licenses: generate-notices
+ @echo "Checking license compliance..."
+ @go-licenses check ./cmd/beegfs-csi-driver/ ./cmd/chwrap --ignore github.com/thinkparq --disallowed_types=forbidden,permissive,reciprocal,restricted,unknown
+ @if [ -n "$$(git status --porcelain NOTICE.md)" ]; then \
+ echo "NOTICE file is not up to date. Please run 'make generate-notices' and commit the changes."; \
+ exit 1; \
+ fi
+
 # Skip sanity tests that are known to fail. Use override directive to append to TESTARGS passed in on the command line. 
 # TODO(webere, A387): Correctly adhere to the CSI spec.
 override TESTARGS += -ginkgo.skip='Controller Service \[Controller Server\] CreateVolume should fail when requesting to create a volume with already existing name and different capacity'