diff --git a/.github/scripts/end2end/common.sh b/.github/scripts/end2end/common.sh index 65ab7117ef..eb490d7026 100644 --- a/.github/scripts/end2end/common.sh +++ b/.github/scripts/end2end/common.sh @@ -4,7 +4,7 @@ get_token() { -d "username=${OIDC_USERNAME}" \ -d "password=${OIDC_PASSWORD}" \ -d "grant_type=password" \ - -d 'scope=openid' \ + -d "scope=openid" \ https://localhost/auth/realms/${OIDC_REALM}/protocol/openid-connect/token | \ jq -cr '.id_token' } diff --git a/.github/scripts/end2end/configs/zenko.yaml b/.github/scripts/end2end/configs/zenko.yaml index dbcfe674d8..f9c18d4cc7 100644 --- a/.github/scripts/end2end/configs/zenko.yaml +++ b/.github/scripts/end2end/configs/zenko.yaml @@ -4,8 +4,6 @@ kind: Zenko metadata: name: ${ZENKO_NAME} ${ZENKO_ANNOTATIONS} - zenko.io/x-backbeat-oneshard-replicaset: data-db-mongodb-sharded-shard-0 - zenko.io/x-backbeat-oneshard-replicaset-hosts: data-db-mongodb-sharded-shard0-data-0.data-db-mongodb-sharded-headless.default.svc.cluster.local:27017 spec: version: ${ZENKO_VERSION_NAME} replicas: 1 diff --git a/.github/scripts/end2end/enable-https.sh b/.github/scripts/end2end/enable-https.sh new file mode 100755 index 0000000000..49a42f05d5 --- /dev/null +++ b/.github/scripts/end2end/enable-https.sh @@ -0,0 +1,87 @@ +#!/bin/sh + +set -exu + +# This script enables HTTPS for an existing HTTP deployment of Zenko +DIR=$(dirname "$0") +KEYCLOAK_VERSION=${KEYCLOAK_VERSION:-'18.4.4'} + +# Create a self-signed certificate for Zenko ingresses +kubectl apply -f - << EOF +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: zenko-tls + namespace: default +spec: + secretName: zenko-tls + issuerRef: + name: artesca-root-ca-issuer + kind: ClusterIssuer + dnsNames: + - ui.zenko.local + - management.zenko.local + - s3.zenko.local + - iam.zenko.local + - sts.zenko.local + - keycloak.zenko.local + - shell-ui.zenko.local +EOF + +# Wait for certificate to be ready +kubectl wait --for=condition=Ready --timeout=2m certificate/zenko-tls + +# Update Shell-UI ingress to use HTTPS +kubectl patch ingress shell-ui --type=json -p '[ + { + "op": "replace", + "path": "/spec/tls", + "value": [{"hosts": ["shell-ui.zenko.local"], "secretName": "zenko-tls"}] + } +]' + +# Get current Zenko instance name +ZENKO_NAME=$(kubectl get zenko -o jsonpath='{.items[0].metadata.name}') +NAMESPACE="default" + +# Update Zenko CR to include TLS certificates +kubectl patch zenko/${ZENKO_NAME} --type=merge -p '{ + "spec": { + "ingress": { + "certificates": [ + { + "hosts": [ + "ui.zenko.local", + "management.zenko.local", + "iam.zenko.local", + "sts.zenko.local", + "s3.zenko.local" + ], + "secretName": "zenko-tls" + } + ], + "annotations": { + "nginx.ingress.kubernetes.io/proxy-body-size": "0m", + "nginx.ingress.kubernetes.io/ssl-redirect": "false" + } + } + } +}' + +# Wait for Zenko to be updated +kubectl wait --for condition=Available --timeout 5m zenko/${ZENKO_NAME} + +# Update environment variables to use HTTPS URLs +echo "UI_ENDPOINT=https://ui.zenko.local" >> $GITHUB_ENV +echo "OIDC_ENDPOINT=https://keycloak.zenko.local" >> $GITHUB_ENV +echo "NAVBAR_ENDPOINT=https://shell-ui.zenko.local" >> $GITHUB_ENV +echo "OIDC_HOST=keycloak.zenko.local" >> $GITHUB_ENV +echo "ENABLE_KEYCLOAK_HTTPS=true" >> $GITHUB_ENV + +# Set the HTTPS ingress options for Keycloak +KEYCLOAK_INGRESS_OPTIONS="$DIR/configs/keycloak_ingress_https.yaml" +KEYCLOAK_OPTIONS="$DIR/configs/keycloak_options.yaml" +helm upgrade --install keycloak codecentric/keycloak -f "${KEYCLOAK_OPTIONS}" -f "${KEYCLOAK_INGRESS_OPTIONS}" --version ${KEYCLOAK_VERSION} +kubectl rollout status sts/keycloak --timeout=5m + +echo "HTTPS successfully enabled for Zenko deployment" diff --git a/.github/scripts/end2end/install-kind-dependencies.sh b/.github/scripts/end2end/install-kind-dependencies.sh index 4300063488..8e43d4f229 100755 --- a/.github/scripts/end2end/install-kind-dependencies.sh +++ b/.github/scripts/end2end/install-kind-dependencies.sh @@ -15,7 +15,7 @@ CERT_MANAGER_VERSION=v1.13.3 KAFKA_OPERATOR_VERSION=0.25.1 INGRESS_NGINX_VERSION=controller-v1.10.3 PROMETHEUS_VERSION=v0.52.1 -KEYCLOAK_VERSION=18.4.4 +KEYCLOAK_VERSION=${KEYCLOAK_VERSION:-'18.4.4'} MONGODB_ROOT_USERNAME=root MONGODB_ROOT_PASSWORD=rootpass @@ -24,6 +24,15 @@ MONGODB_APP_PASSWORD=datapass MONGODB_APP_DATABASE=${ZENKO_MONGODB_DATABASE:-datadb} MONGODB_RS_KEY=0123456789abcdef +# Constants for valid topologies for CI tests +# We support multiple shards per host, or one shard per host, up to 9 nodes +# The first number is the number of nodes, the second is the number of shards +readonly MONGODB_VALID_TOPOLOGIES=( + "1:1" "1:2" "3:1" "3:3" "6:1" "6:2" "6:6" "9:1" "9:3" "9:9" "12:1" "12:4" "12:12" +) + +MONGODB_SHARD_COUNT=${MONGODB_SHARD_COUNT:-1} + ENABLE_KEYCLOAK_HTTPS=${ENABLE_KEYCLOAK_HTTPS:-'false'} KAFKA_CHART=banzaicloud-stable/kafka-operator @@ -34,9 +43,7 @@ else KEYCLOAK_INGRESS_OPTIONS="$DIR/configs/keycloak_ingress_http.yaml" fi -# Older charts (bitnami/mongodb:7.8) have been removed from bitnami's helm repo: stick to the -# commit before removal for now -helm repo add --force-update bitnami https://raw.githubusercontent.com/bitnami/charts/defb094c658024e4aa8245622dab202874880cbc/bitnami +helm repo add --force-update bitnami https://charts.bitnami.com/bitnami helm repo add --force-update pravega https://charts.pravega.io helm repo add --force-update codecentric https://codecentric.github.io/helm-charts/ # BanzaiCloud repo may not work, c.f. https://scality.atlassian.net/browse/AN-225 @@ -114,6 +121,53 @@ stringData: mongodb-replica-set-key: $MONGODB_RS_KEY EOF +# Validate that the current topology is correct +get_mongodb_topology_file() { + local node_count=$1 + local shard_count=$2 + + local base_yaml_name="mongodb-sharded-${node_count}-node" + + # Validate topology + local topology_key="${node_count}:${shard_count}" + if [[ ! " ${MONGODB_VALID_TOPOLOGIES[*]} " =~ " ${topology_key} " ]]; then + echo "Error: Invalid topology - ${node_count} nodes, ${shard_count} shards" + exit 1 + fi + + # Adjust base YAML name if there are multiple shards + [[ "$shard_count" -gt 1 ]] && base_yaml_name="${base_yaml_name}-${shard_count}-shards" + base_yaml_name="${base_yaml_name}.yaml" + + # ensure base file exists + local base_yaml_path="${DIR}/_build/root/deploy/${base_yaml_name}" + if [ ! -f "$base_yaml_path" ]; then + echo "Error: Base YAML file not found at ${base_yaml_path}" + exit 1 + fi + + echo "$base_yaml_path" +} + +# MongoDB selectors are not supported in the CI. +# So we remove them and let the provisioner handle the +# volume provisioning. +patch_mongodb_selector() { + local base_yaml_path=$1 + local shard_count=$2 + + # Remove volume selectors from mongos StatefulSet + yq eval 'select(.kind == "StatefulSet" and .metadata.name == "data-db-mongodb-sharded-mongos") |= del(.spec.volumeClaimTemplates[].spec.selector)' -i "$base_yaml_path" + + # Remove volume selectors from configsvr StatefulSet + yq eval 'select(.kind == "StatefulSet" and .metadata.name == "data-db-mongodb-sharded-configsvr") |= del(.spec.volumeClaimTemplates[].spec.selector)' -i "$base_yaml_path" + + # Remove volume selectors from shard StatefulSets + for ((i=0; i 2 ? 3 : 1 )) \ --set configsvr.persistence.enabled=true \ --set configsvr.persistence.storageClass=${MONGODB_STORAGE_CLASS} \ --set metrics.enabled=true \ @@ -144,8 +155,21 @@ function render_mongodb_sharded_yamls() function mongodb_sharded_yamls() { - render_mongodb_sharded_yamls "${MONGODB_SHARDED_SINGLE_NODE_PATH}" 1 1 - render_mongodb_sharded_yamls "${MONGODB_SHARDED_THREE_NODE_PATH}" 1 3 + # For now we maximize the number of replicas to 3, so each shard is a P-S-S + # Parameters are: shard count - node count - data replica count + render_mongodb_sharded_yamls "${MONGODB_SHARDED_SINGLE_NODE_PATH}" 1 1 1 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_SINGLE_NODE_TWO_SHARDS_PATH}" 2 1 1 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_THREE_NODE_PATH}" 1 3 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_THREE_NODE_THREE_SHARDS_PATH}" 3 3 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_SIX_NODE_PATH}" 1 6 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_SIX_NODE_TWO_SHARDS_PATH}" 2 6 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_SIX_NODE_SIX_SHARDS_PATH}" 6 6 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_NINE_NODE_PATH}" 1 9 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_NINE_NODE_THREE_SHARDS_PATH}" 3 9 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_NINE_NODE_NINE_SHARDS_PATH}" 9 9 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_TWELVE_NODE_PATH}" 1 12 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_TWELVE_NODE_FOUR_SHARDS_PATH}" 4 12 3 + render_mongodb_sharded_yamls "${MONGODB_SHARDED_TWELVE_NODE_TWELVE_SHARDS_PATH}" 12 12 3 } function gen_manifest_yaml() diff --git a/solution-base/mongodb/charts/mongodb-sharded/templates/shard/shard-data-statefulset.yaml b/solution-base/mongodb/charts/mongodb-sharded/templates/shard/shard-data-statefulset.yaml index 7685106be4..124ec80b69 100644 --- a/solution-base/mongodb/charts/mongodb-sharded/templates/shard/shard-data-statefulset.yaml +++ b/solution-base/mongodb/charts/mongodb-sharded/templates/shard/shard-data-statefulset.yaml @@ -447,7 +447,17 @@ spec: {{- end }} {{- if $.Values.shardsvr.persistence.selector }} selector: -{{ toYaml $.Values.shardsvr.persistence.selector | indent 10 }} + matchLabels: + {{- if gt $i 0 }} + app.kubernetes.io/name: {{ printf "mongodb-shard%d" $i }} + {{- else }} + app.kubernetes.io/name: mongodb + {{- end }} + {{- range $key, $value := $.Values.shardsvr.persistence.selector.matchLabels }} + {{- if ne $key "app.kubernetes.io/name" }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} {{- end }} resources: requests: diff --git a/solution-base/mongodb/patches/mongodb-sharded-add-pv-selector.patch b/solution-base/mongodb/patches/mongodb-sharded-add-pv-selector.patch index e897a84c43..175dc1e140 100644 --- a/solution-base/mongodb/patches/mongodb-sharded-add-pv-selector.patch +++ b/solution-base/mongodb/patches/mongodb-sharded-add-pv-selector.patch @@ -1,8 +1,8 @@ diff --git a/solution-base/mongodb/charts/mongodb-sharded/templates/config-server/config-server-statefulset.yaml b/solution-base/mongodb/charts/mongodb-sharded/templates/config-server/config-server-statefulset.yaml -index 091471e4..87057f69 100644 +index d19d608f..c3c3d30e 100644 --- a/solution-base/mongodb/charts/mongodb-sharded/templates/config-server/config-server-statefulset.yaml +++ b/solution-base/mongodb/charts/mongodb-sharded/templates/config-server/config-server-statefulset.yaml -@@ -445,6 +445,10 @@ spec: +@@ -438,6 +438,10 @@ spec: {{- range .Values.configsvr.persistence.accessModes }} - {{ . | quote }} {{- end }} @@ -14,16 +14,26 @@ index 091471e4..87057f69 100644 requests: storage: {{ .Values.configsvr.persistence.size | quote }} diff --git a/solution-base/mongodb/charts/mongodb-sharded/templates/shard/shard-data-statefulset.yaml b/solution-base/mongodb/charts/mongodb-sharded/templates/shard/shard-data-statefulset.yaml -index 4fa00293..89883c12 100644 +index 5e648381..a54852e3 100644 --- a/solution-base/mongodb/charts/mongodb-sharded/templates/shard/shard-data-statefulset.yaml +++ b/solution-base/mongodb/charts/mongodb-sharded/templates/shard/shard-data-statefulset.yaml -@@ -452,6 +452,10 @@ spec: +@@ -451,6 +451,20 @@ spec: {{- range $.Values.shardsvr.persistence.accessModes }} - {{ . | quote }} {{- end }} + {{- if $.Values.shardsvr.persistence.selector }} + selector: -+{{ toYaml $.Values.shardsvr.persistence.selector | indent 10 }} ++ matchLabels: ++ {{- if gt $i 0 }} ++ app.kubernetes.io/name: {{ printf "mongodb-shard%d" $i }} ++ {{- else }} ++ app.kubernetes.io/name: mongodb ++ {{- end }} ++ {{- range $key, $value := $.Values.shardsvr.persistence.selector.matchLabels }} ++ {{- if ne $key "app.kubernetes.io/name" }} ++ {{ $key }}: {{ $value | quote }} ++ {{- end }} ++ {{- end }} + {{- end }} resources: requests: diff --git a/solution-base/mongodb/patches/initialization-config-map.patch b/solution-base/mongodb/patches/update-default-values.patch similarity index 100% rename from solution-base/mongodb/patches/initialization-config-map.patch rename to solution-base/mongodb/patches/update-default-values.patch