The manager image tag derives from .Chart.AppVersion, so bumping appVersion
to v0.5.4 without updating the two image literals in the deployment unittest
broke the suite (helm-unittest gates the PR via `make unit-tests`). Update
both asserts (manager container image and the agent OPERATOR_IMAGE env) to
ghcr.io/cozystack/etcd-operator:v0.5.4. Suite is green again (18/18).
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
(cherry picked from commit 22c1df8b94)
Bump the cozystack etcd-operator packages from v0.5.3 to v0.5.4. The
release is a controller bug-fix set with no API, RBAC or values changes:
- fix(controllers): derive --initial-cluster-state from phase, not from
the seed (cozystack/etcd-operator#355)
- fix(controllers): stop exempting the bootstrap seed from self-heal
(cozystack/etcd-operator#354)
- fix(controllers): extend crash-loop self-heal to memory members
(cozystack/etcd-operator#352)
- fix(controllers): switch the PDB from maxUnavailable to minAvailable
(cozystack/etcd-operator#351)
Adaptations:
- etcd-operator/Chart.yaml: appVersion v0.5.3 -> v0.5.4 (the manager image
tag defaults to .Chart.AppVersion, so this reimages the controller).
- etcd-operator/Makefile, etcd-operator-crds/Makefile: ETCD_OPERATOR_REF
v0.5.3 -> v0.5.4.
- etcd-operator-crds/templates/etcdmembers.yaml: re-vendored at v0.5.4 via
`make update`; description-only change to the /scale replicas/selector
fields tracking the PDB minAvailable fix. etcdclusters/etcdsnapshots
unchanged.
- templates/rbac.yaml left as-is: manager-role-rules.yaml is byte-identical
between v0.5.3 and v0.5.4.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
(cherry picked from commit 19f969b2f8)
v0.5.3 carries the S3 request-checksum fix (cozystack/etcd-operator#342): the
snapshot agent sets RequestChecksumCalculation=WhenRequired on BOTH the S3 client
and the transfer manager, so multipart snapshot uploads (>5 MiB — every real etcd
snapshot) no longer carry the CRC32 STREAMING-UNSIGNED-PAYLOAD-TRAILER that Ceph
RGW rejects with 400 InvalidArgument. Also pulls in #340 (observed EtcdMember
versions) and #341 (--watch-namespace).
- system/etcd-operator: appVersion v0.5.2 -> v0.5.3 (image tag follows AppVersion),
bump ETCD_OPERATOR_REF, update deployment unittest expectations.
- system/etcd-operator-crds: re-vendor CRDs from v0.5.3. etcdmembers gains the
additive #340 status.version field + "Running" printer column and picks up the
peerAutoTLS spec field the vendored copy was already missing (all additive,
backward-compatible; etcdclusters/etcdsnapshots unchanged). Fix the stale
`make update`: upstream has no config/crd kustomization — CRDs live in
charts/etcd-operator/crd-bases — so vendor those directly and stamp
helm.sh/resource-policy: keep.
Verified end-to-end on a Ceph RGW backend: the v0.5.2 (client-only) agent fails a
multipart snapshot upload with the 400 above; v0.5.3 uploads an 11 MiB multipart
snapshot successfully.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <andrey.kolkov@aenix.io>
- backupstrategy-controller: trim() the decoded S3 endpoint before scheme
stripping so a trailing newline in the Secret can't yield a malformed URL
- etcd-operator: give the pre-upgrade selector-fix hook container resource
requests/limits (matches postgres-operator webhook-ready), +unittest
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Addresses review on #3265:
- pre-upgrade-selector-fix hook: add runAsUser: 65532. clastix/kubectl's
image user is the non-numeric name `nonroot`, which the kubelet cannot
verify against runAsNonRoot: true — so the Pod fails admission and the
hook never runs, silently blocking the very 1.5->1.6 upgrade it exists to
unblock. Matches postgres-operator's webhook-ready hook (same image).
- Digest-pin the kubectl image (the comment already claimed digest-pinning
but shipped a floating v1.32 tag). Reuse the digest postgres-operator
already vendors, add the renovate annotation, and template repo:tag@digest.
- Tests (both charts have CI helm-unittest suites, none previously covered
these):
- etcd-operator/tests/selector-fix-hook_test.yaml: hook wiring, namespaced
least-privilege RBAC, numeric-non-root securityContext (guards the
runAsUser regression above), digest-pinned image.
- etcd-operator/tests/deployment_test.yaml: assert the 256Mi cold-start
memory floor so it can't silently drop back to an OOMKilling value.
- extra/etcd/tests/etcd-cluster_test.yaml: assert the transitional
etcd-headless Service (headless, publishNotReadyAddresses, member
selector, client/peer ports).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Two defects that break the etcd-operator on an in-cluster 1.5 -> 1.6 upgrade
(#2859 swapped the upstream chart for the cozystack-authored one):
- #3242: the controller Deployment's spec.selector.matchLabels changed
({instance,name} -> {name,control-plane}). spec.selector is immutable, so
`helm upgrade` cannot patch the existing Deployment and the whole HelmRelease
upgrade fails ("field is immutable") -- the operator and the v1alpha2 CRDs it
serves never come up, which blocks the etcd v1alpha2 adoption. Fresh installs
use the new selector directly, so fresh-install CI does not catch it. Add a
pre-upgrade hook that deletes the Deployment ONLY when its live selector is
the pre-1.6 one (lacks control-plane=controller-manager), so Helm recreates it
cleanly. No-op when the selector already matches (rc.1 -> later) and never
runs on a fresh install (pre-upgrade only). Keeping the selector stable in the
chart is not an option: rc.1 already shipped the new selector, so aligning it
back would merely move the immutable break to rc.1 -> next.
- Raise the manager's cold-start memory limit floor 128Mi -> 256Mi (and the VPA
minAllowed to match). The steady-state working set is ~250Mi (the VPA's own
recommendation); at 128Mi a Pod that starts before the VPA admission webhook
rewrites it (e.g. a Deployment recreated out of band, or the webhook briefly
unavailable during upgrade) OOMKills into a crash loop. Defense in depth so
the operator never depends on VPA timing merely to avoid crashing; the VPA
still scales it further under load up to maxAllowed.
Verified live on a 1.5 -> 1.6 adoption: the delete-Deployment step plus the VPA
re-applying 256Mi+ let the operator come up and the adoption complete.
Refs: #3242, #3243
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
Address review feedback from gemini-code-assist on packages/system/etcd-operator/templates/deployment.yaml: add an explicit seccompProfile (RuntimeDefault) to the controller-manager pod securityContext.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
Upstream release notes: https://github.com/aenix-io/etcd-operator/releases/tag/v0.4.3
Notable changes:
- Add EtcdBackup CRD for declarative etcd snapshots (#307)
- Add EtcdBackupSchedule CRD for scheduled backups (#307)
- Expose metrics port on client service (#299)
- Replace deprecated gcr.io/kubebuilder/kube-rbac-proxy with
quay.io/brancz/kube-rbac-proxy:v0.18.1 (#308)
- Update Kamaji example manifest
Note: Helm 3 does not install CRDs on upgrade. Existing clusters
require manual application of the new EtcdBackup and
EtcdBackupSchedule CRDs:
kubectl apply --filename packages/system/etcd-operator/charts/etcd-operator/crds/
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
The gcr.io/kubebuilder/kube-rbac-proxy image is no longer available
since GCR was deprecated. Replace it with quay.io/brancz/kube-rbac-proxy
from the original upstream author.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Move common-envs.mk and package.mk from scripts/ to hack/ directory.
Update all Makefile includes to use new paths. Remove unused
issue-flux-certificates.sh script.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
This change is aimed at improving the development experience.
- The option `make delete` has been added.
- Added check for `NAME` and `NAMESPACE` variables
- Now, any package (not just system ones) can include options such as
make show, make diff, make apply.
- Applications from packages/extra require explicit specification of the
`NAMESPACE`.
- Applications from packages/apps require explicit specification of both
`NAME` and `NAMESPACE`.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Andrey Kolkov