## What this PR does
`packages/system/etcd-operator/templates/metrics.yaml` rendered a
`VMServiceScrape` (`operator.victoriametrics.com/v1beta1`)
unconditionally, so the `cozy-etcd-operator/etcd-operator` HelmRelease
fails to install on any cluster that does not have the VictoriaMetrics
operator CRDs, with `no matches for kind "VMServiceScrape" in version
"operator.victoriametrics.com/v1beta1"`. That made the VictoriaMetrics
operator a hard dependency of etcd-operator, which it should not be.
This wraps only the `VMServiceScrape` document in a
`.Capabilities.APIVersions.Has "operator.victoriametrics.com/v1beta1"`
gate, following the precedent already established in
`packages/system/linstor/templates/podscrape.yaml`. The
`etcd-operator-metrics` Service keeps rendering unconditionally, so any
scraper — a `VMServiceScrape` when the CRD is present, or something else
entirely — can still target the `metrics` port.
Note: this is a Cozystack-packaging-only issue. The upstream
etcd-operator repo's own chart is unaffected — it already gates its
scrape object.
Added `packages/system/etcd-operator/tests/metrics_test.yaml` (`helm
unittest`) pinning the new behavior: the Service always renders, and the
`VMServiceScrape` renders only when the capability is injected.
Kept this minimal — a pure capabilities gate with no new values key,
matching linstor's style, rather than adding a values toggle.
Follow-up (out of scope for this PR):
`packages/extra/etcd/templates/podscrape.yaml` (a `VMPodScrape`) is
unconditional the same way and would hit the same install failure on a
cluster without the VictoriaMetrics operator.
`packages/system/monitoring-agents` also ships several unconditional
`VMServiceScrape`/`VMPodScrape` objects, though that package may already
assume the VictoriaMetrics operator is present as part of the monitoring
stack it belongs to.
### Screenshots
Not applicable — no UI change.
### Downstream repositories
- [x] No downstream repository is affected by this change
### Release note
```release-note
fix(etcd-operator): stop requiring the VictoriaMetrics operator to install etcd-operator; the VMServiceScrape now only renders when the operator's CRD is present
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Metrics collection now works without the VictoriaMetrics operator API,
while scrape configuration is rendered when that API is available.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Controller-only release: EtcdMember Pods that reach a terminal phase
are replaced instead of being left behind, and EtcdCluster status is no
longer rewritten while etcd itself is unreachable. No CRD, RBAC or
values changes; re-vendoring the CRDs produces an empty diff.
Assisted-By: LLM
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
The manager ClusterRole header still pointed at the upstream config/rbac/role.yaml
path, which 404s at v0.5.5; the rules now live in
charts/etcd-operator/files/manager-role-rules.yaml (already corrected in the
Makefile and rbac_test.yaml).
Signed-off-by: Andrey Kolkov <andrey.kolkov@aenix.io>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
v0.5.5 ships the EtcdDefrag and EtcdDefragPolicy API types (a controller
plus a cron that stamps scheduled defrag runs). Vendor both CRDs into the
etcd-operator-crds package and grant the manager ClusterRole the verbs the
new controllers need: defragpolicies read/patch, defrags full CRUD, the two
new /status subresources, and cluster-scoped event emission.
Signed-off-by: Andrey Kolkov <andrey.kolkov@aenix.io>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The etcd-operator HelmRelease rendered a VMServiceScrape unconditionally, so it failed to install with "no matches for kind VMServiceScrape" on any cluster without the VictoriaMetrics operator CRDs. Wrap it in the same Capabilities.APIVersions gate linstor's podscrape.yaml uses, leaving the metrics Service unconditional.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
The manager image tag derives from .Chart.AppVersion, so bumping appVersion
to v0.5.4 without updating the two image literals in the deployment unittest
broke the suite (helm-unittest gates the PR via `make unit-tests`). Update
both asserts (manager container image and the agent OPERATOR_IMAGE env) to
ghcr.io/cozystack/etcd-operator:v0.5.4. Suite is green again (18/18).
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
Bump the cozystack etcd-operator packages from v0.5.3 to v0.5.4. The
release is a controller bug-fix set with no API, RBAC or values changes:
- fix(controllers): derive --initial-cluster-state from phase, not from
the seed (cozystack/etcd-operator#355)
- fix(controllers): stop exempting the bootstrap seed from self-heal
(cozystack/etcd-operator#354)
- fix(controllers): extend crash-loop self-heal to memory members
(cozystack/etcd-operator#352)
- fix(controllers): switch the PDB from maxUnavailable to minAvailable
(cozystack/etcd-operator#351)
Adaptations:
- etcd-operator/Chart.yaml: appVersion v0.5.3 -> v0.5.4 (the manager image
tag defaults to .Chart.AppVersion, so this reimages the controller).
- etcd-operator/Makefile, etcd-operator-crds/Makefile: ETCD_OPERATOR_REF
v0.5.3 -> v0.5.4.
- etcd-operator-crds/templates/etcdmembers.yaml: re-vendored at v0.5.4 via
`make update`; description-only change to the /scale replicas/selector
fields tracking the PDB minAvailable fix. etcdclusters/etcdsnapshots
unchanged.
- templates/rbac.yaml left as-is: manager-role-rules.yaml is byte-identical
between v0.5.3 and v0.5.4.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
v0.5.3 carries the S3 request-checksum fix (cozystack/etcd-operator#342): the
snapshot agent sets RequestChecksumCalculation=WhenRequired on BOTH the S3 client
and the transfer manager, so multipart snapshot uploads (>5 MiB — every real etcd
snapshot) no longer carry the CRC32 STREAMING-UNSIGNED-PAYLOAD-TRAILER that Ceph
RGW rejects with 400 InvalidArgument. Also pulls in #340 (observed EtcdMember
versions) and #341 (--watch-namespace).
- system/etcd-operator: appVersion v0.5.2 -> v0.5.3 (image tag follows AppVersion),
bump ETCD_OPERATOR_REF, update deployment unittest expectations.
- system/etcd-operator-crds: re-vendor CRDs from v0.5.3. etcdmembers gains the
additive #340 status.version field + "Running" printer column and picks up the
peerAutoTLS spec field the vendored copy was already missing (all additive,
backward-compatible; etcdclusters/etcdsnapshots unchanged). Fix the stale
`make update`: upstream has no config/crd kustomization — CRDs live in
charts/etcd-operator/crd-bases — so vendor those directly and stamp
helm.sh/resource-policy: keep.
Verified end-to-end on a Ceph RGW backend: the v0.5.2 (client-only) agent fails a
multipart snapshot upload with the 400 above; v0.5.3 uploads an 11 MiB multipart
snapshot successfully.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <andrey.kolkov@aenix.io>
- backupstrategy-controller: trim() the decoded S3 endpoint before scheme
stripping so a trailing newline in the Secret can't yield a malformed URL
- etcd-operator: give the pre-upgrade selector-fix hook container resource
requests/limits (matches postgres-operator webhook-ready), +unittest
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Addresses review on #3265:
- pre-upgrade-selector-fix hook: add runAsUser: 65532. clastix/kubectl's
image user is the non-numeric name `nonroot`, which the kubelet cannot
verify against runAsNonRoot: true — so the Pod fails admission and the
hook never runs, silently blocking the very 1.5->1.6 upgrade it exists to
unblock. Matches postgres-operator's webhook-ready hook (same image).
- Digest-pin the kubectl image (the comment already claimed digest-pinning
but shipped a floating v1.32 tag). Reuse the digest postgres-operator
already vendors, add the renovate annotation, and template repo:tag@digest.
- Tests (both charts have CI helm-unittest suites, none previously covered
these):
- etcd-operator/tests/selector-fix-hook_test.yaml: hook wiring, namespaced
least-privilege RBAC, numeric-non-root securityContext (guards the
runAsUser regression above), digest-pinned image.
- etcd-operator/tests/deployment_test.yaml: assert the 256Mi cold-start
memory floor so it can't silently drop back to an OOMKilling value.
- extra/etcd/tests/etcd-cluster_test.yaml: assert the transitional
etcd-headless Service (headless, publishNotReadyAddresses, member
selector, client/peer ports).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Two defects that break the etcd-operator on an in-cluster 1.5 -> 1.6 upgrade
(#2859 swapped the upstream chart for the cozystack-authored one):
- #3242: the controller Deployment's spec.selector.matchLabels changed
({instance,name} -> {name,control-plane}). spec.selector is immutable, so
`helm upgrade` cannot patch the existing Deployment and the whole HelmRelease
upgrade fails ("field is immutable") -- the operator and the v1alpha2 CRDs it
serves never come up, which blocks the etcd v1alpha2 adoption. Fresh installs
use the new selector directly, so fresh-install CI does not catch it. Add a
pre-upgrade hook that deletes the Deployment ONLY when its live selector is
the pre-1.6 one (lacks control-plane=controller-manager), so Helm recreates it
cleanly. No-op when the selector already matches (rc.1 -> later) and never
runs on a fresh install (pre-upgrade only). Keeping the selector stable in the
chart is not an option: rc.1 already shipped the new selector, so aligning it
back would merely move the immutable break to rc.1 -> next.
- Raise the manager's cold-start memory limit floor 128Mi -> 256Mi (and the VPA
minAllowed to match). The steady-state working set is ~250Mi (the VPA's own
recommendation); at 128Mi a Pod that starts before the VPA admission webhook
rewrites it (e.g. a Deployment recreated out of band, or the webhook briefly
unavailable during upgrade) OOMKills into a crash loop. Defense in depth so
the operator never depends on VPA timing merely to avoid crashing; the VPA
still scales it further under load up to maxAllowed.
Verified live on a 1.5 -> 1.6 adoption: the delete-Deployment step plus the VPA
re-applying 256Mi+ let the operator come up and the adoption complete.
Refs: #3242, #3243
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
Address review feedback from gemini-code-assist on packages/system/etcd-operator/templates/deployment.yaml: add an explicit seccompProfile (RuntimeDefault) to the controller-manager pod securityContext.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
Upstream release notes: https://github.com/aenix-io/etcd-operator/releases/tag/v0.4.3
Notable changes:
- Add EtcdBackup CRD for declarative etcd snapshots (#307)
- Add EtcdBackupSchedule CRD for scheduled backups (#307)
- Expose metrics port on client service (#299)
- Replace deprecated gcr.io/kubebuilder/kube-rbac-proxy with
quay.io/brancz/kube-rbac-proxy:v0.18.1 (#308)
- Update Kamaji example manifest
Note: Helm 3 does not install CRDs on upgrade. Existing clusters
require manual application of the new EtcdBackup and
EtcdBackupSchedule CRDs:
kubectl apply --filename packages/system/etcd-operator/charts/etcd-operator/crds/
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
The gcr.io/kubebuilder/kube-rbac-proxy image is no longer available
since GCR was deprecated. Replace it with quay.io/brancz/kube-rbac-proxy
from the original upstream author.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Move common-envs.mk and package.mk from scripts/ to hack/ directory.
Update all Makefile includes to use new paths. Remove unused
issue-flux-certificates.sh script.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
This change is aimed at improving the development experience.
- The option `make delete` has been added.
- Added check for `NAME` and `NAMESPACE` variables
- Now, any package (not just system ones) can include options such as
make show, make diff, make apply.
- Applications from packages/extra require explicit specification of the
`NAMESPACE`.
- Applications from packages/apps require explicit specification of both
`NAME` and `NAMESPACE`.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Timofei Larkin