ROX-25944: CRS Support in Helm Chart by mclasmeier · Pull Request #12713 · stackrox/stackrox

mclasmeier · 2024-09-16T22:41:11Z

Description

IMPORTANT: Only review commits beginning with 8d75c37. Everything before that will hopefully be in master soon.

This PR

implements CRS support in the secured-cluster-services Helm chart.
Extends the standard deployment machinery (k8sbased.sh) so that it can also use CRS-based deployment flows.
Implements similar heuristic as currently exists for init bundles to enable CRS-based deployments for regular dev deployments.
Use CRS-based deployments for nongroovy test suite and (some) scanner V4 installation tests.

User-facing documentation

CHANGELOG is updated
documentation is tracked in a separate ticket.

Testing and quality

the change is production ready (can only be merged after ROX-25946, ROX-25947: New cluster registration logic #13239)
CI results are inspected

Automated testing

added unit tests
modified existing tests

How I validated my change

Manual testing in addition to automated.

openshift-ci · 2024-09-16T22:41:14Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

rhacs-bot · 2024-09-16T23:03:54Z

Images are ready for the commit at 3bd6a76.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.7.x-466-g3bd6a766a7.

codecov · 2024-09-25T12:11:32Z

Codecov Report

Attention: Patch coverage is 56.73077% with 45 lines in your changes missing coverage. Please review.

Project coverage is 48.53%. Comparing base (f7256e0) to head (1a9b0b2).
Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
central/sensor/service/service_impl.go	0.00%	20 Missing ⚠️
pkg/protoconv/certs/typed_service_certificates.go	85.93%	6 Missing and 3 partials ⚠️
pkg/services/convert.go	0.00%	5 Missing ⚠️
central/cluster/datastore/datastore_impl.go	0.00%	4 Missing ⚠️
pkg/mtls/crypto.go	0.00%	4 Missing ⚠️
pkg/mtls/env.go	0.00%	3 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #12713   +/-   ##
=======================================
  Coverage   48.53%   48.53%           
=======================================
  Files        2473     2474    +1     
  Lines      178677   178743   +66     
=======================================
+ Hits        86720    86759   +39     
- Misses      85008    85035   +27     
  Partials     6949     6949

Flag	Coverage Δ
go-unit-tests	`48.53% <56.73%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚨 Try these New Features:

Flaky Tests Detection - Detect and resolve failed and flaky tests
JS Bundle Analysis - Avoid shipping oversized bundles

mclasmeier · 2024-10-11T09:49:54Z

/retest

mclasmeier · 2024-11-07T11:57:32Z

/test all

mclasmeier · 2024-11-12T17:56:45Z

/test all

mclasmeier · 2024-11-12T19:10:13Z

/test all

mclasmeier · 2024-11-12T22:18:28Z

/test all

…stallation is configured to be 'Helm-managed'

… (which should contain either an init bundle or a CRS)

….yaml.htpl Co-authored-by: Marcin Owsiany <porridge@redhat.com>

…s provided at the same time.

…lity and added propert assertions for the CRS data.

…ent script

… bundle

…tpl.htpl Co-authored-by: Marcin Owsiany <porridge@redhat.com>

… of the CI setting

mclasmeier · 2025-01-16T11:07:13Z

Please ping us when this is no longer a draft and is ready for review.

It's ready to be merged. But I don't remember why you raised interest in this specific PR -- maybe you were automatically assigned as reviewers? In any case, this is just about the Helm changes for CRS, so I don't think you need to care about this one. @vikin91

mclasmeier · 2025-01-16T12:42:18Z

/retest

image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl

openshift-ci · 2025-01-16T14:49:35Z

@mclasmeier: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/gke-scanner-v4-tests	`20a8e9b`	link	false	`/test gke-scanner-v4-tests`
ci/prow/ocp-4-12-scanner-v4-tests	`20a8e9b`	link	false	`/test ocp-4-12-scanner-v4-tests`
ci/prow/ocp-4-17-scanner-v4-tests	`20a8e9b`	link	false	`/test ocp-4-17-scanner-v4-tests`
ci/prow/gke-ui-e2e-tests	`c35dac3`	link	false	`/test gke-ui-e2e-tests`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

vladbologa · 2025-01-16T14:58:27Z

/test ocp-4-17-qa-e2e-tests

vikin91 · 2025-01-16T16:37:01Z

Please ping us when this is no longer a draft and is ready for review.

It's ready to be merged. But I don't remember why you raised interest in this specific PR -- maybe you were automatically assigned as reviewers? In any case, this is just about the Helm changes for CRS, so I don't think you need to care about this one. @vikin91

Yes, I was pinged as a reviewer. As I am no longer in the reviewer list then there is no need to worry about that comment :)

openshift-ci bot added the do-not-merge/work-in-progress label Sep 16, 2024

github-actions bot added area/roxctl area/central area/helm area/sensor labels Sep 16, 2024

mclasmeier changed the title ~~Mc/crs 50 helm chart~~ ROX-25944: CRS Support in Helm Charts Sep 16, 2024

mclasmeier force-pushed the mc/crs-50-helm-chart branch from d299ba6 to c5decaf Compare September 25, 2024 10:26

mclasmeier force-pushed the mc/crs-50-helm-chart branch from acd4386 to e1ebd31 Compare October 10, 2024 19:38

mclasmeier force-pushed the mc/crs-50-helm-chart branch 4 times, most recently from 0332313 to ff32c8e Compare October 17, 2024 21:22

mclasmeier force-pushed the mc/crs-50-helm-chart branch 5 times, most recently from f059551 to 301dcb1 Compare November 6, 2024 16:29

mclasmeier force-pushed the mc/crs-50-helm-chart branch 3 times, most recently from e4c2392 to 16450e3 Compare November 12, 2024 14:17

mclasmeier force-pushed the mc/crs-50-helm-chart branch from 16450e3 to 0399719 Compare November 12, 2024 19:09

mclasmeier force-pushed the mc/crs-50-helm-chart branch from be4aefd to c1bdca7 Compare November 12, 2024 22:43

Moritz Clasmeier and others added 20 commits January 16, 2025 11:59

Set SENSOR_HELM_MANAGED=true

6cb98a4

Don't set ROX_DEPLOY_SENSOR_WITH_CRS=false by default

12cb733

In order for CRS to work we need to make sure that secured-cluster in…

b5488e9

…stallation is configured to be 'Helm-managed'

Removed CA placeholder for linting in case the helm_args are provided…

d1bd796

… (which should contain either an init bundle or a CRS)

Elaborate on init bundles vs CRS in helm chart README

ad7bd25

Update image/templates/helm/stackrox-secured-cluster/templates/sensor…

1b76d2a

….yaml.htpl Co-authored-by: Marcin Owsiany <porridge@redhat.com>

Added two tests and make the chart fail in case CRS and init-bundle i…

74e9398

…s provided at the same time.

refactoring of the CRS-part in _init.tpl.htpl to make improve readabi…

ea1ab86

…lity and added propert assertions for the CRS data.

Removed bogus check for ROX_DEPLOY_SENSOR_WITH_CRS == true in deploym…

ae8aa2f

…ent script

Use correct --set-file argument in helm invocation

a370fab

Improve error handling in case an invalid CRS has been provided

74c9fbf

echo linting info

f38b019

Metatemplating conditionals for README

f222496

Modify detection of init bundle; remove bogus check for operator init…

9e1a2bf

… bundle

Describe how to regenerate CRS for testdata.

394fbc8

Remove duplicated check in helm chart

db446a0

Move api_resp definition

adec0bc

Update image/templates/helm/stackrox-secured-cluster/templates/_init.…

9a2b8b5

…tpl.htpl Co-authored-by: Marcin Owsiany <porridge@redhat.com>

Update image/templates/helm/stackrox-secured-cluster/templates/_init.…

b0be6a4

…tpl.htpl Co-authored-by: Marcin Owsiany <porridge@redhat.com>

Enable CRS flow by default if the Helm chart supports it irregardless…

3bd6a76

… of the CI setting

mclasmeier force-pushed the mc/crs-50-helm-chart branch from c35dac3 to 3bd6a76 Compare January 16, 2025 11:00

vladbologa reviewed Jan 16, 2025

View reviewed changes

image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl Show resolved Hide resolved

mclasmeier merged commit 8b747ea into master Jan 16, 2025

mclasmeier deleted the mc/crs-50-helm-chart branch January 16, 2025 18:24

porridge mentioned this pull request Jan 29, 2025

Update README.md for deploying Stackrox via GitOps #13544

Open

Conversation

mclasmeier commented Sep 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

openshift-ci bot commented Sep 16, 2024

Uh oh!

rhacs-bot commented Sep 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Sep 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mclasmeier commented Oct 11, 2024

Uh oh!

mclasmeier commented Nov 7, 2024

Uh oh!

mclasmeier commented Nov 12, 2024

Uh oh!

mclasmeier commented Nov 12, 2024

Uh oh!

mclasmeier commented Nov 12, 2024

Uh oh!

mclasmeier commented Jan 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mclasmeier commented Jan 16, 2025

Uh oh!

Uh oh!

openshift-ci bot commented Jan 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vladbologa commented Jan 16, 2025

Uh oh!

vikin91 commented Jan 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

mclasmeier commented Sep 16, 2024 •

edited

Loading

rhacs-bot commented Sep 16, 2024 •

edited

Loading

codecov bot commented Sep 25, 2024 •

edited

Loading

mclasmeier commented Jan 16, 2025 •

edited

Loading

openshift-ci bot commented Jan 16, 2025 •

edited

Loading