Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.34 (a5a8862) into release-4.21 - #430
Open
shiftstack-merge-bot[bot] wants to merge 74 commits into
Conversation
…ubernetes#3179) Co-authored-by: Yi-Ying Tan <yi-ying.tan.ext@nokia.com>
The Keystone authentication webhook handler writes the raw bearer token submitted in every TokenReview to the log stream when verbosity is 4 or higher. It is pretty common to set this level (-v=4) while e.g. debugging. Additionally, it is common for logs to be sent to a central store, with different access controls than the main cluster. A user with access to this store can use the captured token for replay attacks for any user that authenticates against the cluster until the token's TTL. Stop logging the token and avoid all of this. The combo of user, any error and the usual timestamp etc. should be more than sufficient. Signed-off-by: Stephen Finucane <stephenfin@redhat.com> Co-authored-by: Stephen Finucane <stephenfin@redhat.com>
Adding myself to the OWNERS file. I'm no stranger to CPO, having reviewed a number of patches already [1], and as noted a comment [2] I intend to increase my participation to the project. [1] https://github.com/kubernetes/cloud-provider-openstack/pulls?q=is%3Apr+involves%3Amandre [2] kubernetes#3166 (comment) Co-authored-by: Martin André <m.andre@redhat.com>
…netes#3190) * magnum-auto-healer: Add certificate validation The controller always sets InsecureSkipVerify. The two modern Magnum drivers in use today both use CAPI and thus kubeadm under the hood. kubeadm injects nodes internal IPs as SANs into the certs it generates, meaning certificate validation should pass when using the same root cert. Thus, we add two new configuration knobs: one to point to a CA file to use (defaulting to the well-known location k8s mounts certs to) and another to explicitly disable verification as an escape hatch. Signed-off-by: Stephen Finucane <stephenfin@redhat.com> Assisted-by: Claude Sonnet 4.8 <noreply@anthropic.com> * magnum-auto-healer: Document Endpoint health check parameters Add a parameter reference table covering all Endpoint check options, including the newly added ca-file and tls-insecure fields. Signed-off-by: Stephen Finucane <stephenfin@redhat.com> * magnum-auto-healer: Respect the unhealthy-duration grace period Signed-off-by: Stephen Finucane <stephenfin@redhat.com> --------- Signed-off-by: Stephen Finucane <stephenfin@redhat.com> Co-authored-by: Stephen Finucane <stephenfin@redhat.com>
Co-authored-by: kayrus <kay.diam@gmail.com>
Co-authored-by: kayrus <kay.diam@gmail.com>
Co-authored-by: kayrus <kay.diam@gmail.com>
Co-authored-by: pýrus <kayrus@users.noreply.github.com>
…rvices (kubernetes#2603) * POC of TargetNodeLabels selector on OpenStack LB * Fix type errors * Update implementation of getKeyValuePropertiesFromServiceAnnotation * gofmt -w -s ./pkg * Polish the code and add documentation --------- Co-authored-by: Ririko Nakamura <ririko.nakamura@outlook.com> Co-authored-by: kayrus <kay.diam@gmail.com>
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
…ntainer image to be consistent with ART for 4.17
… image to be consistent with ART for 4.17
…onsistent with ART for 4.17
…rnetes#2746) Many clouds do not have a 1:1 mapping of compute and storage AZs. As we generate topology information from the metadata service on the node (i.e. a compute AZ), this can prevent us from being able to schedule VMs. Add a new boolean, '--with-topology', to allow users to disable the topology feature where it does not make sense. An identical option already exists for the Manila CSI driver. However, unlike that option, this one defaults to 'true' to retain current behavior. Signed-off-by: Stephen Finucane <stephenfin@redhat.com> (cherry picked from commit ac23a1e) Co-authored-by: Stephen Finucane <stephenfin@redhat.com>
as a preemptive measure against [CVE-2024-45338](GHSA-w32m-9786-jp63). This is essentially a backport of bbb82f4 Signed-off-by: Lennart Jern <lennart.jern@est.tech>
Co-authored-by: pýrus <kayrus@users.noreply.github.com>
…es#2842) * refactor list volumes call * upgrade tests * comments improvements * fix imports and list options * token split * add more jointoken tests Co-authored-by: Konstantinos Angelopoulos <konstantinos.angelopoulos@sap.com>
%T prints the type. %t prints the word true/false, which is what we want. [1] [1] https://pkg.go.dev/fmt Conflicts: pkg/csi/manila/driver.go NOTE(stephenfin): Merge conflicts are due to the absence of PR kubernetes#2734, which we don't want to backport. Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
This causes issue with vendoring.
…clouds.yaml (kubernetes#2911) * handle boolean values correctly when reading from secrets Previously, the validator failed when attempting to parse boolean fields like `UseClouds` in `AuthOpts` from secrets. This was due to secrets being stored as strings, leading to a type mismatch. Added logic to correctly parse string representations of booleans to match the expected type in the struct. (cherry picked from commit f3e4fdb) * Implement clouds.yaml support and make auth params optional Enables reading credentials/config from clouds.yaml when UseClouds is set. Mark Region and AuthURL as optional. (cherry picked from commit 1d66e56)
Co-authored-by: pýrus <kayrus@users.noreply.github.com>
Signed-off-by: moonek <gghonor@naver.com> Signed-off-by: Carlos da Silva <ces.eduardo98@gmail.com>
…ntainer image to be consistent with ART for 4.21 Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-openstack-cloud-controller-manager.yml
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: shiftstack-merge-bot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @shiftstack-merge-bot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
14 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated rebase PR generated by RebaseBot.
Summary
https://github.com/kubernetes/cloud-provider-openstack:release-1.34https://github.com/openshift/cloud-provider-openstack:release-4.21Logs
View job log