Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 github-actions[bot]
|
a75152b2e4 |
+3
-214
@@ -2,223 +2,12 @@ name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: ['**']
|
||||
branches: [main]
|
||||
pull_request:
|
||||
branches: [main, dev, uat]
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
node-version:
|
||||
description: 'Node.js version to use'
|
||||
required: false
|
||||
type: string
|
||||
default: '22'
|
||||
workflow_call:
|
||||
inputs:
|
||||
node-version:
|
||||
description: 'Node.js version to use'
|
||||
required: false
|
||||
type: string
|
||||
default: '22'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
ci:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
container: node:22-slim
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Install Python
|
||||
run: apt-get update && apt-get install -y --no-install-recommends python3 python3-yaml
|
||||
|
||||
- name: Validate artifacthub-pkg.yml
|
||||
run: |
|
||||
python3 - <<'EOF'
|
||||
import sys, re
|
||||
try:
|
||||
import yaml
|
||||
except ImportError:
|
||||
print("::warning::PyYAML not available, skipping artifacthub-pkg.yml validation")
|
||||
sys.exit(0)
|
||||
|
||||
try:
|
||||
with open("artifacthub-pkg.yml") as f:
|
||||
pkg = yaml.safe_load(f)
|
||||
except FileNotFoundError:
|
||||
print("::error::artifacthub-pkg.yml not found")
|
||||
sys.exit(1)
|
||||
except yaml.YAMLError as e:
|
||||
print(f"::error::artifacthub-pkg.yml is invalid YAML: {e}")
|
||||
sys.exit(1)
|
||||
|
||||
errors = []
|
||||
|
||||
for field in ["version", "name", "description", "homeURL"]:
|
||||
if not pkg.get(field):
|
||||
errors.append(f"Missing required field: {field}")
|
||||
|
||||
version = pkg.get("version", "")
|
||||
if version and not re.match(r'^\d+\.\d+\.\d+$', str(version)):
|
||||
errors.append(f"version '{version}' is not SemVer (expected X.Y.Z)")
|
||||
|
||||
annotations = pkg.get("annotations", {}) or {}
|
||||
archive_url = annotations.get("headlamp/plugin/archive-url", "")
|
||||
archive_checksum = annotations.get("headlamp/plugin/archive-checksum", "")
|
||||
|
||||
if not archive_url:
|
||||
errors.append("Missing annotation: headlamp/plugin/archive-url")
|
||||
if not archive_checksum:
|
||||
errors.append("Missing annotation: headlamp/plugin/archive-checksum")
|
||||
elif not re.match(r'^sha256:[0-9a-f]{64}$', str(archive_checksum)):
|
||||
errors.append(f"archive-checksum has unexpected format: '{archive_checksum}' (expected sha256:<64 hex chars>)")
|
||||
|
||||
if errors:
|
||||
for e in errors:
|
||||
print(f"::error::{e}")
|
||||
sys.exit(1)
|
||||
|
||||
print(f"artifacthub-pkg.yml valid: name={pkg['name']} version={pkg['version']}")
|
||||
EOF
|
||||
|
||||
- name: Detect package manager
|
||||
id: pkg-manager
|
||||
run: |
|
||||
if [ -f "pnpm-lock.yaml" ]; then
|
||||
echo "manager=pnpm" >> $GITHUB_OUTPUT
|
||||
PM=$(python3 -c "import json,sys; d=json.load(open('package.json')); print('true' if d.get('packageManager','').startswith('pnpm@') else 'false')" 2>/dev/null || echo "false")
|
||||
echo "has_package_manager=$PM" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "manager=npm" >> $GITHUB_OUTPUT
|
||||
echo "has_package_manager=false" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Setup Node
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version: ${{ inputs.node-version || '22' }}
|
||||
cache: ${{ steps.pkg-manager.outputs.manager == 'npm' && 'npm' || '' }}
|
||||
|
||||
- name: Setup pnpm (via Corepack, reads version from packageManager field)
|
||||
if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'true'
|
||||
run: |
|
||||
npm install -g corepack
|
||||
corepack enable pnpm
|
||||
corepack install
|
||||
|
||||
- name: Setup pnpm (version latest)
|
||||
if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'false'
|
||||
uses: pnpm/action-setup@v5
|
||||
with:
|
||||
run_install: false
|
||||
version: latest
|
||||
|
||||
- name: Get pnpm store directory
|
||||
id: pnpm-store
|
||||
if: steps.pkg-manager.outputs.manager == 'pnpm'
|
||||
run: echo "dir=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Cache pnpm store
|
||||
if: steps.pkg-manager.outputs.manager == 'pnpm'
|
||||
uses: actions/cache@v5
|
||||
with:
|
||||
path: ${{ steps.pnpm-store.outputs.dir }}
|
||||
key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-pnpm-
|
||||
|
||||
- name: Validate pnpm lockfile freshness
|
||||
if: steps.pkg-manager.outputs.manager == 'pnpm'
|
||||
run: |
|
||||
if [ ! -f "pnpm-lock.yaml" ]; then
|
||||
echo "No pnpm-lock.yaml found, skipping lockfile freshness check"
|
||||
exit 0
|
||||
fi
|
||||
if ! grep -q 'overrides:' pnpm-lock.yaml 2>/dev/null; then
|
||||
echo "No overrides section in pnpm-lock.yaml, skipping lockfile freshness check"
|
||||
exit 0
|
||||
fi
|
||||
echo "Detected pnpm-lock.yaml with overrides section. Checking lockfile freshness..."
|
||||
ERR_FILE=$(mktemp)
|
||||
if pnpm install --frozen-lockfile 2>&1 | tee "$ERR_FILE"; then
|
||||
echo "Lockfile is fresh."
|
||||
else
|
||||
if grep -q "CONFIG_MISMATCH\|EBADLOCKFILE\|ERR_PNPM_LOCKFILE" "$ERR_FILE"; then
|
||||
echo ""
|
||||
echo "::error::pnpm-lock.yaml is out of sync with package.json overrides."
|
||||
echo "::error::Run 'pnpm install' to regenerate the lockfile and commit the updated pnpm-lock.yaml."
|
||||
rm -f "$ERR_FILE"
|
||||
exit 1
|
||||
fi
|
||||
rm -f "$ERR_FILE"
|
||||
echo "::warning::Install failed with a different error. Will retry in the Install dependencies step."
|
||||
fi
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
max_attempts=3
|
||||
attempt=1
|
||||
while [ $attempt -le $max_attempts ]; do
|
||||
echo "Attempt $attempt of $max_attempts"
|
||||
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
||||
pnpm install --frozen-lockfile && break
|
||||
else
|
||||
npm ci && break
|
||||
fi
|
||||
if [ $attempt -lt $max_attempts ]; then
|
||||
echo "::warning::Install step failed on attempt $attempt. Retrying in 5 seconds..."
|
||||
sleep 5
|
||||
fi
|
||||
attempt=$((attempt + 1))
|
||||
done
|
||||
if [ $attempt -gt $max_attempts ]; then
|
||||
echo "::error::Install step failed after $max_attempts attempts."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Build plugin
|
||||
run: npx @kinvolk/headlamp-plugin build
|
||||
|
||||
- name: Lint
|
||||
run: |
|
||||
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
||||
pnpm run lint
|
||||
else
|
||||
npm run lint
|
||||
fi
|
||||
|
||||
- name: Type-check
|
||||
run: |
|
||||
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
||||
pnpm run tsc
|
||||
else
|
||||
npm run tsc
|
||||
fi
|
||||
|
||||
- name: Format check
|
||||
run: |
|
||||
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
||||
pnpm run format:check
|
||||
else
|
||||
npm run format:check
|
||||
fi
|
||||
|
||||
- name: Run tests
|
||||
run: |
|
||||
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
||||
pnpm test
|
||||
else
|
||||
npm test
|
||||
fi
|
||||
|
||||
- name: Security audit
|
||||
run: |
|
||||
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
||||
npx audit-ci --pnpm --audit-level=high --config ./audit-ci.jsonc
|
||||
else
|
||||
npx audit-ci --npm --audit-level=high --config ./audit-ci.jsonc
|
||||
fi
|
||||
uses: privilegedescalation/.github/.github/workflows/plugin-ci.yaml@main
|
||||
|
||||
@@ -1,116 +1,18 @@
|
||||
name: Promotion Gate
|
||||
name: Dual Approval (CTO + QA)
|
||||
|
||||
# dev PRs: no gate (engineer self-merges).
|
||||
# uat PRs: QA approval required.
|
||||
# main PRs: UAT approval required (uat→main promotions).
|
||||
# Calls the shared dual-approval-check workflow.
|
||||
# Passes when both privilegedescalation-cto and privilegedescalation-qa
|
||||
# have approved the PR. Add "Dual Approval (CTO + QA)" to required_status_checks
|
||||
# in branch protection to enforce this gate.
|
||||
|
||||
on:
|
||||
pull_request_review:
|
||||
types: [submitted, dismissed]
|
||||
pull_request:
|
||||
branches: [uat, main]
|
||||
branches: [main]
|
||||
types: [opened, reopened, synchronize]
|
||||
|
||||
jobs:
|
||||
promotion-gate:
|
||||
name: Promotion Gate
|
||||
runs-on: ubuntu-latest
|
||||
container: ubuntu:latest
|
||||
timeout-minutes: 5
|
||||
|
||||
steps:
|
||||
- name: Install dependencies
|
||||
run: apt-get update -qq && apt-get install -y --no-install-recommends ca-certificates curl jq
|
||||
|
||||
- name: Check promotion approval
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
REPO: ${{ github.repository }}
|
||||
BASE_REF: ${{ github.base_ref }}
|
||||
run: |
|
||||
if [ -z "${PR_NUMBER}" ] || [ "${PR_NUMBER}" = "null" ]; then
|
||||
echo "::notice::No PR number in context. Skipping promotion gate."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Checking promotion gate for PR #${PR_NUMBER} targeting ${BASE_REF} in ${REPO}"
|
||||
|
||||
if [ -z "${BASE_REF}" ] && [ -n "${PR_NUMBER}" ] && [ "${PR_NUMBER}" != "null" ]; then
|
||||
BASE_REF=$(curl -sf \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Accept: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}" | jq -r '.base.ref')
|
||||
echo "BASE_REF was empty; resolved from PR #${PR_NUMBER} API: ${BASE_REF}"
|
||||
fi
|
||||
|
||||
# Determine required reviewer based on target branch
|
||||
case "${BASE_REF}" in
|
||||
dev)
|
||||
echo "Target is dev — no review required. Engineers self-merge."
|
||||
exit 0
|
||||
;;
|
||||
uat)
|
||||
REQUIRED_REVIEWER="pe_regina"
|
||||
GATE_NAME="QA"
|
||||
;;
|
||||
main)
|
||||
REQUIRED_REVIEWER="pe_regina"
|
||||
GATE_NAME="QA"
|
||||
# For plugin repos (Pipeline A), UAT approval is needed for uat→main
|
||||
# Check if the source branch is uat
|
||||
SOURCE_REF=$(curl -sf \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Accept: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}" | jq -r '.head.ref')
|
||||
|
||||
if [ "${SOURCE_REF}" = "uat" ]; then
|
||||
REQUIRED_REVIEWER="pe_patty"
|
||||
GATE_NAME="UAT"
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo "::notice::Target branch '${BASE_REF}' has no promotion gate configured."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "Required reviewer: ${REQUIRED_REVIEWER} (${GATE_NAME})"
|
||||
|
||||
# For uat→main promotions, pe_patty may not be able to review (bot account).
|
||||
# Accept pe_nancy (CTO) as a valid alternative reviewer.
|
||||
ALT_REVIEWER=""
|
||||
if [ "${REQUIRED_REVIEWER}" = "pe_patty" ]; then
|
||||
ALT_REVIEWER="pe_nancy"
|
||||
fi
|
||||
|
||||
REVIEWS=$(curl -sf \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Accept: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}/reviews")
|
||||
|
||||
if [ -z "${REVIEWS}" ] || [ "${REVIEWS}" = "null" ]; then
|
||||
echo "::warning::Could not fetch reviews for PR #${PR_NUMBER}."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
REVIEWER_APPROVED=$(echo "${REVIEWS}" | jq -r --arg user "${REQUIRED_REVIEWER}" \
|
||||
'[.[] | select(.user.login == $user)] | last | if .state then .state == "APPROVED" else false end')
|
||||
|
||||
echo "${GATE_NAME} (${REQUIRED_REVIEWER}) approved: ${REVIEWER_APPROVED}"
|
||||
|
||||
# Fallback: check if CTO approved as alternative for uat→main
|
||||
if [ "${REVIEWER_APPROVED}" != "true" ] && [ -n "${ALT_REVIEWER}" ]; then
|
||||
REVIEWER_APPROVED=$(echo "${REVIEWS}" | jq -r --arg user "${ALT_REVIEWER}" \
|
||||
'[.[] | select(.user.login == $user)] | last | if .state then .state == "APPROVED" else false end')
|
||||
if [ "${REVIEWER_APPROVED}" = "true" ]; then
|
||||
echo "CTO (${ALT_REVIEWER}) approved as fallback for UAT gate."
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "${REVIEWER_APPROVED}" = "true" ]; then
|
||||
echo "Promotion gate passed: ${GATE_NAME} has approved."
|
||||
else
|
||||
echo "Promotion gate failed: waiting for ${GATE_NAME} approval from ${REQUIRED_REVIEWER}."
|
||||
exit 1
|
||||
fi
|
||||
dual-approval:
|
||||
uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
|
||||
secrets: inherit
|
||||
|
||||
@@ -7,380 +7,17 @@ on:
|
||||
description: 'Release version (e.g. 1.0.0)'
|
||||
required: true
|
||||
type: string
|
||||
repository_dispatch:
|
||||
types: [release]
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
|
||||
jobs:
|
||||
check-secrets:
|
||||
runs-on: runners-privilegedescalation
|
||||
outputs:
|
||||
ready: ${{ steps.check.outputs.ready }}
|
||||
steps:
|
||||
- name: Verify GITEA_RELEASE_TOKEN is configured
|
||||
id: check
|
||||
env:
|
||||
GITEA_RELEASE_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
|
||||
run: |
|
||||
if [ -z "$GITEA_RELEASE_TOKEN" ]; then
|
||||
echo "::notice::GITEA_RELEASE_TOKEN org secret is not configured (see PRI-1533). Release skipped — no artifacts will be created."
|
||||
echo "ready=false" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "ready=true" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
ci:
|
||||
needs: check-secrets
|
||||
if: needs.check-secrets.outputs.ready == 'true'
|
||||
uses: ./.github/workflows/ci.yaml
|
||||
with:
|
||||
node-version: '22'
|
||||
|
||||
check-token-permissions:
|
||||
needs: check-secrets
|
||||
if: needs.check-secrets.outputs.ready == 'true'
|
||||
runs-on: runners-privilegedescalation
|
||||
outputs:
|
||||
has_write: ${{ steps.check.outputs.has_write }}
|
||||
steps:
|
||||
- name: Check write permissions via API
|
||||
id: check
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
|
||||
REPO: ${{ github.repository }}
|
||||
run: |
|
||||
HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
|
||||
-X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Accept: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/git/refs" \
|
||||
-d '{"ref":"refs/heads/_release_check","sha":"${{ github.sha }}"}')
|
||||
if [ "$HTTP_CODE" = "201" ]; then
|
||||
echo "::notice::Token has write permission — cleaning up test ref."
|
||||
curl -sf -o /dev/null -w "%{http_code}" \
|
||||
-X DELETE \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/git/refs/heads/_release_check"
|
||||
echo "has_write=true" >> $GITHUB_OUTPUT
|
||||
elif [ "$HTTP_CODE" = "403" ]; then
|
||||
echo "::error::Token lacks write permission. Release cannot push tags or branches."
|
||||
echo "has_write=false" >> $GITHUB_OUTPUT
|
||||
exit 1
|
||||
else
|
||||
echo "::warning::Unexpected response ($HTTP_CODE) when checking write permission."
|
||||
echo "has_write=false" >> $GITHUB_OUTPUT
|
||||
exit 1
|
||||
fi
|
||||
|
||||
check-tag:
|
||||
needs: check-secrets
|
||||
if: needs.check-secrets.outputs.ready == 'true'
|
||||
runs-on: runners-privilegedescalation
|
||||
outputs:
|
||||
skip: ${{ steps.check.outputs.skip }}
|
||||
steps:
|
||||
- name: Check if tag already exists
|
||||
id: check
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
|
||||
REPO: ${{ github.repository }}
|
||||
run: |
|
||||
HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/git/refs/tags/v${{ inputs.version }}")
|
||||
if [ "$HTTP_CODE" = "200" ]; then
|
||||
echo "::notice::Tag v${{ inputs.version }} already exists. Release skipped (not an error)."
|
||||
echo "skip=true" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "skip=false" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
release:
|
||||
needs: [ci, check-tag, check-secrets, check-token-permissions]
|
||||
if: needs.check-secrets.outputs.ready == 'true' && needs.check-tag.outputs.skip != 'true' && needs.check-token-permissions.outputs.has_write == 'true'
|
||||
runs-on: runners-privilegedescalation
|
||||
timeout-minutes: 10
|
||||
|
||||
steps:
|
||||
- name: Validate version format
|
||||
run: |
|
||||
if [[ ! "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
||||
echo "Error: Version must be in X.Y.Z format"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Detect package manager
|
||||
id: pkg-manager
|
||||
run: |
|
||||
if [ -f "pnpm-lock.yaml" ]; then
|
||||
echo "manager=pnpm" >> $GITHUB_OUTPUT
|
||||
echo "lockfile=pnpm-lock.yaml" >> $GITHUB_OUTPUT
|
||||
PM=$(python3 -c "import json,sys; d=json.load(open('package.json')); print('true' if d.get('packageManager','').startswith('pnpm@') else 'false')" 2>/dev/null || echo "false")
|
||||
echo "has_package_manager=$PM" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "manager=npm" >> $GITHUB_OUTPUT
|
||||
echo "lockfile=package-lock.json" >> $GITHUB_OUTPUT
|
||||
echo "has_package_manager=false" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Setup Node
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version: '22'
|
||||
cache: ${{ steps.pkg-manager.outputs.manager == 'npm' && 'npm' || '' }}
|
||||
|
||||
- name: Setup pnpm (via Corepack)
|
||||
if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'true'
|
||||
run: |
|
||||
npm install -g corepack
|
||||
corepack enable pnpm
|
||||
corepack install
|
||||
|
||||
- name: Setup pnpm (version latest)
|
||||
if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'false'
|
||||
uses: pnpm/action-setup@v5
|
||||
with:
|
||||
run_install: false
|
||||
version: latest
|
||||
|
||||
- name: Get pnpm store directory
|
||||
id: pnpm-store
|
||||
if: steps.pkg-manager.outputs.manager == 'pnpm'
|
||||
run: echo "dir=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Cache pnpm store
|
||||
if: steps.pkg-manager.outputs.manager == 'pnpm'
|
||||
uses: actions/cache@v5
|
||||
with:
|
||||
path: ${{ steps.pnpm-store.outputs.dir }}
|
||||
key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-pnpm-
|
||||
|
||||
- name: Configure Git
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
|
||||
run: |
|
||||
git config --global user.name "github-actions[bot]"
|
||||
git config --global user.email "github-actions[bot]@users.noreply.github.com"
|
||||
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
||||
git remote set-url origin "https://x-access-token:${GITEA_TOKEN}@git.farh.net/${{ github.repository }}.git"
|
||||
|
||||
- name: Update version in package.json
|
||||
run: |
|
||||
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
||||
pnpm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
|
||||
else
|
||||
npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
|
||||
fi
|
||||
|
||||
- name: Update artifacthub-pkg.yml
|
||||
env:
|
||||
REPO: ${{ github.repository }}
|
||||
run: |
|
||||
VERSION="${{ inputs.version }}"
|
||||
if [ -f artifacthub-pkg.yml ]; then
|
||||
PKG_NAME=$(grep '^name:' artifacthub-pkg.yml | cut -d: -f2 | tr -d ' "')
|
||||
else
|
||||
PKG_NAME=$(jq -r .name package.json | sed 's|^@[^/]*/||')
|
||||
fi
|
||||
RELEASE_URL="https://git.farh.net/${REPO}/releases/download/v${VERSION}/${PKG_NAME}-${VERSION}.tar.gz"
|
||||
sed -i "s/^version:.*/version: \"${VERSION}\"/" artifacthub-pkg.yml
|
||||
sed -i "s|headlamp/plugin/archive-url:.*|headlamp/plugin/archive-url: \"${RELEASE_URL}\"|" artifacthub-pkg.yml
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
max_attempts=3
|
||||
attempt=1
|
||||
while [ $attempt -le $max_attempts ]; do
|
||||
echo "Attempt $attempt of $max_attempts"
|
||||
if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
|
||||
pnpm install --frozen-lockfile && break
|
||||
else
|
||||
npm ci && break
|
||||
fi
|
||||
if [ $attempt -lt $max_attempts ]; then
|
||||
echo "::warning::Install step failed on attempt $attempt. Retrying in 5 seconds..."
|
||||
sleep 5
|
||||
fi
|
||||
attempt=$((attempt + 1))
|
||||
done
|
||||
if [ $attempt -gt $max_attempts ]; then
|
||||
echo "::error::Install step failed after $max_attempts attempts."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Build plugin
|
||||
run: npx @kinvolk/headlamp-plugin build
|
||||
|
||||
- name: Package plugin
|
||||
run: npx @kinvolk/headlamp-plugin package
|
||||
|
||||
- name: Prepare release tarball
|
||||
run: |
|
||||
VERSION="${{ inputs.version }}"
|
||||
if [ -f artifacthub-pkg.yml ]; then
|
||||
PKG_NAME=$(grep '^name:' artifacthub-pkg.yml | cut -d: -f2 | tr -d ' "')
|
||||
else
|
||||
PKG_NAME=$(jq -r .name package.json | sed 's|^@[^/]*/||')
|
||||
fi
|
||||
TARBALL="${PKG_NAME}-${VERSION}.tar.gz"
|
||||
for f in *.tar.gz; do
|
||||
[ "$f" != "$TARBALL" ] && mv "$f" "$TARBALL"
|
||||
done
|
||||
if [ ! -f "$TARBALL" ]; then
|
||||
echo "Error: Expected tarball $TARBALL not found"
|
||||
ls -la *.tar.gz 2>/dev/null || echo "No .tar.gz files found"
|
||||
exit 1
|
||||
fi
|
||||
echo "TARBALL=$TARBALL" >> $GITHUB_ENV
|
||||
echo "PKG_NAME=$PKG_NAME" >> $GITHUB_ENV
|
||||
|
||||
- name: Validate tarball
|
||||
run: |
|
||||
echo "Tarball: ${{ env.TARBALL }}"
|
||||
ls -lh "${{ env.TARBALL }}"
|
||||
tar -tzf "${{ env.TARBALL }}" | head -20
|
||||
tar -tzf "${{ env.TARBALL }}" | grep -q "main.js" || { echo "Error: main.js not found in tarball"; exit 1; }
|
||||
|
||||
- name: Compute checksum
|
||||
run: |
|
||||
CHECKSUM=$(sha256sum "${{ env.TARBALL }}" | awk '{print $1}')
|
||||
echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
|
||||
sed -i "s|headlamp/plugin/archive-checksum:.*|headlamp/plugin/archive-checksum: sha256:${CHECKSUM}|" artifacthub-pkg.yml
|
||||
|
||||
- name: Commit and tag
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
|
||||
run: |
|
||||
VERSION="${{ inputs.version }}"
|
||||
BRANCH="release/v${VERSION}"
|
||||
if git ls-remote --exit-code origin "refs/heads/$BRANCH" 2>/dev/null; then
|
||||
echo "::notice::Branch $BRANCH already exists — deleting for clean re-trigger."
|
||||
git push origin --delete "$BRANCH"
|
||||
fi
|
||||
git checkout -b "$BRANCH"
|
||||
git add package.json "${{ steps.pkg-manager.outputs.lockfile }}" artifacthub-pkg.yml
|
||||
git commit -m "release: v${VERSION}"
|
||||
git tag "v${VERSION}"
|
||||
git push origin "$BRANCH"
|
||||
git push origin "refs/tags/v${VERSION}"
|
||||
|
||||
- name: Create Gitea Release
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
|
||||
REPO: ${{ github.repository }}
|
||||
run: |
|
||||
VERSION="${{ inputs.version }}"
|
||||
TARBALL="${{ env.TARBALL }}"
|
||||
RESPONSE=$(curl -sf -X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/releases" \
|
||||
-d "{
|
||||
\"tag_name\": \"v${VERSION}\",
|
||||
\"name\": \"Release v${VERSION}\",
|
||||
\"draft\": false,
|
||||
\"prerelease\": false
|
||||
}")
|
||||
if [ -z "$RESPONSE" ]; then
|
||||
echo "::warning::Release creation returned empty response (may already exist)"
|
||||
else
|
||||
echo "::notice::Release v${VERSION} created successfully"
|
||||
fi
|
||||
UPLOAD_URL=$(echo "$RESPONSE" | jq -r '.upload_url' 2>/dev/null || echo "")
|
||||
if [ -n "$UPLOAD_URL" ] && [ "$UPLOAD_URL" != "null" ]; then
|
||||
UPLOAD_URL="${UPLOAD_URL%%\{*}"
|
||||
curl -sf -X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/octet-stream" \
|
||||
"${UPLOAD_URL}?name=${TARBALL}" \
|
||||
--data-binary "@${TARBALL}"
|
||||
echo "::notice::Tarball uploaded successfully"
|
||||
fi
|
||||
|
||||
- name: Create PR for version bump
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
|
||||
REPO: ${{ github.repository }}
|
||||
run: |
|
||||
set -o pipefail
|
||||
VERSION="${{ inputs.version }}"
|
||||
BODY=$(printf "Automated version bump and checksum update for v%s.\n\ncc @cpfarhood" "${VERSION}")
|
||||
RESPONSE=$(curl -sf -X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls" \
|
||||
-d "{
|
||||
\"title\": \"release: v${VERSION}\",
|
||||
\"body\": \"$BODY\",
|
||||
\"base\": \"main\",
|
||||
\"head\": \"release/v${VERSION}\"
|
||||
}")
|
||||
PR_NUMBER=$(echo "$RESPONSE" | jq -r '.number' 2>/dev/null || echo "")
|
||||
if [ -z "$PR_NUMBER" ] || [ "$PR_NUMBER" = "null" ]; then
|
||||
EXISTING=$(curl -sf \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls?state=open&base=main&head=release/v${VERSION}" \
|
||||
| jq -r '.[0].number' 2>/dev/null || echo "")
|
||||
if [ -n "$EXISTING" ] && [ "$EXISTING" != "null" ]; then
|
||||
PR_NUMBER="$EXISTING"
|
||||
echo "::notice::Open PR #${PR_NUMBER} for release/v${VERSION} already exists — skipping creation."
|
||||
else
|
||||
echo "::error::Could not determine PR number for release/v${VERSION}."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
echo "::notice::Working with PR #${PR_NUMBER}"
|
||||
|
||||
PR_STATE=$(curl -sf \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}" \
|
||||
| jq -r '.state' 2>/dev/null || echo "")
|
||||
if [ "$PR_STATE" = "merged" ]; then
|
||||
echo "::notice::PR #${PR_NUMBER} was already merged. Nothing to do."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
MERGE_RESULT=$(curl -sf -X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}/merge" \
|
||||
-d '{"do": "squash"}')
|
||||
if echo "$MERGE_RESULT" | jq -e '.merged' 2>/dev/null; then
|
||||
echo "PR merged successfully."
|
||||
else
|
||||
if [ "$PR_STATE" = "merged" ]; then
|
||||
echo "PR was already merged."
|
||||
else
|
||||
echo "::warning::Merge response: $MERGE_RESULT"
|
||||
fi
|
||||
fi
|
||||
|
||||
- name: Verify checksums are consistent (main == tag == tarball)
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
|
||||
REPO: ${{ github.repository }}
|
||||
run: |
|
||||
VERSION="${{ inputs.version }}"
|
||||
TARBALL_CS=$(sha256sum "${{ env.TARBALL }}" | awk '{print $1}')
|
||||
TAG_CS=$(git show "v${VERSION}:artifacthub-pkg.yml" 2>/dev/null \
|
||||
| grep "archive-checksum" | awk '{print $2}' | sed 's/sha256://')
|
||||
MAIN_CS=$(git fetch origin main 2>/dev/null; git show "origin/main:artifacthub-pkg.yml" \
|
||||
| grep "archive-checksum" | awk '{print $2}' | sed 's/sha256://')
|
||||
echo "Tarball SHA256 : $TARBALL_CS"
|
||||
echo "Tag artifacthub: $TAG_CS"
|
||||
echo "Main artifacthub: $MAIN_CS"
|
||||
FAIL=0
|
||||
[ "$TARBALL_CS" != "$TAG_CS" ] && echo "ERROR: tag checksum mismatch!" && FAIL=1
|
||||
[ "$TARBALL_CS" != "$MAIN_CS" ] && echo "ERROR: main checksum mismatch!" && FAIL=1
|
||||
[ "$FAIL" = "1" ] && exit 1
|
||||
echo "All checksums consistent — ArtifactHub will index correctly."
|
||||
uses: privilegedescalation/.github/.github/workflows/plugin-release.yaml@main
|
||||
secrets:
|
||||
RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
|
||||
RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
|
||||
with:
|
||||
version: ${{ inputs.version }}
|
||||
upstream-repo: fenio/tns-csi
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
{
|
||||
"config": {
|
||||
// Line length — not enforced for docs with code examples
|
||||
"MD013": false,
|
||||
// First line heading — files use YAML frontmatter, not headings
|
||||
"MD041": false,
|
||||
// Emphasis as heading — common pattern for Option 1/2/3 sections
|
||||
"MD036": false,
|
||||
// No duplicate heading — changelog files repeat section names intentionally
|
||||
"MD024": false,
|
||||
// Fenced code language — not always applicable for diagram blocks
|
||||
"MD040": false,
|
||||
// Table column style — table alignment is visual, not semantic
|
||||
"MD060": false,
|
||||
// Ordered list item prefix — number resets are intentional in documents
|
||||
"MD029": false,
|
||||
// No inline HTML — each elements are valid in valid Markdown
|
||||
"MD033": false,
|
||||
// List marker space — spacing after list markers varies by editor
|
||||
"MD030": false,
|
||||
// Blanks around headings — not always needed in compact docs
|
||||
"MD022": false,
|
||||
// Blanks around lists — not always needed in compact docs
|
||||
"MD032": false,
|
||||
// Blanks around fences — not always needed between adjacent blocks
|
||||
"MD031": false,
|
||||
// Multiple blanks — editor artifacts, not semantic
|
||||
"MD012": false,
|
||||
// Single title — files may have multiple H1 sections
|
||||
"MD025": false,
|
||||
// Trailing spaces — editor artifacts
|
||||
"MD009": false,
|
||||
// Bare URLs — URL shortening not always needed
|
||||
"MD034": false,
|
||||
// Single trailing newline — editor artifacts
|
||||
"MD047": false,
|
||||
// Trailing punctuation — heading punctuation is intentional
|
||||
"MD026": false,
|
||||
// Space in emphasis — double-asterisk bold spacing varies by renderer
|
||||
"MD037": false,
|
||||
// No hard tabs — some generated docs use tabs for indentation
|
||||
"MD010": false,
|
||||
// Code block style — generated docs may use inconsistent styles
|
||||
"MD046": false,
|
||||
// Comment style — generated docs have no comments
|
||||
"MD048": false,
|
||||
// Commands show output — shell examples intentionally show only commands
|
||||
"MD014": false
|
||||
},
|
||||
"ignores": [
|
||||
"docs/api-reference/generated/**"
|
||||
]
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
docs/api-reference/generated/**
|
||||
@@ -7,10 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
### Changed
|
||||
|
||||
- **docs: namespace references** — Updated all documentation, README, and ArtifactHub metadata to explicitly reference the `headlamp` namespace instead of generic "controller pod" language. RBAC examples now clearly scope `pods/proxy` access to `kube-system` where the tns-csi controller runs.
|
||||
|
||||
## [1.0.0] - 2026-03-24
|
||||
|
||||
### Added
|
||||
|
||||
@@ -63,12 +63,12 @@ config:
|
||||
pluginsManager:
|
||||
sources:
|
||||
- name: tns-csi
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
|
||||
```
|
||||
|
||||
## RBAC / Security Setup
|
||||
|
||||
The plugin reads from the Kubernetes API and the tns-csi controller pod's Prometheus endpoint (deployed in `kube-system`). The Benchmark page additionally creates and deletes Jobs and PVCs.
|
||||
The plugin reads from the Kubernetes API and the tns-csi controller pod's Prometheus endpoint. The Benchmark page additionally creates and deletes Jobs and PVCs.
|
||||
|
||||
### Minimal read-only permissions
|
||||
|
||||
@@ -90,10 +90,6 @@ rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/log"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/proxy"]
|
||||
verbs: ["get"]
|
||||
resourceNames: ["pods"]
|
||||
```
|
||||
|
||||
### Additional permissions for Benchmark page
|
||||
@@ -109,13 +105,13 @@ rules:
|
||||
|
||||
### Metrics access
|
||||
|
||||
The plugin fetches Prometheus metrics from the tns-csi controller pod via the Kubernetes pod proxy sub-resource in `kube-system`. Grant `get` on `pods/proxy` scoped to `kube-system`:
|
||||
The plugin fetches Prometheus metrics from the tns-csi controller pod via the Kubernetes pod proxy sub-resource. Grant `get` on `pods/proxy` in `kube-system`:
|
||||
|
||||
```yaml
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/proxy"]
|
||||
verbs: ["get"]
|
||||
# Scope to kube-system where the tns-csi controller runs
|
||||
# Optionally scope to the controller pod namespace
|
||||
```
|
||||
|
||||
Apply the role and bind it to your Headlamp service account with a ClusterRoleBinding.
|
||||
|
||||
+4
-4
@@ -91,7 +91,7 @@ metadata:
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: headlamp
|
||||
namespace: <your-namespace>
|
||||
namespace: kube-system # adjust to your Headlamp namespace
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: headlamp-tns-csi-reader
|
||||
@@ -143,7 +143,7 @@ The Kubernetes API server performs the pod proxy hop, so policies should permit
|
||||
|
||||
### Service Account (Default)
|
||||
|
||||
Headlamp runs with a dedicated service account (`headlamp` in the namespace where Headlamp is installed). All users share the same RBAC permissions.
|
||||
Headlamp runs with a dedicated service account (`headlamp` in `kube-system`). All users share the same RBAC permissions.
|
||||
|
||||
**Security Considerations:**
|
||||
- All users have identical access to plugin functionality including Benchmark
|
||||
@@ -187,7 +187,7 @@ Report security vulnerabilities via:
|
||||
|
||||
The project uses:
|
||||
- **npm audit**: Runs automatically during `npm install`
|
||||
- **Renovate**: Automated dependency updates via Mend Renovate (org-wide configured)
|
||||
- **GitHub Dependabot**: Monitors dependencies and creates PRs for updates
|
||||
|
||||
Headlamp itself (`@kinvolk/headlamp-plugin`) is a peer dependency. Security updates to Headlamp should be applied by upgrading your Headlamp installation.
|
||||
|
||||
@@ -223,7 +223,7 @@ All API requests are logged in Kubernetes API audit logs (if enabled). Pod proxy
|
||||
"verb": "get",
|
||||
"requestURI": "/api/v1/namespaces/kube-system/pods/<controller-pod>/proxy/metrics",
|
||||
"user": {
|
||||
"username": "system:serviceaccount:<your-namespace>:headlamp"
|
||||
"username": "system:serviceaccount:kube-system:headlamp"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
+3
-3
@@ -1,4 +1,4 @@
|
||||
version: "1.0.3"
|
||||
version: "1.0.0"
|
||||
name: headlamp-tns-csi-plugin
|
||||
displayName: TrueNAS CSI (tns-csi)
|
||||
description: >-
|
||||
@@ -63,7 +63,7 @@ changes:
|
||||
description: "GitHub App token secrets passed to release workflow"
|
||||
|
||||
annotations:
|
||||
headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.3/headlamp-tns-csi-plugin-1.0.3.tar.gz"
|
||||
headlamp/plugin/archive-checksum: sha256:8a032919de65f9ed45a06f4110083cceb11b91625d97f7b49075adecf38e3adc
|
||||
headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz"
|
||||
headlamp/plugin/archive-checksum: sha256:e38846ceb17a79438f8aecc50f22920b0efa7456f3ebb3e628d89856af83ad01
|
||||
headlamp/plugin/version-compat: ">=0.20.0"
|
||||
headlamp/plugin/distro-compat: "in-cluster,web,app"
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
{
|
||||
// Allowlist for inherited dev-dependency CVEs from @kinvolk/headlamp-plugin
|
||||
// CTO decision (PRI-854): these high-severity vulns are dev/build-time only,
|
||||
// trace to @kinvolk/headlamp-plugin transitive deps (Picomatch, Vite, lodash),
|
||||
// and do NOT ship in production plugin artifacts.
|
||||
"allowlist": [
|
||||
{
|
||||
"id": "GHSA-hhpm-516h-p3p6",
|
||||
"reason": "Picomatch ReDoS: devDependency only, does not ship in production plugin bundle"
|
||||
},
|
||||
{
|
||||
"id": "GHSA-36xf-7xpp-53w5",
|
||||
"reason": "Vite arbitrary file read: devDependency only, does not ship in production plugin bundle"
|
||||
},
|
||||
{
|
||||
"id": "GHSA-jf8v-p3pp-93qh",
|
||||
"reason": "lodash code injection via _.template: devDependency only, does not ship in production plugin bundle"
|
||||
}
|
||||
]
|
||||
}
|
||||
+1
-1
@@ -67,7 +67,7 @@ Welcome to the Headlamp TNS-CSI Plugin documentation.
|
||||
## External Links
|
||||
|
||||
- **[GitHub Repository](https://github.com/privilegedescalation/headlamp-tns-csi-plugin)**
|
||||
- **[Artifact Hub](https://artifacthub.io/packages/headlamp/tns-csi/headlamp-tns-csi-plugin)**
|
||||
- **[Artifact Hub](https://artifacthub.io/packages/headlamp/headlamp-tns-csi-plugin/headlamp-tns-csi-plugin)**
|
||||
- **[tns-csi Driver](https://github.com/fenio/tns-csi)**
|
||||
- **[kbench](https://github.com/longhorn/kbench)**
|
||||
- **[Headlamp](https://headlamp.dev/)**
|
||||
|
||||
@@ -28,7 +28,7 @@ The TNS-CSI plugin is a single-page React application bundled as a Headlamp plug
|
||||
│ HTTPS
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────┐
|
||||
│ Headlamp Pod (headlamp namespace) │
|
||||
│ Headlamp Pod (kube-system) │
|
||||
│ │
|
||||
│ Headlamp UI server + API proxy │
|
||||
│ (forwards requests using service account token │
|
||||
|
||||
+10
-10
@@ -9,11 +9,11 @@ helm repo add headlamp https://headlamp-k8s.github.io/headlamp/
|
||||
helm repo update
|
||||
|
||||
helm install headlamp headlamp/headlamp \
|
||||
--namespace <your-namespace> \
|
||||
--namespace kube-system \
|
||||
--create-namespace \
|
||||
--set config.pluginsDir=/headlamp/plugins \
|
||||
--set pluginsManager.sources[0].name=tns-csi \
|
||||
--set pluginsManager.sources[0].url=https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
|
||||
--set pluginsManager.sources[0].url=https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
|
||||
```
|
||||
|
||||
## Complete values.yaml Example
|
||||
@@ -27,7 +27,7 @@ config:
|
||||
pluginsManager:
|
||||
sources:
|
||||
- name: tns-csi
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
|
||||
|
||||
serviceAccount:
|
||||
name: headlamp
|
||||
@@ -44,7 +44,7 @@ Apply:
|
||||
|
||||
```bash
|
||||
helm install headlamp headlamp/headlamp \
|
||||
--namespace <your-namespace> \
|
||||
--namespace kube-system \
|
||||
-f headlamp-values.yaml
|
||||
```
|
||||
|
||||
@@ -55,7 +55,7 @@ apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: headlamp
|
||||
namespace: <your-namespace>
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 12h
|
||||
url: https://headlamp-k8s.github.io/headlamp/
|
||||
@@ -64,7 +64,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: headlamp
|
||||
namespace: <your-namespace>
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 1h
|
||||
chart:
|
||||
@@ -74,14 +74,14 @@ spec:
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: headlamp
|
||||
namespace: <your-namespace>
|
||||
namespace: kube-system
|
||||
values:
|
||||
config:
|
||||
pluginsDir: /headlamp/plugins
|
||||
pluginsManager:
|
||||
sources:
|
||||
- name: tns-csi
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
|
||||
```
|
||||
|
||||
## RBAC Manifest (Apply Separately)
|
||||
@@ -122,7 +122,7 @@ metadata:
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: headlamp
|
||||
namespace: <your-namespace>
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: headlamp-tns-csi-reader
|
||||
@@ -136,7 +136,7 @@ To upgrade to a new plugin version, update the `url` in your values and apply:
|
||||
|
||||
```bash
|
||||
helm upgrade headlamp headlamp/headlamp \
|
||||
--namespace <your-namespace> \
|
||||
--namespace kube-system \
|
||||
-f headlamp-values.yaml
|
||||
```
|
||||
|
||||
|
||||
@@ -22,7 +22,7 @@ config:
|
||||
pluginsManager:
|
||||
sources:
|
||||
- name: tns-csi
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
|
||||
```
|
||||
|
||||
**Via FluxCD HelmRelease:**
|
||||
@@ -32,7 +32,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: headlamp
|
||||
namespace: <your-namespace>
|
||||
namespace: kube-system
|
||||
spec:
|
||||
chart:
|
||||
spec:
|
||||
@@ -46,7 +46,7 @@ spec:
|
||||
pluginsManager:
|
||||
sources:
|
||||
- name: tns-csi
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
|
||||
```
|
||||
|
||||
### Method 2: Manual Tarball Install
|
||||
@@ -55,10 +55,13 @@ Download and extract the plugin directly:
|
||||
|
||||
```bash
|
||||
# Download the release tarball
|
||||
wget https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
|
||||
wget https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
|
||||
|
||||
# Verify the checksum
|
||||
echo "14a3e8c13d0b894a41aa1cfccbcb1f6af09dcbb8fd95c7040a540987ea2096a7 tns-csi-0.2.4.tar.gz" | sha256sum --check
|
||||
|
||||
# Extract into your Headlamp plugins directory
|
||||
tar xzf tns-csi-1.0.0.tar.gz -C /headlamp/plugins/
|
||||
tar xzf tns-csi-0.2.4.tar.gz -C /headlamp/plugins/
|
||||
```
|
||||
|
||||
The plugin directory should appear as `/headlamp/plugins/tns-csi/`.
|
||||
@@ -78,7 +81,7 @@ initContainers:
|
||||
- -c
|
||||
- |
|
||||
wget -O /tmp/plugin.tar.gz \
|
||||
https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
|
||||
https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
|
||||
tar xzf /tmp/plugin.tar.gz -C /headlamp/plugins/
|
||||
volumeMounts:
|
||||
- name: plugins
|
||||
@@ -95,10 +98,10 @@ cd headlamp-tns-csi-plugin
|
||||
npm install
|
||||
npm run build
|
||||
npm run package
|
||||
# Produces tns-csi-<version>.tar.gz
|
||||
# Produces tns-csi-0.2.4.tar.gz
|
||||
|
||||
# Extract to your Headlamp plugins directory
|
||||
tar xzf tns-csi-<version>.tar.gz -C /headlamp/plugins/
|
||||
tar xzf tns-csi-0.2.4.tar.gz -C /headlamp/plugins/
|
||||
```
|
||||
|
||||
Or use `headlamp-plugin extract` for automatic placement:
|
||||
|
||||
@@ -28,13 +28,13 @@ config:
|
||||
pluginsManager:
|
||||
sources:
|
||||
- name: tns-csi
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
|
||||
url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
|
||||
```
|
||||
|
||||
Then upgrade your Headlamp release:
|
||||
|
||||
```bash
|
||||
helm upgrade headlamp headlamp/headlamp -f values.yaml -n <your-namespace>
|
||||
helm upgrade headlamp headlamp/headlamp -f values.yaml -n kube-system
|
||||
```
|
||||
|
||||
## Step 2: Configure RBAC
|
||||
@@ -70,7 +70,7 @@ metadata:
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: headlamp
|
||||
namespace: <your-namespace>
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: headlamp-tns-csi-reader
|
||||
@@ -78,7 +78,7 @@ roleRef:
|
||||
EOF
|
||||
```
|
||||
|
||||
Adjust `name: headlamp` and `namespace: <your-namespace>` to match your Headlamp service account.
|
||||
Adjust `name: headlamp` and `namespace: kube-system` to match your Headlamp service account.
|
||||
|
||||
## Step 3: Verify
|
||||
|
||||
|
||||
@@ -77,7 +77,7 @@ If a page shows a loading spinner indefinitely:
|
||||
|
||||
1. **Check browser console** for errors (F12 → Console)
|
||||
2. **Check network tab** for failed API requests (look for 403, 404, 500)
|
||||
3. **Check Headlamp pod logs**: `kubectl logs -n <your-namespace> -l app.kubernetes.io/name=headlamp`
|
||||
3. **Check Headlamp pod logs**: `kubectl logs -n kube-system -l app.kubernetes.io/name=headlamp`
|
||||
4. **Try refreshing** — the watch connection may have been interrupted
|
||||
|
||||
## Common API Errors
|
||||
@@ -102,7 +102,7 @@ Look for errors related to `tns-csi`, `headlamp-plugin`, or Kubernetes API paths
|
||||
**Headlamp pod logs:**
|
||||
|
||||
```bash
|
||||
kubectl logs -n <your-namespace> -l app.kubernetes.io/name=headlamp --tail=100
|
||||
kubectl logs -n kube-system -l app.kubernetes.io/name=headlamp --tail=100
|
||||
```
|
||||
|
||||
**tns-csi controller logs:**
|
||||
|
||||
@@ -8,10 +8,10 @@ The Benchmark page requires permissions to create and delete Jobs and PVCs:
|
||||
|
||||
```bash
|
||||
kubectl auth can-i create jobs -n <benchmark-namespace> \
|
||||
--as=system:serviceaccount:<your-namespace>:headlamp
|
||||
--as=system:serviceaccount:kube-system:headlamp
|
||||
|
||||
kubectl auth can-i create persistentvolumeclaims -n <benchmark-namespace> \
|
||||
--as=system:serviceaccount:<your-namespace>:headlamp
|
||||
--as=system:serviceaccount:kube-system:headlamp
|
||||
```
|
||||
|
||||
Apply the additional permissions if missing — see [RBAC Issues](rbac.md) or [SECURITY.md](../../SECURITY.md).
|
||||
|
||||
@@ -47,7 +47,7 @@ This requires `get` on `pods/proxy` in `kube-system`:
|
||||
```bash
|
||||
kubectl auth can-i get pods/proxy \
|
||||
-n kube-system \
|
||||
--as=system:serviceaccount:<your-namespace>:headlamp
|
||||
--as=system:serviceaccount:kube-system:headlamp
|
||||
```
|
||||
|
||||
### 5. Network Policies
|
||||
|
||||
@@ -11,16 +11,16 @@ Use `kubectl auth can-i` to check specific permissions:
|
||||
```bash
|
||||
# Check if the Headlamp service account can list StorageClasses
|
||||
kubectl auth can-i list storageclasses \
|
||||
--as=system:serviceaccount:<your-namespace>:headlamp
|
||||
--as=system:serviceaccount:kube-system:headlamp
|
||||
|
||||
# Check pod proxy access (for metrics)
|
||||
kubectl auth can-i get pods/proxy \
|
||||
-n kube-system \
|
||||
--as=system:serviceaccount:<your-namespace>:headlamp
|
||||
--as=system:serviceaccount:kube-system:headlamp
|
||||
|
||||
# Check snapshot access
|
||||
kubectl auth can-i list volumesnapshots \
|
||||
--as=system:serviceaccount:<your-namespace>:headlamp
|
||||
--as=system:serviceaccount:kube-system:headlamp
|
||||
```
|
||||
|
||||
### Applying the Required RBAC
|
||||
|
||||
@@ -47,7 +47,7 @@ metadata:
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: headlamp # adjust to your Headlamp service account name
|
||||
namespace: <your-namespace>
|
||||
namespace: kube-system # adjust to your Headlamp namespace
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: headlamp-tns-csi-reader
|
||||
@@ -99,7 +99,7 @@ metadata:
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: headlamp
|
||||
namespace: <your-namespace>
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: headlamp-tns-csi-benchmark
|
||||
|
||||
+2
-5
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "tns-csi",
|
||||
"version": "1.0.3",
|
||||
"version": "1.0.0",
|
||||
"description": "Headlamp plugin for TNS-CSI driver visibility and benchmarking",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
@@ -12,7 +12,6 @@
|
||||
"homepage": "https://github.com/privilegedescalation/headlamp-tns-csi-plugin#readme",
|
||||
"author": "privilegedescalation",
|
||||
"license": "Apache-2.0",
|
||||
"packageManager": "pnpm@10.32.1",
|
||||
"scripts": {
|
||||
"start": "headlamp-plugin start",
|
||||
"build": "headlamp-plugin build",
|
||||
@@ -50,8 +49,6 @@
|
||||
},
|
||||
"overrides": {
|
||||
"tar": "^7.5.11",
|
||||
"undici": "^7.24.3",
|
||||
"vite": ">=6.4.2",
|
||||
"elliptic": ">=6.6.1"
|
||||
"undici": "^7.24.3"
|
||||
}
|
||||
}
|
||||
|
||||
Generated
+850
-933
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user