diff --git a/data/data/install.openshift.io_installconfigs.yaml b/data/data/install.openshift.io_installconfigs.yaml index 16d30059e7b..1af18a3665b 100644 --- a/data/data/install.openshift.io_installconfigs.yaml +++ b/data/data/install.openshift.io_installconfigs.yaml @@ -7010,7 +7010,7 @@ spec: name: description: |- name is the name of the IBM Cloud service. - Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC. + Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, VPC, TransitGateway, or PowerVS. For example, the IBM Cloud Private IAM service could be configured with the service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com` Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured @@ -7029,6 +7029,8 @@ spec: - ResourceController - ResourceManager - VPC + - TransitGateway + - PowerVS type: string url: description: |- @@ -8402,6 +8404,7 @@ spec: - ResourceController - ResourceManager - VPC + - TransitGateway type: string url: description: |- diff --git a/go.mod b/go.mod index 01d6c5c4a22..f9f6037e766 100644 --- a/go.mod +++ b/go.mod @@ -70,7 +70,7 @@ require ( github.com/nutanix-cloud-native/cluster-api-provider-nutanix v1.10.3 github.com/nutanix-cloud-native/prism-go-client v0.8.0 github.com/onsi/gomega v1.42.1 - github.com/openshift/api v0.0.0-20260812104507-9d7eaabdfe05 + github.com/openshift/api v0.0.0-20260825094607-13a84dedc5a3 github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120 github.com/openshift/assisted-service/api v0.0.0-20260722223301-f50c5b20c7e1 github.com/openshift/assisted-service/client v0.0.0 diff --git a/go.sum b/go.sum index 0ceaa027cc9..af89713f681 100644 --- a/go.sum +++ b/go.sum @@ -879,8 +879,8 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww= github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= -github.com/openshift/api v0.0.0-20260812104507-9d7eaabdfe05 h1:Ti5JDaDKqhnB0xFb/y/ZeOPR+v+GZANAkZZ7shVLKWA= -github.com/openshift/api v0.0.0-20260812104507-9d7eaabdfe05/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= +github.com/openshift/api v0.0.0-20260825094607-13a84dedc5a3 h1:JRsHyxZTqcs5MK0LYTsyzs9VMdO02cSYMBvyize1fhI= +github.com/openshift/api v0.0.0-20260825094607-13a84dedc5a3/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120 h1:fxnvVDuqfnAz9jCuritFrsb6IK33dxc/MxC9Gtv+nlk= github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120/go.mod h1:eLxB7EHTDEvuJHobsVZsyMKOFkVATz4aGAwNtSGMdyM= github.com/openshift/assisted-service/api v0.0.0-20260722223301-f50c5b20c7e1 h1:CQULurVWElnk8kTQflgNZcu82xcw4DQzwvv2PPC33i4= diff --git a/pkg/asset/manifests/infrastructure.go b/pkg/asset/manifests/infrastructure.go index ab4ec8c4522..b92ab95462d 100644 --- a/pkg/asset/manifests/infrastructure.go +++ b/pkg/asset/manifests/infrastructure.go @@ -11,7 +11,6 @@ import ( "sigs.k8s.io/yaml" configv1 "github.com/openshift/api/config/v1" - "github.com/openshift/api/features" "github.com/openshift/installer/pkg/asset" "github.com/openshift/installer/pkg/asset/installconfig" gcpic "github.com/openshift/installer/pkg/asset/installconfig/gcp" @@ -227,18 +226,16 @@ func (i *Infrastructure) Generate(ctx context.Context, dependencies asset.Parent config.Status.PlatformStatus.GCP.ResourceTags = resourceTags } - if installConfig.Config.Enabled(features.FeatureGateGCPSovereignCloudInstall) { - ssn, err := gcpic.GetSession(ctx) - if err != nil { - return fmt.Errorf("could not get GCP session: %w", err) - } - ud, err := ssn.Credentials.GetUniverseDomain() - if err != nil { - return fmt.Errorf("could not get GCP universe domain: %w", err) - } - if gcp.IsNonDefaultUniverseDomain(ud) { - config.Status.PlatformStatus.GCP.UniverseDomain = ud - } + ssn, err := gcpic.GetSession(ctx) + if err != nil { + return fmt.Errorf("could not get GCP session: %w", err) + } + ud, err := ssn.Credentials.GetUniverseDomain() + if err != nil { + return fmt.Errorf("could not get GCP universe domain: %w", err) + } + if gcp.IsNonDefaultUniverseDomain(ud) { + config.Status.PlatformStatus.GCP.UniverseDomain = ud } // If the user has requested the use of a DNS provisioned by them, then OpenShift needs to diff --git a/pkg/asset/manifests/infrastructure_test.go b/pkg/asset/manifests/infrastructure_test.go index bf4936c1579..0373c0ef056 100644 --- a/pkg/asset/manifests/infrastructure_test.go +++ b/pkg/asset/manifests/infrastructure_test.go @@ -2,9 +2,13 @@ package manifests import ( "context" + "fmt" + "os" + "path/filepath" "testing" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "sigs.k8s.io/yaml" @@ -37,6 +41,9 @@ func TestGenerateInfrastructure(t *testing.T) { installConfig *types.InstallConfig expectedInfrastructure *configv1.Infrastructure expectedFilesGenerated int + // setup, when non-nil, runs before the asset is generated. Platforms + // that reach a cloud API during Generate can use it to stub credentials. + setup func(t *testing.T) }{{ name: "vanilla aws", installConfig: icBuild.build(icBuild.forAWS()), @@ -71,6 +78,7 @@ func TestGenerateInfrastructure(t *testing.T) { }, { name: "default GCP custom DNS", installConfig: icBuild.build(icBuild.forGCP()), + setup: mockGCPCredentials("googleapis.com"), expectedInfrastructure: infraBuild.build( infraBuild.forPlatform(configv1.GCPPlatformType), infraBuild.withGCPClusterHostedDNS("Disabled"), @@ -82,11 +90,22 @@ func TestGenerateInfrastructure(t *testing.T) { icBuild.forGCP(), icBuild.withGCPUserProvisionedDNS("Enabled"), ), + setup: mockGCPCredentials("googleapis.com"), expectedInfrastructure: infraBuild.build( infraBuild.forPlatform(configv1.GCPPlatformType), infraBuild.withGCPClusterHostedDNS("Enabled"), ), expectedFilesGenerated: 2, + }, { + name: "GCP non-default universe domain", + installConfig: icBuild.build(icBuild.forGCP()), + setup: mockGCPCredentials("test.googleapis.com"), + expectedInfrastructure: infraBuild.build( + infraBuild.forPlatform(configv1.GCPPlatformType), + infraBuild.withGCPClusterHostedDNS("Disabled"), + infraBuild.withGCPUniverseDomain("test.googleapis.com"), + ), + expectedFilesGenerated: 2, }, { name: "default AWS custom DNS", installConfig: icBuild.build(icBuild.forAWS()), @@ -284,6 +303,10 @@ func TestGenerateInfrastructure(t *testing.T) { } for _, tc := range cases { t.Run(tc.name, func(t *testing.T) { + if tc.setup != nil { + tc.setup(t) + } + parents := asset.Parents{} parents.Add( &installconfig.ClusterID{ @@ -628,6 +651,13 @@ func (b infraBuildNamespace) withGCPPlatformStatus() infraOption { } } +func (b infraBuildNamespace) withGCPUniverseDomain(domain string) infraOption { + return func(infra *configv1.Infrastructure) { + b.withGCPPlatformStatus()(infra) + infra.Status.PlatformStatus.GCP.UniverseDomain = domain + } +} + func (b infraBuildNamespace) withGCPClusterHostedDNS(enabled string) infraOption { return func(infra *configv1.Infrastructure) { b.withGCPPlatformStatus()(infra) @@ -731,3 +761,28 @@ func (b infraBuildNamespace) withVSphereIngressVIP(vip string) infraOption { infra.Status.PlatformStatus.VSphere.IngressIPs = append(infra.Status.PlatformStatus.VSphere.IngressIPs, vip) } } + +// mockGCPCredentials returns a setup func that points the GCP session loader at +// a throwaway service_account credentials file so unit tests need no real +// credentials. The service_account type lets the test set the reported universe domain. +func mockGCPCredentials(universeDomain string) func(t *testing.T) { + return func(t *testing.T) { + t.Helper() + + creds := fmt.Sprintf(`{ + "type": "service_account", + "project_id": "fake-project", + "private_key": "fake", + "client_email": "fake@fake-project.iam.gserviceaccount.com", + "token_uri": "https://oauth2.googleapis.com/token", + "universe_domain": %q +}`, universeDomain) + + path := filepath.Join(t.TempDir(), "gcp-creds.json") + require.NoError(t, os.WriteFile(path, []byte(creds), 0o600)) + // GOOGLE_APPLICATION_CREDENTIALS is the first entry in the session loader + // chain, so this takes precedence over any real credentials in the + // environment. t.Setenv restores the previous value after the test. + t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", path) + } +} diff --git a/vendor/github.com/openshift/api/config/v1/types.go b/vendor/github.com/openshift/api/config/v1/types.go index e7106ef7abc..84cb7408e94 100644 --- a/vendor/github.com/openshift/api/config/v1/types.go +++ b/vendor/github.com/openshift/api/config/v1/types.go @@ -403,7 +403,7 @@ const ( // IBMCloudServiceName contains a value specifying the name of an IBM Cloud Service, // which are used by MAPI, CIRO, CIO, Installer, etc. -// +kubebuilder:validation:Enum=CIS;COS;COSConfig;DNSServices;GlobalCatalog;GlobalSearch;GlobalTagging;HyperProtect;IAM;KeyProtect;ResourceController;ResourceManager;VPC +// +kubebuilder:validation:Enum=CIS;COS;COSConfig;DNSServices;GlobalCatalog;GlobalSearch;GlobalTagging;HyperProtect;IAM;KeyProtect;ResourceController;ResourceManager;VPC;TransitGateway;PowerVS type IBMCloudServiceName string const ( @@ -433,4 +433,8 @@ const ( IBMCloudServiceResourceManager IBMCloudServiceName = "ResourceManager" // IBMCloudServiceVPC is the name for IBM Cloud VPC. IBMCloudServiceVPC IBMCloudServiceName = "VPC" + // IBMCloudServiceTransitGateway is the name for IBM Cloud Transit Gateway. + IBMCloudServiceTransitGateway IBMCloudServiceName = "TransitGateway" + // IBMCloudServicePowerVS is the name for IBM Cloud Power Virtual Server. + IBMCloudServicePowerVS IBMCloudServiceName = "PowerVS" ) diff --git a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go index a89377ef7d0..b9d9b3d47a9 100644 --- a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go +++ b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go @@ -720,7 +720,7 @@ type AzureResourceTag struct { } // AzureCloudEnvironment is the name of the Azure cloud environment -// +kubebuilder:validation:Enum="";AzurePublicCloud;AzureUSGovernmentCloud;AzureChinaCloud;AzureGermanCloud;AzureStackCloud +// +kubebuilder:validation:Enum="";AzurePublicCloud;AzureUSGovernmentCloud;AzureChinaCloud;AzureGermanCloud;AzureStackCloud;AzureUSSecCloud type AzureCloudEnvironment string const ( @@ -738,6 +738,9 @@ const ( // AzureStackCloud is the Azure cloud environment used at the edge and on premises. AzureStackCloud AzureCloudEnvironment = "AzureStackCloud" + + // AzureUSSecCloud is the Azure cloud environment for US Government Secret (IL6) workloads. + AzureUSSecCloud AzureCloudEnvironment = "AzureUSSecCloud" ) // Start: TOMBSTONE @@ -1515,7 +1518,7 @@ type VSpherePlatformTopology struct { ComputeCluster string `json:"computeCluster"` // networks is the list of port group network names within this failure domain. - // If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined. + // Up to 10 network adapters may be defined. // 10 is the maximum number of virtual network devices which may be attached to a VM as defined by: // https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0 // The available networks (port groups) can be listed using @@ -1523,8 +1526,7 @@ type VSpherePlatformTopology struct { // Networks should be in the form of an absolute path: // //network/. // +required - // +openshift:validation:FeatureGateAwareMaxItems:featureGate="",maxItems=1 - // +openshift:validation:FeatureGateAwareMaxItems:featureGate=VSphereMultiNetworks,maxItems=10 + // +kubebuilder:validation:MaxItems=10 // +kubebuilder:validation:MinItems=1 // +listType=atomic Networks []string `json:"networks"` @@ -1880,7 +1882,7 @@ type VSpherePlatformStatus struct { // override existing defaults of IBM Cloud Services. type IBMCloudServiceEndpoint struct { // name is the name of the IBM Cloud service. - // Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC. + // Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, VPC, TransitGateway, or PowerVS. // For example, the IBM Cloud Private IAM service could be configured with the // service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com` // Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured @@ -1912,8 +1914,8 @@ type IBMCloudPlatformSpec struct { // overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each // endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus // are updated to reflect the same custom endpoints. - // A maximum of 13 service endpoints overrides are supported. - // +kubebuilder:validation:MaxItems=13 + // A maximum of 15 service endpoints overrides are supported. + // +kubebuilder:validation:MaxItems=15 // +listType=map // +listMapKey=name // +optional @@ -1946,7 +1948,7 @@ type IBMCloudPlatformStatus struct { // overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each // endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus // are updated to reflect the same custom endpoints. - // +openshift:validation:FeatureGateAwareMaxItems:featureGate=DyanmicServiceEndpointIBMCloud,maxItems=13 + // +openshift:validation:FeatureGateAwareMaxItems:featureGate=DyanmicServiceEndpointIBMCloud,maxItems=15 // +listType=map // +listMapKey=name // +optional @@ -1997,7 +1999,7 @@ type PowerVSServiceEndpoint struct { // Power Cloud - https://cloud.ibm.com/apidocs/power-cloud // // +required - // +kubebuilder:validation:Enum=CIS;COS;COSConfig;DNSServices;GlobalCatalog;GlobalSearch;GlobalTagging;HyperProtect;IAM;KeyProtect;Power;ResourceController;ResourceManager;VPC + // +kubebuilder:validation:Enum=CIS;COS;COSConfig;DNSServices;GlobalCatalog;GlobalSearch;GlobalTagging;HyperProtect;IAM;KeyProtect;Power;ResourceController;ResourceManager;VPC;TransitGateway Name string `json:"name"` // url is fully qualified URI with scheme https, that overrides the default generated diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml index 6e9daaae518..87dab99e352 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml @@ -405,7 +405,6 @@ infrastructures.config.openshift.io: - NutanixMultiSubnets - OnPremDNSRecords - VSphereHostVMGroupZonal - - VSphereMultiNetworks - VSphereMultiVCenterDay2 FilenameOperatorName: config-operator FilenameOperatorOrdering: "01" diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go index 0519119af44..12b839563ae 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go @@ -1818,7 +1818,7 @@ func (GCPResourceTag) SwaggerDoc() map[string]string { var map_IBMCloudPlatformSpec = map[string]string{ "": "IBMCloudPlatformSpec holds the desired state of the IBMCloud infrastructure provider. This only includes fields that can be modified in the cluster.", - "serviceEndpoints": "serviceEndpoints is a list of custom endpoints which will override the default service endpoints of an IBM service. These endpoints are used by components within the cluster when trying to reach the IBM Cloud Services that have been overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus are updated to reflect the same custom endpoints. A maximum of 13 service endpoints overrides are supported.", + "serviceEndpoints": "serviceEndpoints is a list of custom endpoints which will override the default service endpoints of an IBM service. These endpoints are used by components within the cluster when trying to reach the IBM Cloud Services that have been overridden. The CCCMO reads in the IBMCloudPlatformSpec and validates each endpoint is resolvable. Once validated, the cloud config and IBMCloudPlatformStatus are updated to reflect the same custom endpoints. A maximum of 15 service endpoints overrides are supported.", } func (IBMCloudPlatformSpec) SwaggerDoc() map[string]string { @@ -1841,7 +1841,7 @@ func (IBMCloudPlatformStatus) SwaggerDoc() map[string]string { var map_IBMCloudServiceEndpoint = map[string]string{ "": "IBMCloudServiceEndpoint stores the configuration of a custom url to override existing defaults of IBM Cloud Services.", - "name": "name is the name of the IBM Cloud service. Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC. For example, the IBM Cloud Private IAM service could be configured with the service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com` Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`", + "name": "name is the name of the IBM Cloud service. Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, VPC, TransitGateway, or PowerVS. For example, the IBM Cloud Private IAM service could be configured with the service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com` Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured with the service `name` of `VPC` and `url` of `https://us.south.private.iaas.cloud.ibm.com`", "url": "url is fully qualified URI with scheme https, that overrides the default generated endpoint for a client. This must be provided and cannot be empty. The path must follow the pattern /v[0,9]+ or /api/v[0,9]+", } @@ -2248,7 +2248,7 @@ var map_VSpherePlatformTopology = map[string]string{ "": "VSpherePlatformTopology holds the required and optional vCenter objects - datacenter, computeCluster, networks, datastore and resourcePool - to provision virtual machines.", "datacenter": "datacenter is the name of vCenter datacenter in which virtual machines will be located. The maximum length of the datacenter name is 80 characters.", "computeCluster": "computeCluster the absolute path of the vCenter cluster in which virtual machine will be located. The absolute path is of the form //host/. The maximum length of the path is 2048 characters.", - "networks": "networks is the list of port group network names within this failure domain. If feature gate VSphereMultiNetworks is enabled, up to 10 network adapters may be defined. 10 is the maximum number of virtual network devices which may be attached to a VM as defined by: https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0 The available networks (port groups) can be listed using `govc ls 'network/*'` Networks should be in the form of an absolute path: //network/.", + "networks": "networks is the list of port group network names within this failure domain. Up to 10 network adapters may be defined. 10 is the maximum number of virtual network devices which may be attached to a VM as defined by: https://configmax.esp.vmware.com/guest?vmwareproduct=vSphere&release=vSphere%208.0&categories=1-0 The available networks (port groups) can be listed using `govc ls 'network/*'` Networks should be in the form of an absolute path: //network/.", "datastore": "datastore is the absolute path of the datastore in which the virtual machine is located. The absolute path is of the form //datastore/ The maximum length of the path is 2048 characters.", "resourcePool": "resourcePool is the absolute path of the resource pool where virtual machines will be created. The absolute path is of the form //host//Resources/. The maximum length of the path is 2048 characters.", "folder": "folder is the absolute path of the folder where virtual machines are located. The absolute path is of the form //vm/. The maximum length of the path is 2048 characters.", diff --git a/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go b/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go index 7692fe21b4f..98f8d7dc592 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go @@ -488,6 +488,16 @@ type NodeExporterCollectorConfig struct { // which is subject to change over time. The current default is enabled. // +optional NVMExpressSubsystem NodeExporterCollectorNVMExpressSubsystemConfig `json:"nvmExpressSubsystem,omitzero"` + // interrupts configures the interrupts collector, which exposes interrupt counts + // from /proc/interrupts. + // interrupts is optional. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, + // which is subject to change over time. The current default is disabled. + // The interrupts collector can produce a large number of metrics depending on the hardware + // and interrupt sources present. When enabled, the collect field with at least one include + // pattern is required to explicitly select which interrupt lines are collected. + // +optional + Interrupts NodeExporterCollectorInterruptsConfig `json:"interrupts,omitempty,omitzero"` } // NodeExporterCollectorCpufreqConfig provides configuration for the cpufreq collector @@ -548,7 +558,7 @@ type NodeExporterCollectorNetDevConfig struct { // such as network speed, MTU, and carrier status. // It is enabled by default. // When collectionPolicy is DoNotCollect, the collect field must not be set. -// +kubebuilder:validation:XValidation:rule="has(self.collectionPolicy) && self.collectionPolicy == 'Collect' ? true : !has(self.collect)",message="collect is forbidden when collectionPolicy is not Collect" +// +kubebuilder:validation:XValidation:rule="has(self.collectionPolicy) && self.collectionPolicy == 'Collect' ? true : !has(self.collect)",message="collect may be set when collectionPolicy is Collect, and forbidden otherwise" // +union type NodeExporterCollectorNetClassConfig struct { // collectionPolicy declares whether the netclass collector collects metrics. @@ -649,7 +659,7 @@ type NodeExporterCollectorProcessesConfig struct { // cardinality. If you enable this collector, closely monitor the prometheus-k8s deployment // for excessive memory usage. // When collectionPolicy is DoNotCollect, the collect field must not be set. -// +kubebuilder:validation:XValidation:rule="has(self.collectionPolicy) && self.collectionPolicy == 'Collect' ? true : !has(self.collect)",message="collect is forbidden when collectionPolicy is not Collect" +// +kubebuilder:validation:XValidation:rule="has(self.collectionPolicy) && self.collectionPolicy == 'Collect' ? true : !has(self.collect)",message="collect may be set when collectionPolicy is Collect, and forbidden otherwise" // +union type NodeExporterCollectorSystemdConfig struct { // collectionPolicy declares whether the systemd collector collects metrics. @@ -753,6 +763,69 @@ type NodeExporterCollectorNVMExpressSubsystemConfig struct { CollectionPolicy NodeExporterCollectorCollectionPolicy `json:"collectionPolicy,omitempty"` } +// NodeExporterCollectorInterruptsConfig provides configuration for the interrupts collector +// of the node-exporter agent. The interrupts collector exposes interrupt counts +// from /proc/interrupts. +// It is disabled by default. +// The interrupts collector can produce a large number of metrics depending on the hardware +// and interrupt sources present. When enabled, the collect field with at least one include +// pattern is required to explicitly select which interrupt lines are collected. +// When collectionPolicy is Collect, the collect field must be set with at least one include pattern. +// When collectionPolicy is DoNotCollect, the collect field must not be set. +// +kubebuilder:validation:XValidation:rule="has(self.collectionPolicy) && self.collectionPolicy == 'Collect' ? has(self.collect) : !has(self.collect)",message="collect is required when collectionPolicy is Collect, and forbidden otherwise" +// +union +type NodeExporterCollectorInterruptsConfig struct { + // collectionPolicy declares whether the interrupts collector collects metrics. + // This field is required. + // Valid values are "Collect" and "DoNotCollect". + // When set to "Collect", the interrupts collector is active and the collect field must be set + // with at least one include pattern to select which interrupt lines are collected. + // When set to "DoNotCollect", the interrupts collector is inactive and the collect field must not be set. + // +unionDiscriminator + // +required + CollectionPolicy NodeExporterCollectorCollectionPolicy `json:"collectionPolicy,omitempty"` + // collect contains configuration options that apply only when the interrupts collector is actively collecting metrics + // (i.e. when collectionPolicy is Collect). + // collect is required when collectionPolicy is Collect and must contain at least one include pattern + // to explicitly select which interrupt lines are collected. + // collect must not be set when collectionPolicy is DoNotCollect. + // When set, at least one field must be specified within collect. + // +unionMember + // +optional + Collect NodeExporterCollectorInterruptsCollectConfig `json:"collect,omitzero,omitempty"` +} + +// NodeExporterCollectorInterruptsCollectConfig holds configuration options for the interrupts collector +// when it is actively collecting metrics. At least one field must be specified. +// +kubebuilder:validation:MinProperties=1 +type NodeExporterCollectorInterruptsCollectConfig struct { + // include is a list of regular expression patterns that select which interrupt lines to collect. + // This field is required. + // Each line in /proc/interrupts is matched against the same string node-exporter uses: + // the IRQ name, info, and devices fields joined with ";", for example "LOC;77;IO-APIC 2-edge ...". + // Patterns are combined with OR into a single expression anchored on both ends, + // so each pattern must match the entire string (use ".*" where needed). + // Each entry must be at least 1 character, at most 1024 characters, and only contain printable ASCII characters. + // Maximum length for this list is 50. + // Minimum length for this list is 1. + // Entries in this list must be unique. + // +kubebuilder:validation:MaxItems=50 + // +kubebuilder:validation:MinItems=1 + // +listType=set + // +required + Include []NodeExporterInterruptsIncludePattern `json:"include,omitempty"` +} + +// NodeExporterInterruptsIncludePattern is a string that is interpreted as a Go regular expression +// pattern by the controller to match interrupt line names. +// Invalid regular expressions will cause a controller-level error at runtime. +// Must be at least 1 character and at most 1024 characters. +// Must contain only printable ASCII characters (no control characters). +// +kubebuilder:validation:MinLength=1 +// +kubebuilder:validation:MaxLength=1024 +// +kubebuilder:validation:XValidation:rule="self.matches('^[\\\\x20-\\\\x7E]+$')",message="must contain only printable ASCII characters (no control characters)" +type NodeExporterInterruptsIncludePattern string + // MonitoringPluginConfig provides configuration options for the monitoring plugin // that runs as a dynamic plugin of the OpenShift web console. // The monitoring plugin provides the monitoring UI in the OpenShift web console diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go index 660e2931a7b..598f38fc5de 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go @@ -1027,6 +1027,7 @@ func (in *NodeExporterCollectorConfig) DeepCopyInto(out *NodeExporterCollectorCo out.DeviceMapperMultipath = in.DeviceMapperMultipath out.Zoneinfo = in.Zoneinfo out.NVMExpressSubsystem = in.NVMExpressSubsystem + in.Interrupts.DeepCopyInto(&out.Interrupts) return } @@ -1088,6 +1089,44 @@ func (in *NodeExporterCollectorEthtoolConfig) DeepCopy() *NodeExporterCollectorE return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *NodeExporterCollectorInterruptsCollectConfig) DeepCopyInto(out *NodeExporterCollectorInterruptsCollectConfig) { + *out = *in + if in.Include != nil { + in, out := &in.Include, &out.Include + *out = make([]NodeExporterInterruptsIncludePattern, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeExporterCollectorInterruptsCollectConfig. +func (in *NodeExporterCollectorInterruptsCollectConfig) DeepCopy() *NodeExporterCollectorInterruptsCollectConfig { + if in == nil { + return nil + } + out := new(NodeExporterCollectorInterruptsCollectConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *NodeExporterCollectorInterruptsConfig) DeepCopyInto(out *NodeExporterCollectorInterruptsConfig) { + *out = *in + in.Collect.DeepCopyInto(&out.Collect) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeExporterCollectorInterruptsConfig. +func (in *NodeExporterCollectorInterruptsConfig) DeepCopy() *NodeExporterCollectorInterruptsConfig { + if in == nil { + return nil + } + out := new(NodeExporterCollectorInterruptsConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NodeExporterCollectorKSMDConfig) DeepCopyInto(out *NodeExporterCollectorKSMDConfig) { *out = *in diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go index e7e61f44504..8159016737c 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go @@ -240,6 +240,16 @@ func (in NodeExporterCollectorEthtoolConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorEthtoolConfig" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in NodeExporterCollectorInterruptsCollectConfig) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorInterruptsCollectConfig" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in NodeExporterCollectorInterruptsConfig) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorInterruptsConfig" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in NodeExporterCollectorKSMDConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.NodeExporterCollectorKSMDConfig" diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go index 2c20659cac1..99d9b5a66f4 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go @@ -359,6 +359,7 @@ var map_NodeExporterCollectorConfig = map[string]string{ "deviceMapperMultipath": "deviceMapperMultipath configures the dmmultipath collector, which collects statistics about DM-Multipath devices. deviceMapperMultipath is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is enabled.", "zoneinfo": "zoneinfo configures the zoneinfo collector, which exposes per-zone memory page counts, watermarks, and protection thresholds from /proc/zoneinfo. zoneinfo is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is to not collect zoneinfo metrics. Enable when you need visibility into kernel memory zone allocation and pressure.", "nvmExpressSubsystem": "nvmExpressSubsystem configures the nvmesubsystem collector, which collects statistics about NVM Express (NVMe) subsystem devices. nvmExpressSubsystem is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is enabled.", + "interrupts": "interrupts configures the interrupts collector, which exposes interrupt counts from /proc/interrupts. interrupts is optional. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is disabled. The interrupts collector can produce a large number of metrics depending on the hardware and interrupt sources present. When enabled, the collect field with at least one include pattern is required to explicitly select which interrupt lines are collected.", } func (NodeExporterCollectorConfig) SwaggerDoc() map[string]string { @@ -392,6 +393,25 @@ func (NodeExporterCollectorEthtoolConfig) SwaggerDoc() map[string]string { return map_NodeExporterCollectorEthtoolConfig } +var map_NodeExporterCollectorInterruptsCollectConfig = map[string]string{ + "": "NodeExporterCollectorInterruptsCollectConfig holds configuration options for the interrupts collector when it is actively collecting metrics. At least one field must be specified.", + "include": "include is a list of regular expression patterns that select which interrupt lines to collect. This field is required. Each line in /proc/interrupts is matched against the same string node-exporter uses: the IRQ name, info, and devices fields joined with \";\", for example \"LOC;77;IO-APIC 2-edge ...\". Patterns are combined with OR into a single expression anchored on both ends, so each pattern must match the entire string (use \".*\" where needed). Each entry must be at least 1 character, at most 1024 characters, and only contain printable ASCII characters. Maximum length for this list is 50. Minimum length for this list is 1. Entries in this list must be unique.", +} + +func (NodeExporterCollectorInterruptsCollectConfig) SwaggerDoc() map[string]string { + return map_NodeExporterCollectorInterruptsCollectConfig +} + +var map_NodeExporterCollectorInterruptsConfig = map[string]string{ + "": "NodeExporterCollectorInterruptsConfig provides configuration for the interrupts collector of the node-exporter agent. The interrupts collector exposes interrupt counts from /proc/interrupts. It is disabled by default. The interrupts collector can produce a large number of metrics depending on the hardware and interrupt sources present. When enabled, the collect field with at least one include pattern is required to explicitly select which interrupt lines are collected. When collectionPolicy is Collect, the collect field must be set with at least one include pattern. When collectionPolicy is DoNotCollect, the collect field must not be set.", + "collectionPolicy": "collectionPolicy declares whether the interrupts collector collects metrics. This field is required. Valid values are \"Collect\" and \"DoNotCollect\". When set to \"Collect\", the interrupts collector is active and the collect field must be set with at least one include pattern to select which interrupt lines are collected. When set to \"DoNotCollect\", the interrupts collector is inactive and the collect field must not be set.", + "collect": "collect contains configuration options that apply only when the interrupts collector is actively collecting metrics (i.e. when collectionPolicy is Collect). collect is required when collectionPolicy is Collect and must contain at least one include pattern to explicitly select which interrupt lines are collected. collect must not be set when collectionPolicy is DoNotCollect. When set, at least one field must be specified within collect.", +} + +func (NodeExporterCollectorInterruptsConfig) SwaggerDoc() map[string]string { + return map_NodeExporterCollectorInterruptsConfig +} + var map_NodeExporterCollectorKSMDConfig = map[string]string{ "": "NodeExporterCollectorKSMDConfig provides configuration for the ksmd collector of the node-exporter agent. The ksmd collector collects statistics from the kernel same-page merger daemon. It is disabled by default.", "collectionPolicy": "collectionPolicy declares whether the ksmd collector collects metrics. This field is required. Valid values are \"Collect\" and \"DoNotCollect\". When set to \"Collect\", the ksmd collector is active and kernel same-page merger statistics are collected. When set to \"DoNotCollect\", the ksmd collector is inactive.", diff --git a/vendor/github.com/openshift/api/features/features.go b/vendor/github.com/openshift/api/features/features.go index 35851b87812..61c4585ea9d 100644 --- a/vendor/github.com/openshift/api/features/features.go +++ b/vendor/github.com/openshift/api/features/features.go @@ -170,14 +170,6 @@ var ( enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateVSphereMultiDisk = newFeatureGate("VSphereMultiDisk"). - reportProblemsToJiraComponent("splat"). - contactPerson("vr4manta"). - productScope(ocpSpecific). - enhancementPR("https://github.com/openshift/enhancements/pull/1709"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateNetworkConnect = newFeatureGate("NetworkConnect"). reportProblemsToJiraComponent("Networking/ovn-kubernetes"). contactPerson("tssurya"). @@ -214,8 +206,8 @@ var ( reportProblemsToJiraComponent("etcd"). contactPerson("hasbro17"). productScope(ocpSpecific). - enhancementPR(legacyFeatureGateWithoutEnhancement). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enhancementPR("https://github.com/openshift/enhancements/pull/2031"). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureGateAutomatedEtcdBackup = newFeatureGate("AutomatedEtcdBackup"). @@ -634,14 +626,6 @@ var ( enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateVSphereMultiNetworks = newFeatureGate("VSphereMultiNetworks"). - reportProblemsToJiraComponent("SPLAT"). - contactPerson("rvanderp"). - productScope(ocpSpecific). - enhancementPR(legacyFeatureGateWithoutEnhancement). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateIngressControllerDynamicConfigurationManager = newFeatureGate("IngressControllerDynamicConfigurationManager"). reportProblemsToJiraComponent("Networking/router"). contactPerson("miciah"). @@ -657,7 +641,7 @@ var ( enhancementPR("https://github.com/openshift/enhancements/pull/2033"). enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). mustRegister() - + FeatureGateIngressControllerMultipleHAProxyVersions = newFeatureGate("IngressControllerMultipleHAProxyVersions"). reportProblemsToJiraComponent("Networking/router"). contactPerson("miciah"). @@ -809,14 +793,6 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() - FeatureGateAWSServiceLBNetworkSecurityGroup = newFeatureGate("AWSServiceLBNetworkSecurityGroup"). - reportProblemsToJiraComponent("Cloud Compute / Cloud Controller Manager"). - contactPerson("mtulio"). - productScope(ocpSpecific). - enhancementPR("https://github.com/openshift/enhancements/pull/1802"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateNoRegistryClusterInstall = newFeatureGate("NoRegistryClusterInstall"). reportProblemsToJiraComponent("Installer / Agent based installation"). contactPerson("andfasano"). @@ -877,7 +853,7 @@ var ( contactPerson("barbacbd"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1977"). - enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() FeatureCBORServingAndStorage = newFeatureGate("CBORServingAndStorage"). @@ -923,8 +899,7 @@ var ( contactPerson("pabrodri"). productScope(ocpSpecific). enhancementPR("https://github.com/openshift/enhancements/pull/1874"). - enable(inClusterProfile(SelfManaged), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade(), inDefault(), inOKD()). - enable(inClusterProfile(Hypershift), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade(), inDefault(), inOKD()). mustRegister() FeatureGateCRDCompatibilityRequirementOperator = newFeatureGate("CRDCompatibilityRequirementOperator"). @@ -1014,6 +989,14 @@ var ( enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). mustRegister() + FeatureGateIngressControllerLBSecurityGroupsAWS = newFeatureGate("IngressControllerLBSecurityGroupsAWS"). + reportProblemsToJiraComponent("Routing"). + contactPerson("miciah"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/2037"). + enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()). + mustRegister() + FeatureGateTLSAdherence = newFeatureGate("TLSAdherence"). reportProblemsToJiraComponent("HPCASE / TLS Adherence"). contactPerson("joelanford"). @@ -1068,4 +1051,12 @@ var ( enhancementPR("https://github.com/openshift/enhancements/pull/2007"). enable(inClusterProfile(SelfManaged), inDevPreviewNoUpgrade()). mustRegister() + + FeatureGateGomaxprocsInjection = newFeatureGate("GomaxprocsInjection"). + reportProblemsToJiraComponent("node"). + contactPerson("haircommander"). + productScope(ocpSpecific). + enhancementPR("https://github.com/openshift/enhancements/pull/2047"). + enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). + mustRegister() ) diff --git a/vendor/github.com/openshift/api/features/legacyfeaturegates.go b/vendor/github.com/openshift/api/features/legacyfeaturegates.go index 53b8962a282..bb2f037c8df 100644 --- a/vendor/github.com/openshift/api/features/legacyfeaturegates.go +++ b/vendor/github.com/openshift/api/features/legacyfeaturegates.go @@ -95,8 +95,6 @@ var legacyFeatureGates = sets.New( // never add to this list, if you think you have an exception ask @deads2k "VSphereDriverConfiguration", // never add to this list, if you think you have an exception ask @deads2k - "VSphereMultiNetworks", - // never add to this list, if you think you have an exception ask @deads2k "VSphereMultiVCenters", // never add to this list, if you think you have an exception ask @deads2k "VSphereStaticIPs", diff --git a/vendor/github.com/openshift/api/machine/v1beta1/types_vsphereprovider.go b/vendor/github.com/openshift/api/machine/v1beta1/types_vsphereprovider.go index fe6626f7290..6ffe1e829d8 100644 --- a/vendor/github.com/openshift/api/machine/v1beta1/types_vsphereprovider.go +++ b/vendor/github.com/openshift/api/machine/v1beta1/types_vsphereprovider.go @@ -73,7 +73,6 @@ type VSphereMachineProviderSpec struct { // dataDisks is a list of non OS disks to be created and attached to the VM. The max number of disk allowed to be attached is // currently 29. The max number of disks for any controller is 30, but VM template will always have OS disk so that will leave // 29 disks on any controller type. - // +openshift:enable:FeatureGate=VSphereMultiDisk // +optional // +listType=map // +listMapKey=name diff --git a/vendor/github.com/openshift/api/machineconfiguration/v1/types.go b/vendor/github.com/openshift/api/machineconfiguration/v1/types.go index 5c4f6804eea..189f3f64a4b 100644 --- a/vendor/github.com/openshift/api/machineconfiguration/v1/types.go +++ b/vendor/github.com/openshift/api/machineconfiguration/v1/types.go @@ -781,6 +781,21 @@ type KubeletConfigSpec struct { // When specified, the type field can be set to either "Old", "Intermediate", "Modern", "Custom" or omitted for backward compatibility. // +optional TLSSecurityProfile *configv1.TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"` + + // systemGomaxprocsBehavior controls whether the kubelet-auto-node-size service automatically configures + // GOMAXPROCS for kubelet and CRI-O system services based on the system reserved CPU allocation. + // Valid values are "Autosize" and "Disabled". + // When set to "Autosize", the GOMAXPROCS environment variable for kubelet and CRI-O is set to + // max(ceil(system_reserved_cpu), 1). This optimizes the runtime parallelism of these Go-based system + // services based on their CPU allocation rather than total node capacity. + // When set to "Disabled", automatic GOMAXPROCS configuration is disabled and the system services + // use Go's default GOMAXPROCS behavior. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The current default is "Disabled". + // + // +openshift:enable:FeatureGate=GomaxprocsInjection + // +optional + SystemGomaxprocsBehavior GomaxprocsBehaviorType `json:"systemGomaxprocsBehavior,omitempty"` } // KubeletConfigStatus defines the observed state of a KubeletConfig @@ -975,6 +990,26 @@ type ContainerRuntimeConfiguration struct { // +kubebuilder:validation:MaxItems=10 // +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x.path == y.path))",message="additionalArtifactStores must not contain duplicate paths" AdditionalArtifactStores []AdditionalArtifactStore `json:"additionalArtifactStores,omitempty"` + + // containerGomaxprocsBehavior controls whether CRI-O automatically injects the GOMAXPROCS environment variable into containers + // based on their CPU resource requests. + // Valid values are "Autosize" and "Disabled". + // When set to "Autosize", CRI-O will automatically set GOMAXPROCS proportional to the container's CPU request, + // calculated as max(ceil(cpu_request_in_cores * 2), 1). This helps Go applications optimize their runtime parallelism + // based on the allocated CPU resources rather than the total node capacity. + // When set to "Disabled", GOMAXPROCS injection is disabled and containers will use Go's default GOMAXPROCS behavior. + // When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. + // The current default is "Disabled". + // + // Containers can override the injected GOMAXPROCS value by: + // - Setting GOMAXPROCS in the container image Dockerfile (ENV GOMAXPROCS=...) + // - Setting GOMAXPROCS in the pod spec (env or envFrom) + // - Calling runtime.GOMAXPROCS() programmatically in Go code + // - Adding the skip-gomaxprocs.crio.io annotation to the pod + // + // +openshift:enable:FeatureGate=GomaxprocsInjection + // +optional + ContainerGomaxprocsBehavior GomaxprocsBehaviorType `json:"containerGomaxprocsBehavior,omitempty"` } type ContainerRuntimeDefaultRuntime string @@ -987,13 +1022,26 @@ const ( ContainerRuntimeDefaultRuntimeDefault = ContainerRuntimeDefaultRuntimeCrun ) +// GomaxprocsBehaviorType specifies the GOMAXPROCS auto-sizing behavior +// +kubebuilder:validation:Enum=Autosize;Disabled +type GomaxprocsBehaviorType string + +const ( + // GomaxprocsBehaviorAutosize enables automatic GOMAXPROCS configuration + GomaxprocsBehaviorAutosize GomaxprocsBehaviorType = "Autosize" + // GomaxprocsBehaviorDisabled disables automatic GOMAXPROCS configuration + GomaxprocsBehaviorDisabled GomaxprocsBehaviorType = "Disabled" +) + // StorePath is an absolute filesystem path used by additional container storage configurations. // The path must be between 1 and 256 characters long, begin with a forward slash, and only contain -// the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. Consecutive forward slashes are not permitted. +// the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. Consecutive forward slashes and '..' +// directory traversal components are not permitted. // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=256 // +kubebuilder:validation:XValidation:rule="self.matches('^/[a-zA-Z0-9/._-]+$')",message="path must be absolute and contain only alphanumeric characters, '/', '.', '_', and '-'" // +kubebuilder:validation:XValidation:rule="!self.contains('//')",message="path must not contain consecutive forward slashes" +// +kubebuilder:validation:XValidation:rule="self.split('/').filter(s, s == '..').size() == 0",message="path must not contain '..' components" type StorePath string // AdditionalLayerStore defines a read-only storage location for Open Container Initiative (OCI) container image layers. @@ -1004,7 +1052,7 @@ type AdditionalLayerStore struct { // retrieving from the registry. // The path is required and must be between 1 and 256 characters long, begin with a forward slash, // and only contain the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. - // Consecutive forward slashes are not permitted. + // Consecutive forward slashes and '..' directory traversal components are not permitted. // +required Path StorePath `json:"path,omitempty"` } @@ -1017,7 +1065,7 @@ type AdditionalImageStore struct { // retrieving from the registry. // The path is required and must be between 1 and 256 characters long, begin with a forward slash, // and only contain the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. - // Consecutive forward slashes are not permitted. + // Consecutive forward slashes and '..' directory traversal components are not permitted. // +required Path StorePath `json:"path,omitempty"` } @@ -1030,7 +1078,7 @@ type AdditionalArtifactStore struct { // retrieving from the registry. // The path is required and must be between 1 and 256 characters long, begin with a forward slash, // and only contain the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. - // Consecutive forward slashes are not permitted. + // Consecutive forward slashes and '..' directory traversal components are not permitted. // +required Path StorePath `json:"path,omitempty"` } diff --git a/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.featuregated-crd-manifests.yaml index 7e977bb53b9..f7d431aa103 100644 --- a/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.featuregated-crd-manifests.yaml @@ -6,6 +6,7 @@ containerruntimeconfigs.machineconfiguration.openshift.io: Category: "" FeatureGates: - AdditionalStorageConfig + - GomaxprocsInjection FilenameOperatorName: machine-config FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_80" @@ -41,7 +42,6 @@ controllerconfigs.machineconfiguration.openshift.io: - NutanixMultiSubnets - OnPremDNSRecords - VSphereHostVMGroupZonal - - VSphereMultiNetworks - VSphereMultiVCenterDay2 FilenameOperatorName: machine-config FilenameOperatorOrdering: "01" @@ -89,6 +89,7 @@ kubeletconfigs.machineconfiguration.openshift.io: Capability: "" Category: "" FeatureGates: + - GomaxprocsInjection - TLSGroupPreferences FilenameOperatorName: machine-config FilenameOperatorOrdering: "01" diff --git a/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.swagger_doc_generated.go index 198c2b9a6de..3709378b9b1 100644 --- a/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.swagger_doc_generated.go @@ -13,7 +13,7 @@ package v1 // AUTO-GENERATED FUNCTIONS START HERE var map_AdditionalArtifactStore = map[string]string{ "": "AdditionalArtifactStore defines an additional read-only storage location for Open Container Initiative (OCI) artifacts.", - "path": "path specifies the absolute location of the additional artifact store. The path must exist on the node before configuration is applied. When an artifact is requested, artifacts found at this location will be used instead of retrieving from the registry. The path is required and must be between 1 and 256 characters long, begin with a forward slash, and only contain the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. Consecutive forward slashes are not permitted.", + "path": "path specifies the absolute location of the additional artifact store. The path must exist on the node before configuration is applied. When an artifact is requested, artifacts found at this location will be used instead of retrieving from the registry. The path is required and must be between 1 and 256 characters long, begin with a forward slash, and only contain the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. Consecutive forward slashes and '..' directory traversal components are not permitted.", } func (AdditionalArtifactStore) SwaggerDoc() map[string]string { @@ -22,7 +22,7 @@ func (AdditionalArtifactStore) SwaggerDoc() map[string]string { var map_AdditionalImageStore = map[string]string{ "": "AdditionalImageStore defines an additional read-only storage location for Open Container Initiative (OCI) images.", - "path": "path specifies the absolute location of the additional image store. The path must exist on the node before configuration is applied. When a container image is requested, images found at this location will be used instead of retrieving from the registry. The path is required and must be between 1 and 256 characters long, begin with a forward slash, and only contain the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. Consecutive forward slashes are not permitted.", + "path": "path specifies the absolute location of the additional image store. The path must exist on the node before configuration is applied. When a container image is requested, images found at this location will be used instead of retrieving from the registry. The path is required and must be between 1 and 256 characters long, begin with a forward slash, and only contain the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. Consecutive forward slashes and '..' directory traversal components are not permitted.", } func (AdditionalImageStore) SwaggerDoc() map[string]string { @@ -31,7 +31,7 @@ func (AdditionalImageStore) SwaggerDoc() map[string]string { var map_AdditionalLayerStore = map[string]string{ "": "AdditionalLayerStore defines a read-only storage location for Open Container Initiative (OCI) container image layers.", - "path": "path specifies the absolute location of the additional layer store. The path must exist on the node before configuration is applied. When a container image is requested, layers found at this location will be used instead of retrieving from the registry. The path is required and must be between 1 and 256 characters long, begin with a forward slash, and only contain the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. Consecutive forward slashes are not permitted.", + "path": "path specifies the absolute location of the additional layer store. The path must exist on the node before configuration is applied. When a container image is requested, layers found at this location will be used instead of retrieving from the registry. The path is required and must be between 1 and 256 characters long, begin with a forward slash, and only contain the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. Consecutive forward slashes and '..' directory traversal components are not permitted.", } func (AdditionalLayerStore) SwaggerDoc() map[string]string { @@ -101,15 +101,16 @@ func (ContainerRuntimeConfigStatus) SwaggerDoc() map[string]string { } var map_ContainerRuntimeConfiguration = map[string]string{ - "": "ContainerRuntimeConfiguration defines the tuneables of the container runtime", - "pidsLimit": "pidsLimit specifies the maximum number of processes allowed in a container", - "logLevel": "logLevel specifies the verbosity of the logs based on the level it is set to. Options are fatal, panic, error, warn, info, and debug.", - "logSizeMax": "logSizeMax specifies the Maximum size allowed for the container log file. Negative numbers indicate that no size limit is imposed. If it is positive, it must be >= 8192 to match/exceed conmon's read buffer.", - "overlaySize": "overlaySize specifies the maximum size of a container image. This flag can be used to set quota on the size of container images. (default: 10GB)", - "defaultRuntime": "defaultRuntime is the name of the OCI runtime to be used as the default for containers. Allowed values are `runc` and `crun`. When set to `runc`, OpenShift will use runc to execute the container When set to `crun`, OpenShift will use crun to execute the container When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Currently, the default is `crun`.", - "additionalLayerStores": "additionalLayerStores configures additional read-only container image layer store locations for Open Container Initiative (OCI) images.\n\nLayers are checked in order: additional stores first, then the default location. Stores are read-only. Maximum of 5 stores allowed. Each path must be unique.\n\nWhen omitted, only the default layer location is used. When specified, at least one store must be provided.", - "additionalImageStores": "additionalImageStores configures additional read-only container image store locations for Open Container Initiative (OCI) images.\n\nImages are checked in order: additional stores first, then the default location. Stores are read-only. Maximum of 10 stores allowed. Each path must be unique.\n\nWhen omitted, only the default image location is used. When specified, at least one store must be provided.", - "additionalArtifactStores": "additionalArtifactStores configures additional read-only artifact storage locations for Open Container Initiative (OCI) artifacts.\n\nArtifacts are checked in order: additional stores first, then the default location (/var/lib/containers/storage/artifacts). Stores are read-only. Maximum of 10 stores allowed. Each path must be unique.\n\nWhen omitted, only the default artifact location is used. When specified, at least one store must be provided.", + "": "ContainerRuntimeConfiguration defines the tuneables of the container runtime", + "pidsLimit": "pidsLimit specifies the maximum number of processes allowed in a container", + "logLevel": "logLevel specifies the verbosity of the logs based on the level it is set to. Options are fatal, panic, error, warn, info, and debug.", + "logSizeMax": "logSizeMax specifies the Maximum size allowed for the container log file. Negative numbers indicate that no size limit is imposed. If it is positive, it must be >= 8192 to match/exceed conmon's read buffer.", + "overlaySize": "overlaySize specifies the maximum size of a container image. This flag can be used to set quota on the size of container images. (default: 10GB)", + "defaultRuntime": "defaultRuntime is the name of the OCI runtime to be used as the default for containers. Allowed values are `runc` and `crun`. When set to `runc`, OpenShift will use runc to execute the container When set to `crun`, OpenShift will use crun to execute the container When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. Currently, the default is `crun`.", + "additionalLayerStores": "additionalLayerStores configures additional read-only container image layer store locations for Open Container Initiative (OCI) images.\n\nLayers are checked in order: additional stores first, then the default location. Stores are read-only. Maximum of 5 stores allowed. Each path must be unique.\n\nWhen omitted, only the default layer location is used. When specified, at least one store must be provided.", + "additionalImageStores": "additionalImageStores configures additional read-only container image store locations for Open Container Initiative (OCI) images.\n\nImages are checked in order: additional stores first, then the default location. Stores are read-only. Maximum of 10 stores allowed. Each path must be unique.\n\nWhen omitted, only the default image location is used. When specified, at least one store must be provided.", + "additionalArtifactStores": "additionalArtifactStores configures additional read-only artifact storage locations for Open Container Initiative (OCI) artifacts.\n\nArtifacts are checked in order: additional stores first, then the default location (/var/lib/containers/storage/artifacts). Stores are read-only. Maximum of 10 stores allowed. Each path must be unique.\n\nWhen omitted, only the default artifact location is used. When specified, at least one store must be provided.", + "containerGomaxprocsBehavior": "containerGomaxprocsBehavior controls whether CRI-O automatically injects the GOMAXPROCS environment variable into containers based on their CPU resource requests. Valid values are \"Autosize\" and \"Disabled\". When set to \"Autosize\", CRI-O will automatically set GOMAXPROCS proportional to the container's CPU request, calculated as max(ceil(cpu_request_in_cores * 2), 1). This helps Go applications optimize their runtime parallelism based on the allocated CPU resources rather than the total node capacity. When set to \"Disabled\", GOMAXPROCS injection is disabled and containers will use Go's default GOMAXPROCS behavior. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is \"Disabled\".\n\nContainers can override the injected GOMAXPROCS value by: - Setting GOMAXPROCS in the container image Dockerfile (ENV GOMAXPROCS=...) - Setting GOMAXPROCS in the pod spec (env or envFrom) - Calling runtime.GOMAXPROCS() programmatically in Go code - Adding the skip-gomaxprocs.crio.io annotation to the pod", } func (ContainerRuntimeConfiguration) SwaggerDoc() map[string]string { @@ -251,6 +252,7 @@ var map_KubeletConfigSpec = map[string]string{ "machineConfigPoolSelector": "machineConfigPoolSelector selects which pools the KubeletConfig should apply to. When omitted or set to an empty selector {}, no pools are selected, which is equivalent to not matching any MachineConfigPool.", "kubeletConfig": "kubeletConfig contains upstream Kubernetes kubelet configuration fields. Values are validated by the kubelet itself. Invalid values may render nodes unusable. Refer to OpenShift documentation for the Kubernetes version corresponding to your OpenShift release to find valid kubelet configuration options.", "tlsSecurityProfile": "tlsSecurityProfile configures TLS settings for the kubelet. When omitted, the TLS configuration defaults to the value from apiservers.config.openshift.io/cluster. When specified, the type field can be set to either \"Old\", \"Intermediate\", \"Modern\", \"Custom\" or omitted for backward compatibility.", + "systemGomaxprocsBehavior": "systemGomaxprocsBehavior controls whether the kubelet-auto-node-size service automatically configures GOMAXPROCS for kubelet and CRI-O system services based on the system reserved CPU allocation. Valid values are \"Autosize\" and \"Disabled\". When set to \"Autosize\", the GOMAXPROCS environment variable for kubelet and CRI-O is set to max(ceil(system_reserved_cpu), 1). This optimizes the runtime parallelism of these Go-based system services based on their CPU allocation rather than total node capacity. When set to \"Disabled\", automatic GOMAXPROCS configuration is disabled and the system services use Go's default GOMAXPROCS behavior. When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is \"Disabled\".", } func (KubeletConfigSpec) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go b/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go index 2d442d4b41a..3f6198bd8f1 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go +++ b/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go @@ -924,6 +924,33 @@ type AWSNetworkLoadBalancerParameters struct { // +kubebuilder:validation:MaxItems=10 EIPAllocations []EIPAllocation `json:"eipAllocations"` + // securityGroups is a list of security group IDs to attach to the + // Network Load Balancer. When specified, these security groups replace + // the managed security group that the Cloud Controller Manager would + // otherwise create automatically. The user is responsible for + // configuring the ingress and egress rules on the specified security + // groups. + // + // The specified security groups must exist in the same VPC as the + // cluster and must allow the necessary traffic for the + // IngressController to function. + // + // When this field is omitted, the Cloud Controller Manager + // automatically creates and manages a security group for the NLB. + // + // Each security group ID must be unique and must begin with "sg-" + // followed by 8 or 17 lowercase hexadecimal characters + // (e.g. "sg-abcd1234" or "sg-abcd1234abcd12345"). At least 1 and + // at most 5 security groups can be specified. + // + // +optional + // +listType=atomic + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=5 + // +kubebuilder:validation:XValidation:rule=`self.all(x, self.exists_one(y, x == y))`,message="securityGroups cannot contain duplicates" + // +openshift:enable:FeatureGate=IngressControllerLBSecurityGroupsAWS + SecurityGroups []SecurityGroupID `json:"securityGroups,omitempty"` + // protocol specifies whether the Network Load Balancer uses PROXY // protocol to forward connections to the IngressController. // @@ -955,6 +982,16 @@ type AWSNetworkLoadBalancerParameters struct { Protocol NLBProtocol `json:"protocol,omitempty"` } +// SecurityGroupID is an AWS EC2 security group ID. +// Values must begin with "sg-" followed by 8 or 17 lowercase +// hexadecimal characters (e.g. "sg-abcd1234" or +// "sg-abcd1234abcd12345"). +// +// +kubebuilder:validation:MinLength=11 +// +kubebuilder:validation:MaxLength=20 +// +kubebuilder:validation:XValidation:rule=`self.startsWith('sg-') && self.substring(3).matches('^[0-9a-f]{8}$|^[0-9a-f]{17}$')`,message="securityGroups must be 'sg-' followed by 8 or 17 lowercase hexadecimal characters" +type SecurityGroupID string + // NLBProtocol specifies whether the AWS Network Load Balancer uses // PROXY protocol to forward connections to the IngressController. // +kubebuilder:validation:Enum=TCP;PROXY diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go index 8f7441b6c7c..2d410274511 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go @@ -132,6 +132,11 @@ func (in *AWSNetworkLoadBalancerParameters) DeepCopyInto(out *AWSNetworkLoadBala *out = make([]EIPAllocation, len(*in)) copy(*out, *in) } + if in.SecurityGroups != nil { + in, out := &in.SecurityGroups, &out.SecurityGroups + *out = make([]SecurityGroupID, len(*in)) + copy(*out, *in) + } return } diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml index aab9e3564fe..286437bae01 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml @@ -180,6 +180,7 @@ ingresscontrollers.operator.openshift.io: Category: "" FeatureGates: - IngressControllerDynamicConfigurationManager + - IngressControllerLBSecurityGroupsAWS - IngressControllerMultipleHAProxyVersions - TLSGroupPreferences FilenameOperatorName: ingress diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go index 27e09161681..2da09cf4a5f 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go @@ -920,6 +920,7 @@ var map_AWSNetworkLoadBalancerParameters = map[string]string{ "": "AWSNetworkLoadBalancerParameters holds configuration parameters for an AWS Network load balancer. For Example: Setting AWS EIPs https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html", "subnets": "subnets specifies the subnets to which the load balancer will attach. The subnets may be specified by either their ID or name. The total number of subnets is limited to 10.\n\nIn order for the load balancer to be provisioned with subnets, each subnet must exist, each subnet must be from a different availability zone, and the load balancer service must be recreated to pick up new values.\n\nWhen omitted from the spec, the subnets will be auto-discovered for each availability zone. Auto-discovered subnets are not reported in the status of the IngressController object.", "eipAllocations": "eipAllocations is a list of IDs for Elastic IP (EIP) addresses that are assigned to the Network Load Balancer. The following restrictions apply:\n\neipAllocations can only be used with external scope, not internal. An EIP can be allocated to only a single IngressController. The number of EIP allocations must match the number of subnets that are used for the load balancer. Each EIP allocation must be unique. A maximum of 10 EIP allocations are permitted.\n\nSee https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html for general information about configuration, characteristics, and limitations of Elastic IP addresses.", + "securityGroups": "securityGroups is a list of security group IDs to attach to the Network Load Balancer. When specified, these security groups replace the managed security group that the Cloud Controller Manager would otherwise create automatically. The user is responsible for configuring the ingress and egress rules on the specified security groups.\n\nThe specified security groups must exist in the same VPC as the cluster and must allow the necessary traffic for the IngressController to function.\n\nWhen this field is omitted, the Cloud Controller Manager automatically creates and manages a security group for the NLB.\n\nEach security group ID must be unique and must begin with \"sg-\" followed by 8 or 17 lowercase hexadecimal characters (e.g. \"sg-abcd1234\" or \"sg-abcd1234abcd12345\"). At least 1 and at most 5 security groups can be specified.", "protocol": "protocol specifies whether the Network Load Balancer uses PROXY protocol to forward connections to the IngressController.\n\nWhen set to \"TCP\", the NLB uses AWS's native client IP preservation. This may cause hairpin connection failures for internal load balancers when connections are made from pods to router pods on the same node.\n\nWhen set to \"PROXY\", the NLB disables native client IP preservation and uses PROXY protocol v2. The IngressController enables PROXY protocol on HAProxy so that it can parse PROXY protocol headers to obtain the original client IP. This avoids hairpin connection failures.\n\nThe following values are valid for this field:\n\n* \"TCP\". * \"PROXY\".\n\nWhen omitted, this means the user has no opinion and the value is left to the platform to choose a reasonable default, which is subject to change over time. The current default is \"PROXY\".\n\nNote that changing this field may cause brief connection failures during the transition as the NLB attribute change and router rollout occur independently.", } diff --git a/vendor/modules.txt b/vendor/modules.txt index 37222c06a29..8d8d0d301be 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1314,7 +1314,7 @@ github.com/opencontainers/image-spec/specs-go/v1 # github.com/opencontainers/runtime-spec v1.2.1 ## explicit github.com/opencontainers/runtime-spec/specs-go -# github.com/openshift/api v0.0.0-20260812104507-9d7eaabdfe05 +# github.com/openshift/api v0.0.0-20260825094607-13a84dedc5a3 ## explicit; go 1.26.0 github.com/openshift/api/annotations github.com/openshift/api/config/v1