Repository navigation
Use Merge NOT Squash! - #149
Merged
Merged
Conversation
starting the operator locally gave error "No such file or directory task: Failed to run task "run": task: Failed to run task "d:run": exit status 127", because of an absolute path inside run.sh
changed the path for wait_db_ready. The path without the final / led to a 301 and not a 200
removed hardcoded values for cfg.get operator.image / operator.tag and invoker.image and invoker.tag. Config now check env vars and defaults to old images
invoker and operator image from env
fixed tests for minio / seaweedfs .
added desc to taskfile tasks
fixed tests
added namespace validation in user creation
fix: namespace validation
* do not use a fixed offset to nuvolaris.io * removed talos --------- Co-authored-by: Trustable User <noreply@example.com>
Co-authored-by: Trustable User <noreply@example.com>
Follow-up to #109, which validated spec.namespace but left two other tenant controlled WhiskUser fields flowing unsanitized into shell commands executed inside the data pods via kubectl exec. * spec.postgres.database reached `bash -c "... psql --dbname {db_name}"` in exec_psql_command_in_db. Unlike the namespace field it never becomes a filename, so it was not even constrained to path safe characters. * spec.object-storage.{data,route}.bucket reached `sh -c "echo '{command}' | weed shell"` in the seaweedfs client, where a quote breaks out of the single quoted string. Adds util.validate_database_name and util.validate_bucket_name next to the existing validate_namespace and applies them at the call sites and at the shell sinks, plus matching CEL rules on the CRD so the API server rejects the payload before the operator sees it. The regexes and the CEL rules were cross checked to accept exactly the same inputs. Also: * guards the latent render_kvrocks_script / exec_kvrocks_command pair, which repeats the same pattern but is not currently wired into the user path * makes validate_namespace return False for non string input instead of raising TypeError * corrects a copy pasted error message referring to exec_mongosh_command inside exec_psql_command Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Michele Sciabarra <michele@sciabarra.com>
update naming
Drops the MinIO server component in favour of SeaweedFS as the sole S3/object-storage backend. The MinIO Python SDK is retained as the S3 client; the MinIO server, its ingress, deploy manifests, action and all related test fixtures are removed. Operator: - delete openserverless/minio_deploy.py, minio_ingress.py, minio_util.py, openserverless/policies/minio_rw_policy_tpl.json and the deploy/minio/* and templates/00/01/02-minio-*.yaml manifests - remove the spec.minio and components.minio schema from the Whisk CRD (plus the Minio printer column) and update whisk-user-crd object-storage descriptions to S3/SEAWEEDFS - main.py: no longer create/delete the minio component nor reject a minio+seaweedfs combination; storage validation is seaweedfs only - user_handlers.py / storage_static.py: S3 user storage and static endpoints are provisioned/deleted through seaweedfs_deploy only - milvus_standalone.py: drop create/delete_minio_milvus_account; milvus bucket/credentials are managed via SeaweedfsClient - util.py: remove get_minio_config_data; patcher.py: remove check helper - registry_deploy.py / issuer.py: log and docstring cleanups Deploy: - deploy/minio/* removed; milvus and milvus-slim configmaps/secrets now point at the seaweedfs service (milvus-cfg-*-base.yaml, milvus-s3-secret); drop the unused openserverless-milvus-minio mc-init ConfigMap (slim milvus-cfg-deps.yaml removed as it only contained it) - Dockerfile no longer copies deploy/minio; whisk-system.sh builds the s3 (was minio) action, deploy/whisk-system/s3.zip, actions devel/s3 - delete stale deploy/demos/reference/milvus_manifest.yaml and the duplicate deploy/demos/devel/minio_*.json Actions / tests: - actions common/minio_util.py -> s3_util.py (all copies), devel/minio -> devel/s3 (command/s3.py, class S3 reading S3_* user metadata); devel upload/download read S3_HOST/PORT/ACCESS_KEY/SECRET_KEY - tests/minio.js -> s3.js, tests/minio-nuv.js -> s3-nuv.js (s3_* params) - minio_test.ipy / minio_quota_test.ipy removed; minio_util_test.ipy -> seaweedfs_util_test.ipy and minio_static_test.ipy -> storage_static_test.ipy rewritten against seaweedfs/SeaweedfsClient; milvus_standalone tests kept seaweedfs-only - all 31 whisk test manifests: components.minio -> components.seaweedfs, spec.minio -> spec.seaweedfs (admin dropped, root-user/root-password -> user/password) Chores: - Taskfiles: minio/s minio2 tasks -> s3/s3-nuv, MINIO_* env -> S3_* (defaults openserverless / zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG); drop unused MINIO_API_HOST; root all: uses s3 - docs (OPERATOR.md, deploy/milvus-operator/README.md) updated; minio pip SDK dependency and BINARY-WARNINGS/licensing entries retained
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Codex <codex@openai.com>
* Provide valid Alertmanager routing without notification destinations * Disable inherited workflows on RC7 lab branch * fix: correct operator image build permissions * chore: restore Apache workflow paths on PR branch --------- Co-authored-by: Codex <codex@openai.com>
* Restrict Redis tenant ACLs while preserving Lua on 0.9.0 * Run the shared security regression suite in PR checks * Support private Redis administration from external test runners * Preserve Redis module imports under the legacy doctest runner * Load Kopf handlers by module to preserve the Redis driver --------- Co-authored-by: Codex <codex@openai.com>
…#141) * Isolate etcd and Milvus credentials and management endpoints on 0.9.0 * Run the shared security regression suite in PR checks * Use private tunnels for external etcd and Milvus integration tests --------- Co-authored-by: Codex <codex@openai.com>
* Isolate Kafka and ZooKeeper from tenant action pods on 0.9.0 * Release unused Kind ingress NodePorts before integration tests --------- Co-authored-by: Codex <codex@openai.com>
* Fix FerretDB provisioning with valid namespace prefixes and primary selection * Verify FerretDB login grants while preserving existing database ownership * Restrict baseline CI exceptions to unchanged integration test scripts * Validate FerretDB namespaces before PostgreSQL rendering * Keep FerretDB regressions compatible with protected SQL files --------- Co-authored-by: Codex <codex@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Align main with 0.9.0