Merge branch 'master' into release-v0.1.29

Signed-off-by: Anthony Floeder <anthony.floeder@hpe.com>

Author: ajfloeder

config/repositories.yaml

@@ -68,7 +68,7 @@ thirdPartyServices:
   - name: storage-version-migrator
     useRemoteKTar: false
     kustomization: config/storage-version-migrator/kustomization.yaml
-    url: https://github.com/NearNodeFlash/kube-storage-version-migrator/releases/download/v0.1.2/manifests.tar
+    url: https://github.com/NearNodeFlash/kube-storage-version-migrator/releases/download/v0.1.3/manifests.tar
     waitCmd: kubectl wait deploy -n kube-system trigger --for jsonpath='{.status.availableReplicas}=1'
   - name: nnf-storedversions-maint
     useRemoteFTar: false

dws

@@ -22,6 +22,25 @@
 set -e
 set -o pipefail
 
+# This script must be run from the root of the nnf-deploy repo, not from tools/.
+if [[ ! -f "tools/kind.sh" ]]; then
+    echo "ERROR: kind.sh must be run from the root of the nnf-deploy repo."
+    echo "  cd \$(git -C \"\$(dirname \"\$0\")\" rev-parse --show-toplevel) && tools/kind.sh $*"
+    exit 1
+fi
+
+# kind v0.31.0+ is required for Kubernetes 1.35 support.
+KIND_MIN_VERSION="0.31.0"
+KIND_VERSION=$(kind version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+if [[ -z "$KIND_VERSION" ]]; then
+    echo "ERROR: kind is not installed or not in PATH."
+    exit 1
+fi
+if ! printf '%s\n%s\n' "$KIND_MIN_VERSION" "$KIND_VERSION" | sort -V -C; then
+    echo "ERROR: kind v$KIND_VERSION is installed but v$KIND_MIN_VERSION or later is required for Kubernetes 1.35."
+    exit 1
+fi
+
 usage() {
     echo "Usage: $0 [--no-argocd] <CMD>"
     echo
@@ -103,8 +122,17 @@ function inject_ca_certs {
 
     echo "Injecting CA certificates from $certs into KIND nodes..."
     for node in $(kind get nodes); do
-        docker cp "$certs" "$node:/usr/local/share/ca-certificates/extra-ca-certs.crt"
-        docker exec "$node" update-ca-certificates
+        # Pipe the bundle via stdin and split into individual .crt files so that
+        # update-ca-certificates / c_rehash does not emit
+        # "skipping ... it does not contain exactly one certificate or CRL".
+        docker exec -i "$node" bash -c '
+            awk "/-----BEGIN CERTIFICATE-----/{n++; f=sprintf(\"/usr/local/share/ca-certificates/extra-ca-cert-%d.crt\",n)} f{print > f}"
+        ' < "$certs"
+        # The ca-certificates.crt bundle always triggers a benign c_rehash warning;
+        # filter it so only real warnings surface.
+        local uca_out
+        uca_out=$(docker exec "$node" update-ca-certificates 2>&1)
+        echo "$uca_out" | grep -Fv "skipping ca-certificates.crt" || true
         docker exec "$node" systemctl restart containerd
         echo "  $node: done"
     done
@@ -152,6 +180,7 @@ nodes:
   kubeadmConfigPatches:
   - |
     kind: ClusterConfiguration
+    apiVersion: kubeadm.k8s.io/v1beta3
     apiServer:
         # enable auditing flags on the API server
         extraArgs:
@@ -187,7 +216,7 @@ EOF
         mkdir -p /tmp/nnf && dd if=/dev/zero of=/tmp/nnf/file.in bs=128 count=0 seek=$((1024 * 1024))
     fi
 
-    kind create cluster --wait 60s --image=kindest/node:v1.31.2 --config $CONFIG
+    kind create cluster --wait 60s --image=kindest/node:v1.35.0@sha256:452d707d4862f52530247495d180205e029056831160e22870e37e3f6c1ac31f --config $CONFIG
 
     # If corporate/custom CA certificates are available, inject them into
     # each KIND node so containerd can pull from registries behind a TLS