Merge branch '2028-feature-implement-opentelemetry-in-stackgres' into 'main'

Resolve "[Feature] Implement OpenTelemetry in StackGres"

Closes #2028, #2887, #2891, #2889, and #2892

See merge request ongresinc/stackgres!1609

Author: teoincontatto

.gitlab-ci.yml

@@ -1,7 +1,7 @@
 image: null
 
 variables:
-  SG_CI_IMAGE_NAME: "ci:1.26"
+  SG_CI_IMAGE_NAME: "ci:1.29"
   BUILDER_IMAGE_NAME: "builder:1.9"
   SKIP_NATIVE: "false"
   SKIP_E2E: "false"

.gitlab-ci/test.yml

@@ -7,18 +7,7 @@ shell unit tests:
     - stackgres-runner-v2
     - linux-amd64
   script:
-    - |
-      set +e
-      TMP_PATH="/tmp/stackgres-$JOB_ID"
-      cp -a . "$TMP_PATH"
-      (
-        cd "$TMP_PATH"
-        sh stackgres-k8s/src/operator/src/test/shell/run-in-docker.sh
-      )
-      EXIT_CODE="$?"
-      cp -a "$TMP_PATH"/stackgres-k8s/src/operator/target stackgres-k8s/src/operator/target
-      rm -rf "$TMP_PATH"
-      exit "$EXIT_CODE"
+    - sh stackgres-k8s/src/operator/src/test/shell/run-in-docker.sh
   retry:
     max: 2
     when: [ unknown_failure, api_failure, stuck_or_timeout_failure, runner_system_failure, runner_unsupported,

doc/content/en/04-administration-guide/13-admin-ui/01-change-ui-password/_index.md

@@ -1,34 +1,66 @@
 ---
-title: Change password
+title: Change Web Console's user credentials
 weight: 1
 url: /administration/adminui/change/password
 description: Changing the UI password.
 showToc: true
 ---
 
-### Changing the UI password
+### Changing the Web Console's user credentials
 
-You can use the command below to change the password:
+You can use the commands below to change the username and the password of an existing Web Console user (requires [jq](https://jqlang.github.io/jq/) command):
 
 ```
-NEW_USER=admin
+USERNAME=admin
+NEW_USERNAME=root
 NEW_PASSWORD=password
-kubectl create secret generic -n stackgres stackgres-restapi-admin  --dry-run=client -o json \
-  --from-literal=k8sUsername="$NEW_USER" \
-  --from-literal=password="$(echo -n "${NEW_USER}${NEW_PASSWORD}"| sha256sum | awk '{ print $1 }' )" > password.patch
 
-kubectl patch secret -n stackgres stackgres-restapi-admin -p "$(cat password.patch)" && rm password.patch
-```
+# Patch the StackGres user Secret associated with the user
 
-Remember to remove the generated password hint from the secret to avoid security flaws:
+kubectl get secret -A -l api.stackgres.io/auth=user \
+  --template '{{ range .items }}{{ printf "%s %s %s\n" .metadata.namespace .metadata.name (.data.k8sUsername | base64decode) }}{{ end }}' \
+  | grep " $USERNAME$" \
+  | while read NAMESPACE SECRET_NAME USERNAME
+    do
+      kubectl patch secret -n "$NAMESPACE" "$SECRET_NAME" --type merge \
+        -p "data: { password: \"$(echo -n "${NEW_USERNAME}${NEW_PASSWORD}"| sha256sum | cut -d ' ' -f 1 )\" }"
+    done
 
-```
-kubectl patch secret --namespace stackgres stackgres-restapi-admin --type json -p '[{"op":"remove","path":"/data/clearPassword"}]'
-```
+# Patch any existing ClusterRoleBinding associated with the user
 
+kubectl get clusterrolebindings -o json \
+  | jq -r --arg USERNAME "$USERNAME" --arg NEW_USERNAME "$NEW_USERNAME" \
+    '.items[]
+      | select(.subjects != null and (.subjects | any(.apiGroup == "rbac.authorization.k8s.io" and .kind == "User" and .name == $USERNAME)))
+      | .metadata.name + " " + (
+        .subjects 
+          | map(
+            if .apiGroup == "rbac.authorization.k8s.io" and .kind == "User" and .name == $USERNAME
+            then .name = $NEW_USERNAME else . end)
+          | tojson
+        )' \
+  | while read CLUSTERROLEBINDING_NAME SUBJECTS
+    do
+      kubectl patch clusterrolebindings "$CLUSTERROLEBINDING_NAME" \
+        --type merge -p "subjects: $SUBJECTS"
+    done
 
-To clean up the resources created by the demo just run:
+# Patch any existing RoleBinding associated with the user
 
-```
-kubectl delete --ignore-not-found -f {{< download-url >}}/stackgres-operator-demo.yml
+kubectl get rolebindings -A -o json \
+  | jq -r --arg USERNAME "$USERNAME" --arg NEW_USERNAME "$NEW_USERNAME" \
+    '.items[]
+      | select(.subjects != null and (.subjects | any(.apiGroup == "rbac.authorization.k8s.io" and .kind == "User" and .name == $USERNAME)))
+      | .metadata.namespace + " " + .metadata.name + " " + (
+        .subjects 
+          | map(
+            if .apiGroup == "rbac.authorization.k8s.io" and .kind == "User" and .name == $USERNAME
+            then .name = $NEW_USERNAME else . end)
+          | tojson
+        )' \
+  | while read NAMESPACE ROLEBINDING_NAME SUBJECTS
+    do
+      kubectl patch rolebindings -n "$NAMESPACE" "$CLUSTERROLEBINDING_NAME" \
+        --type merge -p "subjects: $SUBJECTS"
+    done
 ```

doc/content/en/06-crd-reference/15-sgstream/_index.template.md

@@ -23,7 +23,7 @@ The `SGStream` custom resource represents a stream of Change Data Capture (CDC)
 **Example:**
 
 ```yaml
-apiVersion: stackgres.io/v1
+apiVersion: stackgres.io/v1alpha1
 kind: SGStream
 metadata:
   name: cloudevent

stackgres-k8s/ci/build/Dockerfile-ci

@@ -126,7 +126,7 @@ FROM registry.access.redhat.com/ubi8-minimal:8.10-1018
   RUN microdnf install -y xz
   RUN mkdir -p ~/.docker/cli-plugins
   RUN echo '{"experimental":"enabled"}' > ~/.docker/config.json
-  RUN wget -O /bin/kubectl "https://dl.k8s.io/release/v1.29.1/bin/linux/$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64)/kubectl"
+  RUN wget -O /bin/kubectl "https://dl.k8s.io/release/v1.31.1/bin/linux/$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64)/kubectl"
   RUN chmod a+x /bin/kubectl
   RUN wget -O /bin/kind-0.15.0 "https://github.com/kubernetes-sigs/kind/releases/download/v0.15.0/kind-linux-$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64)"
   RUN chmod a+x /bin/kind-0.15.0
@@ -135,18 +135,23 @@ FROM registry.access.redhat.com/ubi8-minimal:8.10-1018
   RUN ln -s /bin/kind-0.20.0 /bin/kind
   RUN wget -O /bin/k3d "https://github.com/rancher/k3d/releases/download/v5.5.1/k3d-linux-$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64)"
   RUN chmod a+x /bin/k3d
-  RUN wget "https://get.helm.sh/helm-v3.14.0-linux-$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64).tar.gz" -O -|tar xz --strip-components=1 -C /bin -f - "linux-$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64)/helm"
-  RUN wget "https://github.com/derailed/k9s/releases/download/v0.31.7/k9s_Linux_$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64).tar.gz" -O -|tar xz -C /bin -f - k9s
+  RUN wget "https://get.helm.sh/helm-v3.16.1-linux-$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64).tar.gz" -O -|tar xz --strip-components=1 -C /bin -f - "linux-$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64)/helm"
+  RUN wget "https://github.com/derailed/k9s/releases/download/v0.32.5/k9s_Linux_$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64).tar.gz" -O -|tar xz -C /bin -f - k9s
   RUN pip3 install awscli
-  RUN wget https://github.com/operator-framework/operator-sdk/releases/download/v1.32.0/operator-sdk_linux_$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64) -O /bin/operator-sdk
+  RUN wget https://github.com/operator-framework/operator-sdk/releases/download/v1.37.0/operator-sdk_linux_$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64) -O /bin/operator-sdk
   RUN chmod a+x /bin/operator-sdk
-  RUN wget https://github.com/operator-framework/operator-registry/releases/download/v1.36.0/linux-$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64)-opm -O /bin/opm
+  RUN wget https://github.com/operator-framework/operator-registry/releases/download/v1.47.0/linux-$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64)-opm -O /bin/opm
   RUN chmod a+x /bin/opm
   RUN microdnf install -y findutils make procps diffutils
   RUN wget https://github.com/norwoodj/helm-docs/releases/download/v1.12.0/helm-docs_1.12.0_Linux_$(uname -m | grep -qxF aarch64 && echo arm64 || echo x86_64).tar.gz -O -|tar xz -C /bin -f - helm-docs
   RUN wget https://github.com/gohugoio/hugo/releases/download/v0.81.0/hugo_0.81.0_Linux-$(uname -m | grep -qxF aarch64 && echo ARM64 || echo 64bit).tar.gz -O -|tar xz -C /bin -f - hugo
   RUN wget https://github.com/fybrik/crdoc/releases/download/v0.6.3/crdoc_Linux_$(uname -m | grep -qxF aarch64 && echo arm64 || echo x86_64).tar.gz -O -|tar xz -C /bin -f - crdoc
-  RUN wget -O - "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.3.0/kustomize_v5.3.0_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/').tar.gz" | tar xzf - -C /bin
+  RUN wget -O - "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.4.3/kustomize_v5.4.3_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/').tar.gz" | tar xzf - -C /bin
   RUN wget -O /bin/kind-0.23.0 "https://github.com/kubernetes-sigs/kind/releases/download/v0.23.0/kind-linux-$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64)"
   RUN chmod a+x /bin/kind-0.23.0
   RUN ln -s -f /bin/kind-0.23.0 /bin/kind
+  # Older operator-sdk versions than 1.36 removed support for plugin quarkus.javaoperatorsdk.io/v1-beta but the bundle is generated only by operator-sdk version 1.32
+  #  another reason to use java-operator-sdk :/
+  RUN wget https://github.com/operator-framework/operator-sdk/releases/download/v1.32.0/operator-sdk_linux_$(uname -m | grep -qxF aarch64 && echo arm64 || echo amd64) -O /bin/operator-sdk-1.32
+  RUN chmod a+x /bin/operator-sdk-1.32
+  

stackgres-k8s/ci/build/config.yml

@@ -1,12 +1,12 @@
 .images:
-  ci_image: &ci_image registry.gitlab.com/ongresinc/stackgres/ci:1.26
+  ci_image: &ci_image registry.gitlab.com/ongresinc/stackgres/ci:1.29
   jdk_build_image: &jdk_build_image registry.gitlab.com/ongresinc/stackgres/builder:1.9
-  jdk_runtime_image: &jdk_runtime_image registry.access.redhat.com/ubi9/openjdk-21:1.20-2.1721752936
-  ubi8_micro_image: &ubi8_micro_image registry.access.redhat.com/ubi8-micro:8.10-9
-  ubi9_minimal_image: &ubi9_minimal_image registry.access.redhat.com/ubi9-minimal:9.4-1194
-  admin_ui_build_image: &admin_ui_build_image registry.access.redhat.com/ubi8/nodejs-20:1-50.1720405266
-  admin_ui_nginx_image: &admin_ui_nginx_image registry.access.redhat.com/ubi8/nginx-124:1-16
-  pglambda_nodejs_image: &pglambda_nodejs_image registry.access.redhat.com/ubi8/nodejs-18:1-114.1720405264
+  jdk_runtime_image: &jdk_runtime_image registry.access.redhat.com/ubi9/openjdk-21:1.20-2.1726695192
+  ubi8_micro_image: &ubi8_micro_image registry.access.redhat.com/ubi8-micro:8.10-13
+  ubi9_minimal_image: &ubi9_minimal_image registry.access.redhat.com/ubi9-minimal:9.4-1227.1726694542
+  admin_ui_build_image: &admin_ui_build_image registry.access.redhat.com/ubi8/nodejs-20:1-63
+  admin_ui_nginx_image: &admin_ui_nginx_image registry.access.redhat.com/ubi8/nginx-124:1-29
+  pglambda_nodejs_image: &pglambda_nodejs_image registry.access.redhat.com/ubi8/nodejs-18:1-127
 platforms:
   - linux/x86_64
   - linux/aarch64

stackgres-k8s/e2e/spec/abstract/prometheus-integration

@@ -6,8 +6,8 @@ e2e_exclusive_lock() {
 
 e2e_test() {
   run_test "Check that exporter queries are wokring" check_exporter_queries
-  run_test "Check that exporter pod monitor was created" check_exporter_pod_monitor
-  run_test "Check that envoy pod monitor was created" check_envoy_pod_monitor
+  run_test "Check that collector was created" check_collector
+  run_test "Check that collector pod monitor was created" check_collector_pod_monitor
   run_test "Check that grafana is embedded" check_grafana_embedded
   run_test "Check that grafana secret is used" check_grafana_secret
 }
@@ -61,14 +61,26 @@ check_exporter_queries() {
   done
 }
 
-check_exporter_pod_monitor() {
-  local SERVICE_MONITOR="$CLUSTER_NAMESPACE-$CLUSTER_NAME-stackgres-postgres-exporter"
+check_collector() {
+  local SERVICE_MONITOR="stackgres-collector"
 
-  if wait_until kubectl get podmonitors.monitoring.coreos.com -n "$(prometheus_namespace)" "$SERVICE_MONITOR"
+  if wait_until kubectl get deployment -n "$OPERATOR_NAMESPACE" "$SERVICE_MONITOR"
   then
-    echo "Exporter pod monitor was created"
+    echo "Collector deployment was created"
   else
-    echo "Exporter pod monitor wasn't created"
+    echo "Collector deployment wasn't created"
+    return 1
+  fi
+}
+
+check_collector_pod_monitor() {
+  local SERVICE_MONITOR="stackgres-collector"
+
+  if wait_until kubectl get podmonitors.monitoring.coreos.com -n "$OPERATOR_NAMESPACE" "$SERVICE_MONITOR"
+  then
+    echo "Collector pod monitor was created"
+  else
+    echo "Collector pod monitor wasn't created"
     return 1
   fi
 
@@ -93,27 +105,6 @@ check_exporter_pod_monitor() {
   fi
 }
 
-check_envoy_pod_monitor() {
-  local SERVICE_MONITOR="$CLUSTER_NAMESPACE-$CLUSTER_NAME-stackgres-envoy"
-
-  if wait_until kubectl get podmonitors.monitoring.coreos.com -n "$(prometheus_namespace)" "$SERVICE_MONITOR"
-  then
-    echo "Envoy pod monitor was created"
-  else
-    echo "Envoy pod monitor wasn't created"
-    return 1
-  fi
-
-  if wait_until kubectl exec -i -n "$CLUSTER_NAMESPACE" curl -- \
-    curl -f -s "http://$(prometheus_service).$(prometheus_namespace):9090/api/v1/query?query=envoy_cluster_upstream_cx_rx_bytes_total"
-  then
-    echo "Envoy metrics was found on prometheus"
-  else
-    echo "Envoy metrics wasn't found on prometheus"
-    return 1
-  fi
-}
-
 check_grafana_embedded() {
   if wait_until kubectl exec -i -n "$CLUSTER_NAMESPACE" curl -- curl -s -k "https://stackgres-restapi.$OPERATOR_NAMESPACE/grafana" -o /dev/null --fail
   then

stackgres-k8s/e2e/spec/aks/backup-with-aks-storage.values.yaml

@@ -23,6 +23,3 @@ cluster:
   pods:
     persistentVolume:
       size: 128Mi
-  configurations:
-    sgBackupConfig: backupconf
-  prometheusAutobind: false

stackgres-k8s/e2e/spec/backup.values.yaml

@@ -13,6 +13,5 @@ cluster:
       retention: 2
       cronSchedule: '0 5 31 2 *'
       sgObjectStorage: objectstorage
-  prometheusAutobind: false
 nonProductionOptions:
   disableClusterPodAntiAffinity: true

stackgres-k8s/e2e/spec/catchup-from-backup-storage.values.yaml

@@ -14,6 +14,5 @@ cluster:
       retention: 2
       cronSchedule: '0 5 31 2 *'
       sgObjectStorage: backupconf
-  prometheusAutobind: false
 nonProductionOptions:
   disableClusterPodAntiAffinity: true