Merge branch 'main' into feat/gcs-workload-identity

Author: mayankshah1607

.e2eignore

@@ -7,6 +7,6 @@ README.md
 LICENSE
 operator.png
 kubernetes.svg
-release_versions
+e2e-tests/release_versions
 .github/**
 .e2eignore

.github/ISSUE_TEMPLATE/1-feature-request.yml

@@ -1,6 +1,6 @@
 name: Feature request 🧭
 description: Suggest an idea for this project
-labels: "feature-request"
+labels: ["feature-request", "Proposed", "PSMDB", "MongoDB"]
 body:
 - type: textarea
   attributes:

.github/workflows/labeler.yml

@@ -1,8 +1,10 @@
 name: "PR Labeler"
+permissions:
+  contents: read
+  pull-requests: write
 on:
   pull_request:
     types: [opened, synchronize]
-
 jobs:
   label:
     runs-on: ubuntu-latest

.github/workflows/reviewdog.yml

@@ -1,4 +1,6 @@
 name: reviewdog
+permissions:
+  contents: read
 on: [pull_request]
 jobs:
   golangci-lint:
@@ -94,12 +96,52 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: check on release branch
-        if: ${{ contains(github.head_ref, 'release-') || contains(github.base_ref, 'release-') }}
+        if: ${{ contains(github.base_ref, 'release-') }}
         run: |
           make generate manifests VERSION="$(grep -Eo "[0-9]+\.[0-9]+\.[0-9]+" pkg/version/version.txt)" IMAGE_TAG_BASE="percona/percona-server-mongodb-operator"
           git diff --exit-code
       - name: check on non release branches
-        if: ${{ ! (contains(github.head_ref, 'release-') || contains(github.base_ref, 'release-')) }}
+        if: ${{ ! contains(github.base_ref, 'release-') }}
         run: |
           make generate manifests VERSION=main
           git diff --exit-code
+
+  e2e-release-versions-images:
+    name: e2e-tests release_versions image availability
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Check if e2e-tests/release_versions changed
+        id: changed
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          if git diff --name-only origin/${{ github.base_ref }}...HEAD -- e2e-tests/release_versions | grep -q .; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Verify release_versions images exist (docker manifest inspect)
+        if: steps.changed.outputs.changed == 'true'
+        run: |
+          set -e
+          # All IMAGE_*=value lines, exclude operator image (percona/percona-server-mongodb-operator)
+          images=$(grep -E '^IMAGE_[^=]+=' e2e-tests/release_versions | cut -d= -f2 | grep -v '^$' | grep -v 'percona/percona-server-mongodb-operator' | sort -u)
+          if [ -z "$images" ]; then
+            echo "No non-operator images found in e2e-tests/release_versions"
+            exit 0
+          fi
+          failed=""
+          for img in $images; do
+            echo "Checking image $img"
+            if ! docker manifest inspect "$img"; then
+              echo "::error::Image not found or inaccessible: $img"
+              failed="${failed} ${img}"
+            fi
+          done
+          if [ -n "$failed" ]; then
+            echo "::error::The following images failed docker manifest inspect:$failed"
+            exit 1
+          fi
+          echo "All images are available."

.github/workflows/scan.yml

@@ -1,5 +1,7 @@
 name: Scan docker
 on: [pull_request]
+permissions:
+  contents: read
 
 env:
   # Use docker.io for Docker Hub if empty
@@ -17,10 +19,10 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build an image from Dockerfile (linux/arm64)
         run: |

.github/workflows/stale.yml

@@ -5,6 +5,9 @@ on:
 
 jobs:
   stale:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/stale@v10

.github/workflows/test.yml

@@ -1,4 +1,7 @@
 name: Run tests
+permissions:
+  contents: read
+  pull-requests: write
 on: [pull_request]
 jobs:
   test:

Jenkinsfile

@@ -394,13 +394,16 @@ void checkE2EIgnoreFiles() {
     echo "Excluded files: $excludedFiles"
     echo "Changed files: $changedFiles"
 
-    def excludedFilesRegex = excludedFiles.collect{it.replace("**", ".*").replace("*", "[^/]*")}
+    // Use placeholder so the * in ".*" (from **) is not replaced by [^/]*
+    def excludedFilesRegex = excludedFiles.collect{
+        it.replace("**", ".__STARSTAR__").replace("*", "[^/]*").replace(".__STARSTAR__", ".*")
+    }
     needToRunTests = !changedFiles.every{changed -> excludedFilesRegex.any{regex -> changed ==~ regex}}
 
     if (needToRunTests) {
         echo "Some changed files are outside of the e2eignore list. Proceeding with execution."
     } else {
-        if (currentBuild.previousBuild?.result != 'SUCCESS') {
+        if (currentBuild.previousBuild?.result != 'SUCCESS' && currentBuild.number != 1) {
             echo "All changed files are e2eignore files, and previous build was unsuccessful. Propagating previous state."
             currentBuild.result = currentBuild.previousBuild?.result
             error "Skipping execution as non-significant changes detected and previous build was unsuccessful."

Makefile

@@ -7,6 +7,7 @@ IMAGE ?= $(IMAGE_TAG_BASE):$(VERSION)
 DEPLOYDIR = ./deploy
 
 ENVTEST_K8S_VERSION = 1.31
+ENVTEST_VERSION ?= release-0.23
 
 all: build
 
@@ -94,7 +95,7 @@ kustomize: ## Download kustomize locally if necessary.
 
 ENVTEST = $(shell pwd)/bin/setup-envtest
 envtest: ## Download envtest-setup locally if necessary.
-	$(call go-get-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@latest)
+	$(call go-get-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@$(ENVTEST_VERSION))
 
 SWAGGER = $(shell pwd)/bin/swagger
 swagger: ## Download swagger locally if necessary.
@@ -104,6 +105,9 @@ MOCKGEN = $(shell pwd)/bin/mockgen
 mockgen: ## Download mockgen locally if necessary.
 	$(call go-get-tool,$(MOCKGEN), github.com/golang/mock/mockgen@latest)
 
+update-version:
+	echo $(NEXT_VER) > pkg/version/version.txt
+
 # Prepare release
 include e2e-tests/release_versions
 CERT_MANAGER_VER := $(shell grep -Eo "cert-manager v.*" go.mod|grep -Eo "[0-9]+\.[0-9]+\.[0-9]+")
@@ -133,8 +137,7 @@ release: manifests
 MAJOR_VER := $(shell grep -oE "crVersion: .*" deploy/cr.yaml|grep -oE "[0-9]+\.[0-9]+\.[0-9]+"|cut -d'.' -f1)
 MINOR_VER := $(shell grep -oE "crVersion: .*" deploy/cr.yaml|grep -oE "[0-9]+\.[0-9]+\.[0-9]+"|cut -d'.' -f2)
 NEXT_VER ?= $(MAJOR_VER).$$(($(MINOR_VER) + 1)).0
-after-release: manifests
-	echo $(NEXT_VER) > pkg/version/version.txt
+after-release: update-version manifests
 	$(SED) -i \
 		-e "s/crVersion: .*/crVersion: $(NEXT_VER)/" \
 		-e "/^spec:/,/^  image:/{s#image: .*#image: perconalab/percona-server-mongodb-operator:main-mongod8.0#}" deploy/cr-minimal.yaml

build/physical-restore-ps-entry.sh

@@ -25,6 +25,11 @@ trap 'handle_sigterm' 15
 
 touch /opt/percona/restore-in-progress
 
+if [ -d /etc/s3/certs-in ] && [ -n "$(ls -A /etc/s3/certs-in/*.crt 2>/dev/null)" ]; then
+	cat /etc/s3/certs-in/*.crt > /etc/s3/certs/ca-bundle.crt
+	chmod 0644 /etc/s3/certs/ca-bundle.crt
+fi
+
 if [[ -z ${PBM_AGENT_TLS_ENABLED} ]] || [[ ${PBM_AGENT_TLS_ENABLED} == "true" ]]; then
 	MONGO_SSL_DIR=/etc/mongodb-ssl
 	if [[ -e "${MONGO_SSL_DIR}/tls.crt" ]] && [[ -e "${MONGO_SSL_DIR}/tls.key" ]]; then