Merge remote-tracking branch 'upstream/main' into feat/gcs-workload-identity

Author: TineoC

.github/dependabot.yml

@@ -73,4 +73,9 @@ updates:
       interval: weekly
       day: "monday"
       time: "01:00"
+    groups:
+      k8s-ecosystem:
+        patterns:
+          - "k8s.io/*"
+          - "sigs.k8s.io/*"
 

.github/workflows/reviewdog.yml

@@ -7,7 +7,7 @@ jobs:
     name: runner / suggester / golangci-lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: golangci-lint
         uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9
         with:
@@ -19,7 +19,7 @@ jobs:
     name: runner / suggester / gofmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - run: gofmt -w -s $(find . -not -path "*/vendor/*" -name "*.go")
       - uses: reviewdog/action-suggester@aa38384ceb608d00f84b4690cacc83a5aba307ff # v1.24.0
         with:
@@ -29,7 +29,7 @@ jobs:
     name: runner / suggester / goimports-reviser
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: '^1.26'
@@ -43,7 +43,7 @@ jobs:
     name: runner / suggester / shfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: '^1.26'
@@ -59,7 +59,7 @@ jobs:
     name: runner / shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1
         with:
           github_token: ${{ secrets.github_token }}
@@ -70,7 +70,7 @@ jobs:
     name: runner / misspell
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: reviewdog/action-misspell@d6429416b12b09b4e2768307d53bef58d172e962 # v1
         with:
           github_token: ${{ secrets.github_token }}
@@ -82,7 +82,7 @@ jobs:
     name: runner / alex
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: reviewdog/action-alex@b6673b547eeb6d430c87ef02dc3524bdf34e324d # v1
         with:
           github_token: ${{ secrets.github_token }}
@@ -94,7 +94,7 @@ jobs:
     name: runner / manifests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: check on release branch
         if: ${{ contains(github.base_ref, 'release-') }}
         run: |
@@ -110,7 +110,7 @@ jobs:
     name: e2e-tests release_versions image availability
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
       - name: Check if e2e-tests/release_versions changed

.github/workflows/scan.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4

.github/workflows/test.yml

@@ -8,7 +8,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod

build/logcollector/entrypoint.sh

@@ -3,7 +3,19 @@ set -e
 
 export PATH="$PATH:/opt/fluent-bit/bin"
 
-LOGROTATE_SCHEDULE="${LOGROTATE_SCHEDULE:-0 0 0 * * *}"
+LOGROTATE_SCHEDULE="${LOGROTATE_SCHEDULE:-0 0 * * *}"
+
+run_cron() {
+	local schedule="$1"
+	local cmd="$2"
+
+	if [ -f /usr/bin/supercronic ]; then
+        printf '%s %s\n' "$schedule" "$cmd" > /tmp/crontab
+        exec supercronic /tmp/crontab
+    else
+        exec go-cron "$schedule" sh -c "$cmd"
+    fi
+}
 
 is_logrotate_config_invalid() {
 	local config_file="$1"
@@ -26,6 +38,14 @@ run_logrotate() {
 	local logrotate_additional_conf_files=()
 	local conf_d_dir="/opt/percona/logcollector/logrotate/conf.d"
 
+	# Ensure logrotate can run with current UID
+	if [[ $EUID != 1001 ]]; then
+		# logrotate requires UID in /etc/passwd
+		sed -e "s^x:1001:^x:$EUID:^" /etc/passwd >/tmp/passwd
+		cat /tmp/passwd >/etc/passwd
+		rm -rf /tmp/passwd
+	fi
+
 	# Check if mongodb.conf exists and validate it
 	if [ -f "$conf_d_dir/mongodb.conf" ]; then
 		logrotate_conf_file="$conf_d_dir/mongodb.conf"
@@ -49,21 +69,14 @@ run_logrotate() {
 			fi
 		done
 	fi
-	# Ensure logrotate can run with current UID
-	if [[ $EUID != 1001 ]]; then
-		# logrotate requires UID in /etc/passwd
-		sed -e "s^x:1001:^x:$EUID:^" /etc/passwd >/tmp/passwd
-		cat /tmp/passwd >/etc/passwd
-		rm -rf /tmp/passwd
-	fi
 
 	local logrotate_cmd="logrotate -s \"$logrotate_status_file\" \"$logrotate_conf_file\""
 	for additional_conf in "${logrotate_additional_conf_files[@]}"; do
 		logrotate_cmd="$logrotate_cmd \"$additional_conf\""
 	done
 
 	set -o xtrace
-	exec go-cron "$LOGROTATE_SCHEDULE" sh -c "$logrotate_cmd"
+	run_cron "$LOGROTATE_SCHEDULE" "$logrotate_cmd"
 }
 
 run_fluentbit() {

build/ps-entry.sh

@@ -245,11 +245,26 @@ _dbPath() {
 	echo "$dbPath"
 }
 
+# generate_pem_files concatenates the TLS key and cert into the .pem files
+generate_pem_files() {
+	MONGO_SSL_DIR=${MONGO_SSL_DIR:-/etc/mongodb-ssl}
+	if [ -f "${MONGO_SSL_DIR}/tls.key" ] && [ -f "${MONGO_SSL_DIR}/tls.crt" ]; then
+		cat "${MONGO_SSL_DIR}/tls.key" "${MONGO_SSL_DIR}/tls.crt" >/tmp/tls.pem
+	fi
+	MONGO_SSL_INTERNAL_DIR=${MONGO_SSL_INTERNAL_DIR:-/etc/mongodb-ssl-internal}
+	if [ -f "${MONGO_SSL_INTERNAL_DIR}/tls.key" ] && [ -f "${MONGO_SSL_INTERNAL_DIR}/tls.crt" ]; then
+		cat "${MONGO_SSL_INTERNAL_DIR}/tls.key" "${MONGO_SSL_INTERNAL_DIR}/tls.crt" >/tmp/tls-internal.pem
+	fi
+}
+
 is_manual_recovery() {
 	recovery_file='/data/db/sleep-forever'
 	if [ -f "${recovery_file}" ]; then
 		echo "The $recovery_file file is detected, node is going to infinity loop"
 		echo "If you want to exit from infinity loop you need to remove $recovery_file file"
+		# Generate the .pem files so a user who execs into the container during
+		# sleep-forever mode can start mongod manually without recreating them.
+		generate_pem_files
 		while [ -f "${recovery_file}" ]; do
 			sleep 1
 		done
@@ -440,16 +455,17 @@ if [[ $originalArgOne == mongo* ]]; then
 		if [ -f "${MONGO_SSL_DIR}/ca.crt" ]; then
 			CA="${MONGO_SSL_DIR}/ca.crt"
 		fi
+
+		generate_pem_files
+
+		MONGO_SSL_INTERNAL_DIR=${MONGO_SSL_INTERNAL_DIR:-/etc/mongodb-ssl-internal}
 		if [ -f "${MONGO_SSL_DIR}/tls.key" ] && [ -f "${MONGO_SSL_DIR}/tls.crt" ]; then
-			cat "${MONGO_SSL_DIR}/tls.key" "${MONGO_SSL_DIR}/tls.crt" >/tmp/tls.pem
 			_mongod_hack_ensure_arg_val --sslPEMKeyFile /tmp/tls.pem "${mongodHackedArgs[@]}"
 			if [ -f "${CA}" ]; then
 				_mongod_hack_ensure_arg_val --sslCAFile "${CA}" "${mongodHackedArgs[@]}"
 			fi
 		fi
-		MONGO_SSL_INTERNAL_DIR=${MONGO_SSL_INTERNAL_DIR:-/etc/mongodb-ssl-internal}
 		if [ -f "${MONGO_SSL_INTERNAL_DIR}/tls.key" ] && [ -f "${MONGO_SSL_INTERNAL_DIR}/tls.crt" ]; then
-			cat "${MONGO_SSL_INTERNAL_DIR}/tls.key" "${MONGO_SSL_INTERNAL_DIR}/tls.crt" >/tmp/tls-internal.pem
 			_mongod_hack_ensure_arg_val --sslClusterFile /tmp/tls-internal.pem "${mongodHackedArgs[@]}"
 			if [ -f "${MONGO_SSL_INTERNAL_DIR}/ca.crt" ]; then
 				_mongod_hack_ensure_arg_val --sslClusterCAFile "${MONGO_SSL_INTERNAL_DIR}/ca.crt" "${mongodHackedArgs[@]}"

cmd/manager/main.go

@@ -16,12 +16,14 @@ import (
 	volumesnapshotv1 "github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumesnapshot/v1"
 	uzap "go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
+	corev1 "k8s.io/api/core/v1"
 	k8sruntime "k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/client-go/discovery"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	metricsServer "sigs.k8s.io/controller-runtime/pkg/metrics/server"
@@ -104,6 +106,12 @@ func main() {
 		WebhookServer: webhook.NewServer(webhook.Options{
 			Port: 9443,
 		}),
+		Client: client.Options{
+			Scheme: scheme,
+			Cache: &client.CacheOptions{
+				DisableFor: []client.Object{&corev1.Node{}},
+			},
+		},
 	}
 
 	options.Controller.GroupKindConcurrency = map[string]int{

config/crd/bases/psmdb.percona.com_perconaservermongodbrestores.yaml

@@ -262,9 +262,19 @@ spec:
                     items:
                       type: string
                     type: array
+                  nsFrom:
+                    type: string
+                  nsTo:
+                    type: string
                   withUsersAndRoles:
                     type: boolean
                 type: object
+                x-kubernetes-validations:
+                - message: nsFrom and nsTo need to be set together
+                  rule: (!has(self.nsFrom) && !has(self.nsTo)) || (has(self.nsFrom)
+                    && has(self.nsTo))
+                - message: nsFrom and nsTo can't be the same
+                  rule: (!has(self.nsFrom) && !has(self.nsTo)) || self.nsFrom != self.nsTo
               storageName:
                 type: string
             type: object

config/crd/bases/psmdb.percona.com_perconaservermongodbs.yaml

@@ -986,6 +986,12 @@ spec:
                     type: string
                   mongosParams:
                     type: string
+                  querySource:
+                    default: profiler
+                    enum:
+                    - profiler
+                    - mongolog
+                    type: string
                   resources:
                     properties:
                       claims:
@@ -3963,6 +3969,18 @@ spec:
                           type: boolean
                         exposeType:
                           type: string
+                        externalDNS:
+                          properties:
+                            domain:
+                              type: string
+                            prefix:
+                              type: string
+                            ttl:
+                              minimum: 0
+                              type: integer
+                          required:
+                          - domain
+                          type: object
                         externalTrafficPolicy:
                           type: string
                         internalTrafficPolicy:
@@ -14797,6 +14815,18 @@ spec:
                             type: boolean
                           exposeType:
                             type: string
+                          externalDNS:
+                            properties:
+                              domain:
+                                type: string
+                              prefix:
+                                type: string
+                              ttl:
+                                minimum: 0
+                                type: integer
+                            required:
+                            - domain
+                            type: object
                           externalTrafficPolicy:
                             type: string
                           internalTrafficPolicy:
@@ -23245,6 +23275,18 @@ spec:
                             type: object
                           exposeType:
                             type: string
+                          externalDNS:
+                            properties:
+                              domain:
+                                type: string
+                              prefix:
+                                type: string
+                              ttl:
+                                minimum: 0
+                                type: integer
+                            required:
+                            - domain
+                            type: object
                           externalTrafficPolicy:
                             type: string
                           internalTrafficPolicy:
@@ -25429,6 +25471,12 @@ spec:
                 properties:
                   allowInvalidCertificates:
                     type: boolean
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf: