diff --git a/e2e-tests/build b/e2e-tests/build index 3dc9f50c07..5c47c7d626 100755 --- a/e2e-tests/build +++ b/e2e-tests/build @@ -4,8 +4,11 @@ set -o errexit set -o xtrace test_dir="$(dirname $0)" -. $(dirname $0)/functions src_dir="$(realpath ${test_dir}/..)" + +GIT_COMMIT=$(git rev-parse HEAD) +GIT_BRANCH=${VERSION:-$(git rev-parse --abbrev-ref HEAD | sed -e 's^/^-^g; s^[.]^-^g;' | sed -e 's/_/-/g' | tr '[:upper:]' '[:lower:]')} +IMAGE=${IMAGE:-"perconalab/percona-server-mongodb-operator:${GIT_BRANCH}"} IMAGE=$(echo "$IMAGE" | sed -e 's#percona/#perconalab/#') if [[ ${DOCKER_NOCACHE:-0} == 1 ]]; then diff --git a/e2e-tests/conf/gke-volume-snapshot-class.yaml b/e2e-tests/conf/volume-snapshot-class-gke.yaml similarity index 100% rename from e2e-tests/conf/gke-volume-snapshot-class.yaml rename to e2e-tests/conf/volume-snapshot-class-gke.yaml diff --git a/e2e-tests/conf/volume-snapshot-class-rancher.yaml b/e2e-tests/conf/volume-snapshot-class-rancher.yaml new file mode 100644 index 0000000000..c7b1c2a8c8 --- /dev/null +++ b/e2e-tests/conf/volume-snapshot-class-rancher.yaml @@ -0,0 +1,9 @@ +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass +metadata: + name: longhorn-snapshot-class +driver: driver.longhorn.io +deletionPolicy: Delete +parameters: + type: bak + backupMode: full diff --git a/e2e-tests/custom-users-roles-sharded/compare/run b/e2e-tests/custom-users-roles-sharded/compare/run index ce30582d48..12b65931da 100755 --- a/e2e-tests/custom-users-roles-sharded/compare/run +++ b/e2e-tests/custom-users-roles-sharded/compare/run @@ -44,13 +44,7 @@ kubectl_bin apply -f "${conf_dir}/client.yml" \ apply_s3_storage_secrets -if version_gt "1.19" && [ $EKS -ne 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -elif version_gt "1.24" && [ $EKS -eq 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -else - kubectl_bin apply -f "$conf_dir/container-rc.yaml" -fi +create_runtime_class desc 'create first PSMDB cluster' diff --git a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-cfg-4-oc.yml b/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-cfg-4-oc.yml deleted file mode 100644 index 7ca74c592d..0000000000 --- a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-cfg-4-oc.yml +++ /dev/null @@ -1,217 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - name: some-name-cfg - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - serviceName: some-name-cfg - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - topologyKey: kubernetes.io/hostname - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=cfg - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerIndexPrefixCompression=true - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: cfg - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: cfg-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 3Gi - status: - phase: Pending diff --git a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-cfg-oc.yml b/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-cfg-oc.yml index d8fbb75aa2..7ca74c592d 100644 --- a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-cfg-oc.yml +++ b/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-cfg-oc.yml @@ -172,6 +172,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-mongos-4-oc.yml b/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-mongos-4-oc.yml deleted file mode 100644 index 78990fd2f8..0000000000 --- a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-mongos-4-oc.yml +++ /dev/null @@ -1,196 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - name: some-name-mongos - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - serviceName: "" - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - topologyKey: kubernetes.io/hostname - containers: - - args: - - mongos - - --bind_ip_all - - --port=27017 - - --sslAllowInvalidCertificates - - --configdb - - cfg/some-name-cfg-0.some-name-cfg.NAME_SPACE.svc.cluster.local:27017,some-name-cfg-1.some-name-cfg.NAME_SPACE.svc.cluster.local:27017,some-name-cfg-2.some-name-cfg.NAME_SPACE.svc.cluster.local:27017 - - --relaxPermChecks - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --config=/etc/mongos-config/mongos.conf - command: - - /opt/percona/ps-entry.sh - env: - - name: MONGODB_PORT - value: "27017" - envFrom: - - secretRef: - name: some-users - optional: false - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --component - - mongos - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "10" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongos - ports: - - containerPort: 27017 - name: mongos - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongos - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 1 - successThreshold: 1 - timeoutSeconds: 1 - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongos-config - name: config - - mountPath: /etc/users-secret - name: users-secret-file - readOnly: true - - mountPath: /opt/percona - name: bin - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: mongos-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - emptyDir: {} - name: mongod-data - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - - configMap: - defaultMode: 420 - name: some-name-mongos - optional: true - name: config - - emptyDir: {} - name: bin - updateStrategy: - type: OnDelete diff --git a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-mongos-oc.yml b/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-mongos-oc.yml index f3b3dad9d5..78990fd2f8 100644 --- a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-mongos-oc.yml +++ b/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-mongos-oc.yml @@ -118,6 +118,8 @@ spec: successThreshold: 1 timeoutSeconds: 1 resources: {} + securityContext: + runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: @@ -145,8 +147,6 @@ spec: imagePullPolicy: Always name: mongos-sidecar-1 resources: {} - securityContext: - runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst @@ -162,6 +162,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-rs0-4-oc.yml b/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-rs0-4-oc.yml deleted file mode 100644 index 49be700e16..0000000000 --- a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-rs0-4-oc.yml +++ /dev/null @@ -1,226 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - name: some-name-rs0 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - serviceName: some-name-rs0 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs0 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs0 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: rs-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs0-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-rs0-oc.yml b/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-rs0-oc.yml index 4a913408bf..49be700e16 100644 --- a/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-rs0-oc.yml +++ b/e2e-tests/custom-users-roles-sharded/compare/statefulset_some-name-rs0-oc.yml @@ -176,6 +176,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/custom-users-roles-sharded/run b/e2e-tests/custom-users-roles-sharded/run index 3d180e041e..5d2783f6d3 100755 --- a/e2e-tests/custom-users-roles-sharded/run +++ b/e2e-tests/custom-users-roles-sharded/run @@ -148,13 +148,7 @@ kubectl_bin apply -f "${conf_dir}/secrets.yml" \ apply_s3_storage_secrets -if version_gt "1.19" && [ $EKS -ne 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -elif version_gt "1.24" && [ $EKS -eq 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -else - kubectl_bin apply -f "$conf_dir/container-rc.yaml" -fi +create_runtime_class desc 'create first PSMDB cluster' diff --git a/e2e-tests/default-cr/compare/statefulset_minimal-cluster-cfg-oc.yml b/e2e-tests/default-cr/compare/statefulset_minimal-cluster-cfg-oc.yml index 14bdc800cc..07d6810862 100644 --- a/e2e-tests/default-cr/compare/statefulset_minimal-cluster-cfg-oc.yml +++ b/e2e-tests/default-cr/compare/statefulset_minimal-cluster-cfg-oc.yml @@ -133,9 +133,6 @@ spec: volumeMounts: - mountPath: /data/db name: mongod-data - - mountPath: /etc/mongodb-secrets - name: minimal-cluster-mongodb-keyfile - readOnly: true - mountPath: /etc/mongodb-ssl name: ssl readOnly: true @@ -171,11 +168,6 @@ spec: serviceAccountName: default terminationGracePeriodSeconds: 60 volumes: - - name: minimal-cluster-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: minimal-cluster-mongodb-keyfile - emptyDir: {} name: bin - emptyDir: {} diff --git a/e2e-tests/default-cr/compare/statefulset_minimal-cluster-cfg.yml b/e2e-tests/default-cr/compare/statefulset_minimal-cluster-cfg.yml index f85f4c4967..619e9744d0 100644 --- a/e2e-tests/default-cr/compare/statefulset_minimal-cluster-cfg.yml +++ b/e2e-tests/default-cr/compare/statefulset_minimal-cluster-cfg.yml @@ -134,9 +134,6 @@ spec: volumeMounts: - mountPath: /data/db name: mongod-data - - mountPath: /etc/mongodb-secrets - name: minimal-cluster-mongodb-keyfile - readOnly: true - mountPath: /etc/mongodb-ssl name: ssl readOnly: true @@ -173,11 +170,6 @@ spec: serviceAccountName: default terminationGracePeriodSeconds: 60 volumes: - - name: minimal-cluster-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: minimal-cluster-mongodb-keyfile - emptyDir: {} name: bin - emptyDir: {} diff --git a/e2e-tests/default-cr/compare/statefulset_minimal-cluster-rs0-oc.yml b/e2e-tests/default-cr/compare/statefulset_minimal-cluster-rs0-oc.yml index 5f0b98d73d..95e1f6f17e 100644 --- a/e2e-tests/default-cr/compare/statefulset_minimal-cluster-rs0-oc.yml +++ b/e2e-tests/default-cr/compare/statefulset_minimal-cluster-rs0-oc.yml @@ -133,9 +133,6 @@ spec: volumeMounts: - mountPath: /data/db name: mongod-data - - mountPath: /etc/mongodb-secrets - name: minimal-cluster-mongodb-keyfile - readOnly: true - mountPath: /etc/mongodb-ssl name: ssl readOnly: true @@ -171,11 +168,6 @@ spec: serviceAccountName: default terminationGracePeriodSeconds: 60 volumes: - - name: minimal-cluster-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: minimal-cluster-mongodb-keyfile - emptyDir: {} name: bin - emptyDir: {} diff --git a/e2e-tests/default-cr/compare/statefulset_minimal-cluster-rs0.yml b/e2e-tests/default-cr/compare/statefulset_minimal-cluster-rs0.yml index 867b1366da..93ec3ebf98 100644 --- a/e2e-tests/default-cr/compare/statefulset_minimal-cluster-rs0.yml +++ b/e2e-tests/default-cr/compare/statefulset_minimal-cluster-rs0.yml @@ -134,9 +134,6 @@ spec: volumeMounts: - mountPath: /data/db name: mongod-data - - mountPath: /etc/mongodb-secrets - name: minimal-cluster-mongodb-keyfile - readOnly: true - mountPath: /etc/mongodb-ssl name: ssl readOnly: true @@ -173,11 +170,6 @@ spec: serviceAccountName: default terminationGracePeriodSeconds: 60 volumes: - - name: minimal-cluster-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: minimal-cluster-mongodb-keyfile - emptyDir: {} name: bin - emptyDir: {} diff --git a/e2e-tests/default-cr/compare/statefulset_my-cluster-name-cfg-oc.yml b/e2e-tests/default-cr/compare/statefulset_my-cluster-name-cfg-oc.yml index ac1ea267bc..246f8e9efc 100644 --- a/e2e-tests/default-cr/compare/statefulset_my-cluster-name-cfg-oc.yml +++ b/e2e-tests/default-cr/compare/statefulset_my-cluster-name-cfg-oc.yml @@ -130,9 +130,6 @@ spec: volumeMounts: - mountPath: /data/db name: mongod-data - - mountPath: /etc/mongodb-secrets - name: my-cluster-name-mongodb-keyfile - readOnly: true - mountPath: /etc/mongodb-ssl name: ssl readOnly: true @@ -290,11 +287,6 @@ spec: serviceAccountName: default terminationGracePeriodSeconds: 60 volumes: - - name: my-cluster-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-keyfile - emptyDir: {} name: bin - emptyDir: {} diff --git a/e2e-tests/default-cr/compare/statefulset_my-cluster-name-cfg.yml b/e2e-tests/default-cr/compare/statefulset_my-cluster-name-cfg.yml index f382d06224..5ec54a1356 100644 --- a/e2e-tests/default-cr/compare/statefulset_my-cluster-name-cfg.yml +++ b/e2e-tests/default-cr/compare/statefulset_my-cluster-name-cfg.yml @@ -131,9 +131,6 @@ spec: volumeMounts: - mountPath: /data/db name: mongod-data - - mountPath: /etc/mongodb-secrets - name: my-cluster-name-mongodb-keyfile - readOnly: true - mountPath: /etc/mongodb-ssl name: ssl readOnly: true @@ -293,11 +290,6 @@ spec: serviceAccountName: default terminationGracePeriodSeconds: 60 volumes: - - name: my-cluster-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-keyfile - emptyDir: {} name: bin - emptyDir: {} diff --git a/e2e-tests/default-cr/compare/statefulset_my-cluster-name-rs0-oc.yml b/e2e-tests/default-cr/compare/statefulset_my-cluster-name-rs0-oc.yml index 6f8cca04e7..13d67914cd 100644 --- a/e2e-tests/default-cr/compare/statefulset_my-cluster-name-rs0-oc.yml +++ b/e2e-tests/default-cr/compare/statefulset_my-cluster-name-rs0-oc.yml @@ -130,9 +130,6 @@ spec: volumeMounts: - mountPath: /data/db name: mongod-data - - mountPath: /etc/mongodb-secrets - name: my-cluster-name-mongodb-keyfile - readOnly: true - mountPath: /etc/mongodb-ssl name: ssl readOnly: true @@ -290,11 +287,6 @@ spec: serviceAccountName: default terminationGracePeriodSeconds: 60 volumes: - - name: my-cluster-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-keyfile - emptyDir: {} name: bin - emptyDir: {} diff --git a/e2e-tests/default-cr/compare/statefulset_my-cluster-name-rs0.yml b/e2e-tests/default-cr/compare/statefulset_my-cluster-name-rs0.yml index b3cbe0b40b..99df069f1c 100644 --- a/e2e-tests/default-cr/compare/statefulset_my-cluster-name-rs0.yml +++ b/e2e-tests/default-cr/compare/statefulset_my-cluster-name-rs0.yml @@ -131,9 +131,6 @@ spec: volumeMounts: - mountPath: /data/db name: mongod-data - - mountPath: /etc/mongodb-secrets - name: my-cluster-name-mongodb-keyfile - readOnly: true - mountPath: /etc/mongodb-ssl name: ssl readOnly: true @@ -293,11 +290,6 @@ spec: serviceAccountName: default terminationGracePeriodSeconds: 60 volumes: - - name: my-cluster-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-keyfile - emptyDir: {} name: bin - emptyDir: {} diff --git a/e2e-tests/demand-backup-eks-credentials-irsa/run b/e2e-tests/demand-backup-eks-credentials-irsa/run index c140d82303..29333bf59e 100755 --- a/e2e-tests/demand-backup-eks-credentials-irsa/run +++ b/e2e-tests/demand-backup-eks-credentials-irsa/run @@ -8,7 +8,7 @@ set_debug # EKS cluster should be run without the policy AmazonS3FullAccess # This policy makes the test false passed. -if [ $EKS -ne 1 ]; then +if [[ "$EKS" -ne 1 ]]; then echo "Skip the test. We run it for EKS only " exit 0 fi @@ -279,4 +279,4 @@ kubectl_bin delete psmdb-backup --all --ignore-not-found=true destroy $namespace -desc 'test passed' \ No newline at end of file +desc 'test passed' diff --git a/e2e-tests/demand-backup-eks-credentials/run b/e2e-tests/demand-backup-eks-credentials/run index 35ed886fe8..32b6f11a94 100755 --- a/e2e-tests/demand-backup-eks-credentials/run +++ b/e2e-tests/demand-backup-eks-credentials/run @@ -6,7 +6,7 @@ test_dir=$(realpath $(dirname $0)) . ${test_dir}/../functions set_debug -if [ $EKS -ne 1 ]; then +if [[ "$EKS" -ne 1 ]]; then echo "Skip the test. We run it for EKS only" exit 0 fi diff --git a/e2e-tests/demand-backup-fs/run b/e2e-tests/demand-backup-fs/run index 3f3a3df5f3..41c2788a55 100755 --- a/e2e-tests/demand-backup-fs/run +++ b/e2e-tests/demand-backup-fs/run @@ -58,7 +58,7 @@ if [[ $GKE != 1 ]]; then fi uid=1001 -if [[ "${OPENSHIFT}" ]]; then +if [[ -n "$OPENSHIFT" ]]; then uid=1001210000 fi @@ -70,7 +70,7 @@ kubectl_bin apply \ -f "${conf_dir}/secrets.yml" \ -f "${conf_dir}/client.yml" -if [[ "${OPENSHIFT}" ]]; then +if [[ -n "$OPENSHIFT" ]]; then log "creating custom security context constraints to allow NFS volumes" kubectl_bin apply -f ${test_dir}/conf/rbac-oc.yml fi @@ -78,7 +78,7 @@ fi log "creating PSMDB cluster ${cluster}" if [[ $GKE != 1 ]]; then cluster_yaml=${test_dir}/conf/${cluster}.yml - if [[ "${OPENSHIFT}" ]]; then + if [[ -n "$OPENSHIFT" ]]; then cluster_yaml=${test_dir}/conf/${cluster}-oc.yml fi diff --git a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-cfg-4-oc.yml b/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-cfg-4-oc.yml deleted file mode 100644 index 0741d448f2..0000000000 --- a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-cfg-4-oc.yml +++ /dev/null @@ -1,290 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - name: some-name-cfg - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - serviceName: some-name-cfg - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - topologyKey: kubernetes.io/hostname - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27018 - - --replSet=cfg - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27018" - - name: MONGODB_REPLSET - value: cfg - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27018 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - - mountPath: /opt/percona/hookscript - name: hookscript - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: cfg-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: cfg - - name: PBM_MONGODB_PORT - value: "27018" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona/pbm-hookscript - name: pbm-hookscript - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-cfg-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - - configMap: - defaultMode: 420 - name: some-name-pbm-hookscript - optional: true - name: pbm-hookscript - - configMap: - defaultMode: 420 - name: some-name-cfg-cfg-hookscript - optional: true - name: hookscript - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 3Gi - status: - phase: Pending diff --git a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-cfg-oc.yml b/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-cfg-oc.yml index 2f72559684..0741d448f2 100644 --- a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-cfg-oc.yml +++ b/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-cfg-oc.yml @@ -230,6 +230,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-mongos-4-oc.yml b/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-mongos-4-oc.yml deleted file mode 100644 index 3ce91fc9e3..0000000000 --- a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-mongos-4-oc.yml +++ /dev/null @@ -1,203 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - name: some-name-mongos - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - serviceName: "" - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - topologyKey: kubernetes.io/hostname - containers: - - args: - - mongos - - --bind_ip_all - - --port=27019 - - --sslAllowInvalidCertificates - - --configdb - - cfg/some-name-cfg-0.some-name-cfg.NAME_SPACE.svc.cluster.local:27018,some-name-cfg-1.some-name-cfg.NAME_SPACE.svc.cluster.local:27018,some-name-cfg-2.some-name-cfg.NAME_SPACE.svc.cluster.local:27018 - - --relaxPermChecks - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --config=/etc/mongos-config/mongos.conf - command: - - /opt/percona/ps-entry.sh - env: - - name: MONGODB_PORT - value: "27019" - envFrom: - - secretRef: - name: some-users - optional: false - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --component - - mongos - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "10" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongos - ports: - - containerPort: 27019 - name: mongos - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongos - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 1 - successThreshold: 1 - timeoutSeconds: 1 - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongos-config - name: config - - mountPath: /etc/users-secret - name: users-secret-file - readOnly: true - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/hookscript - name: hookscript - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: mongos-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - emptyDir: {} - name: mongod-data - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - - configMap: - defaultMode: 420 - name: some-name-mongos - optional: true - name: config - - emptyDir: {} - name: bin - - configMap: - defaultMode: 420 - name: some-name-mongos-hookscript - optional: true - name: hookscript - updateStrategy: - type: OnDelete diff --git a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-mongos-oc.yml b/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-mongos-oc.yml index d20fc066cd..3ce91fc9e3 100644 --- a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-mongos-oc.yml +++ b/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-mongos-oc.yml @@ -120,7 +120,6 @@ spec: resources: {} securityContext: runAsNonRoot: true - runAsUser: 1001 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: @@ -165,9 +164,9 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler - securityContext: - fsGroup: 1001 + securityContext: {} serviceAccount: default serviceAccountName: default terminationGracePeriodSeconds: 60 diff --git a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-rs0-4-oc.yml b/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-rs0-4-oc.yml deleted file mode 100644 index bb646555d2..0000000000 --- a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-rs0-4-oc.yml +++ /dev/null @@ -1,281 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - name: some-name-rs0 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - serviceName: some-name-rs0 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27016 - - --replSet=rs0 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27016" - - name: MONGODB_REPLSET - value: rs0 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27016 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - - mountPath: /opt/percona/hookscript - name: hookscript - workingDir: /data/db - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs0 - - name: PBM_MONGODB_PORT - value: "27016" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona/pbm-hookscript - name: pbm-hookscript - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs0-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - - configMap: - defaultMode: 420 - name: some-name-pbm-hookscript - optional: true - name: pbm-hookscript - - configMap: - defaultMode: 420 - name: some-name-rs0-mongod-hookscript - optional: true - name: hookscript - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-rs0-oc.yml b/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-rs0-oc.yml index 936d00df5a..bb646555d2 100644 --- a/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-rs0-oc.yml +++ b/e2e-tests/demand-backup-sharded/compare/statefulset_some-name-rs0-oc.yml @@ -221,6 +221,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/demand-backup-sharded/run b/e2e-tests/demand-backup-sharded/run index df711fa803..2414dddca4 100755 --- a/e2e-tests/demand-backup-sharded/run +++ b/e2e-tests/demand-backup-sharded/run @@ -28,13 +28,7 @@ kubectl_bin apply \ -f "$conf_dir/client.yml" apply_s3_storage_secrets -if version_gt "1.19" && [ $EKS -ne 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -elif version_gt "1.24" && [ $EKS -eq 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -else - kubectl_bin apply -f "$conf_dir/container-rc.yaml" -fi +create_runtime_class apply_cluster "$test_dir/conf/$cluster-rs0.yml" desc 'check if all 3 Pods started' @@ -253,6 +247,5 @@ fi # desc 'check for passwords leak' # check_passwords_leak -kubectl_bin delete -f "$conf_dir/container-rc.yaml" destroy "$namespace" desc 'test passed' diff --git a/e2e-tests/demand-backup-snapshot-vault/run b/e2e-tests/demand-backup-snapshot-vault/run index 33f89ac0f6..57ae0ad962 100755 --- a/e2e-tests/demand-backup-snapshot-vault/run +++ b/e2e-tests/demand-backup-snapshot-vault/run @@ -8,8 +8,6 @@ set_debug vault_name="vault-service" -VOLUME_SNAPSHOT_CLASS=$(deploy_volume_snapshot_class) - create_tls_secret() { local name=$1 local service_name=$2 @@ -140,10 +138,10 @@ vault_append() { run_snapshot_backup() { local backup_name=$1 + local snapshot_class=$(get_volume_snapshot_class) log "running snapshot backup $backup_name" - - yq eval '.metadata.name = "'${backup_name}'" | .spec.volumeSnapshotClass = "'${VOLUME_SNAPSHOT_CLASS}'"' \ + yq eval '.metadata.name = "'${backup_name}'" | .spec.volumeSnapshotClass = "'${snapshot_class}'"' \ "${test_dir}/conf/backup.yml" \ | kubectl_bin apply -f - } @@ -171,6 +169,7 @@ cluster="some-name" create_infra "${namespace}" deploy_minio apply_s3_storage_secrets +deploy_volume_snapshot_class desc 'Setting up Vault' setup_vault diff --git a/e2e-tests/demand-backup-snapshot/run b/e2e-tests/demand-backup-snapshot/run index 86b18b449c..64e0f33d42 100755 --- a/e2e-tests/demand-backup-snapshot/run +++ b/e2e-tests/demand-backup-snapshot/run @@ -6,14 +6,12 @@ test_dir=$(realpath "$(dirname "$0")") . "${test_dir}/../functions" set_debug -VOLUME_SNAPSHOT_CLASS=$(deploy_volume_snapshot_class) - run_snapshot_backup() { local backup_name=$1 + local snapshot_class=$(get_volume_snapshot_class) log "running snapshot backup $backup_name" - - yq eval '.metadata.name = "'${backup_name}'" | .spec.volumeSnapshotClass = "'${VOLUME_SNAPSHOT_CLASS}'"' \ + yq eval '.metadata.name = "'${backup_name}'" | .spec.volumeSnapshotClass = "'${snapshot_class}'"' \ "${test_dir}/conf/backup.yml" \ | kubectl_bin apply -f - } @@ -62,6 +60,7 @@ run_snapshot_restore_backupsource() { create_infra "${namespace}" deploy_minio apply_s3_storage_secrets +deploy_volume_snapshot_class cluster="some-name" diff --git a/e2e-tests/expose-sharded/compare/statefulset_some-name-cfg-4-oc.yml b/e2e-tests/expose-sharded/compare/statefulset_some-name-cfg-4-oc.yml deleted file mode 100644 index 6014112bbd..0000000000 --- a/e2e-tests/expose-sharded/compare/statefulset_some-name-cfg-4-oc.yml +++ /dev/null @@ -1,269 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - name: some-name-cfg - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - serviceName: some-name-cfg - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - topologyKey: kubernetes.io/hostname - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=cfg - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerIndexPrefixCompression=true - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: cfg - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: cfg-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: cfg - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 3Gi - status: - phase: Pending diff --git a/e2e-tests/expose-sharded/compare/statefulset_some-name-cfg-oc.yml b/e2e-tests/expose-sharded/compare/statefulset_some-name-cfg-oc.yml index 7cc3b74085..6014112bbd 100644 --- a/e2e-tests/expose-sharded/compare/statefulset_some-name-cfg-oc.yml +++ b/e2e-tests/expose-sharded/compare/statefulset_some-name-cfg-oc.yml @@ -224,6 +224,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/expose-sharded/compare/statefulset_some-name-mongos-4-oc.yml b/e2e-tests/expose-sharded/compare/statefulset_some-name-mongos-4-oc.yml deleted file mode 100644 index 78990fd2f8..0000000000 --- a/e2e-tests/expose-sharded/compare/statefulset_some-name-mongos-4-oc.yml +++ /dev/null @@ -1,196 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - name: some-name-mongos - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - serviceName: "" - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app.kubernetes.io/component: mongos - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - topologyKey: kubernetes.io/hostname - containers: - - args: - - mongos - - --bind_ip_all - - --port=27017 - - --sslAllowInvalidCertificates - - --configdb - - cfg/some-name-cfg-0.some-name-cfg.NAME_SPACE.svc.cluster.local:27017,some-name-cfg-1.some-name-cfg.NAME_SPACE.svc.cluster.local:27017,some-name-cfg-2.some-name-cfg.NAME_SPACE.svc.cluster.local:27017 - - --relaxPermChecks - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --config=/etc/mongos-config/mongos.conf - command: - - /opt/percona/ps-entry.sh - env: - - name: MONGODB_PORT - value: "27017" - envFrom: - - secretRef: - name: some-users - optional: false - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --component - - mongos - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "10" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongos - ports: - - containerPort: 27017 - name: mongos - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongos - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 1 - successThreshold: 1 - timeoutSeconds: 1 - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongos-config - name: config - - mountPath: /etc/users-secret - name: users-secret-file - readOnly: true - - mountPath: /opt/percona - name: bin - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: mongos-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - emptyDir: {} - name: mongod-data - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - - configMap: - defaultMode: 420 - name: some-name-mongos - optional: true - name: config - - emptyDir: {} - name: bin - updateStrategy: - type: OnDelete diff --git a/e2e-tests/expose-sharded/compare/statefulset_some-name-mongos-oc.yml b/e2e-tests/expose-sharded/compare/statefulset_some-name-mongos-oc.yml index f3b3dad9d5..78990fd2f8 100644 --- a/e2e-tests/expose-sharded/compare/statefulset_some-name-mongos-oc.yml +++ b/e2e-tests/expose-sharded/compare/statefulset_some-name-mongos-oc.yml @@ -118,6 +118,8 @@ spec: successThreshold: 1 timeoutSeconds: 1 resources: {} + securityContext: + runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: @@ -145,8 +147,6 @@ spec: imagePullPolicy: Always name: mongos-sidecar-1 resources: {} - securityContext: - runAsNonRoot: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst @@ -162,6 +162,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/expose-sharded/compare/statefulset_some-name-rs0-4-oc.yml b/e2e-tests/expose-sharded/compare/statefulset_some-name-rs0-4-oc.yml deleted file mode 100644 index 6b4485bbe5..0000000000 --- a/e2e-tests/expose-sharded/compare/statefulset_some-name-rs0-4-oc.yml +++ /dev/null @@ -1,278 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - name: some-name-rs0 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - serviceName: some-name-rs0 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs0 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs0 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: rs-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs0 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs0-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/expose-sharded/run b/e2e-tests/expose-sharded/run index 1f2278e461..befddbcc52 100755 --- a/e2e-tests/expose-sharded/run +++ b/e2e-tests/expose-sharded/run @@ -99,13 +99,7 @@ function main() { -f "$conf_dir/client.yml" apply_s3_storage_secrets - if version_gt "1.19" && [ $EKS -ne 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - - elif version_gt "1.24" && [ $EKS -eq 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - - else - kubectl_bin apply -f "$conf_dir/container-rc.yaml" - fi + create_runtime_class apply_cluster "$test_dir/conf/$cluster-rs0.yml" desc 'check if all 3 Pods started' @@ -237,9 +231,7 @@ function main() { compare_mongo_cmd "find" "myApp:myPass@$cluster-rs0-1.$cluster-rs0.$namespace" "-6nd" compare_mongo_cmd "find" "myApp:myPass@$cluster-rs0-2.$cluster-rs0.$namespace" "-6nd" - kubectl_bin delete -f "$conf_dir/container-rc.yaml" destroy "$namespace" - desc 'test passed' } diff --git a/e2e-tests/functions b/e2e-tests/functions index 210b30c6ec..57bdc8a204 100755 --- a/e2e-tests/functions +++ b/e2e-tests/functions @@ -1,130 +1,49 @@ #!/bin/bash -GIT_COMMIT=$(git rev-parse HEAD) -GIT_BRANCH=${VERSION:-$(git rev-parse --abbrev-ref HEAD | sed -e 's^/^-^g; s^[.]^-^g;' | sed -e 's/_/-/g' | tr '[:upper:]' '[:lower:]')} -API="psmdb.percona.com/v1" -OPERATOR_VERSION="$(grep 'crVersion' $(realpath $(dirname ${BASH_SOURCE[0]})/../deploy/cr.yaml) | awk '{print $2}')" -IMAGE=${IMAGE:-"perconalab/percona-server-mongodb-operator:${GIT_BRANCH}"} -IMAGE_MONGOD=${IMAGE_MONGOD:-"perconalab/percona-server-mongodb-operator:main-mongod8.0"} -IMAGE_MONGOD_CHAIN=${IMAGE_MONGOD_CHAIN:-$' -perconalab/percona-server-mongodb-operator:main-mongod6.0 -perconalab/percona-server-mongodb-operator:main-mongod7.0 -perconalab/percona-server-mongodb-operator:main-mongod8.0'} -IMAGE_BACKUP=${IMAGE_BACKUP:-"perconalab/percona-server-mongodb-operator:main-backup"} -IMAGE_SEARCH=${IMAGE_SEARCH:-"perconalab/percona-server-mongodb-operator:main-mongot"} -SKIP_BACKUPS_TO_AWS_GCP_AZURE=${SKIP_BACKUPS_TO_AWS_GCP_AZURE:-1} -PMM_SERVER_VER=${PMM_SERVER_VER:-"9.9.9"} -IMAGE_PMM_CLIENT=${IMAGE_PMM_CLIENT:-"percona/pmm-client:2.44.1-1"} -IMAGE_PMM_SERVER=${IMAGE_PMM_SERVER:-"perconalab/pmm-server:dev-latest"} -IMAGE_PMM3_CLIENT=${IMAGE_PMM3_CLIENT:-"perconalab/pmm-client:3-dev-latest"} -IMAGE_PMM3_SERVER=${IMAGE_PMM3_SERVER:-"perconalab/pmm-server:3-dev-latest"} -IMAGE_LOGCOLLECTOR=${IMAGE_LOGCOLLECTOR:-"perconalab/fluentbit:main-logcollector"} -IMAGE_CLUSTERSYNC=${IMAGE_CLUSTERSYNC:-"percona/percona-clustersync-mongodb:0.9.0"} - -REGISTRY_NAME=${REGISTRY_NAME:-docker.io} -REGISTRY_NAME_FULL="${REGISTRY_NAME%/}/" - -detect_k8s_env() { - local provider="unknown" - if kubectl_bin api-resources | grep -q 'openshift.io' 2>/dev/null; then - provider="openshift" - elif kubectl_bin get nodes -o jsonpath='{.items[0].metadata.labels}' 2>/dev/null | grep -q 'eks.amazonaws.com'; then - provider="eks" - elif kubectl_bin get nodes -o jsonpath='{.items[0].metadata.labels}' 2>/dev/null | grep -q 'cloud.google.com/gke'; then - provider="gke" - elif kubectl_bin get nodes -o jsonpath='{.items[0].metadata.labels}' 2>/dev/null | grep -q 'kubernetes.azure.com'; then - provider="aks" - elif kubectl_bin get nodes -o jsonpath='{.items[0].spec.providerID}' 2>/dev/null | grep -qi 'kind://'; then - provider="kind" - elif kubectl_bin get nodes -o jsonpath='{.items[0].spec.providerID}' 2>/dev/null | grep -qi 'minikube'; then - provider="minikube" - fi - - echo "$provider" -} - -qualify_image_ref() { - local ref="$1" - local first="${ref%%/*}" - - if [[ $first == *.* || $first == *:* || $first == "localhost" ]]; then - printf '%s' "$ref" - return 0 - fi - - if [[ $ref == percona/* || $ref == perconalab/* ]]; then - printf '%s%s' "$REGISTRY_NAME_FULL" "$ref" - return 0 - fi +source "$(dirname "${BASH_SOURCE[0]}")/vars" - printf '%s' "$ref" -} +kubectl_bin() { + local LAST_OUT="$(mktemp)" + local LAST_ERR="$(mktemp)" + local exit_status=0 + local timeout=4 -qualify_image_var() { - local var="$1" - local val="${!var}" - local out="" - local ref + for i in $(seq 0 2); do + set +e + kubectl "$@" 1>"$LAST_OUT" 2>"$LAST_ERR" + exit_status=$? + set -e + if [ ${exit_status} != 0 -a -n "${DEBUG_TESTS}" ]; then + cat "$LAST_OUT" + cat "$LAST_ERR" >&2 + sleep "$((timeout * i))" + else + break + fi + done - [[ -z $val ]] && return 0 + cat "$LAST_OUT" + cat "$LAST_ERR" >&2 + rm "$LAST_OUT" "$LAST_ERR" + return ${exit_status} +} - if [[ $val == *$'\n'* ]]; then - while IFS= read -r ref; do - [[ -z $ref ]] && continue - out+=$(qualify_image_ref "$ref") - out+=$'\n' - done <<<"$val" - out="${out%$'\n'}" - printf -v "$var" '%s' "$out" - return 0 +set_debug() { + if [[ ${DEBUG_TESTS} == 1 ]]; then + set -o xtrace + else + set +o xtrace fi +} - printf -v "$var" '%s' "$(qualify_image_ref "$val")" -} - -for var in IMAGE IMAGE_MONGOD IMAGE_MONGOD_CHAIN IMAGE_BACKUP IMAGE_SEARCH \ - IMAGE_PMM_CLIENT IMAGE_PMM_SERVER \ - IMAGE_PMM3_CLIENT IMAGE_PMM3_SERVER \ - IMAGE_CLUSTERSYNC \ - IMAGE_LOGCOLLECTOR IMAGE_OPERATOR; do - qualify_image_var "$var" -done -CERT_MANAGER_VER="1.19.3" -MINIO_VER="5.4.0" -CHAOS_MESH_VER="2.7.1" -UPDATE_COMPARE_FILES=${UPDATE_COMPARE_FILES:-0} -DELETE_CRD_ON_START=${DELETE_CRD_ON_START:-1} -SKIP_DELETE=${SKIP_DELETE:-0} -tmp_dir=$(mktemp -d) -sed=$(which gsed || which sed) -date=$(which gdate || which date) - -test_name=$(basename $test_dir) -namespace="${test_name}-${RANDOM}" -replica_namespace="${test_name}-replica-${RANDOM}" -conf_dir=$(realpath $test_dir/../conf || :) -src_dir=$(realpath $test_dir/../..) -logs_dir=$(realpath $test_dir/../logs || :) - -if [[ ${ENABLE_LOGGING} == "true" ]]; then - if [ ! -d "${logs_dir}" ]; then - mkdir "${logs_dir}" - fi - exec &> >(tee ${logs_dir}/${test_name}.log) - echo "Log: ${logs_dir}/${test_name}.log" -fi - -if [ -f "$conf_dir/cloud-secret.yml" ]; then - SKIP_BACKUPS_TO_AWS_GCP_AZURE='' -fi - -if oc get projects 2>/dev/null; then - OPENSHIFT=4 -fi - -if kubectl get nodes | grep "^minikube" >/dev/null; then - export MINIKUBE=1 -fi +desc() { + set +o xtrace + local msg="$@" + printf "\n\n-----------------------------------------------------------------------------------\n" + printf "$msg" + printf "\n-----------------------------------------------------------------------------------\n\n" + set_debug +} minikube_sleep() { sleep_time=${1:-10} @@ -133,19 +52,6 @@ minikube_sleep() { fi } -if [ $(kubectl version -o json | jq -r '.serverVersion.gitVersion' | grep "-eks-") ]; then - EKS=1 -else - EKS=0 -fi - -if [ $(kubectl version -o json | jq -r '.serverVersion.gitVersion' | grep "gke") ]; then - GKE=1 -else - GKE=0 -fi -KUBE_VERSION=$(kubectl version -o json | jq -r '.serverVersion.major + "." + .serverVersion.minor' | $sed -r 's/[^0-9.]+//g') - log() { set +o xtrace echo "[$(date +%Y-%m-%dT%H:%M:%S%z)]" $* @@ -160,14 +66,6 @@ sleep_with_log() { sleep ${d} } -set_debug() { - if [[ ${DEBUG_TESTS} == 1 ]]; then - set -o xtrace - else - set +o xtrace - fi -} - version_gt() { # return true if kubernetes version equal or greater than desired if [ $(echo "${KUBE_VERSION} >= $1" | bc -l) -eq 1 ]; then @@ -208,7 +106,7 @@ create_namespace() { | xargs kubectl delete ns & fi - if [ -n "${OPENSHIFT}" ]; then + if [[ -n "$OPENSHIFT" ]]; then desc 'cleaned up all old namespaces' if [ -n "$OPERATOR_NS" -a $(oc get project "$OPERATOR_NS" -o json | jq -r '.metadata.name') ]; then oc delete --grace-period=0 --force=true project "$namespace" && sleep 120 || : @@ -711,7 +609,7 @@ deploy_vault() { destroy_vault "$name" - if [[ -n ${OPENSHIFT} ]]; then + if [[ -n "$OPENSHIFT" ]]; then oc patch clusterrole system:auth-delegator --type='json' -p '[{"op":"add","path":"/rules/-", "value":{"apiGroups":["security.openshift.io"], "resourceNames": ["privileged"], "resources":["securitycontextconstraints"],"verbs":["use"]}}]' retry 10 60 helm install "$name" hashicorp/vault \ @@ -819,7 +717,7 @@ retry() { wait_for_running() { local name="$1" let last_pod="$(($2 - 1))" || : - local check_cluster_readyness="${3:-true}" + local check_cluster_readiness="${3:-true}" set_debug local rs_name=${name/*-/} @@ -844,9 +742,9 @@ wait_for_running() { done fi sleep 10 - if [[ ${check_cluster_readyness} == "true" ]]; then + if [[ ${check_cluster_readiness} == "true" ]]; then set +x - echo -n "Waiting for cluster readyness" + echo -n "Waiting for cluster ${cluster_name} to be ready" local timeout=0 until [[ $(kubectl_bin get psmdb ${cluster_name} -o jsonpath={.status.state}) == "ready" ]]; do sleep 1 @@ -914,12 +812,9 @@ compare_kubectl() { local expected_result=${test_dir}/compare/${resource//\//_}${postfix}.yml local new_result="${tmp_dir}/${resource//\//_}.yml" - if [ -n "$OPENSHIFT" -a -f ${expected_result//.yml/-oc.yml} ]; then + if [[ -n "$OPENSHIFT" && -f ${expected_result//.yml/-oc.yml} ]]; then desc "OPENSHIFT" expected_result=${expected_result//.yml/-oc.yml} - if [ "$OPENSHIFT" = 4 -a -f ${expected_result//-oc.yml/-4-oc.yml} ]; then - expected_result=${expected_result//-oc.yml/-4-oc.yml} - fi fi kubectl_bin get -o yaml ${resource} \ @@ -933,6 +828,8 @@ compare_kubectl() { del(.spec.template.spec.containers[].env[] | select(.name == "NAMESPACE")) | del(.metadata.selfLink) | del(.metadata.annotations."cloud.google.com/neg") | + del(.metadata.annotations."field.cattle.io/publicEndpoints") | + del(.metadata.annotations."metallb.io/ip-allocated-from-pool") | del(.metadata.annotations."kubectl.kubernetes.io/last-applied-configuration") | del(.. | select(has("image")).image) | del(.. | select(has("clusterIP")).clusterIP) | @@ -1433,6 +1330,11 @@ run_pumba() { } deploy_cert_manager() { + if [[ $PLATFORM == "rancher" ]]; then + log "Rancher cluster detected, skipping cert manager deployment" + return + fi + desc 'deploy cert manager' kubectl_bin -n cert-manager delete clusterissuer --all || : @@ -1506,7 +1408,7 @@ destroy() { delete_crd destroy_cert_manager || true - if [ -n "$OPENSHIFT" ]; then + if [[ -n "$OPENSHIFT" ]]; then oc delete --grace-period=0 --force=true project "$namespace" & if [ -n "$OPERATOR_NS" ]; then oc delete --grace-period=0 --force=true project "$OPERATOR_NS" & @@ -1521,16 +1423,12 @@ destroy() { } destroy_cert_manager() { - kubectl_bin delete -f "https://github.com/cert-manager/cert-manager/releases/download/v${CERT_MANAGER_VER}/cert-manager.yaml" -} + if [[ $PLATFORM == "rancher" ]]; then + log "Rancher cluster detected, skipping cert manager destroy" + return + fi -desc() { - set +o xtrace - local msg="$@" - printf "\n\n-----------------------------------------------------------------------------------\n" - printf "$msg" - printf "\n-----------------------------------------------------------------------------------\n\n" - set_debug + kubectl_bin delete -f "https://github.com/cert-manager/cert-manager/releases/download/v${CERT_MANAGER_VER}/cert-manager.yaml" } get_backup_dest() { @@ -1566,18 +1464,58 @@ get_service_endpoint() { exit 1 } +execute_curl() { + local name="curl-${RANDOM}" + local image="${CURL_IMAGE:-docker.io/alpine/curl:latest}" + + kubectl_bin run "$name" \ + -n "$namespace" \ + --restart=Never \ + --image="$image" \ + --attach \ + --rm \ + --quiet \ + --command -- curl "$@" +} + +curl_metric_values() { + local metric=$1 + local instance=$2 + local endpoint=$3 + local encoded_user_pass=$4 + local start + local end + + start=$($date -u "+%s" -d "-1 minute") + end=$($date -u "+%s") + + execute_curl -s -k \ + "https://${encoded_user_pass}@$endpoint/graph/api/datasources/proxy/1/api/v1/query_range?query=min%28${metric}%7Bnode_name%3D%7E%22${instance}%22%7D%20or%20${metric}%7Bnode_name%3D%7E%22${instance}%22%7D%29&start=${start}&end=${end}&step=60" \ + | jq -r '.data.result[0].values[][1]' \ + | grep '^[0-9]' +} + get_metric_values() { local metric=$1 local instance=$2 local user_pass=$3 - local start=$($date -u "+%s" -d "-1 minute") - local end=$($date -u "+%s") - local endpoint=$(get_service_endpoint monitoring-service) + local endpoint + local encoded_user_pass + + endpoint=$(get_service_endpoint monitoring-service) + encoded_user_pass=$(urlencode_userinfo "$user_pass") + + retry 30 2 curl_metric_values "$metric" "$instance" "$endpoint" "$encoded_user_pass" +} - curl -s -k "https://${user_pass}@$endpoint/graph/api/datasources/proxy/1/api/v1/query_range?query=min%28$metric%7Bnode_name%3D%7E%22$instance%22%7d%20or%20$metric%7Bnode_name%3D%7E%22$instance%22%7D%29&start=$start&end=$end&step=60" \ - | jq '.data.result[0].values[][1]' \ - | grep '^"[0-9]' +curl_qan_values() { + local payload_file=$1 + local endpoint=$2 + local encoded_user_pass=$3 + execute_curl -s -k -XPOST -d "$(cat "$payload_file")" "https://${encoded_user_pass}@$endpoint/v0/qan/GetReport" \ + | jq -r '.rows[].sparkline' \ + | grep -qv '^null$' } get_qan_values() { @@ -1587,9 +1525,11 @@ get_qan_values() { local start local end local endpoint + local encoded_user_pass start=$($date -u -d '-12 hour' '+%Y-%m-%dT%H:%M:%S%:z') end=$($date -u '+%Y-%m-%dT%H:%M:%S%:z') endpoint=$(get_service_endpoint monitoring-service) + encoded_user_pass=$(urlencode_userinfo "$user_pass") cat >payload.json <"$LAST_OUT" 2>"$LAST_ERR" - exit_status=$? - set -e - if [ ${exit_status} != 0 -a -n "${DEBUG_TESTS}" ]; then - cat "$LAST_OUT" - cat "$LAST_ERR" >&2 - sleep "$((timeout * i))" - else - break - fi - done - - cat "$LAST_OUT" - cat "$LAST_ERR" >&2 - rm "$LAST_OUT" "$LAST_ERR" - return ${exit_status} -} - patch_secret() { local secret=$1 local key=$2 @@ -1757,7 +1658,7 @@ wait_cluster_consistency() { retry=0 sleep 7 # wait for two reconcile loops ;) 3 sec x 2 times + 1 sec = 7 seconds - echo -n 'waiting for cluster readyness' + echo -n "waiting for cluster ${cluster_name} to be ready" until [[ "$(kubectl_bin get psmdb "${cluster_name}" -o jsonpath='{.status.state}')" == "ready" ]]; do let retry+=1 if [ $retry -ge $wait_time ]; then @@ -1784,7 +1685,7 @@ run_backup() { | kubectl_bin apply -f - } -function check_backup_deletion_aws() { +check_backup_deletion_aws() { bucket=$(echo "$1" | cut -d'/' -f1) key_prefix=$(echo "$1" | cut -d'/' -f2-) key=$2 @@ -1805,7 +1706,7 @@ function check_backup_deletion_aws() { echo "Backup ${key_prefix}${key} in bucket $bucket not found in $storage_name" } -function check_backup_deletion_oss() { +check_backup_deletion_oss() { bucket=$(echo "$1" | cut -d'/' -f1) key_prefix=$(echo "$1" | cut -d'/' -f2-) key=$2 @@ -1830,7 +1731,7 @@ function check_backup_deletion_oss() { echo "Backup ${key_prefix}${key} in bucket $bucket not found in $storage_name" } -function check_backup_deletion_gcs() { +check_backup_deletion_gcs() { backup_dest_gcp=$1 obj=$2 storage_name="gcp-cs" @@ -1851,7 +1752,7 @@ function check_backup_deletion_gcs() { echo "Backup $gcs_path not found in $storage_name" } -function check_backup_deletion_azure() { +check_backup_deletion_azure() { url_path=$(echo "$1" | sed 's|https://[^/]*\.blob\.core\.windows\.net/||') container=$(echo "$url_path" | cut -d'/' -f1) blob_prefix=$(echo "$url_path" | cut -d'/' -f2-) @@ -1892,7 +1793,7 @@ check_backup_deletion() { done } -function setup_aws_credentials() { +setup_aws_credentials() { local secret_name="aws-s3-secret" if [[ -n $AWS_ACCESS_KEY_ID ]] && [[ -n $AWS_SECRET_ACCESS_KEY ]]; then @@ -1928,7 +1829,7 @@ function setup_aws_credentials() { echo "AWS credentials configured successfully" } -function setup_alibaba_cloud_s3_credentials() { +setup_alibaba_cloud_s3_credentials() { local region=${1:-"us-east-1"} local secret_name="alibaba-cloud-secret" @@ -1960,7 +1861,7 @@ function setup_alibaba_cloud_s3_credentials() { echo "Alibaba Cloud S3-compatible credentials configured successfully" } -function setup_oci_s3_credentials() { +setup_oci_s3_credentials() { local region=${1:-"us-ashburn-1"} local secret_name="oci-secret" @@ -1992,7 +1893,7 @@ function setup_oci_s3_credentials() { echo "OCI S3-compatible credentials configured successfully" } -function setup_gcs_credentials() { +setup_gcs_credentials() { local secret_name="gcp-cs-secret" if gsutil ls >/dev/null 2>&1; then @@ -2038,7 +1939,7 @@ EOF echo "GCS credentials configured successfully" } -function setup_azure_credentials() { +setup_azure_credentials() { local secret_name="azure-secret" echo "Setting up Azure credentials from K8s secret: $secret_name" @@ -2131,7 +2032,7 @@ check_crd_for_deletion() { done } -function get_mongod_ver_from_image() { +get_mongod_ver_from_image() { local image=${1} version_info=$(run_simple_cli_inside_image ${image} 'mongod --version' | $sed -r 's/^.*db version v(([0-9]+\.){2}[0-9]+-[0-9]+).*$/\1/g') @@ -2143,7 +2044,7 @@ function get_mongod_ver_from_image() { echo ${version_info} } -function get_pbm_version() { +get_pbm_version() { local image=${1} local version_info=$(run_simple_cli_inside_image ${image} 'pbm-agent version' | $sed -r 's/^Version:\ (([0-9]+\.){2}[0-9]+)\ .*/\1/g') @@ -2155,7 +2056,7 @@ function get_pbm_version() { echo ${version_info} } -function run_simple_cli_inside_image() { +run_simple_cli_inside_image() { local image=${1} local cli=${2} @@ -2167,7 +2068,7 @@ function run_simple_cli_inside_image() { echo ${output} } -function generate_vs_json() { +generate_vs_json() { local template_path=${1} local target_path=${2} @@ -2255,7 +2156,7 @@ deploy_pmm_server() { helm uninstall monitoring || : helm repo remove stable || : helm repo add stable https://charts.helm.sh/stable - if [[ $OPENSHIFT ]]; then + if [[ -n "$OPENSHIFT" ]]; then oc create sa pmm-server oc adm policy add-scc-to-user privileged -z pmm-server if [[ $OPERATOR_NS ]]; then @@ -2459,6 +2360,14 @@ urlencode() { echo -n "$uri" | jq -s -R -r @uri } +urlencode_userinfo() { + local user_pass="$1" + local username="${user_pass%%:*}" + local password="${user_pass#*:}" + + printf '%s:%s' "$(urlencode "$username")" "$(urlencode "$password")" +} + getUserData() { local secretName=$1 local dataKey=$2 @@ -2683,7 +2592,7 @@ wait_for_oplogs() { done } -function check_backup_existence_aws() { +check_backup_existence_aws() { bucket=$(echo "$1" | cut -d'/' -f1) key_prefix=$(echo "$1" | cut -d'/' -f2-) key=$2 @@ -2710,7 +2619,7 @@ function check_backup_existence_aws() { echo "Backup $bucket/$key_prefix/$key found in $storage_name" } -function check_backup_existence_gcs() { +check_backup_existence_gcs() { backup_dest_gcp=$1 obj=$2 storage_name="gcp-cs" @@ -2732,7 +2641,7 @@ function check_backup_existence_gcs() { echo "Backup $gcs_path found in $storage_name" } -function check_backup_existence_azure() { +check_backup_existence_azure() { url_path=$(echo "$1" | sed 's|https://[^/]*\.blob\.core\.windows\.net/||') container=$(echo "$url_path" | cut -d'/' -f1) blob_prefix=$(echo "$url_path" | cut -d'/' -f2-) @@ -2823,7 +2732,7 @@ check_backup_in_storage() { esac } -function wait_all_pvc_resize() { +wait_all_pvc_resize() { local expected_size=$1 local max_retry=${2:-120} local sleep_time=${3:-5} @@ -2836,7 +2745,7 @@ function wait_all_pvc_resize() { return 0 } -function wait_pvc_resize() { +wait_pvc_resize() { local pvc=$1 local expected_size=$2 local max_retry=${3:-120} @@ -2860,21 +2769,54 @@ function wait_pvc_resize() { return 0 } +setup_rancher_backup_storage() { + local minio_service_name="${1:-minio-service}" + + yq ' + .metadata.name = "minio-secret-longhorn" | + .stringData.AWS_ENDPOINTS = "http://'"${minio_service_name}.${namespace}"'.svc.cluster.local:9000" + ' "${conf_dir}/minio-secret.yml" \ + | kubectl_bin apply -n longhorn-system -f - + + kubectl_bin -n longhorn-system patch backuptargets.longhorn.io default \ + --type=merge \ + -p '{ + "spec": { + "backupTargetURL": "s3://operator-testing@us-east-1/", + "credentialSecret": "minio-secret-longhorn" + } + }' +} + deploy_volume_snapshot_class() { local snapshot_class_file - local k8s_env - k8s_env=$(detect_k8s_env) - case "$k8s_env" in + case "$PLATFORM" in gke) - snapshot_class_file="${conf_dir}/gke-volume-snapshot-class.yaml" + snapshot_class_file="${conf_dir}/volume-snapshot-class-gke.yaml" + ;; + rancher) + setup_rancher_backup_storage + snapshot_class_file="${conf_dir}/volume-snapshot-class-rancher.yaml" ;; *) - echo "Unsupported Kubernetes environment for volume snapshot class: $k8s_env" >&2 + echo "Unsupported Kubernetes environment for volume snapshot class: $PLATFORM" return 1 ;; esac - kubectl_bin apply -f "${snapshot_class_file}" >&2 - yq eval '.metadata.name' "${snapshot_class_file}" + kubectl_bin apply -f "${snapshot_class_file}" +} + +get_volume_snapshot_class() { + kubectl_bin get volumesnapshotclass -o jsonpath='{.items[0].metadata.name}' 2>/dev/null +} + +create_runtime_class() { + kubectl_bin delete runtimeclass container-rc --ignore-not-found + + local handler="runc" + desc "Create RuntimeClass with handler $handler" + yq eval ".handler = \"$handler\"" "$conf_dir/container-rc.yaml" \ + | kubectl_bin apply -f - } diff --git a/e2e-tests/init-deploy/compare/statefulset_another-name-rs0-4-oc.yml b/e2e-tests/init-deploy/compare/statefulset_another-name-rs0-4-oc.yml deleted file mode 100644 index 69610fa1a2..0000000000 --- a/e2e-tests/init-deploy/compare/statefulset_another-name-rs0-4-oc.yml +++ /dev/null @@ -1,342 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: another-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - name: another-name-rs0 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: another-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: another-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - serviceName: another-name-rs0 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: another-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs0 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=keyFile - - --keyFile=/etc/mongodb-secrets/mongodb-key - - --tlsMode=disabled - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: another-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs0 - - name: LOGCOLLECTOR_ENABLED - value: "true" - envFrom: - - secretRef: - name: internal-another-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 500M - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-secrets - name: another-name-mongodb-keyfile - readOnly: true - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: another-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: my-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: my-sidecar-2 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-another-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-another-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs0 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT) - - name: PBM_AGENT_TLS_ENABLED - value: "false" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - - args: - - fluent-bit - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - imagePullPolicy: IfNotPresent - name: logs - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - args: - - logrotate - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-another-name-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-another-name-users - optional: false - imagePullPolicy: IfNotPresent - name: logrotate - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 500M - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 300 - volumes: - - name: another-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: another-name-mongodb-keyfile - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: another-name-rs0-mongod - optional: true - name: config - - name: another-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: another-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: true - secretName: another-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: another-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-another-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/init-deploy/compare/statefulset_another-name-rs0-oc.yml b/e2e-tests/init-deploy/compare/statefulset_another-name-rs0-oc.yml index ae5da6a13a..69610fa1a2 100644 --- a/e2e-tests/init-deploy/compare/statefulset_another-name-rs0-oc.yml +++ b/e2e-tests/init-deploy/compare/statefulset_another-name-rs0-oc.yml @@ -160,6 +160,56 @@ spec: resources: {} terminationMessagePath: /dev/termination-log terminationMessagePolicy: File + - args: + - pbm-agent-entrypoint + command: + - /opt/percona/pbm-entry.sh + env: + - name: PBM_AGENT_MONGODB_USERNAME + valueFrom: + secretKeyRef: + key: MONGODB_BACKUP_USER_ESCAPED + name: internal-another-name-users + optional: false + - name: PBM_AGENT_MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_BACKUP_PASSWORD_ESCAPED + name: internal-another-name-users + optional: false + - name: PBM_MONGODB_REPLSET + value: rs0 + - name: PBM_MONGODB_PORT + value: "27017" + - name: PBM_AGENT_SIDECAR + value: "true" + - name: PBM_AGENT_SIDECAR_SLEEP + value: "5" + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: PBM_MONGODB_URI + value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT) + - name: PBM_AGENT_TLS_ENABLED + value: "false" + imagePullPolicy: Always + name: backup-agent + resources: {} + securityContext: + runAsNonRoot: true + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + volumeMounts: + - mountPath: /etc/mongodb-ssl + name: ssl + readOnly: true + - mountPath: /opt/percona + name: bin + readOnly: true + - mountPath: /data/db + name: mongod-data - args: - fluent-bit command: @@ -237,6 +287,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/init-deploy/run b/e2e-tests/init-deploy/run index 13fa8e2370..c98bf14e35 100755 --- a/e2e-tests/init-deploy/run +++ b/e2e-tests/init-deploy/run @@ -15,14 +15,7 @@ kubectl_bin apply \ -f "$test_dir/conf/secrets_with_tls.yml" \ -f "$conf_dir/client.yml" -desc 'create custom RuntimeClass' -if version_gt "1.19" && [ $EKS -ne 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -elif version_gt "1.24" && [ $EKS -eq 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -else - kubectl_bin apply -f "$conf_dir/container-rc.yaml" -fi +create_runtime_class cluster="some-name-rs0" desc "create first PSMDB cluster $cluster" @@ -158,8 +151,5 @@ echo "found mongod.log and mongod.full.log in /data/db/logs" # desc 'check for passwords leak' # check_passwords_leak -desc 'delete custom RuntimeClass' -kubectl_bin delete -f "$conf_dir/container-rc.yaml" destroy $namespace - desc 'test passed' diff --git a/e2e-tests/ldap-tls/run b/e2e-tests/ldap-tls/run index 615bd37a95..a56d1abd3f 100755 --- a/e2e-tests/ldap-tls/run +++ b/e2e-tests/ldap-tls/run @@ -7,7 +7,7 @@ test_dir=$(realpath "$(dirname "$0")") set_debug deploy_openldap() { - if [[ $OPENSHIFT ]]; then + if [[ -n "$OPENSHIFT" ]]; then yq 'select(.kind=="Deployment").spec.template.spec.containers[0].securityContext.capabilities.drop[0]="ALL" | select(.kind=="Deployment").spec.template.spec.containers[0].securityContext.capabilities.add[0]="NET_BIND_SERVICE" | select(.metadata.name == "ldap-ca").spec.dnsNames[0]="openldap.'$namespace'.svc.cluster.local"' "$test_dir/conf/openldap.yaml" \ diff --git a/e2e-tests/ldap/run b/e2e-tests/ldap/run index a357df0c24..027f891bf9 100755 --- a/e2e-tests/ldap/run +++ b/e2e-tests/ldap/run @@ -7,7 +7,7 @@ test_dir=$(realpath "$(dirname "$0")") set_debug deploy_openldap() { - if [[ $OPENSHIFT ]]; then + if [[ -n "$OPENSHIFT" ]]; then yq 'select(.kind=="Deployment").spec.template.spec.containers[0].securityContext.capabilities.drop[0]="ALL" | select(.kind=="Deployment").spec.template.spec.containers[0].securityContext.capabilities.add[0]="NET_BIND_SERVICE"' "$test_dir/conf/openldap.yaml" \ | kubectl_bin apply -f - diff --git a/e2e-tests/monitoring-2-0/run b/e2e-tests/monitoring-2-0/run index 968ceeb81f..679ed9d32b 100755 --- a/e2e-tests/monitoring-2-0/run +++ b/e2e-tests/monitoring-2-0/run @@ -90,7 +90,7 @@ insert_data_mongos "100700" "myApp" \ "--tlsCertificateKeyFile /tmp/tls.pem --tlsCAFile /etc/mongodb-ssl/ca.crt --tls" "$custom_port" desc 'add PMM_SERVER_API_KEY for secret some-users' -API_KEY=$(curl --insecure -X POST -H "Content-Type: application/json" -d '{"name":"operator", "role": "Admin"}' "https://admin:admin@"$(get_service_endpoint monitoring-service)"/graph/api/auth/keys" | jq .key) +API_KEY=$(execute_curl --insecure -X POST -H "Content-Type: application/json" -d '{"name":"operator", "role": "Admin"}' "https://admin:admin@"$(get_service_endpoint monitoring-service)"/graph/api/auth/keys" | jq .key) kubectl_bin patch secret some-users --type merge --patch '{"stringData": {"PMM_SERVER_API_KEY": '$API_KEY'}}' desc 'check if all 3 Pods started' @@ -159,12 +159,12 @@ kubectl_bin patch psmdb ${cluster} --type json -p='[{"op":"add","path":"/spec/pa wait_for_running $cluster-rs0 3 # get services list from pmm server -curl -s -k -d '{"service_type":"MONGODB_SERVICE"}' "https://admin:admin@"$(get_service_endpoint monitoring-service)"/v1/inventory/Services/List" >${tmp_dir}/pmm_service_list.json +execute_curl -s -k -d '{"service_type":"MONGODB_SERVICE"}' "https://admin:admin@"$(get_service_endpoint monitoring-service)"/v1/inventory/Services/List" >${tmp_dir}/pmm_service_list.json check_custom_cluster_name ${namespace}-${cluster}-mongos-0 ${tmp_dir}/pmm_service_list.json check_custom_cluster_name ${namespace}-${cluster}-rs0-0 ${tmp_dir}/pmm_service_list.json check_custom_cluster_name ${namespace}-${cluster}-cfg-0 ${tmp_dir}/pmm_service_list.json -if [[ -n ${OPENSHIFT} ]]; then +if [[ -n "$OPENSHIFT" ]]; then oc adm policy remove-scc-from-user privileged -z pmm-server if [ -n "$OPERATOR_NS" ]; then oc delete clusterrolebinding pmm-psmdb-operator-cluster-wide diff --git a/e2e-tests/monitoring-pmm3/run b/e2e-tests/monitoring-pmm3/run index 68a1cd4f75..3a093d8b7c 100755 --- a/e2e-tests/monitoring-pmm3/run +++ b/e2e-tests/monitoring-pmm3/run @@ -22,7 +22,8 @@ does_node_id_exists() { admin_pass=$(kubectl_bin get secret pmm-secret -o jsonpath="{.data.PMM_ADMIN_PASSWORD}" | base64 --decode) # The password may contain URL-reserved characters, percent-encode it so it # can be safely embedded in the --server-url userinfo. - admin_pass_encoded=$(jq -rn --arg x "$admin_pass" '$x|@uri') + admin_pass_encoded=$(urlencode "$admin_pass") + for node_id in "${nodeList[@]}"; do nodeList_from_pmm+=($(kubectl_bin exec -n "${namespace}" monitoring-server-0 -- pmm-admin --server-url=https://admin:${admin_pass_encoded}@$(get_pmm_service_ip monitoring-service)/ --server-insecure-tls inventory list nodes --node-type=container | grep $node_id | awk '{print $4}')) done @@ -40,7 +41,7 @@ verify_custom_cluster_name() { endpoint=$(get_service_endpoint monitoring-service) local response - response=$(curl -s -k \ + response=$(execute_curl -s -k \ -H "Authorization: Bearer ${token}" \ "https://$endpoint/v1/inventory/services?service_type=SERVICE_TYPE_MONGODB_SERVICE") @@ -143,7 +144,7 @@ deploy_pmm3_server() { helm repo add percona https://percona.github.io/percona-helm-charts/ helm repo update - if [[ $OPENSHIFT ]]; then + if [[ -n "$OPENSHIFT" ]]; then oc create sa pmm-server oc adm policy add-scc-to-user privileged -z pmm-server if [[ $OPERATOR_NS ]]; then @@ -213,8 +214,8 @@ EOF local wait_count=30 local retry=0 - until [[ "$(curl -s -k -H "Authorization: Bearer ${token}" -XPOST -d @payload.json "https://$endpoint/v1/qan/metrics:getReport" \ - | jq '.rows[].fingerprint')" ]]; do + until [[ "$(execute_curl -s -k -H "Authorization: Bearer ${token}" -XPOST -d "$(cat payload.json)" "https://$endpoint/v1/qan/metrics:getReport" \ + | jq -r '(.rows // [])[]? | .fingerprint // empty')" ]]; do sleep 2 local start=$($date -u "+%s" -d "-1 minute") local end=$($date -u "+%s") @@ -246,7 +247,7 @@ get_metric_values() { local wait_count=30 local retry=0 - until [[ $(curl -s -k -H "Authorization: Bearer ${token}" "https://$endpoint/graph/api/datasources/proxy/1/api/v1/query_range?query=min%28$metric%7Bnode_name%3D%7E%22$instance%22%7d%20or%20$metric%7Bnode_name%3D%7E%22$instance%22%7D%29&start=$start&end=$end&step=60" \ + until [[ $(execute_curl -s -k -H "Authorization: Bearer ${token}" "https://$endpoint/graph/api/datasources/proxy/1/api/v1/query_range?query=min%28$metric%7Bnode_name%3D%7E%22$instance%22%7d%20or%20$metric%7Bnode_name%3D%7E%22$instance%22%7D%29&start=$start&end=$end&step=60" \ | jq '.data.result[0].values[][1]' \ | grep '^"[0-9]') ]]; do sleep 2 @@ -275,7 +276,7 @@ get_pmm_server_token() { fi local create_response create_status_code create_json_response - create_response=$(curl --insecure -s -X POST -H 'Content-Type: application/json' -H 'Accept: application/json' \ + create_response=$(execute_curl --insecure -s -X POST -H 'Content-Type: application/json' -H 'Accept: application/json' \ -d "{\"name\":\"${key_name}\", \"role\":\"Admin\", \"isDisabled\":false}" \ --user "admin:${ADMIN_PASSWORD}" \ "https://$(get_service_endpoint monitoring-service)/graph/api/serviceaccounts" \ @@ -299,7 +300,7 @@ get_pmm_server_token() { fi local token_response token_status_code token_json_response - token_response=$(curl --insecure -s -X POST -H 'Content-Type: application/json' \ + token_response=$(execute_curl --insecure -s -X POST -H 'Content-Type: application/json' \ -d "{\"name\":\"${key_name}\"}" \ --user "admin:${ADMIN_PASSWORD}" \ "https://$(get_service_endpoint monitoring-service)/graph/api/serviceaccounts/${service_account_id}/tokens" \ @@ -335,7 +336,7 @@ delete_pmm_server_token() { local user_credentials="admin:${ADMIN_PASSWORD}" local service_accounts_response service_accounts_status - service_accounts_response=$(curl --insecure -s -X GET --user "${user_credentials}" \ + service_accounts_response=$(execute_curl --insecure -s -X GET --user "${user_credentials}" \ "https://$(get_service_endpoint monitoring-service)/graph/api/serviceaccounts/search" \ -w "\n%{http_code}") @@ -357,7 +358,7 @@ delete_pmm_server_token() { fi local tokens_response tokens_status tokens_json - tokens_response=$(curl --insecure -s -X GET --user "${user_credentials}" \ + tokens_response=$(execute_curl --insecure -s -X GET --user "${user_credentials}" \ "https://$(get_service_endpoint monitoring-service)/graph/api/serviceaccounts/${service_account_id}/tokens" \ -w "\n%{http_code}") @@ -379,7 +380,7 @@ delete_pmm_server_token() { fi local delete_response delete_status - delete_response=$(curl --insecure -s -X DELETE --user "${user_credentials}" \ + delete_response=$(execute_curl --insecure -s -X DELETE --user "${user_credentials}" \ "https://$(get_service_endpoint monitoring-service)/graph/api/serviceaccounts/${service_account_id}/tokens/${token_id}" \ -w "\n%{http_code}") @@ -553,9 +554,9 @@ for instance in "${does_node_id_exists_in_pmm[@]}"; do fi done -if [[ -n ${OPENSHIFT} ]]; then +if [[ -n "$OPENSHIFT" ]]; then oc adm policy remove-scc-from-user privileged -z pmm-server - if [ -n "$OPERATOR_NS" ]; then + if [[ -n "$OPERATOR_NS" ]]; then oc delete clusterrolebinding pmm-psmdb-operator-cluster-wide else oc delete rolebinding pmm-psmdb-operator-namespace-only diff --git a/e2e-tests/multi-cluster-service/run b/e2e-tests/multi-cluster-service/run index 8eea22002f..6cbd47eacf 100755 --- a/e2e-tests/multi-cluster-service/run +++ b/e2e-tests/multi-cluster-service/run @@ -12,7 +12,7 @@ set -o xtrace test_dir=$(realpath $(dirname $0)) . ${test_dir}/../functions -if [ $GKE -ne 1 ]; then +if [[ "$GKE" -ne 1 ]]; then echo "Skip the test. We run it for GKE only" exit 0 fi @@ -111,13 +111,7 @@ kubectl_bin apply \ -f "$conf_dir/client.yml" apply_s3_storage_secrets -if version_gt "1.19" && [ $EKS -ne 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -elif version_gt "1.24" && [ $EKS -eq 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - -else - kubectl_bin apply -f "$conf_dir/container-rc.yaml" -fi +create_runtime_class apply_cluster "$test_dir/conf/$cluster.yml" desc 'check if all 3 Pods started' diff --git a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-cfg-4-oc.yml b/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-cfg-4-oc.yml deleted file mode 100644 index 48fc8e77da..0000000000 --- a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-cfg-4-oc.yml +++ /dev/null @@ -1,275 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - name: some-name-cfg - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - serviceName: some-name-cfg - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - topologyKey: kubernetes.io/hostname - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=cfg - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerIndexPrefixCompression=true - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: cfg - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-secrets - name: some-name-mongodb-keyfile - readOnly: true - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: cfg-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: cfg - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME) - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: some-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-keyfile - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 3Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs0-4-oc.yml b/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs0-4-oc.yml deleted file mode 100644 index d38e1e61ea..0000000000 --- a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs0-4-oc.yml +++ /dev/null @@ -1,275 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - name: some-name-rs0 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - serviceName: some-name-rs0 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs0 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs0 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-secrets - name: some-name-mongodb-keyfile - readOnly: true - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs0 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME) - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: some-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-keyfile - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs0-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs1-4-oc.yml b/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs1-4-oc.yml deleted file mode 100644 index 9d54db6999..0000000000 --- a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs1-4-oc.yml +++ /dev/null @@ -1,275 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs1 - name: some-name-rs1 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs1 - serviceName: some-name-rs1 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs1 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs1 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs1 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-secrets - name: some-name-mongodb-keyfile - readOnly: true - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs1 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME) - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: some-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-keyfile - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs1-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs1-oc.yml b/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs1-oc.yml index 1a038b0f11..9d54db6999 100644 --- a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs1-oc.yml +++ b/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs1-oc.yml @@ -147,6 +147,8 @@ spec: - mountPath: /etc/mongodb-encryption name: some-name-mongodb-encryption-key readOnly: true + - mountPath: /etc/users-secret + name: users-secret-file workingDir: /data/db - args: - pbm-agent-entrypoint @@ -254,6 +256,10 @@ spec: defaultMode: 288 optional: true secretName: some-name-ssl-internal + - name: users-secret-file + secret: + defaultMode: 420 + secretName: internal-some-name-users updateStrategy: type: OnDelete volumeClaimTemplates: diff --git a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs2-4-oc.yml b/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs2-4-oc.yml deleted file mode 100644 index 24742e08a5..0000000000 --- a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs2-4-oc.yml +++ /dev/null @@ -1,285 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs2 - name: some-name-rs2 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs2 - serviceName: some-name-rs2 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs2 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs2 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs2 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-secrets - name: some-name-mongodb-keyfile - readOnly: true - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: rs-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs2 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME) - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: some-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-keyfile - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs2-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs2-oc.yml b/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs2-oc.yml index d2b134c346..24742e08a5 100644 --- a/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs2-oc.yml +++ b/e2e-tests/pitr-physical-backup-source/compare/statefulset_some-name-rs2-oc.yml @@ -147,6 +147,8 @@ spec: - mountPath: /etc/mongodb-encryption name: some-name-mongodb-encryption-key readOnly: true + - mountPath: /etc/users-secret + name: users-secret-file workingDir: /data/db - args: - -c @@ -264,6 +266,10 @@ spec: defaultMode: 288 optional: true secretName: some-name-ssl-internal + - name: users-secret-file + secret: + defaultMode: 420 + secretName: internal-some-name-users updateStrategy: type: OnDelete volumeClaimTemplates: diff --git a/e2e-tests/pitr-physical/compare/statefulset_some-name-cfg-4-oc.yml b/e2e-tests/pitr-physical/compare/statefulset_some-name-cfg-4-oc.yml deleted file mode 100644 index 48fc8e77da..0000000000 --- a/e2e-tests/pitr-physical/compare/statefulset_some-name-cfg-4-oc.yml +++ /dev/null @@ -1,275 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - name: some-name-cfg - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - serviceName: some-name-cfg - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - topologyKey: kubernetes.io/hostname - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=cfg - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerIndexPrefixCompression=true - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: cfg - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-secrets - name: some-name-mongodb-keyfile - readOnly: true - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: cfg-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: cfg - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME) - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: some-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-keyfile - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 3Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs0-4-oc.yml b/e2e-tests/pitr-physical/compare/statefulset_some-name-rs0-4-oc.yml deleted file mode 100644 index d38e1e61ea..0000000000 --- a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs0-4-oc.yml +++ /dev/null @@ -1,275 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - name: some-name-rs0 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - serviceName: some-name-rs0 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs0 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs0 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-secrets - name: some-name-mongodb-keyfile - readOnly: true - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs0 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME) - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: some-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-keyfile - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs0-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs1-4-oc.yml b/e2e-tests/pitr-physical/compare/statefulset_some-name-rs1-4-oc.yml deleted file mode 100644 index 9d54db6999..0000000000 --- a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs1-4-oc.yml +++ /dev/null @@ -1,275 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs1 - name: some-name-rs1 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs1 - serviceName: some-name-rs1 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs1 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs1 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs1 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-secrets - name: some-name-mongodb-keyfile - readOnly: true - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs1 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME) - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: some-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-keyfile - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs1-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs1-oc.yml b/e2e-tests/pitr-physical/compare/statefulset_some-name-rs1-oc.yml index 1a038b0f11..9d54db6999 100644 --- a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs1-oc.yml +++ b/e2e-tests/pitr-physical/compare/statefulset_some-name-rs1-oc.yml @@ -147,6 +147,8 @@ spec: - mountPath: /etc/mongodb-encryption name: some-name-mongodb-encryption-key readOnly: true + - mountPath: /etc/users-secret + name: users-secret-file workingDir: /data/db - args: - pbm-agent-entrypoint @@ -254,6 +256,10 @@ spec: defaultMode: 288 optional: true secretName: some-name-ssl-internal + - name: users-secret-file + secret: + defaultMode: 420 + secretName: internal-some-name-users updateStrategy: type: OnDelete volumeClaimTemplates: diff --git a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs2-4-oc.yml b/e2e-tests/pitr-physical/compare/statefulset_some-name-rs2-4-oc.yml deleted file mode 100644 index 24742e08a5..0000000000 --- a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs2-4-oc.yml +++ /dev/null @@ -1,285 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs2 - name: some-name-rs2 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs2 - serviceName: some-name-rs2 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs2 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs2 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs2 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-secrets - name: some-name-mongodb-keyfile - readOnly: true - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: rs-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs2 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME) - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - name: some-name-mongodb-keyfile - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-keyfile - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs2-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs2-oc.yml b/e2e-tests/pitr-physical/compare/statefulset_some-name-rs2-oc.yml index d2b134c346..24742e08a5 100644 --- a/e2e-tests/pitr-physical/compare/statefulset_some-name-rs2-oc.yml +++ b/e2e-tests/pitr-physical/compare/statefulset_some-name-rs2-oc.yml @@ -147,6 +147,8 @@ spec: - mountPath: /etc/mongodb-encryption name: some-name-mongodb-encryption-key readOnly: true + - mountPath: /etc/users-secret + name: users-secret-file workingDir: /data/db - args: - -c @@ -264,6 +266,10 @@ spec: defaultMode: 288 optional: true secretName: some-name-ssl-internal + - name: users-secret-file + secret: + defaultMode: 420 + secretName: internal-some-name-users updateStrategy: type: OnDelete volumeClaimTemplates: diff --git a/e2e-tests/pitr-sharded/compare/statefulset_some-name-cfg-4-oc.yml b/e2e-tests/pitr-sharded/compare/statefulset_some-name-cfg-4-oc.yml deleted file mode 100644 index 6014112bbd..0000000000 --- a/e2e-tests/pitr-sharded/compare/statefulset_some-name-cfg-4-oc.yml +++ /dev/null @@ -1,269 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - name: some-name-cfg - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - serviceName: some-name-cfg - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - spec: - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app.kubernetes.io/component: cfg - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: cfg - topologyKey: kubernetes.io/hostname - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=cfg - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerIndexPrefixCompression=true - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: cfg - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: cfg-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: cfg - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 3Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-sharded/compare/statefulset_some-name-cfg-oc.yml b/e2e-tests/pitr-sharded/compare/statefulset_some-name-cfg-oc.yml index 7cc3b74085..6014112bbd 100644 --- a/e2e-tests/pitr-sharded/compare/statefulset_some-name-cfg-oc.yml +++ b/e2e-tests/pitr-sharded/compare/statefulset_some-name-cfg-oc.yml @@ -224,6 +224,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs0-4-oc.yml b/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs0-4-oc.yml deleted file mode 100644 index 57e3ff9ae8..0000000000 --- a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs0-4-oc.yml +++ /dev/null @@ -1,268 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - name: some-name-rs0 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - serviceName: some-name-rs0 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs0 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs0 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs0 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs0 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - runtimeClassName: container-rc - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs0-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs0-oc.yml b/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs0-oc.yml index 73d8fd7ac9..57e3ff9ae8 100644 --- a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs0-oc.yml +++ b/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs0-oc.yml @@ -218,6 +218,7 @@ spec: - mountPath: /opt/percona name: bin restartPolicy: Always + runtimeClassName: container-rc schedulerName: default-scheduler securityContext: {} serviceAccount: default diff --git a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs1-4-oc.yml b/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs1-4-oc.yml deleted file mode 100644 index a35f019628..0000000000 --- a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs1-4-oc.yml +++ /dev/null @@ -1,267 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs1 - name: some-name-rs1 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs1 - serviceName: some-name-rs1 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs1 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs1 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs1 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs1 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs1-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs1-oc.yml b/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs1-oc.yml index 529a0ebe6e..a35f019628 100644 --- a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs1-oc.yml +++ b/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs1-oc.yml @@ -144,6 +144,8 @@ spec: - mountPath: /etc/mongodb-encryption name: some-name-mongodb-encryption-key readOnly: true + - mountPath: /etc/users-secret + name: users-secret-file workingDir: /data/db - args: - pbm-agent-entrypoint @@ -246,6 +248,10 @@ spec: defaultMode: 288 optional: true secretName: some-name-ssl-internal + - name: users-secret-file + secret: + defaultMode: 420 + secretName: internal-some-name-users updateStrategy: type: OnDelete volumeClaimTemplates: diff --git a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs2-4-oc.yml b/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs2-4-oc.yml deleted file mode 100644 index c00f1a432c..0000000000 --- a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs2-4-oc.yml +++ /dev/null @@ -1,277 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - annotations: {} - generation: 1 - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs2 - name: some-name-rs2 - ownerReferences: - - controller: true - kind: PerconaServerMongoDB - name: some-name -spec: - podManagementPolicy: OrderedReady - replicas: 3 - revisionHistoryLimit: 10 - selector: - matchLabels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs2 - serviceName: some-name-rs2 - template: - metadata: - annotations: {} - labels: - app.kubernetes.io/component: mongod - app.kubernetes.io/instance: some-name - app.kubernetes.io/managed-by: percona-server-mongodb-operator - app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/part-of: percona-server-mongodb - app.kubernetes.io/replset: rs2 - spec: - containers: - - args: - - --bind_ip_all - - --auth - - --dbpath=/data/db - - --port=27017 - - --replSet=rs2 - - --storageEngine=wiredTiger - - --relaxPermChecks - - --sslAllowInvalidCertificates - - --clusterAuthMode=x509 - - --tlsMode=preferTLS - - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - - --wiredTigerCacheSizeGB=0.25 - - --wiredTigerIndexPrefixCompression=true - - --config=/etc/mongodb-config/mongod.conf - - --quiet - command: - - /opt/percona/ps-entry.sh - env: - - name: SERVICE_NAME - value: some-name - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_REPLSET - value: rs2 - envFrom: - - secretRef: - name: internal-some-name-users - optional: false - imagePullPolicy: Always - livenessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - liveness - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - - --startupDelaySeconds - - "7200" - failureThreshold: 4 - initialDelaySeconds: 60 - periodSeconds: 30 - successThreshold: 1 - timeoutSeconds: 10 - name: mongod - ports: - - containerPort: 27017 - name: mongodb - protocol: TCP - readinessProbe: - exec: - command: - - /opt/percona/mongodb-healthcheck - - k8s - - readiness - - --component - - mongod - - --ssl - - --sslInsecure - - --sslCAFile - - /etc/mongodb-ssl/ca.crt - - --sslPEMKeyFile - - /tmp/tls.pem - failureThreshold: 8 - initialDelaySeconds: 10 - periodSeconds: 3 - successThreshold: 1 - timeoutSeconds: 2 - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /etc/mongodb-ssl-internal - name: ssl-internal - readOnly: true - - mountPath: /etc/mongodb-config - name: config - - mountPath: /opt/percona - name: bin - - mountPath: /.mongodb - name: mongosh - - mountPath: /etc/mongodb-encryption - name: some-name-mongodb-encryption-key - readOnly: true - - mountPath: /etc/users-secret - name: users-secret-file - workingDir: /data/db - - args: - - -c - - while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done - command: - - /bin/sh - imagePullPolicy: Always - name: rs-sidecar-1 - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - - args: - - pbm-agent-entrypoint - command: - - /opt/percona/pbm-entry.sh - env: - - name: PBM_AGENT_MONGODB_USERNAME - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_USER_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_AGENT_MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_BACKUP_PASSWORD_ESCAPED - name: internal-some-name-users - optional: false - - name: PBM_MONGODB_REPLSET - value: rs2 - - name: PBM_MONGODB_PORT - value: "27017" - - name: PBM_AGENT_SIDECAR - value: "true" - - name: PBM_AGENT_SIDECAR_SLEEP - value: "5" - - name: SHARDED - value: "TRUE" - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: PBM_MONGODB_URI - value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true - - name: PBM_AGENT_TLS_ENABLED - value: "true" - imagePullPolicy: Always - name: backup-agent - resources: {} - securityContext: - runAsNonRoot: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /etc/mongodb-ssl - name: ssl - readOnly: true - - mountPath: /opt/percona - name: bin - readOnly: true - - mountPath: /data/db - name: mongod-data - dnsPolicy: ClusterFirst - initContainers: - - command: - - /init-entrypoint.sh - imagePullPolicy: Always - name: mongo-init - resources: - limits: - cpu: 500m - memory: 1G - requests: - cpu: 100m - memory: 100M - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /opt/percona - name: bin - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 60 - volumes: - - emptyDir: {} - name: bin - - emptyDir: {} - name: mongosh - - configMap: - defaultMode: 420 - name: some-name-rs2-mongod - optional: true - name: config - - name: some-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: some-name-mongodb-encryption-key - - name: ssl - secret: - defaultMode: 288 - optional: false - secretName: some-name-ssl - - name: ssl-internal - secret: - defaultMode: 288 - optional: true - secretName: some-name-ssl-internal - - name: users-secret-file - secret: - defaultMode: 420 - secretName: internal-some-name-users - updateStrategy: - type: OnDelete - volumeClaimTemplates: - - metadata: - name: mongod-data - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi - status: - phase: Pending diff --git a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs2-oc.yml b/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs2-oc.yml index 452d2d9e4f..c00f1a432c 100644 --- a/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs2-oc.yml +++ b/e2e-tests/pitr-sharded/compare/statefulset_some-name-rs2-oc.yml @@ -144,6 +144,8 @@ spec: - mountPath: /etc/mongodb-encryption name: some-name-mongodb-encryption-key readOnly: true + - mountPath: /etc/users-secret + name: users-secret-file workingDir: /data/db - args: - -c @@ -256,6 +258,10 @@ spec: defaultMode: 288 optional: true secretName: some-name-ssl-internal + - name: users-secret-file + secret: + defaultMode: 420 + secretName: internal-some-name-users updateStrategy: type: OnDelete volumeClaimTemplates: diff --git a/e2e-tests/pitr-sharded/run b/e2e-tests/pitr-sharded/run index 6c473f514f..40c6cf7c5e 100755 --- a/e2e-tests/pitr-sharded/run +++ b/e2e-tests/pitr-sharded/run @@ -29,19 +29,11 @@ main() { -f "$conf_dir/secrets.yml" \ -f "$conf_dir/client.yml" apply_s3_storage_secrets - - desc 'create custom RuntimeClass' - if version_gt "1.19" && [ $EKS -ne 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - - elif version_gt "1.24" && [ $EKS -eq 1 ]; then - cat "$conf_dir/container-rc.yaml" | $sed 's/docker/runc/g' | kubectl_bin apply -f - - else - kubectl_bin apply -f "$conf_dir/container-rc.yaml" - fi + create_runtime_class cluster="some-name" desc "create first PSMDB cluster $cluster" - if [ $EKS -eq 0 ]; then + if [[ "$EKS" -eq 0 ]]; then apply_cluster $test_dir/conf/$cluster-rs0.yml else apply_cluster $test_dir/conf/eks-$cluster-rs0.yml @@ -73,7 +65,7 @@ main() { wait_backup_agent $cluster-rs2-2 local backup_name - if [ $EKS -eq 0 ]; then + if [[ "$EKS" -eq 0 ]]; then backup_name="backup-minio" else kubectl_bin patch psmdb some-name --type=merge -p '{"spec":{"backup":{"pitr":{"enabled":true}}}}' @@ -97,10 +89,7 @@ main() { check_recovery $backup_name-1 latest "" "-3rd" "$cluster" compare_latest_restorable_time "${cluster}-rs0" "${backup_name}-1" - desc 'delete custom RuntimeClass' - kubectl_bin delete -f "$conf_dir/container-rc.yaml" destroy $namespace - desc 'test passed' } diff --git a/e2e-tests/pvc-auto-resize/compare/statefulset_some-name-rs0-oc.yml b/e2e-tests/pvc-auto-resize/compare/statefulset_some-name-rs0-oc.yml index 7a6f30e808..f524070e91 100644 --- a/e2e-tests/pvc-auto-resize/compare/statefulset_some-name-rs0-oc.yml +++ b/e2e-tests/pvc-auto-resize/compare/statefulset_some-name-rs0-oc.yml @@ -201,6 +201,6 @@ spec: - ReadWriteOnce resources: requests: - storage: 1G + storage: 1Gi status: phase: Pending diff --git a/e2e-tests/pvc-auto-resize/compare/statefulset_some-name-rs0.yml b/e2e-tests/pvc-auto-resize/compare/statefulset_some-name-rs0.yml index 8656b46182..1fe6123d0c 100644 --- a/e2e-tests/pvc-auto-resize/compare/statefulset_some-name-rs0.yml +++ b/e2e-tests/pvc-auto-resize/compare/statefulset_some-name-rs0.yml @@ -203,6 +203,6 @@ spec: - ReadWriteOnce resources: requests: - storage: 1G + storage: 1Gi status: phase: Pending diff --git a/e2e-tests/pvc-auto-resize/conf/some-name-eks.yml b/e2e-tests/pvc-auto-resize/conf/some-name-eks.yml index 7f96298d4e..1db4968200 100644 --- a/e2e-tests/pvc-auto-resize/conf/some-name-eks.yml +++ b/e2e-tests/pvc-auto-resize/conf/some-name-eks.yml @@ -34,7 +34,7 @@ spec: storageClassName: gp2-resizable resources: requests: - storage: 1G + storage: 1Gi size: 3 secrets: users: some-users diff --git a/e2e-tests/pvc-auto-resize/conf/some-name.yml b/e2e-tests/pvc-auto-resize/conf/some-name.yml index 3361f4c47d..c592de425e 100644 --- a/e2e-tests/pvc-auto-resize/conf/some-name.yml +++ b/e2e-tests/pvc-auto-resize/conf/some-name.yml @@ -33,7 +33,7 @@ spec: persistentVolumeClaim: resources: requests: - storage: 1G + storage: 1Gi size: 3 secrets: users: some-users \ No newline at end of file diff --git a/e2e-tests/pvc-auto-resize/run b/e2e-tests/pvc-auto-resize/run index a7748bc5ec..125dc4831b 100755 --- a/e2e-tests/pvc-auto-resize/run +++ b/e2e-tests/pvc-auto-resize/run @@ -110,7 +110,7 @@ function apply_resourcequota() { set_debug -if [ "$EKS" == 1 ]; then +if [[ "$EKS" -eq 1 ]]; then echo "EKS environment detected, creating storageclass for EBS volumes" kubectl_bin apply -f "${test_dir}/conf/eks-storageclass.yml" else @@ -126,7 +126,7 @@ kubectl_bin apply \ desc 'create PSMDB cluster with storageAutoscaling enabled' cluster="some-name" -if [ "$EKS" == 1 ]; then +if [[ "$EKS" -eq 1 ]]; then spinup_psmdb "${cluster}-rs0" "$test_dir/conf/$cluster-eks.yml" else spinup_psmdb "${cluster}-rs0" "$test_dir/conf/$cluster.yml" @@ -160,7 +160,7 @@ wait_cluster_consistency "$cluster" 64 desc 'verify cluster is ready' kubectl_bin get psmdb "${cluster}" -o jsonpath='{.status.state}' | grep -q "ready" -if [[ -n ${OPENSHIFT} || $EKS == 1 ]]; then +if [[ -n "$OPENSHIFT" || "$EKS" -eq 1 ]]; then # On AWS (OpenShift/EKS), EBS volumes can only be expanded once every 6 hours. # Skip the multi-resize quota and maxSize tests since they require # multiple sequential resizes of the same volume. @@ -209,21 +209,18 @@ wait_for_auto_resize "mongod-data-${cluster}-rs0-1" "9Gi" 60 10 wait_for_auto_resize "mongod-data-${cluster}-rs0-2" "9Gi" 60 10 fill_disk_to_threshold "${cluster}-rs0-0" 50 5200 +wait_for_auto_resize "mongod-data-${cluster}-rs0-0" "10Gi" 60 10 +wait_for_auto_resize "mongod-data-${cluster}-rs0-1" "10Gi" 60 10 +wait_for_auto_resize "mongod-data-${cluster}-rs0-2" "10Gi" 60 10 final_size=$(get_pvc_size "mongod-data-${cluster}-rs0-0") -if [[ ${final_size} == "10Gi" ]]; then - echo "PVC correctly stopped at maxSize 10Gi" -elif [[ ${final_size} == "9Gi" ]]; then - echo "PVC is at 9Gi, will resize to 10Gi (maxSize)" - wait_for_auto_resize "mongod-data-${cluster}-rs0-0" "10Gi" 60 10 - wait_for_auto_resize "mongod-data-${cluster}-rs0-1" "10Gi" 60 10 - wait_for_auto_resize "mongod-data-${cluster}-rs0-2" "10Gi" 60 10 -else - echo "WARNING: PVC size is ${final_size}, expected 9Gi or 10Gi" +if [[ ${final_size} != "10Gi" ]]; then + echo "WARNING: PVC size is ${final_size}, expected 10Gi" + exit 1 fi desc 'verify final autoscaling status' -check_autoscaling_status "${cluster}" 4 "mongod-data-${cluster}-rs0-0" "mongod-data-${cluster}-rs0-1" "mongod-data-${cluster}-rs0-2" +check_autoscaling_status "${cluster}" 5 "mongod-data-${cluster}-rs0-0" "mongod-data-${cluster}-rs0-1" "mongod-data-${cluster}-rs0-2" wait_cluster_consistency "$cluster" 64 diff --git a/e2e-tests/pvc-resize/compare/statefulset_some-name-rs0-oc.yml b/e2e-tests/pvc-resize/compare/statefulset_some-name-rs0-oc.yml index dd30fc2e92..ec12ef2aad 100644 --- a/e2e-tests/pvc-resize/compare/statefulset_some-name-rs0-oc.yml +++ b/e2e-tests/pvc-resize/compare/statefulset_some-name-rs0-oc.yml @@ -209,6 +209,6 @@ spec: - ReadWriteOnce resources: requests: - storage: 1G + storage: 1Gi status: phase: Pending diff --git a/e2e-tests/pvc-resize/compare/statefulset_some-name-rs0.yml b/e2e-tests/pvc-resize/compare/statefulset_some-name-rs0.yml index fde1a7a180..98c8224021 100644 --- a/e2e-tests/pvc-resize/compare/statefulset_some-name-rs0.yml +++ b/e2e-tests/pvc-resize/compare/statefulset_some-name-rs0.yml @@ -211,6 +211,6 @@ spec: - ReadWriteOnce resources: requests: - storage: 1G + storage: 1Gi status: phase: Pending diff --git a/e2e-tests/pvc-resize/conf/some-name.yml b/e2e-tests/pvc-resize/conf/some-name.yml index 39f8ceb0ef..93ffc3a55a 100644 --- a/e2e-tests/pvc-resize/conf/some-name.yml +++ b/e2e-tests/pvc-resize/conf/some-name.yml @@ -51,7 +51,7 @@ spec: persistentVolumeClaim: resources: requests: - storage: 1G + storage: 1Gi size: 3 secrets: users: some-users diff --git a/e2e-tests/pvc-resize/run b/e2e-tests/pvc-resize/run index 7b41990c22..e90a3fc6e2 100755 --- a/e2e-tests/pvc-resize/run +++ b/e2e-tests/pvc-resize/run @@ -92,7 +92,7 @@ function wait_pvc_request_revert() { set_debug -if [ "$EKS" == 1 ]; then +if [[ "$EKS" -eq 1 ]]; then echo "EKS environment detected, creating storageclass for EBS volumes" kubectl_bin apply -f "${test_dir}/conf/eks-storageclass.yml" else @@ -108,13 +108,13 @@ kubectl_bin apply \ desc 'create PSMDB cluster' cluster="some-name" -if [ "$EKS" == 1 ]; then +if [[ "$EKS" -eq 1 ]]; then spinup_psmdb "${cluster}-rs0" "$test_dir/conf/$cluster-eks.yml" else spinup_psmdb "${cluster}-rs0" "$test_dir/conf/$cluster.yml" fi -patch_pvc_request "${cluster}" "2G" +patch_pvc_request "${cluster}" "2Gi" wait_cluster_consistency "$cluster" echo @@ -132,13 +132,13 @@ wait_all_pvc_resize "2Gi" echo -if [[ $EKS == 1 || -n ${OPENSHIFT} ]]; then +if [[ "$EKS" -eq 1 || -n "$OPENSHIFT" ]]; then # AWS rate limits PVC expansion for the same EBS volume (1 expand operation in every 6 hours), # so we need to delete and recreate the cluster echo "Deleting and recreating PSMDB cluster ${cluster}" kubectl_bin delete psmdb ${cluster} kubectl_bin apply -f "$conf_dir/secrets.yml" - if [ "$EKS" == 1 ]; then + if [[ "$EKS" -eq 1 ]]; then spinup_psmdb "${cluster}-rs0" "$test_dir/conf/$cluster-eks.yml" else spinup_psmdb "${cluster}-rs0" "$test_dir/conf/$cluster.yml" @@ -157,7 +157,7 @@ desc 'create resourcequota' # handle the error and keep the cluster ready apply_resourcequota 7Gi -patch_pvc_request "${cluster}" "3G" +patch_pvc_request "${cluster}" "3Gi" wait_cluster_consistency "$cluster" echo @@ -166,7 +166,7 @@ wait_pvc_resize "persistentvolumeclaim/mongod-data-some-name-rs0-0" "3Gi" # We're setting the quota to 9Gi, so we can resize all PVCs to 3Gi apply_resourcequota 9Gi -patch_pvc_request "${cluster}" "3G" +patch_pvc_request "${cluster}" "3Gi" wait_cluster_consistency "$cluster" 42 echo @@ -176,15 +176,15 @@ desc "test downscale" # operator shouldn't downscale the PVCs. instead it reverts the storage request # in the spec back to the configured size and keeps the cluster ready -patch_pvc_request "${cluster}" "1G" -wait_pvc_request_revert "${cluster}" "3G" +patch_pvc_request "${cluster}" "1Gi" +wait_pvc_request_revert "${cluster}" "3Gi" wait_cluster_status ${cluster} "ready" -if [[ $EKS == 1 || -n ${OPENSHIFT} ]]; then +if [[ "$EKS" -eq 1 || -n "$OPENSHIFT" ]]; then echo "Deleting and recreating PSMDB cluster ${cluster} to avoid cloud storage resize cooldown" kubectl_bin delete psmdb ${cluster} kubectl_bin apply -f "$conf_dir/secrets.yml" - if [ "$EKS" == 1 ]; then + if [[ "$EKS" -eq 1 ]]; then spinup_psmdb "${cluster}-rs0" "$test_dir/conf/$cluster-eks.yml" else spinup_psmdb "${cluster}-rs0" "$test_dir/conf/$cluster.yml" @@ -206,7 +206,7 @@ wait_for_running ${sts_name} 3 restarted_at_before=$(kubectl_bin get statefulset ${sts_name} -o jsonpath='{.spec.template.metadata.annotations.kubectl\.kubernetes\.io/restartedAt}') [ -z "$restarted_at_before" ] && { echo "ERROR: restartedAt not found"; exit 1; } -patch_pvc_request "${cluster}" "4G" +patch_pvc_request "${cluster}" "4Gi" wait_all_pvc_resize "4Gi" sleep_with_log 30 "wait for StatefulSet recreation after orphan delete during PVC resize" diff --git a/e2e-tests/release_versions b/e2e-tests/release_versions index 859bd06815..3076c463eb 100644 --- a/e2e-tests/release_versions +++ b/e2e-tests/release_versions @@ -17,3 +17,7 @@ AKS_MAX=1.34 OPENSHIFT_MIN=4.17.48 OPENSHIFT_MAX=4.21.1 MINIKUBE_REL=1.35.0 +RKE2_MIN=1.33 +RKE2_MAX=1.35 +RANCHER=2.14.2 +CERT_MANAGER=1.20.2 diff --git a/e2e-tests/security-context/run b/e2e-tests/security-context/run index fd1f06ba9d..a810366200 100755 --- a/e2e-tests/security-context/run +++ b/e2e-tests/security-context/run @@ -13,7 +13,7 @@ kubectl_bin apply -f $conf_dir/secrets.yml -f $conf_dir/client.yml -f $conf_dir/ desc 'create additional service account' kubectl_bin apply -f "$test_dir/conf/service-account.yml" -if [[ -n ${OPENSHIFT} ]]; then +if [[ -n "$OPENSHIFT" ]]; then oc adm policy add-scc-to-user privileged -z percona-server-mongodb-operator-workload if [ -n "$OPERATOR_NS" ]; then oc patch clusterrole/percona-server-mongodb-operator --type json -p='[{"op":"add","path": "/rules/-","value":{"apiGroups":["security.openshift.io"],"resources":["securitycontextconstraints"],"verbs":["use"],"resourceNames":["privileged"]}}]' @@ -41,7 +41,7 @@ wait_for_running "${cluster}-rs0" "3" desc 'check if statefulset created with expected config' compare_kubectl "statefulset/${cluster}-rs0" $postfix -if [[ -n ${OPENSHIFT} ]]; then +if [[ -n "$OPENSHIFT" ]]; then oc adm policy remove-scc-from-user privileged -z percona-server-mongodb-operator-workload fi destroy $namespace diff --git a/e2e-tests/storage/conf/hostpath-helper.yml b/e2e-tests/storage/conf/hostpath-helper.yml index f8d77637be..cd6364f1bd 100644 --- a/e2e-tests/storage/conf/hostpath-helper.yml +++ b/e2e-tests/storage/conf/hostpath-helper.yml @@ -14,11 +14,21 @@ spec: containers: - name: cleanup image: ubuntu - command: ["bash", "-xc", "rm -rf /mnt/run/data-dir /mnt/run/data/fast-disks; install -m 777 -d /mnt/run/data-dir /mnt/run/data/fast-disks && sleep 100500"] + command: + - bash + - -xc + - | + rm -rf /mnt/run/data-dir /mnt/run/data/fast-disks + mkdir -p /mnt/run/data-dir /mnt/run/data/fast-disks + chown 1001:1001 /mnt/run/data-dir /mnt/run/data/fast-disks + chmod 777 /mnt/run/data-dir /mnt/run/data/fast-disks + chcon -R unconfined_u:object_r:svirt_sandbox_file_t:s0 /mnt/run/data-dir /mnt/run/data/fast-disks || true + sleep 100500 volumeMounts: - name: root mountPath: /mnt - securityContext: + securityContext: + privileged: true runAsUser: 0 volumes: - name: root diff --git a/e2e-tests/storage/run b/e2e-tests/storage/run index 4dff4779f6..1f17f789ec 100755 --- a/e2e-tests/storage/run +++ b/e2e-tests/storage/run @@ -6,7 +6,7 @@ test_dir=$(realpath $(dirname $0)) . ${test_dir}/../functions set_debug -if [ -n "${OPENSHIFT}" ]; then +if [[ -n "$OPENSHIFT" ]]; then echo "This test is not supported on OpenShift because hostpath is not allowed by default" exit 0 fi diff --git a/e2e-tests/unsafe-psa/run b/e2e-tests/unsafe-psa/run index dba5d86c16..c81aed5f37 100755 --- a/e2e-tests/unsafe-psa/run +++ b/e2e-tests/unsafe-psa/run @@ -65,7 +65,7 @@ function main() { # PVC resize did not work for PSA deployment and it was fixed in 1.22 if default_sc_allows_expansion; then desc 'resizing PVCs' - patch_pvc_request "$psmdb" "2G" + patch_pvc_request "$psmdb" "2Gi" wait_cluster_consistency "$psmdb" wait_all_pvc_resize "2Gi" else diff --git a/e2e-tests/vars b/e2e-tests/vars new file mode 100644 index 0000000000..548a349bf6 --- /dev/null +++ b/e2e-tests/vars @@ -0,0 +1,135 @@ +#!/usr/bin/env bash + +with_registry() { + local ref="$1" + + case "$ref" in + *.*/*|*:*/*|localhost/*) + printf '%s' "$ref" + ;; + percona/*|perconalab/*) + printf '%s%s' "$REGISTRY_NAME_FULL" "$ref" + ;; + *) + printf '%s' "$ref" + ;; + esac +} + +qualify_image_var() { + local var="$1" + local val="${!var}" + + [[ -z $val ]] && return + + if [[ $val == *$'\n'* ]]; then + local out="" ref + + while IFS= read -r ref; do + [[ -n $ref ]] && out+="$(with_registry "$ref")"$'\n' + done <<<"$val" + + val="${out%$'\n'}" + else + val="$(with_registry "$val")" + fi + + printf -v "$var" '%s' "$val" +} + +detect_k8s_env() { + local provider="unknown" + if kubectl api-resources | grep -q 'openshift.io' 2>/dev/null; then + provider="openshift" + elif kubectl get nodes -o jsonpath='{.items[0].metadata.labels}' 2>/dev/null | grep -q 'eks.amazonaws.com'; then + provider="eks" + elif kubectl get nodes -o jsonpath='{.items[0].metadata.labels}' 2>/dev/null | grep -q 'cloud.google.com/gke'; then + provider="gke" + elif kubectl get nodes -o jsonpath='{.items[0].metadata.labels}' 2>/dev/null | grep -q 'kubernetes.azure.com'; then + provider="aks" + elif kubectl get nodes -o jsonpath='{.items[0].spec.providerID}' 2>/dev/null | grep -qi 'kind://'; then + provider="kind" + elif kubectl get nodes -o jsonpath='{.items[0].spec.providerID}' 2>/dev/null | grep -qi 'minikube'; then + provider="minikube" + elif kubectl get nodes -o jsonpath='{.items[0].spec.providerID}' 2>/dev/null | grep -qi 'rke2'; then + provider="rancher" + fi + + echo "$provider" +} + +setup_logging() { + if [[ ${ENABLE_LOGGING} == true ]]; then + echo "Debug logging enabled. Logs will be saved to $logs_dir/$test_name.log" + mkdir -p "$logs_dir" + exec &> >(tee "$logs_dir/$test_name.log") + echo "Log: $logs_dir/$test_name.log" + else + echo "Debug logging disabled." + fi +} + +# Test variables +export tmp_dir=$(mktemp -d) +export sed=$(command -v gsed || command -v sed) +export date=$(command -v gdate || command -v date) +export test_name=$(basename "$test_dir") +export namespace="${test_name}-${RANDOM}" +export replica_namespace="${test_name}-replica-${RANDOM}" +export conf_dir=$(realpath "$test_dir/../conf" || :) +export src_dir=$(realpath "$test_dir/../..") +export logs_dir="$test_dir/../logs" + +# Git information +export GIT_COMMIT=$(git rev-parse HEAD) +export GIT_BRANCH=${VERSION:-$(git rev-parse --abbrev-ref HEAD | sed -e 's^/^-^g; s^[.]^-^g;' | sed -e 's/_/-/g' | tr '[:upper:]' '[:lower:]')} +export API="psmdb.percona.com/v1" +export OPERATOR_VERSION="$(grep 'crVersion' $(realpath $(dirname ${BASH_SOURCE[0]})/../deploy/cr.yaml) | awk '{print $2}')" + +# Images and registry definitions +export REGISTRY_NAME=${REGISTRY_NAME:-docker.io} +export REGISTRY_NAME_FULL="${REGISTRY_NAME%/}/" +export IMAGE=${IMAGE:-"perconalab/percona-server-mongodb-operator:${GIT_BRANCH}"} +export IMAGE_MONGOD=${IMAGE_MONGOD:-"perconalab/percona-server-mongodb-operator:main-mongod8.0"} +export IMAGE_MONGOD_CHAIN=${IMAGE_MONGOD_CHAIN:-$' +perconalab/percona-server-mongodb-operator:main-mongod6.0 +perconalab/percona-server-mongodb-operator:main-mongod7.0 +perconalab/percona-server-mongodb-operator:main-mongod8.0'} +export IMAGE_SEARCH=${IMAGE_SEARCH:-"perconalab/percona-server-mongodb-operator:main-mongot"} +export IMAGE_BACKUP=${IMAGE_BACKUP:-"perconalab/percona-server-mongodb-operator:main-backup"} +export IMAGE_PMM_CLIENT=${IMAGE_PMM_CLIENT:-"percona/pmm-client:2.44.1-1"} +export IMAGE_PMM_SERVER=${IMAGE_PMM_SERVER:-"perconalab/pmm-server:dev-latest"} +export IMAGE_PMM3_CLIENT=${IMAGE_PMM3_CLIENT:-"perconalab/pmm-client:3-dev-latest"} +export IMAGE_PMM3_SERVER=${IMAGE_PMM3_SERVER:-"perconalab/pmm-server:3-dev-latest"} +export IMAGE_LOGCOLLECTOR=${IMAGE_LOGCOLLECTOR:-"perconalab/fluentbit:main-logcollector"} +export IMAGE_CLUSTERSYNC=${IMAGE_CLUSTERSYNC:-"percona/percona-clustersync-mongodb:0.9.0"} + +for image in \ + IMAGE IMAGE_MONGOD IMAGE_MONGOD_CHAIN IMAGE_BACKUP \ + IMAGE_PMM_CLIENT IMAGE_PMM_SERVER \ + IMAGE_PMM3_CLIENT IMAGE_PMM3_SERVER \ + IMAGE_LOGCOLLECTOR IMAGE_CLUSTERSYNC IMAGE_OPERATOR; do + qualify_image_var "$image" +done + +# Platform information +export KUBE_VERSION=$(kubectl version -o json | jq -r '.serverVersion.major + "." + .serverVersion.minor' | $sed -r 's/[^0-9.]+//g') +export PLATFORM=$(detect_k8s_env) +# Exports GKE, EKS, AKS, OPENSHIFT, KIND, MINIKUBE, RANCHER variables based on detected platform +export "$(echo "${PLATFORM}" | tr '[:lower:]' '[:upper:]')=1" + +# Dependencies versions +export CERT_MANAGER_VER="1.19.3" +export MINIO_VER="5.4.0" +export CHAOS_MESH_VER="2.7.1" +export PMM_SERVER_VER=${PMM_SERVER_VER:-"9.9.9"} +export SKIP_BACKUPS_TO_AWS_GCP_AZURE=${SKIP_BACKUPS_TO_AWS_GCP_AZURE:-1} +export UPDATE_COMPARE_FILES=${UPDATE_COMPARE_FILES:-0} +export DELETE_CRD_ON_START=${DELETE_CRD_ON_START:-1} +export SKIP_DELETE=${SKIP_DELETE:-0} +if [[ -f "$conf_dir/cloud-secret.yml" ]]; then + export SKIP_BACKUPS_TO_AWS_GCP_AZURE='' +fi + +# Test logging +setup_logging