Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduce tinkerbell essentials #600

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions packages/core/platform/bundles/distro-full.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -199,3 +199,10 @@ releases:
namespace: cozy-keycloak
optional: true
dependsOn: [keycloak]

- name: tinkerbell
releaseName: tinkerbell
chart: cozy-tinkerbell
namespace: cozy-tinkerbell
optional: true
dependsOn: [cilium,kubeovn]
Comment on lines +203 to +208
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codebase verification

Cross-bundle dependency issue detected

Tinkerbell in distro-full.yaml declares a dependency on KubeOVN, but KubeOVN is defined in a separate bundle (paas-full.yaml) with no visible mechanism to combine these bundles. This could lead to deployment failures if the bundles are deployed independently, as there's no guarantee KubeOVN will be available when Tinkerbell requires it.

  • packages/core/platform/bundles/distro-full.yaml: Tinkerbell depends on KubeOVN
  • packages/core/platform/bundles/paas-full.yaml: KubeOVN is defined here, but no connection to distro-full bundle
🔗 Analysis chain

Verify dependency order for Tinkerbell deployment.

The dependencies look correct, but let's verify that kubeovn is properly listed in the bundle and deployed before Tinkerbell.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Check if kubeovn is defined in the bundle
rg "name: kubeovn" packages/core/platform/bundles/

Length of output: 114


Script:

#!/bin/bash
# Check for imports/includes of paas-full in distro-full
rg -A 5 "paas-full" packages/core/platform/bundles/distro-full.yaml

# Get complete context of kubeovn configuration
rg -B 2 -A 5 "name: kubeovn" packages/core/platform/bundles/paas-full.yaml

Length of output: 297


Script:

#!/bin/bash
# Look for any bundle composition or import mechanisms in yaml files
rg -l "import|include|compose|bundle" packages/core/platform/bundles/

# Check if there are any other references to these bundles
rg -l "distro-full|paas-full" packages/core/platform/

Length of output: 173

7 changes: 7 additions & 0 deletions packages/core/platform/bundles/paas-full.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -281,6 +281,13 @@ releases:
optional: true
dependsOn: [cilium,kubeovn]

- name: tinkerbell
releaseName: tinkerbell
chart: cozy-tinkerbell
namespace: cozy-tinkerbell
optional: true
dependsOn: [cilium,kubeovn]

{{- if $oidcEnabled }}
- name: keycloak
releaseName: keycloak
Expand Down
3 changes: 3 additions & 0 deletions packages/system/tinkerbell/Chart.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
apiVersion: v2
name: cozy-tinkerbell
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
16 changes: 16 additions & 0 deletions packages/system/tinkerbell/Makefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
export NAME=tinkerbell
export NAMESPACE=cozy-$(NAME)

include ../../../scripts/package.mk

update:
rm -rf charts
mkdir -p charts
cd charts && \
tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/tinkerbell/charts | awk -F'[/^]' 'END{print $$3}') && \
curl -sSL https://github.com/tinkerbell/charts/archive/refs/tags/$${tag}.tar.gz | \
tar xzvf - --strip 2 charts-$${tag#*v}/tinkerbell
Comment on lines +10 to +12
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Add version pinning and checksum verification.

Downloading the latest tag without version pinning could lead to unexpected breaking changes. Consider:

  1. Pinning to specific versions
  2. Adding checksum verification for security
-	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/tinkerbell/charts  | awk -F'[/^]' 'END{print $$3}') && \
-	curl -sSL https://github.com/tinkerbell/charts/archive/refs/tags/$${tag}.tar.gz | \
+	tag="v1.2.3" && \ # Replace with your desired version
+	expected_sha256="abc123..." && \ # Replace with actual checksum
+	curl -sSL https://github.com/tinkerbell/charts/archive/refs/tags/$${tag}.tar.gz -o charts.tar.gz && \
+	echo "$${expected_sha256} charts.tar.gz" | sha256sum -c && \
+	tar xzvf charts.tar.gz --strip 2 charts-$${tag#*v}/tinkerbell && \
+	rm charts.tar.gz

Committable suggestion skipped: line range outside the PR's diff.

find charts -maxdepth 1 -mindepth 1 ! -name tink -and ! -name smee -and ! -name rufio -exec rm -rf {} \;
mkdir -p charts/smee/crds
mv charts/tink/crds/hardware-crd.yaml charts/smee/crds
rm -rf charts/tink
25 changes: 25 additions & 0 deletions packages/system/tinkerbell/charts/rufio/Chart.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
apiVersion: v2
name: rufio
description: Rufio handles BMC interactions for Tinkerbell
icon: https://github.com/tinkerbell/artwork/blob/6f07de53d75cb8932dbc7d14201e038cf3a3b230/Tinkerbell-Icon-Dark.png

# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application

# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.4.0

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "0.6.1"
Original file line number Diff line number Diff line change
@@ -0,0 +1,166 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.16.4
name: jobs.bmc.tinkerbell.org
spec:
group: bmc.tinkerbell.org
names:
categories:
- tinkerbell
kind: Job
listKind: JobList
plural: jobs
shortNames:
- j
singular: job
scope: Namespaced
versions:
- name: v1alpha1
schema:
openAPIV3Schema:
description: Job is the Schema for the bmcjobs API.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: JobSpec defines the desired state of Job.
properties:
machineRef:
description: |-
MachineRef represents the Machine resource to execute the job.
All the tasks in the job are executed for the same Machine.
properties:
name:
description: Name of the Machine.
type: string
namespace:
description: Namespace the Machine resides in.
type: string
required:
- name
- namespace
type: object
tasks:
description: |-
Tasks represents a list of baseboard management actions to be executed.
The tasks are executed sequentially. Controller waits for one task to complete before executing the next.
If a single task fails, job execution stops and sets condition Failed.
Condition Completed is set only if all the tasks were successful.
items:
description: |-
Action represents the action to be performed.
A single task can only perform one type of action.
For example either PowerAction or OneTimeBootDeviceAction.
maxProperties: 1
properties:
oneTimeBootDeviceAction:
description: OneTimeBootDeviceAction represents a baseboard
management one time set boot device operation.
properties:
device:
description: |-
Devices represents the boot devices, in order for setting one time boot.
Currently only the first device in the slice is used to set one time boot.
items:
description: BootDevice represents boot device of the
Machine.
type: string
type: array
efiBoot:
description: EFIBoot instructs the machine to use EFI boot.
type: boolean
required:
- device
type: object
powerAction:
description: PowerAction represents a baseboard management power
operation.
enum:
- "on"
- "off"
- soft
- status
- cycle
- reset
type: string
virtualMediaAction:
description: VirtualMediaAction represents a baseboard management
virtual media insert/eject.
properties:
kind:
type: string
mediaURL:
description: |-
mediaURL represents the URL of the image to be inserted into the virtual media, or empty to
eject media.
type: string
required:
- kind
type: object
type: object
minItems: 1
type: array
required:
- machineRef
- tasks
type: object
status:
description: JobStatus defines the observed state of Job.
properties:
completionTime:
description: |-
CompletionTime represents time when the job was completed.
The completion time is only set when the job finishes successfully.
format: date-time
type: string
conditions:
description: Conditions represents the latest available observations
of an object's current state.
items:
properties:
message:
description: Message represents human readable message indicating
details about last transition.
type: string
status:
description: |-
Status is the status of the Job condition.
Can be True or False.
type: string
type:
description: Type of the Job condition.
type: string
required:
- status
- type
type: object
type: array
startTime:
description: StartTime represents time when the Job controller started
processing a job.
format: date-time
type: string
type: object
type: object
served: true
storage: true
subresources:
status: {}
Loading
Loading