fix(rook): fix CSI image extraction and install helm in cron-rook-update workflow - #6116
Open
xavpaice wants to merge 4 commits into
Open
fix(rook): fix CSI image extraction and install helm in cron-rook-update workflow#6116xavpaice wants to merge 4 commits into
xavpaice wants to merge 4 commits into
Conversation
Rook's upstream operator.yaml no longer contains the commented ROOK_CSI_*_IMAGE lines that the generate script was grepping for. Starting with newer versions (e.g. v1.20.x), the CSI sidecar images are stored in a ConfigMap as quoted image references, so the grep for '_IMAGE: ' returns no matches and the script exits with code 1. Update the image extraction to pull any quoted image reference from the operator.yaml. This handles both the old commented _IMAGE lines and the new ConfigMap image values, so the generated Manifest includes the CSI sidecar images needed for air-gap installs.
Matches the pattern used by the prometheus and goldpinger update workflows, ensuring the cron-rook-update job has a known Helm version available even if the runner image changes.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Greptile review: the workflow was piping the upstream get-helm-3 script directly to bash in a job that later uses an automation PAT. Replace the pipe-to-bash install with a pinned Helm tarball download and a hardcoded SHA-256 checksum verification so upstream script compromise cannot lead to arbitrary runner execution.
|
Reviews (2): Last reviewed commit: "security(rook): pin Helm version and ver..." | Re-trigger Greptile |
Helm v4 is a new major version with potential breaking changes for chart rendering. Stay on the Helm 3 line with the latest patch (3.21.4) to avoid introducing unrelated behavior changes while still satisfying the security review by pinning a verified binary.
|
Reviews (3): Last reviewed commit: "fixup! security(rook): pin Helm 3.21.4 i..." | Re-trigger Greptile |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the failure in the
cron-rook-updateworkflow run https://github.com/replicatedhq/kURL/actions/runs/32680028352.Diagnosis
The
Create Rook Updatestep exits with code 1 while generating the Rook add-on. The failing part is inaddons/rook/template/generate.sh:This line expects Rook's
operator.yamlto contain commentedROOK_CSI_*_IMAGE:lines that list the CSI sidecar images. Newer Rook versions (e.g. v1.20.x) moved those images into a ConfigMap as quoted image references and removed the old commented_IMAGE:lines, sogrep '_IMAGE: 'returns no matches and exits 1. Withset -euo pipefail, that aborts the whole script.Fix
operator.yaml. This matches both the old commented_IMAGE:lines and the new ConfigMap values, so the generatedManifestincludes the CSI sidecar images required for air-gap installs.update-rook.yamlworkflow, matching theupdate-prometheus.yamlandupdate-goldpinger.yamlworkflows.Verification
I ran the fixed
generate.shin an Ubuntu 24.04 container (the same runner image). It successfully generated the latest Rook version with a completeManifest:I also tested regenerating Rook 1.18.11 with
--forceto confirm the new extraction still works for the olderoperator.yamlformat.