Skip to content

Commit 72af8ae

Browse files
BraisVQangelmp01
BraisVQ
and
angelmp01
authored
Prepare release 4.9.0 (#1346)
* Security improvements (#1328) * Added Helm Opentelemetry Collector infrastructure configuration (#1338) * Update CHANGELOG.md --------- Co-authored-by: Angel MP <angelmp.mail@gmail.com>
1 parent 0113dab commit 72af8ae

File tree

24 files changed

+714
-26
lines changed

24 files changed

+714
-26
lines changed

‎CHANGELOG.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,17 @@
66

77

88
### Changed
9-
9+
- Nexus storage change ([#1341](https://github.com/opendevstack/ods-core/issues/1341))
10+
- Update Aqua cli to 760 ([#1344](https://github.com/opendevstack/ods-core/pull/1344))
1011

1112
### Fixed
1213

1314

15+
## [4.9.0] - 2025-8-06
16+
17+
- Security improvements ([#1328](https://github.com/opendevstack/ods-core/pull/1328))
18+
- Added Helm Opentelemetry Collector Infrastructure configuration (([#1339](https://github.com/opendevstack/ods-core/issues/1339))
19+
1420
## [4.8.0] - 2025-4-10
1521

1622
### Added

‎Makefile

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,22 @@ configure-nexus:
163163
### configure-nexus is not part of install-nexus because it is not idempotent yet.
164164

165165

166+
# OPENTELEMETRY COLLECTOR
167+
## Install or update Opentelemetry Collector.
168+
install-opentelemetry-collector: apply-opentelemetry-collector-chart start-opentelemetry-collector-build
169+
.PHONY: opentelemetry-collector
170+
171+
## Apply OpenShift resources related to the Opentelemetry Collector.
172+
apply-opentelemetry-collector-chart:
173+
cd opentelemetry-collector/chart && envsubst < values.yaml.template > values.yaml && helm upgrade --install --namespace $(ODS_NAMESPACE) opentelemetry-collector . && rm values.yaml
174+
.PHONY: apply-opentelemetry-collector-chart
175+
176+
## Start build of BuildConfig "Opentelemetry Collector".
177+
start-opentelemetry-collector-build:
178+
ocp-scripts/start-and-follow-build.sh --namespace $(ODS_NAMESPACE) --build-config opentelemetry-collector
179+
.PHONY: start-opentelemetry-collector-build
180+
181+
166182
# BACKUP
167183
## Create a backup of the current state.
168184
backup: backup-sonarqube backup-ocp-config

‎configuration-sample/ods-core.env.sample

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -409,3 +409,31 @@ AQUA_ALERT_EMAILS=
409409

410410
# The name of a Nexus repository to store the reports generated by Aqua
411411
AQUA_NEXUS_REPOSITORY=leva-documentation
412+
413+
##########################
414+
# Opentelemety Collector #
415+
##########################
416+
# The docker image used to build the Opentelemetry Collector
417+
OPENTELEMETRY_COLLECTOR_IMAGE=otel/opentelemetry-collector-k8s
418+
419+
# The docker image tag used to build the Opentelemetry Collector
420+
OPENTELEMETRY_COLLECTOR_IMAGE_TAG=0.123.0-amd64
421+
422+
# The Go memory limit for the Opentelemetry Collector
423+
OPENTELEMETRY_COLLECTOR_GOMEMLIMIT=128MiB
424+
425+
# The endpoint to send telemetry data using the OpenTelemetry Protocol (OTLP)
426+
OPENTELEMETRY_COLLECTOR_OTLP_API_ENDPOINT=https://fake-jaeger/v1/traces
427+
428+
# The Authorization Token used to authenticate requests sent to the OTLP_API_ENDPOINT
429+
OPENTELEMETRY_COLLECTOR_OTLP_API_TOKEN=Api-Token fakeJaegerIDToken
430+
431+
# The Host of the Opentelemetry Collector
432+
OPENTELEMETRY_COLLECTOR_INGRESS_HOST=fake.opentelemetry-collector.com
433+
434+
# Resource requests and limits for the Opentelemetry Collector
435+
OPENTELEMETRY_COLLECTOR_CPU_REQUEST=200m
436+
OPENTELEMETRY_COLLECTOR_MEMORY_REQUEST=128Mi
437+
OPENTELEMETRY_COLLECTOR_CPU_LIMIT=1
438+
OPENTELEMETRY_COLLECTOR_MEMORY_LIMIT=256Mi
439+

‎create-projects/Jenkinsfile

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,6 @@ podTemplate(
8080
sh(
8181
script: """./create-projects/create-projects.sh --verbose \
8282
--project=${projectId} \
83-
--admins=${projectAdmins} \
8483
--groups=${projectGroups}""",
8584
label: 'Create OpenShift projects'
8685
)

‎create-projects/create-projects.sh

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -84,14 +84,16 @@ fi
8484

8585
if [ -n "${PROJECT_GROUPS}" ]; then
8686
echo "Seeding special permission groups (${PROJECT_GROUPS}) ..."
87+
88+
cd_usergroup_role="edit-atlassian-team"
89+
usergroup_role="edit"
90+
admingroup_role="admin"
91+
readonlygroup_role="view"
92+
8793
for group in ${PROJECT_GROUPS//,/ }; do
8894
groupName=$(echo "${group}" | cut -d "=" -f1)
8995
groupValue=$(echo "${group}" | cut -d "=" -f2)
9096

91-
usergroup_role="edit"
92-
admingroup_role="admin"
93-
readonlygroup_role="view"
94-
9597
if [ "${groupValue}" == "" ]; then
9698
continue
9799
fi
@@ -101,7 +103,7 @@ if [ -n "${PROJECT_GROUPS}" ]; then
101103
if [[ "${groupName}" == *USERGROUP* ]]; then
102104
oc policy add-role-to-group "${usergroup_role}" "${groupValue}" -n "${PROJECT_ID}-dev"
103105
oc policy add-role-to-group "${usergroup_role}" "${groupValue}" -n "${PROJECT_ID}-test"
104-
oc policy add-role-to-group "${usergroup_role}" "${groupValue}" -n "${PROJECT_ID}-cd"
106+
oc policy add-role-to-group "${cd_usergroup_role}" "${groupValue}" -n "${PROJECT_ID}-cd"
105107
elif [[ "${groupName}" == *ADMINGROUP* ]]; then
106108
oc policy add-role-to-group "${admingroup_role}" "${groupValue}" -n "${PROJECT_ID}-dev"
107109
oc policy add-role-to-group "${admingroup_role}" "${groupValue}" -n "${PROJECT_ID}-test"

‎create-projects/tests/run.sh

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -52,20 +52,16 @@ oc mock --receive 'policy add-role-to-group view system:authenticated -n foo-cd'
5252
oc mock --verify
5353

5454
echo ""
55-
echo "=== create-projects: With admins but no groups ==="
55+
echo "=== create-projects: Without admins and no groups ==="
5656

5757
oc mock --receive='new-project' --times 3
5858

59-
# Expect admins
60-
oc mock --receive 'policy add-role-to-user admin foo.bar@example.com -n foo-cd' --times 1
61-
oc mock --receive 'policy add-role-to-user admin baz.qux@example.com -n foo-cd' --times 1
62-
6359
# Expect default view/edit setup
6460
oc mock --receive 'policy add-role-to-group view system:authenticated -n foo-dev' --times 1
6561
oc mock --receive 'policy add-role-to-group view system:authenticated -n foo-test' --times 1
6662
oc mock --receive 'policy add-role-to-group view system:authenticated -n foo-cd' --times 1
6763

68-
../create-projects.sh --project foo --admins foo.bar@example.com,baz.qux@example.com --groups=
64+
../create-projects.sh --project foo --groups=
6965

7066
oc mock --verify
7167

@@ -81,7 +77,7 @@ oc mock --receive 'policy add-role-to-group view baz -n foo-cd' --times 1
8177

8278
oc mock --receive 'policy add-role-to-group edit foo -n foo-dev' --times 1
8379
oc mock --receive 'policy add-role-to-group edit foo -n foo-test' --times 1
84-
oc mock --receive 'policy add-role-to-group edit foo -n foo-cd' --times 1
80+
oc mock --receive 'policy add-role-to-group edit-atlassian-team foo -n foo-cd' --times 1
8581

8682
oc mock --receive 'policy add-role-to-group admin bar -n foo-dev' --times 1
8783
oc mock --receive 'policy add-role-to-group admin bar -n foo-test' --times 1

‎jenkins/ocp-config/deploy/jenkins-master.yml

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -267,18 +267,6 @@ objects:
267267
name: '${JENKINS_SERVICE_NAME}'
268268
labels:
269269
template: ods-jenkins-template
270-
- apiVersion: authorization.openshift.io/v1
271-
kind: RoleBinding
272-
metadata:
273-
name: '${JENKINS_SERVICE_NAME}_edit'
274-
labels:
275-
template: ods-jenkins-template
276-
roleRef:
277-
name: edit
278-
subjects:
279-
- kind: ServiceAccount
280-
name: '${JENKINS_SERVICE_NAME}'
281-
namespace: '${TAILOR_NAMESPACE}'
282270
- apiVersion: v1
283271
kind: Service
284272
metadata:

‎ods-setup/setup-ods-project.sh

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,141 @@ if ! oc adm policy add-cluster-role-to-user self-provisioner system:serviceaccou
6969
exit 1
7070
fi
7171

72+
# Create a new role 'edit-atlassian-team' without secret-related resources access
73+
if ! oc get clusterrole edit-atlassian-team > /dev/null 2>&1; then
74+
echo "You might not have enough rights to create the new role 'edit-atlassian-team'."
75+
echo "This script needs to be run by a cluster admin."
76+
77+
# Create a temporary file
78+
TEMP_FILE=$(mktemp 2>/dev/null || echo "/tmp/tempfile_$$")
79+
80+
# Get the edit role YAML and rename it
81+
oc get clusterrole edit -o yaml | sed 's/name: edit/name: edit-atlassian-team/' > $TEMP_FILE
82+
83+
# Process the YAML to remove secret-related resources, empty sections, and metadata fields
84+
PROCESSED_FILE=$(mktemp 2>/dev/null || echo "/tmp/tempfile_$$")
85+
86+
awk '
87+
BEGIN {
88+
skip_current_group = 0;
89+
inside_api_group = 0;
90+
api_group_buffer = "";
91+
skip_section = 0;
92+
in_metadata = 0;
93+
contains_secret = 0;
94+
}
95+
96+
# Skip metadata fields and sections
97+
/creationTimestamp:/ || /resourceVersion:/ || /uid:/ {
98+
next;
99+
}
100+
101+
# Detect start of aggregationRule section and skip it
102+
/^aggregationRule:/ {
103+
skip_section = 1;
104+
next;
105+
}
106+
107+
# Detect end of aggregationRule section (when we see apiVersion)
108+
/^apiVersion:/ {
109+
skip_section = 0;
110+
print $0;
111+
next;
112+
}
113+
114+
# Track if we are in metadata section
115+
/^metadata:/ {
116+
in_metadata = 1;
117+
print $0;
118+
next;
119+
}
120+
121+
# Detect start of annotations or labels in metadata and skip them
122+
/^ annotations:/ || /^ labels:/ {
123+
if (in_metadata) {
124+
skip_section = 1;
125+
next;
126+
}
127+
}
128+
129+
# Detect when we leave annotations or labels section (any line with single indent level)
130+
/^ [a-zA-Z]/ {
131+
if (skip_section && in_metadata && $0 !~ /^ annotations:/ && $0 !~ /^ labels:/) {
132+
skip_section = 0;
133+
}
134+
}
135+
136+
# Detect end of metadata section
137+
/^[a-zA-Z]/ && in_metadata && $0 !~ /^metadata:/ {
138+
in_metadata = 0;
139+
}
140+
141+
# Skip lines while in a section we want to skip
142+
{
143+
if (skip_section) {
144+
next;
145+
}
146+
}
147+
148+
# Detect API Groups line
149+
/^- apiGroups:/ {
150+
# If we were previously in an API group, print it if it wasnt being skipped and has no secrets
151+
if (inside_api_group && !skip_current_group && !contains_secret && api_group_buffer != "") {
152+
print api_group_buffer;
153+
}
154+
155+
# Reset variables for new group
156+
inside_api_group = 1;
157+
api_group_buffer = $0;
158+
skip_current_group = 0;
159+
contains_secret = 0;
160+
161+
# Check if this apiGroup itself contains "secret"
162+
if ($0 ~ /secret/ || $0 ~ /external-secrets\.io/) {
163+
skip_current_group = 1;
164+
}
165+
next;
166+
}
167+
168+
# Look for resources section that might contain secrets
169+
/^ resources:/ {
170+
api_group_buffer = api_group_buffer "\n" $0;
171+
next;
172+
}
173+
174+
# Check for secret in resource names
175+
/^ - / && inside_api_group {
176+
# If this resource contains "secret", mark the group for skipping
177+
if ($0 ~ /secret/) {
178+
contains_secret = 1;
179+
}
180+
api_group_buffer = api_group_buffer "\n" $0;
181+
next;
182+
}
183+
184+
# Process all other lines
185+
{
186+
if (inside_api_group) {
187+
# Add to buffer
188+
api_group_buffer = api_group_buffer "\n" $0;
189+
} else {
190+
# Not in an API group, print directly
191+
print $0;
192+
}
193+
}
194+
195+
END {
196+
# Print the last API group if it wasnt being skipped and has no secrets
197+
if (inside_api_group && !skip_current_group && !contains_secret && api_group_buffer != "") {
198+
print api_group_buffer;
199+
}
200+
}' $TEMP_FILE > $PROCESSED_FILE
201+
202+
# Create the role and clean up
203+
oc create -f $PROCESSED_FILE
204+
rm $TEMP_FILE $PROCESSED_FILE
205+
fi
206+
72207
# Create cd-user secret
73208
cd ${SCRIPT_DIR}/ocp-config/cd-user
74209
${TAILOR} -n ${NAMESPACE} apply ${NON_INTERACTIVE} ${REVEAL_SECRETS}

‎opentelemetry-collector/.helmignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎opentelemetry-collector/README.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Opentelemetry Collector
2+
3+
The OpenTelemetry Collector is a vendor-agnostic way to receive, process, and export telemetry data. It supports various data formats and protocols, making it easy to collect and distribute your observability data.
4+
5+
## Setup
6+
7+
The OpenShift templates are located in the chart directory and can be compared with the OC cluster using Helm. For example, run cd chart && helm secrets diff upgrade to see if there is any drift between the current and desired state.
8+
9+
To install the OpenTelemetry Collector, run:
10+
11+
`helm install opentelemetry-collector .`
12+
13+
## Configuration
14+
15+
All the relevant configuration of the Opentelemetry Collector is store in the config map named collector-config in the same namespace where is running the pod.
16+
17+
## Building a new image
18+
19+
Push to this repository, then go to the build config in OC and start a new build.
20+
21+
Aditionally you can run `make start-opentelemetry-collector-build`.
22+

0 commit comments

Comments
 (0)