Skip to content

Commit 4308535

Browse files
pengzhoumlpengzhouml
authored
Merge pull request #280 from marklogic/develop
Merge develop to 2.0.0 release
2 parents 5e371ec + a4579a1 commit 4308535

14 files changed

+195
-166
lines changed

‎README.md

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ Following table lists all the parameters supported by the latest MarkLogic Helm
124124
| `image.pullPolicy` | Image pull policy for MarkLogic image | `IfNotPresent` |
125125
| `initContainers.configureGroup.image` | Image for configureGroup InitContainer | `curlimages/curl:8.8.0` |
126126
| `initContainers.configureGroup.pullPolicy` | Pull policy for configureGroup InitContainer | `IfNotPresent` |
127-
| `initContainers.utilContainer.image` | Image for copyCerts and volume permission change for root to rootless upgrade InitContainer | `redhat/ubi9:9.3` |
127+
| `initContainers.utilContainer.image` | Image for copyCerts and volume permission change for root to rootless upgrade InitContainer | `redhat/ubi9:9.4` |
128128
| `initContainers.utilContainer.pullPolicy` | Pull policy for copyCerts and volume permission change for root to rootless upgrade InitContainer | `IfNotPresent` |
129129
| `imagePullSecrets` | Registry secret names as an array | `[]` |
130130
| `hugepages.enabled` | Parameter to enable Hugepage on MarkLogic | `false` |
@@ -170,14 +170,14 @@ Following table lists all the parameters supported by the latest MarkLogic Helm
170170
| `containerSecurityContext.enabled` | Parameter to enable security context for MarkLogic containers | `true` |
171171
| `containerSecurityContext.runAsUser` | User ID to run the entrypoint of the container process | `1000` |
172172
| `containerSecurityContext.runAsNonRoot` | Indicates that the container must run as a non-root user | `true` |
173-
| `containerSecurityContext.allowPrivilegeEscalation` | Controls whether a process can gain more privileges than its parent process | `true` |
173+
| `containerSecurityContext.allowPrivilegeEscalation` | Controls whether a process can gain more privileges than its parent process | `false` |
174174
| `livenessProbe.enabled` | Parameter to enable the liveness probe | `true` |
175175
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for liveness probe | `300` |
176176
| `livenessProbe.periodSeconds` | Period seconds for liveness probe | `10` |
177177
| `livenessProbe.timeoutSeconds` | Timeout seconds for liveness probe | `5` |
178178
| `livenessProbe.failureThreshold` | Failure threshold for liveness probe | `15` |
179179
| `livenessProbe.successThreshold` | Success threshold for liveness probe | `1` |
180-
| `readinessProbe.enabled` | Parameter to enable the readiness probe | `false` |
180+
| `readinessProbe.enabled` | Parameter to enable the readiness probe | `true` |
181181
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readiness probe | `10` |
182182
| `readinessProbe.periodSeconds` | Period seconds for readiness probe | `10` |
183183
| `readinessProbe.timeoutSeconds` | Timeout seconds for readiness probe | `5` |
@@ -234,12 +234,9 @@ Following table lists all the parameters supported by the latest MarkLogic Helm
234234

235235
## Known Issues and Limitations
236236

237-
1. If the hostname is greater than 64 characters there will be issues with certificates. It is highly recommended to use hostname shorter than 64 characters or use SANs for hostnames in the certificates.
238-
2. The MarkLogic Docker image must be run in privileged mode. At the moment if the image isn't run as privileged many calls that use sudo during the startup script will fail due to lack of required permissions as the image will not be able to create a user with the required permissions.
239-
3. The latest released version of CentOS 7 has known security vulnerabilities with respect to glib2 CVE-2016-3191, CVE-2015-8385, CVE-2015-8387, CVE-2015-8390, CVE-2015-8394, CVE-2016-3191, glibc CVE-2019-1010022, pcre CVE-2015-8380, CVE-2015-8387, CVE-2015-8390, CVE-2015-8393, CVE-2015-8394, SQLite CVE-2019-5827. These libraries are included in the CentOS base image but, to-date, no fixes have been made available. Even though these libraries may be present in the base image that is used by MarkLogic Server, they are not used by MarkLogic Server itself, hence there is no impact or mitigation required.
240-
4. The latest released version of fluent/fluent-bit:2.2.2 has known security vulnerabilities with respect to libcom-err2 CVE-2022-1304, libgcrypt20 CVE-2021-33560, libgnutls30 CVE-2024-0567, libldap-2.4-2 CVE-2023-2953, libzstd1 CVE-2022-4899, zlib1g CVE-2023-45853. These libraries are included in the Debian base image but, to-date, no fixes have been made available. For libpq5 CVE-2024-0985, we wait for a future upgrade of the fluent-bit image to include the fix. We will provide updates and mitigation strategies as soon as more information becomes available.
241-
5. The latest released version of redhat/ubi9:9.3 has known security vulnerabilities with respect to setuptools GHSA-r9hx-vwmv-q579. We wait for a future upgrade of the redhad ubi image to include the fix.
242-
6. The security context “allowPrivilegeEscalation” is set to TRUE by default in values.yaml file and cannot be changed to run the current MarkLogic container. Work is in progress to run MarkLogic container in "rootless" mode.
243-
7. Known Issues and Limitations for the MarkLogic Server Docker image can be viewed using the link: https://github.com/marklogic/marklogic-docker?tab=readme-ov-file#Known-Issues-and-Limitations
244-
8. The Readiness and Startup Probe are not compatible with HA deployment. At the moment these probes may fail in the case of Security database failover. As of the 1.0.2 helm chart release, the startup and readiness probes are disabled by default.
245-
9. Path based routing and Ingress features are only supported with MarkLogic 11.1 and higher.
237+
1. If the hostname is greater than 64 characters there will be issues with certificates. It is highly recommended to use hostname shorter than 64 characters or use SANs for hostnames in the certificates. If you still choose to use hostname greater than 64 characters, set "allowLongHostnames" to true.
238+
2. The latest released version of fluent/fluent-bit:3.1.1 has known high and critical security vulnerabilities. If you decide to enable the log collection feature, choose and deploy the fluent-bit or an alternate image with no vulnerabilities as per your requirements.
239+
3. The security context “allowPrivilegeEscalation” is set to false by default in the
240+
values.yaml file. This should not be changed when running the MarkLogic container with default rootless image. If you choose to use an image with root privileges, set "allowPrivilegeEscalation" to true.
241+
4. Known Issues and Limitations for the MarkLogic Server Docker image can be viewed using the link: https://github.com/marklogic/marklogic-docker?tab=readme-ov-file#Known-Issues-and-Limitations.
242+
5. Path-based routing and Ingress features are only supported with MarkLogic 11.1 and higher.

‎charts/templates/configmap-scripts.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -588,7 +588,7 @@ data:
588588
response_code=$( \
589589
curl -s --anyauth \
590590
--user ${MARKLOGIC_ADMIN_USERNAME}:${MARKLOGIC_ADMIN_PASSWORD} \
591-
-w '%{http_code}' \
591+
-w '%{http_code}' --retry 5 \
592592
-X PUT \
593593
-H "Content-type: application/json" \
594594
$LOCAL_HTTPS_OPTION -d "${group_cfg}" \
@@ -613,11 +613,11 @@ data:
613613
info "creating group for other Helm Chart"
614614
615615
# Create a group if group is not already exits
616-
GROUP_RESP_CODE=$( curl --anyauth -m 20 -s -o /dev/null -w "%{http_code}" $HTTPS_OPTION -X GET $HTTP_PROTOCOL://${MARKLOGIC_BOOTSTRAP_HOST}:8002/manage/v2/groups/${MARKLOGIC_GROUP} --anyauth --user ${MARKLOGIC_ADMIN_USERNAME}:${MARKLOGIC_ADMIN_PASSWORD} )
616+
GROUP_RESP_CODE=$( curl --anyauth --retry 5 -m 20 -s -o /dev/null -w "%{http_code}" $HTTPS_OPTION -X GET $HTTP_PROTOCOL://${MARKLOGIC_BOOTSTRAP_HOST}:8002/manage/v2/groups/${MARKLOGIC_GROUP} --anyauth --user ${MARKLOGIC_ADMIN_USERNAME}:${MARKLOGIC_ADMIN_PASSWORD} )
617617
if [[ ${GROUP_RESP_CODE} -eq 200 ]]; then
618618
info "Skipping creation of group $MARKLOGIC_GROUP as it already exists on the MarkLogic cluster."
619619
else
620-
res_code=$(curl --anyauth --user ${MARKLOGIC_ADMIN_USERNAME}:${MARKLOGIC_ADMIN_PASSWORD} $HTTPS_OPTION -m 20 -s -w '%{http_code}' -X POST -d "${group_cfg}" -H "Content-type: application/json" $HTTP_PROTOCOL://${MARKLOGIC_BOOTSTRAP_HOST}:8002/manage/v2/groups)
620+
res_code=$(curl --anyauth --retry 5 --user ${MARKLOGIC_ADMIN_USERNAME}:${MARKLOGIC_ADMIN_PASSWORD} $HTTPS_OPTION -m 20 -s -w '%{http_code}' -X POST -d "${group_cfg}" -H "Content-type: application/json" $HTTP_PROTOCOL://${MARKLOGIC_BOOTSTRAP_HOST}:8002/manage/v2/groups)
621621
if [[ ${res_code} -eq 201 ]]; then
622622
log "Info: [initContainer] Successfully configured group $MARKLOGIC_GROUP on the MarkLogic cluster."
623623
else

‎charts/values.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ initContainers:
5454
image: "curlimages/curl:8.8.0"
5555
pullPolicy: IfNotPresent
5656
utilContainer:
57-
image: "redhat/ubi9:9.3"
57+
image: "redhat/ubi9:9.4"
5858
pullPolicy: IfNotPresent
5959

6060
## Configure the imagePullSecrets to pull the image from private repository that requires credential

‎makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ upgrade-test: prepare
220220
image-scan:
221221

222222
@echo "=====Scan dependent Docker images in charts/values.yaml" $(if $(saveOutput), | tee -a dep-image-scan.txt,)
223-
@for depImage in $(shell grep -E "^.*\bimage:\s+(.*)" charts/values.yaml | sed 's/image: //g' | sed 's/"//g'); do\
223+
@for depImage in $(shell grep -E "^\s*\bimage:\s+(.*)" charts/values.yaml | sed 's/image: //g' | sed 's/"//g'); do\
224224
echo " - $${depImage}" $(if $(saveOutput), | tee -a dep-image-scan.txt,) ; \
225225
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock anchore/grype:latest $${depImage} | grep 'High\|Critical' $(if $(saveOutput), | tee -a dep-image-scan.txt,);\
226226
echo $(if $(saveOutput), | tee -a dep-image-scan.txt,) ;\

‎test/e2e/backup_restore_test.go

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -100,21 +100,35 @@ func RunRequests(t *testing.T, client *req.Client, dbReq string, hostsEndpoint s
100100
var retryFn = (func(resp *req.Response, err error) bool {
101101
if err != nil {
102102
t.Fatalf(err.Error())
103+
return true
104+
}
105+
if resp == nil || resp.Body == nil {
106+
t.Fatalf("error in getting response body")
107+
return true
103108
}
104109
body, err = io.ReadAll(resp.Body)
105110
if err != nil {
106-
t.Fatalf(err.Error())
111+
t.Fatalf("error reading response body, %s", err.Error())
112+
return true
107113
}
108114
result = (string(body))
109-
return true
115+
return false
110116
})
111117

112118
if operation == "backup-status" {
113119
retryFn = (func(resp *req.Response, err error) bool {
114120
if err != nil {
115121
t.Fatalf(err.Error())
116122
}
117-
body, _ := io.ReadAll(resp.Body)
123+
if resp == nil || resp.Body == nil {
124+
t.Fatalf("error in getting response body")
125+
return true
126+
}
127+
body, err := io.ReadAll(resp.Body)
128+
if body == nil || err != nil {
129+
t.Fatalf("error reading response body")
130+
return true
131+
}
118132
status = (gjson.Get(string(body), `status`)).Str
119133
if status != "completed" {
120134
fmt.Println("Waiting for backup to be completed")

‎test/e2e/clustering_test.go

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -131,20 +131,16 @@ func TestClusterJoin(t *testing.T) {
131131
SetRetryCount(5).
132132
SetRetryFixedInterval(10 * time.Second).
133133
AddRetryCondition(func(resp *req.Response, err error) bool {
134-
if resp == nil || err != nil {
134+
if err != nil {
135135
t.Logf("error in AddRetryCondition: %s", err.Error())
136136
return true
137137
}
138-
if resp.Response == nil {
139-
t.Log("Could not get the Response Object, Retrying...")
140-
return true
141-
}
142-
if resp.Body == nil {
143-
t.Log("Could not get the body for the response, Retrying...")
138+
if resp == nil || resp.Body == nil {
139+
t.Log("Could not get the Response Body, Retrying...")
144140
return true
145141
}
146142
body, err := io.ReadAll(resp.Body)
147-
if body == nil || err != nil {
143+
if err != nil {
148144
t.Logf("error in read response body: %s", err.Error())
149145
return true
150146
}

0 commit comments

Comments
 (0)