Merge remote-tracking branch 'origin' into YDBOPS-9679

kobzonega · kobzonega · commit e76ac8056f05 · 2024-09-13T14:25:50.000+07:00
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,5 +1,3 @@
-I hereby agree to the terms of the CLA available at: https://yandex.ru/legal/cla/?lang=en
-
 <!--- Please provide a general summary of your changes in the title above -->
 
 ## Pull request type
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,37 +1,21 @@
 # Notice to external contributors
 
-## How do I start?
+## Common
 
-We try to maintain a small but helpful selection of information on how ydb-k8s-operator is developed and released,
-as well as some details of its architecture. Please, have a look at the [docs folder](./docs/), its README functions
-as a table of content.
+YDB is a free and open project and we appreciate to receive contributions from our community.
 
-## A note on legal terms
+## Contributing code changes
 
-Hello! In order for us to accept patches and other contributions from you, you will have to adopt our Yandex Contributor License Agreement (the “**CLA**”). The current version of the CLA you may find here https://yandex.ru/legal/cla/?lang=en
+If you would like to contribute a new feature or a bug fix, please discuss your idea first on the GitHub issue.
+If there is no issue for your idea, please open one. It may be that somebody is already working on it,
+or that there are some complex obstacles that you should know about before starting the implementation.
+Usually there are several ways to fix a problem and it is important to find the right approach before spending time on a PR
+that cannot be merged.
 
-By adopting the CLA, you state the following:
+## Provide a contribution
 
-* You obviously wish and are willingly licensing your contributions to us for our open source projects under the terms of the CLA,
-* You has read the terms and conditions of the CLA and agree with them in full,
-* You are legally able to provide and license your contributions as stated,
-* We may use your contributions for our open source projects and for any other our project too,
-* We rely on your assurances concerning the rights of third parties in relation to your contributions.
-
-If you agree with these principles, please read and adopt our CLA. By providing us your contributions, you hereby declare that you has already read and adopt our CLA, and we may freely merge your contributions with our corresponding open source project and use it in further in accordance with terms and conditions of the CLA.
-
-## How to agree to CLA
-
-If you are willing to adopt terms and conditions of the CLA, you are able to provide your contributions. When you submit your pull request, please add the following information into it:
-
-```
-I hereby agree to the terms of the CLA available at: [link].
-```
-
-Replace the bracketed text as follows:
-* [link] is the link to the current version of the CLA: https://yandex.ru/legal/cla/?lang=en.
-
-It is enough to provide us such notification once. 
+To make a contribution you should submit a pull request. There will probably be discussion about the pull request and,
+if any changes are needed, we would love to work with you to get your pull request merged.
 
 ## Other questions
 
diff --git a/api/v1alpha1/const.go b/api/v1alpha1/const.go
@@ -30,13 +30,10 @@ const (
 	ConfigDir      = "/opt/ydb/cfg"
 	ConfigFileName = "config.yaml"
 
-	DatabaseEncryptionKeySecretDir  = "encryption"
-	DatabaseEncryptionKeySecretFile = "key.pem"
+	DatabaseEncryptionKeySecretDir  = "database_encryption"
+	DatabaseEncryptionKeySecretFile = "key"
 	DatabaseEncryptionKeyConfigFile = "key.txt"
 
-	DatastreamsIAMServiceAccountKeyDir  = "datastreams"
-	DatastreamsIAMServiceAccountKeyFile = "sa_key.json"
-
 	BinariesDir      = "/opt/ydb/bin"
 	DaemonBinaryName = "ydbd"
 
diff --git a/api/v1alpha1/database_types.go b/api/v1alpha1/database_types.go
@@ -249,9 +249,6 @@ type EncryptionConfig struct {
 type DatastreamsConfig struct {
 	// +required
 	Enabled bool `json:"enabled"`
-
-	// +required
-	IAMServiceAccountKey *corev1.SecretKeySelector `json:"iam_service_account_key,omitempty"`
 }
 
 type DatabaseServices struct {
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/deploy/ydb-operator/Chart.yaml b/deploy/ydb-operator/Chart.yaml
@@ -15,10 +15,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.23
+version: 0.5.25
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.5.23"
+appVersion: "0.5.25"
diff --git a/internal/controllers/storage/controller_test.go b/internal/controllers/storage/controller_test.go
@@ -123,7 +123,7 @@ var _ = Describe("Storage controller medium tests", func() {
 			}, &foundStorage)).Should(Succeed())
 
 			foundConfigurationChecksumAnnotation := false
-			if podAnnotations[annotations.ConfigurationChecksum] == resources.GetConfigurationChecksum(foundStorage.Spec.Configuration) {
+			if podAnnotations[annotations.ConfigurationChecksum] == resources.SHAChecksum(foundStorage.Spec.Configuration) {
 				foundConfigurationChecksumAnnotation = true
 			}
 			Expect(foundConfigurationChecksumAnnotation).To(BeTrue())
diff --git a/internal/resources/database.go b/internal/resources/database.go
@@ -43,7 +43,7 @@ func (b *DatabaseBuilder) GetResourceBuilders(restConfig *rest.Config) []Resourc
 	statefulSetLabels.Merge(map[string]string{labels.StatefulsetComponent: b.Name})
 
 	statefulSetAnnotations := CopyDict(b.Spec.AdditionalAnnotations)
-	statefulSetAnnotations[annotations.ConfigurationChecksum] = GetConfigurationChecksum(b.Spec.Configuration)
+	statefulSetAnnotations[annotations.ConfigurationChecksum] = SHAChecksum(b.Spec.Configuration)
 
 	grpcServiceLabels := databaseLabels.Copy()
 	grpcServiceLabels.Merge(b.Spec.Service.GRPC.AdditionalLabels)
@@ -123,7 +123,7 @@ func (b *DatabaseBuilder) GetResourceBuilders(restConfig *rest.Config) []Resourc
 						api.DatabaseEncryptionKeySecretDir,
 						api.DatabaseEncryptionKeySecretFile,
 					),
-					ID:      b.Name,
+					ID:      SHAChecksum(b.Spec.StorageClusterRef.Name),
 					Pin:     b.Spec.Encryption.Pin,
 					Version: 1,
 				},
diff --git a/internal/resources/database_statefulset.go b/internal/resources/database_statefulset.go
@@ -183,7 +183,6 @@ func (b *DatabaseStatefulSetBuilder) buildVolumes() []corev1.Volume {
 	}
 
 	if b.Spec.Datastreams != nil && b.Spec.Datastreams.Enabled {
-		volumes = append(volumes, b.buildDatastreamsIAMServiceAccountKeyVolume())
 		if b.Spec.Service.Datastreams.TLSConfiguration.Enabled {
 			volumes = append(volumes, buildTLSVolume(datastreamsTLSVolumeName, b.Spec.Service.Datastreams.TLSConfiguration))
 		}
@@ -385,23 +384,6 @@ func (b *DatabaseStatefulSetBuilder) buildEncryptionVolumes() []corev1.Volume {
 	return []corev1.Volume{encryptionKeySecret, encryptionKeyConfig}
 }
 
-func (b *DatabaseStatefulSetBuilder) buildDatastreamsIAMServiceAccountKeyVolume() corev1.Volume {
-	return corev1.Volume{
-		Name: datastreamsIAMServiceAccountKeyVolumeName,
-		VolumeSource: corev1.VolumeSource{
-			Secret: &corev1.SecretVolumeSource{
-				SecretName: b.Spec.Datastreams.IAMServiceAccountKey.Name,
-				Items: []corev1.KeyToPath{
-					{
-						Key:  b.Spec.Datastreams.IAMServiceAccountKey.Key,
-						Path: api.DatastreamsIAMServiceAccountKeyFile,
-					},
-				},
-			},
-		},
-	}
-}
-
 func (b *DatabaseStatefulSetBuilder) buildContainer() corev1.Container {
 	command, args := b.buildContainerArgs()
 	imagePullPolicy := corev1.PullIfNotPresent
@@ -509,11 +491,6 @@ func (b *DatabaseStatefulSetBuilder) buildVolumeMounts() []corev1.VolumeMount {
 	}
 
 	if b.Spec.Datastreams != nil && b.Spec.Datastreams.Enabled {
-		volumeMounts = append(volumeMounts, corev1.VolumeMount{
-			Name:      datastreamsIAMServiceAccountKeyVolumeName,
-			ReadOnly:  true,
-			MountPath: api.DatastreamsIAMServiceAccountKeyDir,
-		})
 		if b.Spec.Service.Datastreams.TLSConfiguration.Enabled {
 			volumeMounts = append(volumeMounts, corev1.VolumeMount{
 				Name:      datastreamsTLSVolumeName,
diff --git a/internal/resources/databasenodeset.go b/internal/resources/databasenodeset.go
@@ -69,7 +69,7 @@ func (b *DatabaseNodeSetResource) GetResourceBuilders(restConfig *rest.Config) [
 	}
 
 	statefulSetAnnotations := CopyDict(b.Spec.AdditionalAnnotations)
-	statefulSetAnnotations[annotations.ConfigurationChecksum] = GetConfigurationChecksum(b.Spec.Configuration)
+	statefulSetAnnotations[annotations.ConfigurationChecksum] = SHAChecksum(b.Spec.Configuration)
 
 	var resourceBuilders []ResourceBuilder
 	resourceBuilders = append(resourceBuilders,
diff --git a/internal/resources/resource.go b/internal/resources/resource.go
@@ -61,7 +61,7 @@ const (
 	wellKnownNameForTLSCertificateAuthority = "ca.crt"
 	wellKnownNameForTLSCertificate          = "tls.crt"
 	wellKnownNameForTLSPrivateKey           = "tls.key"
-	wellKnownNameForEncryptionKeySecret     = "key.pem"
+	wellKnownNameForEncryptionKeySecret     = "key"
 
 	caBundleEnvName         = "CA_BUNDLE"
 	caBundleFileName        = "userCABundle.crt"
@@ -72,9 +72,8 @@ const (
 	localCertsDir  = "/usr/local/share/ca-certificates"
 	systemCertsDir = "/etc/ssl/certs"
 
-	encryptionKeyConfigVolumeName             = "encryption-config"
-	encryptionKeySecretVolumeName             = "encryption-key"
-	datastreamsIAMServiceAccountKeyVolumeName = "datastreams-iam-sa-key"
+	encryptionKeyConfigVolumeName = "encryption-config"
+	encryptionKeySecretVolumeName = "encryption-key"
 )
 
 type ResourceBuilder interface {
@@ -565,9 +564,9 @@ func buildCAStorePatchingCommandArgs(
 	return command, args
 }
 
-func GetConfigurationChecksum(configuration string) string {
+func SHAChecksum(text string) string {
 	hasher := sha256.New()
-	hasher.Write([]byte(configuration))
+	hasher.Write([]byte(text))
 	return hex.EncodeToString(hasher.Sum(nil))
 }
 
diff --git a/internal/resources/storage.go b/internal/resources/storage.go
@@ -36,7 +36,7 @@ func (b *StorageClusterBuilder) GetResourceBuilders(restConfig *rest.Config) []R
 	statefulSetLabels.Merge(map[string]string{labels.StatefulsetComponent: b.Name})
 
 	statefulSetAnnotations := CopyDict(b.Spec.AdditionalAnnotations)
-	statefulSetAnnotations[annotations.ConfigurationChecksum] = GetConfigurationChecksum(b.Spec.Configuration)
+	statefulSetAnnotations[annotations.ConfigurationChecksum] = SHAChecksum(b.Spec.Configuration)
 
 	grpcServiceLabels := storageLabels.Copy()
 	grpcServiceLabels.Merge(b.Spec.Service.GRPC.AdditionalLabels)
diff --git a/internal/resources/storage_init_job.go b/internal/resources/storage_init_job.go
@@ -70,7 +70,7 @@ func GetInitJobBuilder(storage *api.Storage) ResourceBuilder {
 		}
 		if storage.Spec.InitJob.AdditionalAnnotations != nil {
 			jobAnnotations = CopyDict(storage.Spec.InitJob.AdditionalAnnotations)
-			jobAnnotations[annotations.ConfigurationChecksum] = GetConfigurationChecksum(storage.Spec.Configuration)
+			jobAnnotations[annotations.ConfigurationChecksum] = SHAChecksum(storage.Spec.Configuration)
 		}
 	}
 
diff --git a/internal/resources/storagenodeset.go b/internal/resources/storagenodeset.go
@@ -69,7 +69,7 @@ func (b *StorageNodeSetResource) GetResourceBuilders(restConfig *rest.Config) []
 	}
 
 	statefulSetAnnotations := CopyDict(b.Spec.AdditionalAnnotations)
-	statefulSetAnnotations[annotations.ConfigurationChecksum] = GetConfigurationChecksum(b.Spec.Configuration)
+	statefulSetAnnotations[annotations.ConfigurationChecksum] = SHAChecksum(b.Spec.Configuration)
 
 	var resourceBuilders []ResourceBuilder
 	resourceBuilders = append(

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,3 @@`
`1`		`-I hereby agree to the terms of the CLA available at: https://yandex.ru/legal/cla/?lang=en`
`2`		`-`
`3`	`1`	`<!--- Please provide a general summary of your changes in the title above -->`
`4`	`2`
`5`	`3`	`## Pull request type`
Original file line number	Diff line number	Diff line change
`@@ -249,9 +249,6 @@ type EncryptionConfig struct {`
`249`	`249`	`type DatastreamsConfig struct {`
`250`	`250`	`// +required`
`251`	`251`	Enabled bool `json:"enabled"`
`252`		`-`
`253`		`- // +required`
`254`		- IAMServiceAccountKey *corev1.SecretKeySelector `json:"iam_service_account_key,omitempty"`
`255`	`252`	`}`
`256`	`253`
`257`	`254`	`type DatabaseServices struct {`
Original file line number	Diff line number	Diff line change
`@@ -123,7 +123,7 @@ var _ = Describe("Storage controller medium tests", func() {`
`123`	`123`	`}, &foundStorage)).Should(Succeed())`
`124`	`124`
`125`	`125`	`foundConfigurationChecksumAnnotation := false`
`126`		`- if podAnnotations[annotations.ConfigurationChecksum] == resources.GetConfigurationChecksum(foundStorage.Spec.Configuration) {`
	`126`	`+ if podAnnotations[annotations.ConfigurationChecksum] == resources.SHAChecksum(foundStorage.Spec.Configuration) {`
`127`	`127`	`foundConfigurationChecksumAnnotation = true`
`128`	`128`	`}`
`129`	`129`	`Expect(foundConfigurationChecksumAnnotation).To(BeTrue())`
Original file line number	Diff line number	Diff line change
`@@ -69,7 +69,7 @@ func (b DatabaseNodeSetResource) GetResourceBuilders(restConfig rest.Config) [`
`69`	`69`	`}`
`70`	`70`
`71`	`71`	`statefulSetAnnotations := CopyDict(b.Spec.AdditionalAnnotations)`
`72`		`- statefulSetAnnotations[annotations.ConfigurationChecksum] = GetConfigurationChecksum(b.Spec.Configuration)`
	`72`	`+ statefulSetAnnotations[annotations.ConfigurationChecksum] = SHAChecksum(b.Spec.Configuration)`
`73`	`73`
`74`	`74`	`var resourceBuilders []ResourceBuilder`
`75`	`75`	`resourceBuilders = append(resourceBuilders,`