Merge pull request #86 from fedepaol/ocp/bump090922

Upstream bump - 090922

.github/workflows/ci.yaml

@@ -301,7 +301,7 @@ jobs:
           spec:
             logLevel: debug
           EOF
-          sudo -E env "PATH=$PATH" inv e2etest --skip "IPV6|DUALSTACK|metrics" -e /tmp/kind_logs
+          sudo -E env "PATH=$PATH" inv e2etest --skip "IPV6|DUALSTACK|metrics|L2-interface selector" -e /tmp/kind_logs
 
       - name: Collect Logs
         if: ${{ failure() }}

.github/workflows/publish.yaml

@@ -49,6 +49,10 @@ jobs:
 
   publish-images:
     runs-on: ubuntu-20.04
+    needs: [unit-tests]
+    permissions:
+      contents: read
+      id-token: write # needed for signing the images with GitHub OIDC Token
     strategy:
       fail-fast: true
       matrix:
@@ -57,6 +61,11 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: "v1.9.0"
+
       - name: Code checkout
         uses: actions/checkout@v3
 
@@ -86,6 +95,7 @@ jobs:
 
       - name: Build and push ${{ matrix.image }}
         uses: docker/build-push-action@v3
+        id: build-and-push
         with:
           context: .
           tags: ${{ steps.meta.outputs.tags }}
@@ -98,3 +108,56 @@ jobs:
           build-args: |
             GIT_BRANCH: ${{ github.ref_name }}
             GIT_COMMIT: ${{ github.sha }}
+
+      - name: Cosign sign tags
+        run: cosign sign ${TAGS}
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}@${{ steps.build-and-push.outputs.digest }}
+          COSIGN_EXPERIMENTAL: 1
+
+  release-charts:
+    needs: [publish-images]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896
+          fetch-depth: 0
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Chart releaser
+        if: startsWith(github.ref, 'refs/tags/v') # we craft releases only for tags
+        run: |
+          # Download chart releaser
+          curl -sSLo cr.tar.gz "https://github.com/helm/chart-releaser/releases/download/v1.4.0/chart-releaser_1.4.0_linux_amd64.tar.gz"
+          tar -xzf cr.tar.gz
+          rm -f cr.tar.gz
+          repo=$(basename "$GITHUB_REPOSITORY")
+          owner=$(dirname "$GITHUB_REPOSITORY")
+          tag="${GITHUB_REF_NAME:1}"
+
+          exists=$(curl -s -H "Accept: application/vnd.github.v3+json" https://github.com/$GITHUB_REPOSITORY/releases/tag/$repo-chart-$tag -w %{http_code} -o /dev/null)
+          if [[ $exists != "200" ]]; then
+            echo "Creating release..."
+            # package chart
+            ./cr package charts/$repo
+            # upload chart to github releases
+            ./cr upload \
+                --owner "$owner" \
+                --git-repo "$repo" \
+                --release-name-template "{{ .Name }}-chart-{{ .Version }}" \
+                --token "${{ secrets.GITHUB_TOKEN }}"
+            # Update index and push to github pages
+            ./cr index \
+                --owner "$owner" \
+                --git-repo "$repo" \
+                --index-path index.yaml \
+                --release-name-template "{{ .Name }}-chart-{{ .Version }}" \
+                --push
+          else
+            echo "Release already exists"
+          fi

api/v1beta1/l2advertisement_types.go

@@ -35,6 +35,10 @@ type L2AdvertisementSpec struct {
 	// NodeSelectors allows to limit the nodes to announce as next hops for the LoadBalancer IP. When empty, all the nodes having  are announced as next hops.
 	// +optional
 	NodeSelectors []metav1.LabelSelector `json:"nodeSelectors,omitempty"`
+	// A list of interfaces to announce from. The LB IP will be announced only from these interfaces.
+	// If the field is not set, we advertise from all the interfaces on the host.
+	// +optional
+	Interfaces []string `json:"interfaces,omitempty"`
 }
 
 // L2AdvertisementStatus defines the observed state of L2Advertisement.

charts/metallb/README.md

@@ -108,6 +108,7 @@ A network load-balancer implementation for Kubernetes using standard routing pro
 | speaker.frr.image.pullPolicy | string | `nil` |  |
 | speaker.frr.image.repository | string | `"frrouting/frr"` |  |
 | speaker.frr.image.tag | string | `"v7.5.1"` |  |
+| speaker.frr.metricsPort | int | `7473` |  |
 | speaker.image.pullPolicy | string | `nil` |  |
 | speaker.image.repository | string | `"quay.io/metallb/speaker"` |  |
 | speaker.image.tag | string | `nil` |  |

charts/metallb/charts/crds/templates/crds.yaml

@@ -906,6 +906,13 @@ spec:
           spec:
             description: L2AdvertisementSpec defines the desired state of L2Advertisement.
             properties:
+              interfaces:
+                description: A list of interfaces to announce from. The LB IP will
+                  be announced only from these interfaces. If the field is not set,
+                  we advertise from all the interfaces on the host.
+                items:
+                  type: string
+                type: array
               ipAddressPoolSelectors:
                 description: A selector for the IPAddressPools which would get advertised
                   via this advertisement. If no IPAddressPool is selected by this

charts/metallb/templates/speaker.yaml

@@ -345,9 +345,9 @@ spec:
         image: {{ .Values.speaker.frr.image.repository }}:{{ .Values.speaker.frr.image.tag | default .Chart.AppVersion }}
         command: ["/etc/frr_metrics/frr-metrics"]
         args:
-          - --metrics-port=7473
+          - --metrics-port={{ .Values.speaker.frr.metricsPort }}
         ports:
-          - containerPort: 7473
+          - containerPort: {{ .Values.speaker.frr.metricsPort }}
             name: monitoring
         volumeMounts:
           - name: frr-sockets

charts/metallb/templates/webhooks.yaml

@@ -1,7 +1,7 @@
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
-  name: validating-webhook-configuration
+  name: metallb-webhook-configuration
   labels:
     {{- include "metallb.labels" . | nindent 4 }}
 webhooks:

charts/metallb/values.yaml

@@ -311,6 +311,7 @@ speaker:
       repository: frrouting/frr
       tag: v7.5.1
       pullPolicy:
+    metricsPort: 7473
 
     # if set, enables a rbac proxy sidecar container on the speaker to
     # expose the frr metrics via tls.

config/crd/bases/metallb.io_l2advertisements.yaml

@@ -37,6 +37,13 @@ spec:
           spec:
             description: L2AdvertisementSpec defines the desired state of L2Advertisement.
             properties:
+              interfaces:
+                description: A list of interfaces to announce from. The LB IP will
+                  be announced only from these interfaces. If the field is not set,
+                  we advertise from all the interfaces on the host.
+                items:
+                  type: string
+                type: array
               ipAddressPoolSelectors:
                 description: A selector for the IPAddressPools which would get advertised
                   via this advertisement. If no IPAddressPool is selected by this

config/manifests/metallb-frr-prometheus.yaml

@@ -976,6 +976,13 @@ spec:
           spec:
             description: L2AdvertisementSpec defines the desired state of L2Advertisement.
             properties:
+              interfaces:
+                description: A list of interfaces to announce from. The LB IP will
+                  be announced only from these interfaces. If the field is not set,
+                  we advertise from all the interfaces on the host.
+                items:
+                  type: string
+                type: array
               ipAddressPoolSelectors:
                 description: A selector for the IPAddressPools which would get advertised
                   via this advertisement. If no IPAddressPool is selected by this

config/manifests/metallb-frr.yaml

@@ -976,6 +976,13 @@ spec:
           spec:
             description: L2AdvertisementSpec defines the desired state of L2Advertisement.
             properties:
+              interfaces:
+                description: A list of interfaces to announce from. The LB IP will
+                  be announced only from these interfaces. If the field is not set,
+                  we advertise from all the interfaces on the host.
+                items:
+                  type: string
+                type: array
               ipAddressPoolSelectors:
                 description: A selector for the IPAddressPools which would get advertised
                   via this advertisement. If no IPAddressPool is selected by this
@@ -1863,7 +1870,7 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   creationTimestamp: null
-  name: validating-webhook-configuration
+  name: metallb-webhook-configuration
 webhooks:
 - admissionReviewVersions:
   - v1

config/manifests/metallb-native-prometheus.yaml

@@ -976,6 +976,13 @@ spec:
           spec:
             description: L2AdvertisementSpec defines the desired state of L2Advertisement.
             properties:
+              interfaces:
+                description: A list of interfaces to announce from. The LB IP will
+                  be announced only from these interfaces. If the field is not set,
+                  we advertise from all the interfaces on the host.
+                items:
+                  type: string
+                type: array
               ipAddressPoolSelectors:
                 description: A selector for the IPAddressPools which would get advertised
                   via this advertisement. If no IPAddressPool is selected by this

config/manifests/metallb-native.yaml

@@ -976,6 +976,13 @@ spec:
           spec:
             description: L2AdvertisementSpec defines the desired state of L2Advertisement.
             properties:
+              interfaces:
+                description: A list of interfaces to announce from. The LB IP will
+                  be announced only from these interfaces. If the field is not set,
+                  we advertise from all the interfaces on the host.
+                items:
+                  type: string
+                type: array
               ipAddressPoolSelectors:
                 description: A selector for the IPAddressPools which would get advertised
                   via this advertisement. If no IPAddressPool is selected by this
@@ -1653,7 +1660,7 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   creationTimestamp: null
-  name: validating-webhook-configuration
+  name: metallb-webhook-configuration
 webhooks:
 - admissionReviewVersions:
   - v1

config/webhook/kustomization.yaml

@@ -5,3 +5,10 @@ resources:
 
 configurations:
 - kustomizeconfig.yaml
+
+patchesJson6902:
+- path: patches/patch_webhook_configuration.yaml
+  target:
+    version: v1
+    kind: ValidatingWebhookConfiguration
+    name: validating-webhook-configuration

config/webhook/patches/patch_webhook_configuration.yaml

@@ -0,0 +1,4 @@
+- op: replace
+  path: /metadata/name
+  value: metallb-webhook-configuration
+