Test PR

.dmtlint.yaml

@@ -0,0 +1,316 @@
+warnings-only:
+  - images
+linters-settings:
+  probes:
+    probes-excludes:
+      d8-istio:
+        - kube-rbac-proxy
+        - operator
+        - istio-proxy
+        - metadata-discovery
+      d8-chrony:
+        - chrony
+      d8-admission-policy-engine:
+        - constraint-exporter
+        - kube-rbac-proxy
+      d8-cert-manager:
+        - kube-rbac-proxy
+        - cainjector
+        - cert-manager
+      d8-cni-cilium:
+        - frontend
+        - backend
+        - kube-rbac-proxy
+        - pause-check-linux-kernel
+        - pause-cilium
+        - pause-kube-rbac-proxy
+        - operator
+      d8-cni-flannel:
+        - kube-flannel
+        - wait-memcached
+      d8-cloud-provider-aws:
+        - node-termination-handler
+        - kube-rbac-proxy
+      d8-cloud-provider-azure:
+        - kube-rbac-proxy
+      d8-cloud-provider-gcp:
+        - kube-rbac-proxy
+      d8-cloud-provider-yandex:
+        - kube-rbac-proxy
+      d8-cloud-provider-vsphere:
+        - kube-rbac-proxy
+      d8-cni-simple-bridge:
+        - simple-bridge
+      kube-system:
+        - kube-rbac-proxy
+        - image-holder-etcd
+        - image-holder-kube-apiserver-healthcheck
+        - image-holder-kube-apiserver129
+        - image-holder-kube-controller-manager129
+        - image-holder-kube-scheduler129
+        - coredns
+        - deckhouse
+        - handler
+        - iptables-loop
+        - admission-controller
+        - recommender
+        - updater
+        - kube-proxy
+        - backup
+      d8-system:
+        - kube-rbac-proxy
+        - web
+        - kube-router
+        - deckhouse
+        - handler
+      d8-ingress-nginx:
+        - kruise
+      d8-l2-load-balancer:
+        - controller
+        - kube-rbac-proxy
+      d8-metallb:
+        - kube-rbac-proxy
+        - controller
+      d8-monitoring:
+        - kube-rbac-proxy
+        - kubelet-eviction-thresholds-exporter
+        - node-exporter
+        - monitoring-ping
+        - prometheus-metrics-adapter
+        - image-availability-exporter
+        - dashboard-provisioner
+        - grafana
+        - exporter
+      d8-network-gateway:
+        - snat
+        - dhcp
+      d8-operator-prometheus:
+        - kube-rbac-proxy
+        - prometheus-operator
+      d8-operator-trivy:
+        - kube-rbac-proxy
+        - report-updater
+      d8-pod-reloader:
+        - kube-rbac-proxy
+      d8-runtime-audit-engine:
+        - rules-loader
+      d8-snapshot-controller:
+        - kube-rbac-proxy
+        - snapshot-controller
+        - snapshot-validation
+      d8-static-routing-manager:
+        - agent
+      d8-upmeter:
+        - agent
+        - kube-rbac-proxy
+        - smoke-mini-a
+        - smoke-mini-b
+        - smoke-mini-c
+        - smoke-mini-d
+        - smoke-mini-e
+        - smoke-mini
+      dex-authenticator-namespace:
+        - redis
+      test-namespace:
+        - redis
+      d8-okmeter:
+        - okagent
+      d8-openvpn:
+        - kube-rbac-proxy
+        - openvpn-tcp
+        - ovpn-admin
+      d8-dashboard:
+        - dashboard
+        - metrics-scraper
+        - api
+        - auth
+        - web
+      d8-service-with-healthchecks:
+        - agent
+        - controller
+        - kube-rbac-proxy
+      d8-user-authz:
+        - user-authz-webhook
+        - webhook
+      d8-cloud-provider-dynamix:
+        - kube-rbac-proxy
+      d8-cloud-provider-huaweicloud:
+        - kube-rbac-proxy
+      d8-cloud-provider-openstack:
+        - kube-rbac-proxy
+      d8-cloud-provider-vcd:
+        - kube-rbac-proxy
+      d8-cloud-provider-zvirt:
+        - kube-rbac-proxy
+      d8-cloud-instance-manager:
+        - controller
+        - reserve-resources
+  openapi:
+    enum-file-excludes:
+      - prometheus:/openapi/values.yaml:
+          - "properties.internal.properties.grafana.properties.alertsChannelsConfig.properties.notifiers.items.properties.type"
+      - admission-policy-engine:/openapi/values.yaml:
+          - "properties.internal.properties.podSecurityStandards.properties.enforcementActions.items"
+      - ceph-csi:/openapi/values.yaml:
+          - "properties.internal.properties.crs.items.properties.spec.properties.rbd.properties.storageClasses.items.properties.defaultFSType"
+      - cloud-provider-aws:/openapi/config-values.yaml:
+          - "properties.storageClass.properties.provision.items.properties.type"
+          - "properties.storageClass.properties.provision.items.oneOf[*].properties.type"
+      - cloud-provider-aws:/openapi/values.yaml:
+          - "properties.internal.properties.storageClasses.items.oneOf[*].properties.type"
+      - cloud-provider-azure:/openapi/config-values.yaml:
+          - "properties.storageClass.properties.provision.items.properties.type"
+      - cni-flannel:/openapi/values.yaml:
+          - "properties.internal.properties.podNetworkMode"
+      - metallb:/openapi/config-values.yaml:
+          - "properties.addressPools.items.properties.protocol"
+      - node-manager:/openapi/config-values.yaml:
+          - "properties.allowedBundles.items"
+      - kube-dns:/openapi/values.yaml:
+          - "properties.internal.properties.specificNodeType"
+      - descheduler:/openapi/values.yaml:
+          - "properties.internal.properties.deschedulers.items.properties.strategies.properties.removePodsViolatingNodeAffinity.properties.nodeAffinityType.items"
+      - cloud-provider-dynamix:/openapi/values.yaml:
+          - "properties.internal.properties.providerClusterConfiguration.properties.apiVersion"
+          - "properties.internal.properties.providerDiscoveryData.properties.apiVersion"
+      - cloud-provider-huaweicloud:/openapi/values.yaml:
+          - "properties.internal.properties.providerClusterConfiguration.properties.apiVersion"
+          - "properties.internal.properties.providerDiscoveryData.properties.apiVersion"
+      - cloud-provider-openstack:/openapi/values.yaml:
+          - "properties.internal.properties.discoveryData.properties.apiVersion"
+      - cloud-provider-vcd:/openapi/values.yaml:
+          - "properties.internal.properties.discoveryData.properties.apiVersion"
+          - "properties.internal.properties.providerDiscoveryData.properties.apiVersion"
+          - "properties.internal.properties.providerClusterConfiguration.properties.apiVersion"
+      - cloud-provider-zvirt:/openapi/values.yaml:
+          - "properties.internal.properties.providerClusterConfiguration.properties.apiVersion"
+          - "properties.internal.properties.providerDiscoveryData.properties.apiVersion"
+      - cloud-provider-vsphere:/openapi/config-values.yaml:
+#        Have to be fixed in https://github.com/deckhouse/deckhouse/issues/11294
+        - "properties.storageClass.properties.compatibilityFlag"
+      - cloud-provider-vsphere:/openapi/values.yaml:
+        - "properties.internal.properties.providerClusterConfiguration.properties.apiVersion"
+        - "properties.internal.properties.providerDiscoveryData.properties.apiVersion"
+    ha-absolute-keys-excludes:
+      - "user-authn:/openapi/config-values.yaml": "properties.publishAPI.properties.https"
+  nocyrillic:
+    no-cyrillic-file-excludes:
+      - user-authz:/rbac.yaml
+      - documentation:/images/web/site/_data/topnav.yml
+      - documentation:/images/docs-builder/modules-docs/hugo.yaml
+  license:
+    copyright-excludes:
+      - upmeter:/images/upmeter/stress.sh
+      - cni-simple-bridge:/images/simple-bridge/rootfs/bin/simple-bridge
+      - monitoring-applications:/applications/consul/placeholder
+      - monitoring-applications:/applications/fluentd/placeholder
+      - monitoring-applications:/applications/grafana/placeholder
+      - monitoring-applications:/applications/minio/placeholder
+      - monitoring-applications:/applications/nginx/placeholder
+      - monitoring-applications:/applications/trickster/placeholder
+    skip-oss-checks:
+      - basic-auth
+      - cloud-provider-aws
+      - cloud-provider-azure
+      - cloud-provider-gcp
+      - cloud-provider-yandex
+      - deckhouse-tools
+      - documentation
+      - flow-schema
+      - kube-proxy
+      - monitoring-applications
+      - monitoring-custom
+      - monitoring-ping
+      - multitenancy-manager
+      - network-gateway
+      - node-local-dns
+      - okmeter
+      - registry-packages-proxy
+      - secret-copier
+      - static-routing-manager
+      - upmeter
+      - user-authz
+      - cni-simple-bridge
+      - extended-monitoring
+      - namespace-configurator
+      - service-with-healthchecks
+      - cloud-provider-dynamix
+      - cloud-provider-huaweicloud
+      - cloud-provider-openstack
+      - cloud-provider-vcd
+      - cloud-provider-zvirt
+      - cloud-provider-vsphere
+  rbac:
+    skip-check-wildcards:
+      - "admission-policy-engine/templates/rbac-for-us.yaml":
+          - "d8:admission-policy-engine:gatekeeper"
+      - "deckhouse/templates/webhook-handler/rbac-for-us.yaml":
+          - "d8:deckhouse:webhook-handler"
+      - "okmeter/templates/rbac-for-us.yaml":
+          - "d8:okmeter"
+      - "operator-prometheus/templates/rbac-for-us.yaml":
+          - "d8:operator-prometheus"
+      - "prometheus-metrics-adapter/templates/rbac-for-us.yaml":
+          - "d8:prometheus-metrics-adapter:horizontal-pod-autoscaler-external-metrics"
+      - "upmeter/templates/upmeter-agent/rbac-for-us.yaml":
+          - "d8:upmeter:upmeter-agent"
+          - "upmeter-agent"
+      - "upmeter/templates/upmeter/rbac-for-us.yaml":
+          - "d8:upmeter:upmeter"
+      - "vertical-pod-autoscaler/templates/rbac-for-us.yaml":
+          - "d8:vertical-pod-autoscaler:controllers-reader"
+      - "istio/templates/multicluster/api-proxy/rbac-for-us.yaml":
+          - "d8:istio:multicluster:api-proxy"
+    skip-object-check-binding:
+      - deckhouse
+      - node-manager
+      - user-authz
+  container:
+    skip-containers:
+      - "okmeter:okagent"
+      - "d8-control-plane-manager:*image-holder*"
+      - "d8-system:init-downloaded-modules"
+      - "node-local-dns:coredns"
+      - "deckhouse:init-downloaded-modules"
+      - "documentation:builder"
+      - "kiali:kiali"
+      - "aggregating-proxy:wait-memcached"
+      - "upmeter-agent:chown-volume-data"
+      - "d8-kube-dns-sts-pods-hosts-appender-webhook:webhook"
+      - "caps-controller-manager:caps-controller-manager"
+      - "standby-holder-name:reserve-resources"
+  monitoring:
+    skip-module-checks:
+      - "extended-monitoring"
+      - "cloud-provider-yandex"
+  k8s_resources:
+    skip-container-checks:
+      - "cloud-controller-manager"
+      - "istiod"
+      - "kiali"
+      - "node-local-dns"
+      - "dashboard"
+      - "dashboard-metrics-scraper"
+      - "metrics-scraper"
+      - "api"
+      - "api-proxy"
+      - "auth"
+      - "d8-control-plane-apiserver"
+      - "d8-kube-dns-sts-pods-hosts-appender-webhook"
+      - "ingressgateway"
+      - "smoke-mini-a"
+      - "smoke-mini-b"
+      - "smoke-mini-c"
+      - "smoke-mini-d"
+      - "smoke-mini-e"
+      - "web"
+      - "metadata-exporter"
+      - "prometheus-pp"
+      - "standby-holder-name"
+      - "machine-controller-manager"
+    skip-vpa-checks:
+      - "d8-system:deckhouse"
+      - "d8-cloud-instance-manager:node-manager"
+      - "d8-okmeter:okmeter"
+    skip-pdb-checks:
+      - "d8-cloud-instance-manager:node-manager"

.github/ci_includes/werf_envs.yml

@@ -19,7 +19,7 @@ WERF_LOG_TERMINAL_WIDTH: "200"
 SOURCE_REPO: "${{secrets.SOURCE_REPO_GIT}}"
 # cloud providers source repo should contain creds for repo for ex https://user:password@my-repo.com/group
 CLOUD_PROVIDERS_SOURCE_REPO: "${{secrets.CLOUD_PROVIDERS_SOURCE_REPO}}"
-GOPROXY: "${{secrets.GOPROXY}}"
+GOPROXY: "${{vars.GOPROXY}}"
 # observability source repo should contain creds for repo for ex https://user:password@my-repo.com/group
 OBSERVABILITY_SOURCE_REPO: "${{secrets.OBSERVABILITY_SOURCE_REPO}}"
 # Next two are required for accessing the stronghold repo during d8 cli builds.

.github/ci_templates/e2e_tests.yml

@@ -551,7 +551,7 @@ check_e2e_labels:
 {!{- end }!}
 
     - name: Cleanup bootstrapped cluster
-      if: {!{ coll.Has $ctx "manualRun" | test.Ternary "success()" "always()" }!}
+      if: {!{ coll.Has $ctx "manualRun" | test.Ternary "inputs.autodelete||success()" "always()" }!}
       id: cleanup_cluster
       timeout-minutes: 60
       env:

.github/ci_templates/tests.yml

@@ -5,13 +5,6 @@ docker_options: '-w /deckhouse -v ${{github.workspace}}:/deckhouse -e "TERM=xter
 # <template: unit_run_args>
 {!{- end -}!}
 
-{!{ define "matrix_run_args" }!}
-# <template: matrix_run_args>
-args: 'make tests-matrix'
-docker_options: '-w /deckhouse -v ${{github.workspace}}:/deckhouse -e "TERM=xterm-256color" -v ~/go-pkg-cache:/go/pkg -v ~/deckhouse-bin-cache:/deckhouse/bin'
-# </template: matrix_run_args>
-{!{- end -}!}
-
 {!{ define "dhctl_run_args" }!}
 # <template: dhctl_run_args>
 args: 'make ci'
@@ -114,3 +107,16 @@ steps:
       make tests-webhooks
 # </template: tests_webhooks_template>
 {!{- end -}!}
+
+{!{ define "tests_dmt_lint" }!}
+# <template: tests_dmt_lint>
+{!{- $ctx       := index . 0 }!}
+runs-on: [self-hosted, regular]
+steps:
+{!{ tmpl.Exec "started_at_output"       $ctx | strings.Indent 2 }!}
+{!{ tmpl.Exec "checkout_full_step"      $ctx | strings.Indent 2 }!}
+  - name: DMT lint
+    run: |
+      make dmt-lint
+# </template: tests_dmt_lint>
+{!{- end -}!}