Repository navigation
69 integration with proxmox paas proxmox bundle - #1924
Conversation
Introduce a new "External IPs" sidebar and associated dashboard factory to display services of type LoadBalancer. Signed-off-by: Kirill Ilin <[email protected]>
Signed-off-by: Kirill Ilin <[email protected]>
… dashboard Signed-off-by: Kirill Ilin <[email protected]>
## What this PR does This patch enables the `offline_access` scope for the dashbord keycloak client, so that users get a refresh token which gatekeeper can use to automatically refresh an expiring access token. Also session timeouts were increased. ### Release note ```release-note [dashboard] Increase session timeouts, add the offline_access scope, enable refresh tokens to improve the overall user experience when working with the dashboard. ``` Signed-off-by: Timofei Larkin <[email protected]>
<!-- Thank you for making a contribution! Here are some tips for you: - Start the PR title with the [label] of Cozystack component: - For system components: [platform], [system], [linstor], [cilium], [kube-ovn], [dashboard], [cluster-api], etc. - For managed apps: [apps], [tenant], [kubernetes], [postgres], [virtual-machine] etc. - For development and maintenance: [tests], [ci], [docs], [maintenance]. - If it's a work in progress, consider creating this PR as a draft. - Don't hesistate to ask for opinion and review in the community chats, even if it's still a draft. - Add the label `backport` if it's a bugfix that needs to be backported to a previous version. --> ## What this PR does Fixes filtering pods on Pods tab of Service details page ### Release note <!-- Write a release note: - Explain what has changed internally and for users. - Start with the same [label] as in the PR title - Follow the guidelines at https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md. --> ```release-note [dashboard] Fix filtering pods on Pods tab for Service ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected label selector field name in pod details table configuration to ensure proper label filtering functionality. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
cozystack#1912) <!-- Thank you for making a contribution! Here are some tips for you: - Start the PR title with the [label] of Cozystack component: - For system components: [platform], [system], [linstor], [cilium], [kube-ovn], [dashboard], [cluster-api], etc. - For managed apps: [apps], [tenant], [kubernetes], [postgres], [virtual-machine] etc. - For development and maintenance: [tests], [ci], [docs], [maintenance]. - If it's a work in progress, consider creating this PR as a draft. - Don't hesistate to ask for opinion and review in the community chats, even if it's still a draft. - Add the label `backport` if it's a bugfix that needs to be backported to a previous version. --> ## What this PR does Add labels and selectors for Service and Ingress resources to correctly show them in corresponding tabs for Kubernetes app in dashboard ### Release note <!-- Write a release note: - Explain what has changed internally and for users. - Start with the same [label] as in the PR title - Follow the guidelines at https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md. --> ```release-note [kubernetes] show Ingress and Service resources in dashboard ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Introduced standardized metadata labels across Kubernetes application resources including cloud configuration, ingress, and service components to improve resource organization, tracking, identification, and multi-tenant environment management * Extended the system's resource management framework to include and manage additional Kubernetes infrastructure components, such as ingress-nginx, enhancing overall cluster orchestration and service networking capabilities <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…#1908) Introduce a new "External IPs" sidebar and associated dashboard factory to display services of type LoadBalancer. <!-- Thank you for making a contribution! Here are some tips for you: - Start the PR title with the [label] of Cozystack component: - For system components: [platform], [system], [linstor], [cilium], [kube-ovn], [dashboard], [cluster-api], etc. - For managed apps: [apps], [tenant], [kubernetes], [postgres], [virtual-machine] etc. - For development and maintenance: [tests], [ci], [docs], [maintenance]. - If it's a work in progress, consider creating this PR as a draft. - Don't hesistate to ask for opinion and review in the community chats, even if it's still a draft. - Add the label `backport` if it's a bugfix that needs to be backported to a previous version. --> ## What this PR does Add External IPs tab to sidebar with all `Service` resources of type `LoadBalancer` in tenant ### Release note <!-- Write a release note: - Explain what has changed internally and for users. - Start with the same [label] as in the PR title - Follow the guidelines at https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md. --> ```release-note [dashboard] add External IPs tab with `Service` resources of type `LoadBalancer` ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added External IPs menu item in the Administration section for quick access to load balancer services * Introduced a new dashboard view displaying external IPs with tabbed interface for enhanced visibility <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Andrei Kvapil <[email protected]>
Signed-off-by: Andrei Kvapil <[email protected]>
The cozystack-operator's manager cache is filtered to only include specific secrets and namespaces with certain labels. This caused telemetry collection to fail because resources like kube-system namespace, nodes, services, and PVs were not in the cache. Switch to using mgr.GetAPIReader() which bypasses the cache and queries the API server directly. This is appropriate for telemetry since it only runs every 15 minutes. Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>
## What this PR does This patch enables the `offline_access` scope for the dashbord keycloak client, so that users get a refresh token which gatekeeper can use to automatically refresh an expiring access token. Also session timeouts were increased. ### Release note ```release-note [dashboard] Increase session timeouts, add the offline_access scope, enable refresh tokens to improve the overall user experience when working with the dashboard. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated authentication configuration with additional OAuth2 scope parameters to enhance security credentials handling. * Enhanced Keycloak client configuration with optional client scopes and session management attributes, including logout redirect settings and session timeout controls for improved session lifecycle management. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What this PR does Fixes telemetry collection in cozystack-operator which was failing because the manager's cache is filtered and doesn't include resources needed for telemetry (kube-system namespace, nodes, services, PVs). Switches to using `mgr.GetAPIReader()` which bypasses the cache. ### Release note ```release-note [system] Fix telemetry collection in cozystack-operator ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Chores** * Updated Docker image versions from 1.5.0 to 1.6.1 for platform migrations and testing environments. * Enhanced telemetry collection system with improved data access patterns. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add missing changelog documentation for recent patch releases. Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>
….3 (cozystack#1922) ## What this PR does Add missing changelog documentation for recent patch releases that were released without changelog entries. ### Release note ```release-note [docs] Add changelog documentation for v0.40.3, v0.41.1, v0.41.2, v0.41.3 ```
…-proxmox-paas-proxmox-bundle
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1354ba4
into
cozystack:69-integration-with-proxmox-paas-proxmox-bundle
Summary of ChangesHello Marian Koreniuk (@themoriarti), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces foundational changes aimed at enhancing the platform's capabilities, potentially in preparation for a Proxmox PAAS integration as indicated by the title. Key modifications include refining the telemetry data collection mechanism to ensure access to non-cached, up-to-date resource information, and significant improvements to the dashboard UI for better visibility and management of Kubernetes LoadBalancer services. The changes also standardize resource labeling for Kubernetes components, update Keycloak client configurations for improved authentication, and incorporate several dependency updates and recent bug fixes and improvements documented in new changelog entries. These updates collectively contribute to improved system observability, manageability, and security. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request integrates a variety of changes, seemingly from a fork, that enhance dashboard functionality, update dependencies, and apply several fixes. Key additions include a new 'External IPs' view in the dashboard to display LoadBalancer services and improved labeling for tenant resources. The telemetry collector is now correctly configured to use a non-cached client, which should resolve issues with accessing cluster-wide resources.
My review has identified a couple of areas for improvement:
- A security concern regarding the use of
wget | shin a Dockerfile, which could be vulnerable to a man-in-the-middle attack. - An opportunity to improve configurability by avoiding hardcoded session timeout values in a Keycloak client template.
Overall, the changes are positive, but addressing the identified points will improve the security and maintainability of the codebase. The pull request title and description are a bit confusing and don't seem to accurately reflect the content of the changes.
| FROM alpine:3.22 | ||
|
|
||
| RUN wget -O- https://github.com/cozystack/cozyhr/raw/refs/heads/main/hack/install.sh | sh -s -- -v 1.5.0 | ||
| RUN wget -O- https://github.com/cozystack/cozyhr/raw/refs/heads/main/hack/install.sh | sh -s -- -v 1.6.1 |
There was a problem hiding this comment.
Piping the output of wget directly to sh is a security risk. The script is downloaded and executed without any integrity check. If the source at https://github.com/cozystack/cozyhr were to be compromised, or if a man-in-the-middle attack occurred, this could lead to arbitrary code execution within your build environment.
It is strongly recommended to adopt a safer pattern:
- Download the script to a file.
- Verify the file's checksum (e.g., SHA256) against a known-good value.
- Execute the script only if the checksum matches.
An even better approach would be to use a versioned binary release of cozyhr if one is available.
| client.session.idle.timeout: "86400" | ||
| client.session.max.lifespan: "604800" |
There was a problem hiding this comment.
The session idle timeout and max lifespan for the Keycloak client are hardcoded. This reduces flexibility for administrators who might need to enforce different session policies based on their environment's security requirements. It's a good practice to make these values configurable through the chart's values.yaml.
client.session.idle.timeout: {{ index .Values._cluster "dashboardClientSessionIdleTimeout" | default "86400" | quote }}
client.session.max.lifespan: {{ index .Values._cluster "dashboardClientSessionMaxLifespan" | default "604800" | quote }}
from fork to integration proxmox original