metal3-io / metal3-dev-env

Metal³ Development Environment
Apache License 2.0
109 stars 117 forks source link

remove hardcoded KUBECTL_SHA256 pinning with downloaded SHA check #1437

Closed tuminoid closed 3 days ago

tuminoid commented 4 days ago

Kubectl is not our production binary, so loosen the pinning by changing from hardcoded kubectl pinning to verifying versus downloaded sha256. KUBECTL_SHA256 is passed thru JJB -> project-infra -> CAPM3 -> dev-env and it makes it super difficult to test new k8s versions in sane way, especially when we would actually need to have one version skew to for upgrade scenarios.

tuminoid commented 4 days ago

/test metal3-dev-env-integration-test-ubuntu-main

Setting up a dev-env is successful test enough for this, as we can see from the logs if it downloaded it or not, and if it matched or not.

tuminoid commented 3 days ago

/test metal3-centos-e2e-integration-test-release-1-7

Let's also see if we can pass older release test (we should, as we just ignore anything passed to us)

tuminoid commented 3 days ago

/unhold

Works as expected. It ignores the KUBECTL_SHA256 if passed to it and download the sha and verified it regardless of the version of kubectl.

/cc @Rozzii @kashifest

tuminoid commented 3 days ago

/retitle remove hardcoded KUBECTL_SHA256 pinning with downloaded SHA check

metal3-io-bot commented 3 days ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kashifest

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/metal3-io/metal3-dev-env/blob/main/OWNERS)~~ [kashifest] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment