Merge remote-tracking branch 'origin/master' into preflight_add_update

.gdn/.gdnsuppress

@@ -225,20 +225,6 @@
       "expirationDate": null,
       "type": null
     },
-    "20cd31403587ea29d121d28ac3ef7d9b6a7b922baaf817f79ba4ccf0d5730b43": {
-      "signature": "20cd31403587ea29d121d28ac3ef7d9b6a7b922baaf817f79ba4ccf0d5730b43",
-      "alternativeSignatures": [],
-      "target": "portal/v1/build/main.js.LICENSE.txt",
-      "memberOf": [
-        "default"
-      ],
-      "tool": "policheck",
-      "ruleId": "166862",
-      "justification": null,
-      "createdDate": "2022-07-14 16:28:44Z",
-      "expirationDate": null,
-      "type": null
-    },
     "9c277a79f4467e0f7fc8eaeac774f9680776f80a1acfee7a0e3331dde2f7ef6d": {
       "signature": "9c277a79f4467e0f7fc8eaeac774f9680776f80a1acfee7a0e3331dde2f7ef6d",
       "alternativeSignatures": [],

.github/CODEOWNERS

@@ -1 +1 @@
-* @jewzaam @bennerv @hawkowl @rogbas @petrkotas @jharrington22 @cblecker @cadenmarchese @ulrichschlueter @s-amann @SudoBrendan @Shivkumar13 @yjst2012 @jaitaiwan @anshulvermapatel @hlipsig @dofinn
+* @jewzaam @bennerv @hawkowl @rogbas @petrkotas @jharrington22 @cblecker @cadenmarchese @ulrichschlueter @s-amann @SudoBrendan @Shivkumar13 @yjst2012 @jaitaiwan @anshulvermapatel @hlipsig @tiguelu

.github/PULL_REQUEST_TEMPLATE.md

@@ -33,3 +33,10 @@ How did you test that this PR works?
   docs.
 - If no, explain why (e.g. "tech debt cleanup, N/A").
 -->
+
+### How do you know this will function as expected in production? 
+
+<!--
+- Does adequate telemetry, monitoring and documentation exist to effectively operate your change?
+- Have failure modes been identified and mitigated? 
+-->

.github/workflows/ci-go.yml

@@ -11,37 +11,44 @@ on:
 permissions:
   contents: read
 
-env:
-  GOFLAGS: -tags=containers_image_openpgp,exclude_graphdriver_btrfs,exclude_graphdriver_devicemapper
-
 jobs:
   ci-from-docker:
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi8/go-toolset:1.20.12-5
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
-
-    - name: Build from buildah
-      uses: redhat-actions/buildah-build@v2
-      with:
-        image: test-image
-        tags: ${{ github.sha }}
-        context: .
-        containerfiles: ./Dockerfile.ci
-        build-args: REGISTRY=registry.access.redhat.com
+    - name: Install Go runtime deps
+      run: |
+        make install-go-tools
+    - name: Build all
+      run: |
+        make build-all
+    - name: Run unit tests
+      run: |
+        make unit-test-go
 
   vendor-check:
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi8/go-toolset:1.20.12-5
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
-
-    - name: Set up Go
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: go.mod
-
     - run: |
         go mod vendor
-        go mod tidy -compat=1.18
+        go mod tidy -compat=1.20
+        hack/ci-utils/isClean.sh
+
+  generate-check:
+    runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi8/go-toolset:1.20.12-5
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Run make generate
+      run: |
+        make generate
         hack/ci-utils/isClean.sh

.github/workflows/golint.yml

@@ -25,9 +25,9 @@ jobs:
         go-version-file: go.mod
 
     - name: Run golangci-lint
-      uses: golangci/golangci-lint-action@v3
+      uses: golangci/golangci-lint-action@v4
       with:
-        version: v1.55.1
+        version: v1.56.2
         args: -v --timeout 15m
 
   validate-go:

.github/workflows/release-note.yml

@@ -25,7 +25,7 @@ jobs:
       run: ./.github/generate_release_note.sh ${{ github.workspace }}/CHANGELOG.txt
 
     - name: Release
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@v2
       with:
         body_path: ${{ github.workspace }}/CHANGELOG.txt
         name: Release ${{ github.ref_name }}

.github/workflows/yamllint.yml

@@ -6,6 +6,9 @@ name: mega-linter-yaml
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: mega-linter-yaml

.gitignore

@@ -30,7 +30,6 @@ gomock_reflect_*
 /e2e-report.xml
 /deploy/config.yaml
 **/*.swp
-/portal/v1/node_modules/
 /portal/v2/node_modules/
 portal/v2/.vscode/
 .idea*
@@ -43,3 +42,4 @@ megalinter-reports/
 /jq
 /portalauth
 .kiota.log
+/clusterapp.env

.golangci.yml

@@ -10,7 +10,10 @@ run:
     - "containers_image_openpgp"
     - "exclude_graphdriver_devicemapper"
     - "exclude_graphdriver_btrfs"
-  go: "1.18"
+  go: "1.20"
+
+output:
+  format: github-actions
 
 issues:
   max-same-issues: 0

.pipelines/ci.yml

@@ -22,7 +22,7 @@ pr:
 resources:
   containers:
     - container: golang
-      image: registry.access.redhat.com/ubi8/go-toolset:1.18
+      image: registry.access.redhat.com/ubi8/go-toolset:1.20.12-5
       options: --user=0
     - container: python
       image: registry.access.redhat.com/ubi8/python-39:latest
@@ -82,12 +82,6 @@ jobs:
         displayName: 🧪 Run Golang unit tests
         target: golang
 
-      - script: |
-          set -xe
-          make validate-fips
-        displayName: 🕵️ Validate FIPS
-        target: golang
-
       - task: PublishTestResults@2
         displayName: 📊 Publish tests results
         inputs:

.pipelines/clean-subscription.yml

@@ -9,7 +9,7 @@ parameters:
 resources:
   containers:
     - container: golang
-      image: registry.access.redhat.com/ubi8/go-toolset:1.18
+      image: registry.access.redhat.com/ubi8/go-toolset:1.20
       options: --user=0
 
 variables:

.pipelines/e2e.yml

@@ -51,6 +51,7 @@ jobs:
 
           export CI=true
           . ./hack/e2e/run-rp-and-e2e.sh
+          get_cluster_sp
           deploy_e2e_db
         displayName: Setup (Azure)
 

.pipelines/onebranch/pipeline.buildrp.official.yml

@@ -14,7 +14,7 @@ pr: none
 variables:
   Cdp_Definition_Build_Count: $[counter('', 0)] # needed for onebranch.pipeline.version task https://aka.ms/obpipelines/versioning
   ONEBRANCH_AME_ACR_LOGIN: cdpxb8e9ef87cd634085ab141c637806568c00.azurecr.io
-  LinuxContainerImage: $(ONEBRANCH_AME_ACR_LOGIN)/b8e9ef87-cd63-4085-ab14-1c637806568c/official/ubi8/go-toolset:1.18.4 # Docker image which is used to build the project https://aka.ms/obpipelines/containers
+  LinuxContainerImage: $(ONEBRANCH_AME_ACR_LOGIN)/b8e9ef87-cd63-4085-ab14-1c637806568c/official/ubi8/go-toolset:1.20.12-5 # Docker image which is used to build the project https://aka.ms/obpipelines/containers
   Debian_Frontend: noninteractive
 
 resources:

.pipelines/onebranch/pipeline.buildrp.pullrequest.yml

@@ -14,7 +14,7 @@ pr: none
 variables:
   Cdp_Definition_Build_Count: $[counter('', 0)] # needed for onebranch.pipeline.version task https://aka.ms/obpipelines/versioning
   ONEBRANCH_AME_ACR_LOGIN: cdpxb8e9ef87cd634085ab141c637806568c00.azurecr.io
-  LinuxContainerImage: $(ONEBRANCH_AME_ACR_LOGIN)/b8e9ef87-cd63-4085-ab14-1c637806568c/official/ubi8/go-toolset:1.18.4 # Docker image which is used to build the project https://aka.ms/obpipelines/containers
+  LinuxContainerImage: $(ONEBRANCH_AME_ACR_LOGIN)/b8e9ef87-cd63-4085-ab14-1c637806568c/official/ubi8/go-toolset:1.20.12-5 # Docker image which is used to build the project https://aka.ms/obpipelines/containers
   Debian_Frontend: noninteractive
 
 resources:

.sha256sum

@@ -5,4 +5,5 @@ b1f1de0fe40d05de90742b17928968923b936adc294000f58974f50a297581dd  swagger/redhat
 01ba9562a8dac2824998ff0ad0d2465f79e6a66597bdb321e9409b9f2d12d222  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/stable/2023-04-01/redhatopenshift.json
 c023515341196746454c0ae7af077d40d3ec13f6b88b33cb558f0a7ab17a5a24  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2023-07-01-preview/redhatopenshift.json
 440748951dd1c3b34b5ccbdcb7cd966e3b89490887a1f1d64429561fad789515  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/stable/2023-09-04/redhatopenshift.json
-98b241e3225ff4bbe96f4046aea98dae06c2bac2cc0e25ab8d85583bfc7f1861  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/stable/2023-11-22/redhatopenshift.json
+74a46fdde6ceb0121fe1515c7e11e902dd921b54cffe693307fb02b3dc88f26e  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/stable/2023-11-22/redhatopenshift.json
+a27184734436629e24b344c3b5c015437f144e18e7eddce7e252a1ed4cda7bca  swagger/redhatopenshift/resource-manager/Microsoft.RedHatOpenShift/preview/2024-08-12-preview/redhatopenshift.json

.yaml-lint.yml

@@ -8,6 +8,7 @@ yaml-files:
 ignore: |
     vendor/
     *aro.openshift.io*.yaml
+    pkg/operator/deploy/staticresources/
 
 rules:
   braces: enable

Dockerfile.aro-e2e

@@ -1,17 +1,19 @@
 # Uses a multi-stage container build to build the RP & E2E components.
 #
 ARG REGISTRY
-FROM ${REGISTRY}/ubi8/go-toolset:1.18.10 AS builder
-ENV GOOS=linux \
-    GOPATH=/go/
-WORKDIR ${GOPATH}/src/github.com/Azure/ARO-RP
+FROM ${REGISTRY}/ubi8/go-toolset:1.20.12-5 AS builder
+
 USER root
-COPY . ${GOPATH}/src/github.com/Azure/ARO-RP/
-RUN make aro RELEASE=${IS_OFFICIAL_RELEASE} -o generate && make e2e.test e2etools
+ENV GOPATH=/root/go
+RUN mkdir -p /app
+WORKDIR /app
+
+COPY . /app
+RUN make aro RELEASE=${IS_OFFICIAL_RELEASE} -o generate && make validate-fips && make e2e.test e2etools
 
 FROM ${REGISTRY}/ubi8/ubi-minimal
 RUN microdnf update && microdnf clean all
-COPY --from=builder /go/src/github.com/Azure/ARO-RP/aro /go/src/github.com/Azure/ARO-RP/e2e.test /go/src/github.com/Azure/ARO-RP/db /go/src/github.com/Azure/ARO-RP/cluster /go/src/github.com/Azure/ARO-RP/portalauth /go/src/github.com/Azure/ARO-RP/jq /usr/local/bin/
+COPY --from=builder /app/aro /app/e2e.test /app/db /app/cluster /app/portalauth /app/jq /usr/local/bin/
 ENTRYPOINT ["aro"]
 EXPOSE 2222/tcp 8080/tcp 8443/tcp 8444/tcp 8445/tcp
 USER 1000

Dockerfile.aro-multistage

@@ -1,17 +1,19 @@
 # Uses a multi-stage container build to build the RP.
 #
 ARG REGISTRY
-FROM ${REGISTRY}/ubi8/go-toolset:1.18.10 AS builder
-ENV GOOS=linux \
-    GOPATH=/go/
-WORKDIR ${GOPATH}/src/github.com/Azure/ARO-RP
+FROM ${REGISTRY}/ubi8/go-toolset:1.20.12-5 AS builder
+
 USER root
-COPY . ${GOPATH}/src/github.com/Azure/ARO-RP/
-RUN make aro RELEASE=${IS_OFFICIAL_RELEASE} -o generate && make e2e.test
+ENV GOPATH=/root/go
+RUN mkdir -p /app
+WORKDIR /app
+
+COPY . /app
+RUN make aro RELEASE=${IS_OFFICIAL_RELEASE} -o generate && make validate-fips && make e2e.test
 
 FROM ${REGISTRY}/ubi8/ubi-minimal
 RUN microdnf update && microdnf clean all
-COPY --from=builder /go/src/github.com/Azure/ARO-RP/aro /go/src/github.com/Azure/ARO-RP/e2e.test /usr/local/bin/
+COPY --from=builder /app/aro /app/e2e.test /usr/local/bin/
 ENTRYPOINT ["aro"]
 EXPOSE 2222/tcp 8080/tcp 8443/tcp 8444/tcp 8445/tcp
 USER 1000

Dockerfile.ci-rp

@@ -0,0 +1,67 @@
+ARG REGISTRY
+ARG VERSION
+
+###############################################################################
+# Stage 1: Build the SRE Portal Assets
+# builder is responsible for all compilation and validation of the RP
+###############################################################################
+FROM ${REGISTRY}/ubi8/nodejs-16  as portal-build
+WORKDIR /build/portal/v2
+USER root
+
+# Copying package files and installing dependencies
+COPY portal/v2/package*.json ./
+RUN npm ci
+RUN npm audit --omit=dev # Run audit without dev dependencies
+
+# Copying the rest of the source and build
+COPY --chown=root:root portal/v2/ ./
+RUN npm run lint && npm run build
+
+###############################################################################
+# Stage 2: Compile the Golang RP code
+###############################################################################
+FROM ${REGISTRY}/ubi8/go-toolset:1.20.12-5 AS builder
+USER root
+WORKDIR /app
+
+# golang config and build steps
+ENV GOPATH=/root/go
+ENV GOFLAGS="-tags=containers_image_openpgp,exclude_graphdriver_btrfs,exclude_graphdriver_devicemapper"
+
+# Install golangci-lint and verify
+RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b /usr/local/bin v1.56.2 && \
+    golangci-lint --version || (echo "golangci-lint not found" && exit 1)
+
+# Copy dependencies and source files
+COPY go.mod go.sum ./
+COPY vendor vendor
+COPY swagger swagger
+COPY .golangci.yml ./
+COPY hack hack
+COPY cmd cmd
+COPY pkg pkg
+COPY test test
+
+# Ensure JS assets are available before generating Go code
+COPY --from=portal-build /build/pkg/portal/assets/v2/build /app/pkg/portal/assets/v2/build
+
+# Lint, generate, build, and test
+RUN golangci-lint run --verbose
+RUN go generate ./...
+RUN go build -ldflags "-X github.com/Azure/ARO-RP/pkg/util/version.GitCommit=${VERSION}" ./cmd/aro
+RUN go test ./test/e2e/... -tags e2e,codec.safe -c -ldflags "-X github.com/Azure/ARO-RP/pkg/util/version.GitCommit=${VERSION}" -o e2e.test
+
+# Additional tests
+RUN ARO_RUN_PKI_TESTS=nope go run gotest.tools/[email protected] --format pkgname --junitfile report.xml -- -coverprofile=cover.out ./...
+RUN hack/fips/validate-fips.sh ./aro
+
+###############################################################################
+# Stage 3: final is our slim image with minimal layers and tools
+###############################################################################
+FROM ${REGISTRY}/ubi8/ubi-minimal AS final
+RUN microdnf update && microdnf clean all
+COPY --from=builder /app/aro /app/e2e.test /usr/local/bin/
+ENTRYPOINT ["aro"]
+EXPOSE 2222/tcp 8080/tcp 8443/tcp 8444/tcp 8445/tcp
+USER 1000