feat: simplify pipeline, add direct TLS transport, and improve Ceph workers

Makefile

@@ -416,7 +416,7 @@ bundle: manifests kustomize operator-sdk ## Generate bundle manifests and metada
 	cd config/manifests/bases && $(KUSTOMIZE) edit add annotation --force 'olm.skipRange':"$(SKIP_RANGE)"
 	cd config/manifests/bases && $(KUSTOMIZE) edit add patch --name ceph-volsync-plugin-operator.v0.0.1 --kind ClusterServiceVersion\
 		--patch '[{"op": "replace", "path": "/spec/replaces", "value": "$(REPLACES)"}]'
-	$(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
+	$(KUSTOMIZE) build config/manifests | sed 's|MOVER_IMAGE_PLACEHOLDER|${MOVER_IMG}|g; s|CEPH_CSI_CONFIG_NAME_PLACEHOLDER|${CEPH_CSI_CONFIG_NAME}|g; s|CEPH_CSI_CONFIG_NAMESPACE_PLACEHOLDER|${CEPH_CSI_CONFIG_NAMESPACE}|g' | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
 	$(OPERATOR_SDK) bundle validate ./bundle
 
 .PHONY: bundle-build

cmd/manager/openshift/mover_scc.yaml

@@ -26,6 +26,8 @@ runAsUser:
   type: RunAsAny  # allow mover to run as root
 seLinuxContext:
   type: MustRunAs
+  seLinuxOptions:
+    type: spc_t
 seccompProfiles:
   - runtime/default
 supplementalGroups:

go.mod

@@ -12,11 +12,11 @@ require (
 	github.com/onsi/ginkgo/v2 v2.27.2
 	github.com/onsi/gomega v1.38.2
 	github.com/openshift/api v0.0.0-20240115183315-0793e918179d
-	github.com/pierrec/lz4/v4 v4.1.21
 	github.com/spf13/viper v1.19.0
 	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.27.0
 	golang.org/x/sync v0.19.0
+	golang.org/x/sys v0.40.0
 	google.golang.org/grpc v1.79.3
 	google.golang.org/protobuf v1.36.10
 	k8s.io/api v0.35.1
@@ -98,7 +98,6 @@ require (
 	golang.org/x/mod v0.30.0 // indirect
 	golang.org/x/net v0.48.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
 	golang.org/x/term v0.38.0 // indirect
 	golang.org/x/text v0.32.0 // indirect
 	golang.org/x/time v0.9.0 // indirect

go.sum

@@ -137,8 +137,6 @@ github.com/openshift/api v0.0.0-20240115183315-0793e918179d h1:gtwDqGPf5QmsV8jvO
 github.com/openshift/api v0.0.0-20240115183315-0793e918179d/go.mod h1:CxgbWAlvu2iQB0UmKTtRu1YfepRg1/vJ64n2DlIEVz4=
 github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
 github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
-github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
-github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

internal/ceph/config/csiconfig_test.go

@@ -26,6 +26,15 @@ import (
 	cephcsi "github.com/ceph/ceph-csi/api/deploy/kubernetes"
 )
 
+const (
+	testClusterID1    = "cluster-1"
+	testClusterID2    = "cluster-2"
+	testClusterID5    = "cluster-5"
+	testCSINamespace  = "ceph-csi"
+	testCephFSSecret1 = "cephfs-secret-1"
+	testRBDSecret1    = "rbd-secret-1"
+)
+
 var (
 	csiClusters = "csi-clusters.json"
 	clusterID1  = "test1"
@@ -169,10 +178,10 @@ func TestGetRBDControllerPublishSecretRefFromData(t *testing.T) {
 	t.Parallel()
 	csiConfig := []cephcsi.ClusterInfo{
 		{
-			ClusterID: "cluster-1",
+			ClusterID: testClusterID1,
 			RBD: cephcsi.RBD{
 				ControllerPublishSecretRef: corev1.SecretReference{
-					Name: "rbd-secret-1", Namespace: "ceph-csi",
+					Name: testRBDSecret1, Namespace: testCSINamespace,
 				},
 			},
 		},
@@ -182,12 +191,12 @@ func TestGetRBDControllerPublishSecretRefFromData(t *testing.T) {
 		t.Fatalf("json.Marshal() error: %v", err)
 	}
 
-	name, ns, err := GetRBDControllerPublishSecretRefFromData(data, "cluster-1")
+	name, ns, err := GetRBDControllerPublishSecretRefFromData(data, testClusterID1)
 	if err != nil {
 		t.Fatalf("GetRBDControllerPublishSecretRefFromData() error: %v", err)
 	}
-	if name != "rbd-secret-1" || ns != "ceph-csi" {
-		t.Errorf("got (%q, %q), want (%q, %q)", name, ns, "rbd-secret-1", "ceph-csi")
+	if name != testRBDSecret1 || ns != testCSINamespace {
+		t.Errorf("got (%q, %q), want (%q, %q)", name, ns, testRBDSecret1, testCSINamespace)
 	}
 
 	_, _, err = GetRBDControllerPublishSecretRefFromData(data, "missing")
@@ -200,10 +209,10 @@ func TestGetCephFSControllerPublishSecretRefFromData(t *testing.T) {
 	t.Parallel()
 	csiConfig := []cephcsi.ClusterInfo{
 		{
-			ClusterID: "cluster-1",
+			ClusterID: testClusterID1,
 			CephFS: cephcsi.CephFS{
 				ControllerPublishSecretRef: corev1.SecretReference{
-					Name: "cephfs-secret-1", Namespace: "ceph-csi",
+					Name: testCephFSSecret1, Namespace: testCSINamespace,
 				},
 			},
 		},
@@ -213,12 +222,12 @@ func TestGetCephFSControllerPublishSecretRefFromData(t *testing.T) {
 		t.Fatalf("json.Marshal() error: %v", err)
 	}
 
-	name, ns, err := GetCephFSControllerPublishSecretRefFromData(data, "cluster-1")
+	name, ns, err := GetCephFSControllerPublishSecretRefFromData(data, testClusterID1)
 	if err != nil {
 		t.Fatalf("GetCephFSControllerPublishSecretRefFromData() error: %v", err)
 	}
-	if name != "cephfs-secret-1" || ns != "ceph-csi" {
-		t.Errorf("got (%q, %q), want (%q, %q)", name, ns, "cephfs-secret-1", "ceph-csi")
+	if name != testCephFSSecret1 || ns != testCSINamespace {
+		t.Errorf("got (%q, %q), want (%q, %q)", name, ns, testCephFSSecret1, testCSINamespace)
 	}
 
 	_, _, err = GetCephFSControllerPublishSecretRefFromData(data, "missing")
@@ -236,43 +245,43 @@ func TestGetRBDControllerPublishSecretRef(t *testing.T) {
 	}{
 		{
 			name:      "get secret in cluster-1",
-			clusterID: "cluster-1",
+			clusterID: testClusterID1,
 			want: corev1.SecretReference{
-				Name:      "rbd-secret-1",
-				Namespace: "ceph-csi",
+				Name:      testRBDSecret1,
+				Namespace: testCSINamespace,
 			},
 		},
 		{
 			name:      "get secret in cluster-2",
-			clusterID: "cluster-2",
+			clusterID: testClusterID2,
 			want: corev1.SecretReference{
 				Name:      "rbd-secret-2",
-				Namespace: "ceph-csi",
+				Namespace: testCSINamespace,
 			},
 		},
 		{
 			name:      "get secret where not provided in cluster-5",
-			clusterID: "cluster-5",
+			clusterID: testClusterID5,
 			want:      corev1.SecretReference{Name: "", Namespace: ""},
 		},
 	}
 
 	csiConfig := []cephcsi.ClusterInfo{
 		{
-			ClusterID: "cluster-1",
+			ClusterID: testClusterID1,
 			RBD: cephcsi.RBD{
 				ControllerPublishSecretRef: corev1.SecretReference{
-					Name:      "rbd-secret-1",
-					Namespace: "ceph-csi",
+					Name:      testRBDSecret1,
+					Namespace: testCSINamespace,
 				},
 			},
 		},
 		{
-			ClusterID: "cluster-2",
+			ClusterID: testClusterID2,
 			RBD: cephcsi.RBD{
 				ControllerPublishSecretRef: corev1.SecretReference{
 					Name:      "rbd-secret-2",
-					Namespace: "ceph-csi",
+					Namespace: testCSINamespace,
 				},
 			},
 		},
@@ -281,7 +290,7 @@ func TestGetRBDControllerPublishSecretRef(t *testing.T) {
 			RBD: cephcsi.RBD{
 				ControllerPublishSecretRef: corev1.SecretReference{
 					Name:      "",
-					Namespace: "ceph-csi",
+					Namespace: testCSINamespace,
 				},
 			},
 		},
@@ -295,7 +304,7 @@ func TestGetRBDControllerPublishSecretRef(t *testing.T) {
 			},
 		},
 		{
-			ClusterID: "cluster-5",
+			ClusterID: testClusterID5,
 			RBD:       cephcsi.RBD{},
 		},
 	}
@@ -334,43 +343,43 @@ func TestGetCephFSControllerPublishSecretRef(t *testing.T) {
 	}{
 		{
 			name:      "get secret in cluster-1",
-			clusterID: "cluster-1",
+			clusterID: testClusterID1,
 			want: corev1.SecretReference{
-				Name:      "cephfs-secret-1",
-				Namespace: "ceph-csi",
+				Name:      testCephFSSecret1,
+				Namespace: testCSINamespace,
 			},
 		},
 		{
 			name:      "get secret in cluster-2",
-			clusterID: "cluster-2",
+			clusterID: testClusterID2,
 			want: corev1.SecretReference{
 				Name:      "cephfs-secret-2",
-				Namespace: "ceph-csi",
+				Namespace: testCSINamespace,
 			},
 		},
 		{
 			name:      "get secret where not provided in cluster-5",
-			clusterID: "cluster-5",
+			clusterID: testClusterID5,
 			want:      corev1.SecretReference{Name: "", Namespace: ""},
 		},
 	}
 
 	csiConfig := []cephcsi.ClusterInfo{
 		{
-			ClusterID: "cluster-1",
+			ClusterID: testClusterID1,
 			CephFS: cephcsi.CephFS{
 				ControllerPublishSecretRef: corev1.SecretReference{
-					Name:      "cephfs-secret-1",
-					Namespace: "ceph-csi",
+					Name:      testCephFSSecret1,
+					Namespace: testCSINamespace,
 				},
 			},
 		},
 		{
-			ClusterID: "cluster-2",
+			ClusterID: testClusterID2,
 			CephFS: cephcsi.CephFS{
 				ControllerPublishSecretRef: corev1.SecretReference{
 					Name:      "cephfs-secret-2",
-					Namespace: "ceph-csi",
+					Namespace: testCSINamespace,
 				},
 			},
 		},
@@ -379,7 +388,7 @@ func TestGetCephFSControllerPublishSecretRef(t *testing.T) {
 			CephFS: cephcsi.CephFS{
 				ControllerPublishSecretRef: corev1.SecretReference{
 					Name:      "",
-					Namespace: "ceph-csi",
+					Namespace: testCSINamespace,
 				},
 			},
 		},
@@ -393,7 +402,7 @@ func TestGetCephFSControllerPublishSecretRef(t *testing.T) {
 			},
 		},
 		{
-			ClusterID: "cluster-5",
+			ClusterID: testClusterID5,
 			CephFS:    cephcsi.CephFS{},
 		},
 	}

internal/controller/replicationdestination_controller_test.go

@@ -24,6 +24,11 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+const (
+	testRDName = "test-rd"
+	testRDNS   = "test-ns"
+)
+
 func TestRdHasMover(t *testing.T) {
 	testCases := []struct {
 		name     string
@@ -34,8 +39,8 @@ func TestRdHasMover(t *testing.T) {
 			name: "No mover",
 			rd: &volsyncv1alpha1.ReplicationDestination{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-rd",
-					Namespace: "test-ns",
+					Name:      testRDName,
+					Namespace: testRDNS,
 				},
 				Spec: volsyncv1alpha1.ReplicationDestinationSpec{},
 			},
@@ -45,8 +50,8 @@ func TestRdHasMover(t *testing.T) {
 			name: "Rclone mover",
 			rd: &volsyncv1alpha1.ReplicationDestination{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-rd",
-					Namespace: "test-ns",
+					Name:      testRDName,
+					Namespace: testRDNS,
 				},
 				Spec: volsyncv1alpha1.ReplicationDestinationSpec{
 					Rclone: &volsyncv1alpha1.ReplicationDestinationRcloneSpec{},
@@ -58,8 +63,8 @@ func TestRdHasMover(t *testing.T) {
 			name: "Restic mover",
 			rd: &volsyncv1alpha1.ReplicationDestination{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-rd",
-					Namespace: "test-ns",
+					Name:      testRDName,
+					Namespace: testRDNS,
 				},
 				Spec: volsyncv1alpha1.ReplicationDestinationSpec{
 					Restic: &volsyncv1alpha1.ReplicationDestinationResticSpec{},
@@ -71,8 +76,8 @@ func TestRdHasMover(t *testing.T) {
 			name: "Rsync mover",
 			rd: &volsyncv1alpha1.ReplicationDestination{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-rd",
-					Namespace: "test-ns",
+					Name:      testRDName,
+					Namespace: testRDNS,
 				},
 				Spec: volsyncv1alpha1.ReplicationDestinationSpec{
 					Rsync: &volsyncv1alpha1.ReplicationDestinationRsyncSpec{},
@@ -84,8 +89,8 @@ func TestRdHasMover(t *testing.T) {
 			name: "RsyncTLS mover",
 			rd: &volsyncv1alpha1.ReplicationDestination{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-rd",
-					Namespace: "test-ns",
+					Name:      testRDName,
+					Namespace: testRDNS,
 				},
 				Spec: volsyncv1alpha1.ReplicationDestinationSpec{
 					RsyncTLS: &volsyncv1alpha1.ReplicationDestinationRsyncTLSSpec{},