@rancher/shell 3.0.8 → 3.0.9-rc.2

package/edit/provisioning.cattle.io.cluster/tabs/networking/index.vue

@@ -20,7 +20,7 @@ export default {
     'update:value', 'cluster-cidr-changed', 'local-cluster-auth-endpoint-changed',
     'service-cidr-changed', 'cluster-domain-changed', 'cluster-dns-changed',
     'truncate-hostname-changed', 'ca-certs-changed', 'service-node-port-range-changed',
-    'fqdn-changed', 'tls-san-changed', 'stack-preference-changed', 'validationChanged'
+    'fqdn-changed', 'tls-san-changed', 'stack-preference-changed', 'validationChanged', 'enable-flannel-masq-changed'
   ],
 
   components: {
@@ -57,9 +57,31 @@ export default {
     hasSomeIpv6Pools: {
       type:    Boolean,
       default: false
+    },
+
+    enableFlannelMasq: {
+      type:    Boolean,
+      default: false
     }
   },
 
+  watch: {
+    isProbablyIPv6(neu) {
+      if (this.mode === _CREATE && this.showFlannelMasq) {
+        this.$emit('enable-flannel-masq-changed', neu);
+      }
+    },
+
+    isK3s(neu) {
+      if (!neu) {
+        this.$emit('enable-flannel-masq-changed', null);
+      } else if (this.isProbablyIPv6) {
+        this.$emit('enable-flannel-masq-changed', true);
+      }
+    },
+
+  },
+
   data() {
     return { STACK_PREFS };
   },
@@ -68,12 +90,15 @@ export default {
     truncateHostnames() {
       return this.truncateLimit === NETBIOS_TRUNCATION_LENGTH;
     },
+
     serverConfig() {
       return this.value.spec.rkeConfig.machineGlobalConfig;
     },
+
     serverArgs() {
       return this.selectedVersion?.serverArgs || {};
     },
+
     stackPreferenceOptions() {
       return [{
         label: this.t('cluster.rke2.stackPreference.options.ipv4'),
@@ -88,21 +113,19 @@ export default {
       },
       ];
     },
-    showIpv6Warning() {
-      const clusterCIDR = this.serverConfig['cluster-cidr'] || '';
-      const serviceCIDR = this.serverConfig['service-cidr'] || '';
 
-      return clusterCIDR.includes(':') || serviceCIDR.includes(':');
-    },
     hostnameTruncationManuallySet() {
       return !!this.truncateLimit && this.truncateLimit !== NETBIOS_TRUNCATION_LENGTH;
     },
+
     isEdit() {
       return this.mode === _EDIT;
     },
+
     isView() {
       return this.mode === _VIEW;
     },
+
     localValue: {
       get() {
         return this.value;
@@ -123,6 +146,31 @@ export default {
         this.localValue.spec.networking.stackPreference = neu;
       }
     },
+
+    isK3s() {
+      return (this.selectedVersion?.label || '').includes('k3s');
+    },
+
+    showFlannelMasq() {
+      const flannelEnabled = this.value?.spec?.rkeConfig?.machineGlobalConfig?.['flannel-backend'] !== 'none';
+
+      return this.isK3s && flannelEnabled;
+    },
+
+    hasIpv6StackPref() {
+      return [STACK_PREFS.IPV6, STACK_PREFS.DUAL].includes(this.value?.spec?.rkeConfig?.networking?.stackPreference);
+    },
+
+    hasIpv6ServerConfig() {
+      const clusterCIDR = this.serverConfig['cluster-cidr'] || '';
+      const serviceCIDR = this.serverConfig['service-cidr'] || '';
+
+      return clusterCIDR.includes(':') || serviceCIDR.includes(':');
+    },
+
+    isProbablyIPv6() {
+      return this.hasSomeIpv6Pools || this.hasIpv6StackPref || this.hasIpv6ServerConfig;
+    },
   },
 
   methods: {
@@ -140,7 +188,7 @@ export default {
       } else {
         return null;
       }
-    }
+    },
   }
 };
 </script>
@@ -154,13 +202,6 @@ export default {
         class="icon icon-info"
       />
     </h3>
-    <Banner
-      v-if="showIpv6Warning"
-      color="warning"
-      data-testid="network-tab-ipv6StackPreferenceWarning"
-    >
-      {{ t('cluster.rke2.address.ipv6.warning') }}
-    </Banner>
     <div class="row mb-20">
       <div
         v-if="serverArgs['cluster-cidr']"
@@ -298,5 +339,32 @@ export default {
         />
       </div>
     </div>
+    <template v-if="showFlannelMasq">
+      <h3
+        v-t="'cluster.k3s.flannelMasq.title'"
+        class="mt-20"
+      />
+      <Banner
+        v-if="isProbablyIPv6"
+        color="warning"
+        data-testid="cluster-rke2-flannel-masq-banner"
+        :label="t('cluster.k3s.flannelMasq.banner', null, true)"
+      />
+      <div
+        class="row mb-20 "
+      >
+        <div
+          class="col"
+        >
+          <Checkbox
+            :value="enableFlannelMasq"
+            data-testid="cluster-rke2-flannel-masq-checkbox"
+            :mode="mode"
+            :label="t('cluster.k3s.flannelMasq.label')"
+            @update:value="e=>$emit('enable-flannel-masq-changed', e)"
+          />
+        </div>
+      </div>
+    </template>
   </div>
 </template>

package/edit/workload/__tests__/index.test.ts

@@ -4,100 +4,137 @@ import Workload from '@shell/edit/workload/index.vue';
 jest.mock('@shell/models/secret', () => ({ onmessage: jest.fn() }));
 
 describe('component: Workload', () => {
-  it.each([
-    [
-      `pods \"test\" is forbidden: violates PodSecurity \"restricted:latest\": allowPrivilegeEscalation != false (container \"container-0\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container \"container-0\" must set securityContext.capabilities.drop=[\"ALL\"]), runAsNonRoot != true (container \"container-0\" must not set securityContext.runAsNonRoot=false), seccompProfile (pod or container \"container-0\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")`,
-      `workload.error, \"test\",\"restricted:latest\"`
-    ]
-  ])('should map error message into object', (oldMessage, newMessage) => {
-    const mockedValidationMixin = {
-      methods: {
-        fvFormIsValid:           jest.fn(),
-        type:                    jest.fn(),
-        fvGetAndReportPathRules: jest.fn(),
-      },
-      computed: { fvUnreportedValidationErrors: jest.fn().mockReturnValue([]) }
-    };
-    const mockedCREMixin = {};
-    const mockedWorkloadMixin = {
-      methods: {
-        doneRoute:                   jest.fn(),
-        workloadSubTypes:            jest.fn(),
-        applyHooks:                  jest.fn(),
-        save:                        jest.fn(),
-        selectType:                  jest.fn(),
-        isCronJob:                   jest.fn(),
-        spec:                        jest.fn(),
-        isReplicable:                jest.fn(),
-        isStatefulSet:               jest.fn(),
-        headlessServices:            jest.fn(),
-        defaultTab:                  jest.fn(),
-        allContainers:               jest.fn(),
-        isPod:                       jest.fn(),
-        tabWeightMap:                jest.fn(),
-        podLabels:                   jest.fn(),
-        podTemplateSpec:             jest.fn(),
-        isLoadingSecondaryResources: jest.fn(),
-        allNodes:                    jest.fn(),
-        allNodeObjects:              jest.fn(),
-        clearPvcFormState:           jest.fn(),
-        savePvcHookName:             jest.fn(),
-        namespacedConfigMaps:        jest.fn(),
-        podAnnotations:              jest.fn(),
-        isJob:                       jest.fn(),
-        podFsGroup:                  jest.fn(),
-        namespacedSecrets:           jest.fn(),
-        registerBeforeHook:          jest.fn(),
-        pvcs:                        jest.fn(),
-        // tabWeightMap:     jest.fn(),
-      }
-    };
+  const baseMockedValidationMixin = {
+    methods: {
+      fvFormIsValid:           jest.fn(),
+      type:                    jest.fn(),
+      fvGetAndReportPathRules: jest.fn(),
+    },
+    computed: { fvUnreportedValidationErrors: jest.fn().mockReturnValue([]) }
+  };
+  const baseMockedCREMixin = {};
+  const baseMockedWorkloadMixin = {
+    methods: {
+      doneRoute:                   jest.fn(),
+      workloadSubTypes:            jest.fn(),
+      applyHooks:                  jest.fn(),
+      save:                        jest.fn(),
+      selectType:                  jest.fn(),
+      isCronJob:                   jest.fn(),
+      spec:                        jest.fn(),
+      isReplicable:                jest.fn(),
+      isStatefulSet:               jest.fn(),
+      headlessServices:            jest.fn(),
+      defaultTab:                  jest.fn(),
+      isPod:                       jest.fn(),
+      tabWeightMap:                jest.fn(),
+      podLabels:                   jest.fn(),
+      podTemplateSpec:             jest.fn(),
+      isLoadingSecondaryResources: jest.fn(),
+      allNodes:                    jest.fn(),
+      clearPvcFormState:           jest.fn(),
+      savePvcHookName:             jest.fn(),
+      namespacedConfigMaps:        jest.fn(),
+      podAnnotations:              jest.fn(),
+      isJob:                       jest.fn(),
+      namespacedSecrets:           jest.fn(),
+      registerBeforeHook:          jest.fn(),
+      pvcs:                        jest.fn(),
+    },
+    computed: { allContainers: jest.fn(() => []) }
+  };
 
-    const MockedWorkload = { ...Workload, mixins: [mockedValidationMixin, mockedCREMixin, mockedWorkloadMixin] };
-    const wrapper = shallowMount(MockedWorkload, {
-      props: {
-        value:         { metadata: {}, spec: { template: {} } },
-        params:        {},
-        fvFormIsValid: {}
-      },
+  describe('component: Workload', () => {
+    it.each([
+      [
+        `pods \"test\" is forbidden: violates PodSecurity \"restricted:latest\": allowPrivilegeEscalation != false (container \"container-0\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container \"container-0\" must set securityContext.capabilities.drop=[\"ALL\"]), runAsNonRoot != true (container \"container-0\" must not set securityContext.runAsNonRoot=false), seccompProfile (pod or container \"container-0\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")`,
+        `workload.error, \"test\",\"restricted:latest\"`
+      ]
+    ])('should map error message into object', (oldMessage, newMessage) => {
+    // For this test, allNodeObjects is just a jest.fn() in the base mixin
+      const MockedWorkload = { ...Workload, mixins: [baseMockedValidationMixin, baseMockedCREMixin, { ...baseMockedWorkloadMixin, computed: { ...baseMockedWorkloadMixin.computed, allNodeObjects: jest.fn() } }] };
+      const wrapper = shallowMount(MockedWorkload, {
+        props: {
+          value:         { metadata: {}, spec: { template: {} } },
+          params:        {},
+          fvFormIsValid: {}
+        },
 
-      global: {
-        mocks: {
-          $route:      { params: {}, query: {} },
-          $router:     { applyQuery: jest.fn() },
-          $fetchState: { pending: false },
-          $store:      {
-            getters: {
-              'cluster/schemaFor': jest.fn(),
-              'type-map/labelFor': jest.fn(),
-              'i18n/t':            (text: string, v: {[key:string]: string}) => {
-                return `${ text }, ${ Object.values(v || {}) }`;
+        global: {
+          mocks: {
+            $route:      { params: {}, query: {} },
+            $router:     { applyQuery: jest.fn() },
+            $fetchState: { pending: false },
+            $store:      {
+              getters: {
+                'cluster/schemaFor': jest.fn(),
+                'type-map/labelFor': jest.fn(),
+                'i18n/t':            (text: string, v: {[key:string]: string}) => {
+                  return `${ text }, ${ Object.values(v || {}) }`;
+                },
               },
             },
           },
-        },
 
-        stubs: {
-          Tab:                 true,
-          LabeledInput:        true,
-          VolumeClaimTemplate: true,
-          Networking:          true,
-          Job:                 true,
-          NodeScheduling:      true,
-          PodAffinity:         true,
-          Tolerations:         true,
-          Storage:             true,
-          Tabbed:              true,
-          LabeledSelect:       true,
-          NameNsDescription:   true,
-          CruResource:         true,
-          KeyValue:            true
+          stubs: {
+            Tab:                 true,
+            LabeledInput:        true,
+            VolumeClaimTemplate: true,
+            Networking:          true,
+            Job:                 true,
+            NodeScheduling:      true,
+            PodAffinity:         true,
+            Tolerations:         true,
+            Storage:             true,
+            Tabbed:              true,
+            LabeledSelect:       true,
+            NameNsDescription:   true,
+            CruResource:         true,
+            KeyValue:            true
+          },
         },
-      },
+      });
+
+      const result = (wrapper.vm as any).mapError(oldMessage).message;
+
+      expect(result).toStrictEqual(newMessage);
     });
 
-    const result = (wrapper.vm as any).mapError(oldMessage).message;
+    describe('secondaryResourceDataConfig', () => {
+      it('should filter out nodes with control-plane or etcd taints from workerNodes parsingFunc', () => {
+        const allNodeObjects = [
+          {
+            id:   'node-1',
+            spec: { taints: [{ key: 'node-role.kubernetes.io/control-plane', effect: 'NoSchedule' }] }
+          },
+          {
+            id:   'node-2',
+            spec: { taints: [{ key: 'node-role.kubernetes.io/etcd', effect: 'NoSchedule' }] }
+          },
+          {
+            id:   'node-3',
+            spec: { taints: [{ key: 'node-role.kubernetes.io/worker', effect: 'NoSchedule' }] }
+          },
+          {
+            id:   'node-4',
+            spec: { taints: [] }
+          },
+          {
+            id:   'node-5',
+            spec: {}
+          },
+          {
+            id:   'node-6',
+            spec: null
+          }
+        ];
+
+        const { data } = (Workload.mixins[2] as any).methods.secondaryResourceDataConfig.apply({ value: { metadata: { namespace: 'test' } } });
+        const workerNodesParsingFunc = data.node.applyTo.find((r: any) => r.var === 'workerNodes').parsingFunc;
+        const result = workerNodesParsingFunc(allNodeObjects);
 
-    expect(result).toStrictEqual(newMessage);
+        expect(result).toStrictEqual(['node-3', 'node-4', 'node-5', 'node-6']);
+      });
+    });
   });
 });

package/edit/workload/index.vue

@@ -3,6 +3,7 @@ import CreateEditView from '@shell/mixins/create-edit-view';
 import FormValidation from '@shell/mixins/form-validation';
 import WorkLoadMixin from '@shell/edit/workload/mixins/workload';
 import { mapGetters } from 'vuex';
+import { FORM_TYPES } from '@shell/components/form/Security';
 
 export default {
   name:   'Workload',
@@ -20,10 +21,22 @@ export default {
     },
   },
   data() {
-    return { selectedName: null, errors: [] };
+    return {
+      selectedName: null,
+      errors:       [],
+      FORM_TYPES
+    };
   },
-  computed: { ...mapGetters({ t: 'i18n/t' }) },
-  methods:  {
+  computed: {
+    ...mapGetters({ t: 'i18n/t' }),
+
+    isFormValid() {
+      const hasContainerErrors = this.allContainers.some(this.hasContainerError);
+
+      return this.fvFormIsValid && !hasContainerErrors;
+    }
+  },
+  methods: {
     changed(tab) {
       const key = this.idKey;
 
@@ -35,6 +48,10 @@ export default {
       }
     },
 
+    hasContainerError(tab) {
+      return Object.values(tab.error || {}).some((error) => !!error);
+    },
+
     /**
      * Find error exceptions to be mapped for each case
      */
@@ -81,7 +98,7 @@ export default {
     class="filled-height"
   >
     <CruResource
-      :validation-passed="fvFormIsValid"
+      :validation-passed="isFormValid"
       :selected-subtype="type"
       :resource="value"
       :mode="mode"
@@ -165,9 +182,10 @@ export default {
           :label="tab.name"
           :name="tab[idKey]"
           :weight="tab.weight"
-          :error="!!tab.error"
+          :error="hasContainerError(tab)"
         >
           <Tabbed
+            name="containerTabs"
             :side-tabs="true"
             :weight="99"
             :data-testid="`workload-container-tabs-${i}`"
@@ -177,7 +195,7 @@ export default {
               :label="t('workload.container.titles.general')"
               name="general"
               :weight="tabWeightMap['general']"
-              :error="tabErrors.general"
+              :error="!!tab.error.general"
             >
               <template
                 #tab-header-right
@@ -210,6 +228,7 @@ export default {
                       name="initContainer"
                       :options="[true, false]"
                       :labels="[t('workload.container.init'), t('workload.container.standard')]"
+                      :aria-label="t('workload.container.initContainer.label')"
                       @update:value="updateInitContainer($event, allContainers[i])"
                     />
                   </div>
@@ -222,7 +241,6 @@ export default {
                       :mode="mode"
                       :label="t('workload.container.image')"
                       :placeholder="t('generic.placeholder', {text: 'nginx:latest'}, true)"
-                      :rules="fvGetAndReportPathRules('image')"
                     />
                   </div>
                   <div class="col span-6">
@@ -334,10 +352,14 @@ export default {
               :label="t('workload.container.titles.securityContext')"
               name="securityContext"
               :weight="tabWeightMap['securityContext']"
+              :error="!!tab.error.localhostProfile"
             >
               <Security
+                ref="security"
                 v-model:value="allContainers[i].securityContext"
                 :mode="mode"
+                :seccomp-profile-types="seccompProfileTypes"
+                :form-type="FORM_TYPES.CONTAINER"
               />
             </Tab>
             <Tab
@@ -406,8 +428,10 @@ export default {
           :label="t('workload.tabs.labels.pod')"
           :name="'pod'"
           :weight="98"
+          :error="tabErrors.podSecurityContext"
         >
           <Tabbed
+            name="podTabs"
             data-testid="workload-pod-tabs"
             :side-tabs="true"
             :use-hash="useTabbedHash"
@@ -434,7 +458,7 @@ export default {
             </Tab>
             <Tab
               :label="t('workload.container.titles.resources')"
-              name="resources"
+              name="resources-pod"
               :weight="tabWeightMap['resources']"
             >
               <div>
@@ -476,7 +500,7 @@ export default {
             </Tab>
             <Tab
               :label="t('workload.container.titles.podScheduling')"
-              name="podScheduling"
+              name="podScheduling-pod"
               :weight="tabWeightMap['podScheduling']"
             >
               <PodAffinity
@@ -488,19 +512,19 @@ export default {
             </Tab>
             <Tab
               :label="t('workload.container.titles.nodeScheduling')"
-              name="nodeScheduling"
+              name="nodeScheduling-pod"
               :weight="tabWeightMap['nodeScheduling']"
             >
               <NodeScheduling
                 :mode="mode"
                 :value="podTemplateSpec"
-                :nodes="allNodes"
+                :nodes="workerNodes"
                 :loading="isLoadingSecondaryResources"
               />
             </Tab>
             <Tab
               :label="t('workload.container.titles.upgrading')"
-              name="upgrading"
+              name="upgrading-pod"
               :weight="tabWeightMap['upgrading']"
             >
               <Job
@@ -519,26 +543,21 @@ export default {
             </Tab>
             <Tab
               :label="t('workload.container.titles.securityContext')"
-              name="securityContext"
+              name="securityContext-pod"
               :weight="tabWeightMap['securityContext']"
+              :error="tabErrors.podSecurityContext"
             >
-              <div>
-                <h3>{{ t('workload.container.security.podFsGroup') }}</h3>
-                <div class="row">
-                  <div class="col span-6">
-                    <LabeledInput
-                      v-model:value.number="podFsGroup"
-                      type="number"
-                      :mode="mode"
-                      :label="t('workload.container.security.fsGroup')"
-                    />
-                  </div>
-                </div>
-              </div>
+              <Security
+                ref="security"
+                v-model:value="podTemplateSpec.securityContext"
+                :mode="mode"
+                :seccomp-profile-types="seccompProfileTypes"
+                :form-type="FORM_TYPES.POD"
+              />
             </Tab>
             <Tab
               :label="t('workload.container.titles.networking')"
-              name="networking"
+              name="networking-pod"
               :weight="tabWeightMap['networking']"
             >
               <Networking
@@ -549,7 +568,7 @@ export default {
             <Tab
               v-if="isStatefulSet"
               :label="t('workload.container.titles.volumeClaimTemplates')"
-              name="volumeClaimTemplates"
+              name="volumeClaimTemplates-pod"
               :weight="tabWeightMap['volumeClaimTemplates']"
             >
               <VolumeClaimTemplate
@@ -558,7 +577,7 @@ export default {
               />
             </Tab>
             <Tab
-              name="labels"
+              name="labels-pod"
               label-key="generic.labelsAndAnnotations"
               :weight="tabWeightMap['labels']"
             >