Skip to content

Commit 3c1c5f2

Browse files
oliverbaehleroliverbaehler
authored
feat: kubernetes bump and helm improvements (#1634)
* feat(helm): add label and annotation vaules Signed-off-by: Oliver Bähler <[email protected]> * chore: remove harpoon from workflows Signed-off-by: Oliver Bähler <[email protected]> * feat(helm): extend podlabels to crd jobs Signed-off-by: Oliver Bähler <[email protected]> * feat: bump kubernetes 1.34 Signed-off-by: Oliver Bähler <[email protected]> * feat(helm): extend podlabels to crd jobs Signed-off-by: Oliver Bähler <[email protected]> * feat(helm): extend podlabels to crd jobs Signed-off-by: Oliver Bähler <[email protected]> * feat: bump kubernetes 1.34 Signed-off-by: Oliver Bähler <[email protected]> --------- Signed-off-by: Oliver Bähler <[email protected]>
1 parent 7613886 commit 3c1c5f2

File tree

15 files changed

+424
-430
lines changed

15 files changed

+424
-430
lines changed

‎.github/workflows/e2e.yml‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,5 @@ jobs:
3535
- uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4
3636
with:
3737
version: v3.14.2
38-
- name: unit tracing
39-
run: sudo make trace-unit
40-
- name: e2e tracing
41-
run: sudo make trace-e2e
42-
- name: build seccomp profile
43-
run: make seccomp
44-
- name: upload artifact
45-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
46-
with:
47-
name: capsule-seccomp
48-
path: capsule-seccomp.json
38+
- name: e2e
39+
run: sudo make e2e

‎.github/workflows/releaser.yml‎

Lines changed: 0 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -11,41 +11,7 @@ concurrency:
1111
cancel-in-progress: true
1212

1313
jobs:
14-
seccomp-generation:
15-
name: Seccomp Generation
16-
strategy:
17-
fail-fast: false
18-
matrix:
19-
# differently from the e2e workflow
20-
# we don't need all the versions of kubernetes
21-
# to generate the seccomp profile.
22-
k8s-version:
23-
- "v1.30.0"
24-
runs-on: ubuntu-latest-8-cores
25-
steps:
26-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
27-
with:
28-
fetch-depth: 0
29-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
30-
with:
31-
go-version-file: 'go.mod'
32-
- uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4
33-
with:
34-
version: v3.14.2
35-
- name: unit tracing
36-
run: sudo make trace-unit
37-
- name: e2e tracing
38-
run: sudo KIND_K8S_VERSION=${{ matrix.k8s-version }} make trace-e2e
39-
- name: build seccomp profile
40-
run: make seccomp
41-
- name: upload artifact
42-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
43-
with:
44-
name: capsule-seccomp
45-
path: capsule-seccomp.json
46-
4714
create-release:
48-
needs: seccomp-generation
4915
runs-on: ubuntu-latest
5016
permissions:
5117
contents: write
@@ -67,11 +33,6 @@ jobs:
6733
- uses: anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c
6834
- name: Install Cosign
6935
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
70-
- name: download artifact
71-
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
72-
with:
73-
name: capsule-seccomp
74-
path: ./capsule-seccomp.json
7536
- name: Run GoReleaser
7637
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
7738
with:

‎.goreleaser.yml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,12 +73,10 @@ release:
7373
>
7474
> | Kubernetes version | Minimum required |
7575
> |--------------------|------------------|
76-
> | `v1.33` | `>= 1.33.0` |
76+
> | `v1.34` | `>= 1.34.0` |
7777
7878
7979
Thanks to all the contributors! 🚀 🦄
80-
extra_files:
81-
- glob: ./capsule-seccomp.json
8280
checksum:
8381
name_template: 'checksums.txt'
8482
changelog:

‎charts/capsule/README.md‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,17 @@ The following Values have changed key or Value:
3535
| Key | Type | Default | Description |
3636
|-----|------|---------|-------------|
3737
| global.jobs.kubectl.affinity | object | `{}` | Set affinity rules |
38-
| global.jobs.kubectl.annotations | object | `{}` | Annotations to add to the certgen job. |
38+
| global.jobs.kubectl.annotations | object | `{}` | Annotations to add to the job. |
3939
| global.jobs.kubectl.backoffLimit | int | `4` | Backofflimit for jobs |
4040
| global.jobs.kubectl.image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy of the helm chart job |
4141
| global.jobs.kubectl.image.registry | string | `"docker.io"` | Set the image repository of the helm chart job |
4242
| global.jobs.kubectl.image.repository | string | `"clastix/kubectl"` | Set the image repository of the helm chart job |
4343
| global.jobs.kubectl.image.tag | string | `""` | Set the image tag of the helm chart job |
4444
| global.jobs.kubectl.imagePullSecrets | list | `[]` | ImagePullSecrets |
45+
| global.jobs.kubectl.labels | object | `{}` | Labels to add to the job. |
4546
| global.jobs.kubectl.nodeSelector | object | `{}` | Set the node selector |
47+
| global.jobs.kubectl.podAnnotations | object | `{}` | Annotations to add to the job pod |
48+
| global.jobs.kubectl.podLabels | object | `{}` | Labels to add to the job pod |
4649
| global.jobs.kubectl.podSecurityContext | object | `{"enabled":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the job pods. |
4750
| global.jobs.kubectl.priorityClassName | string | `""` | Set a pod priorityClassName |
4851
| global.jobs.kubectl.resources | object | `{}` | Job resources |
@@ -65,6 +68,7 @@ The following Values have changed key or Value:
6568
| jobs | object | `{}` | Deprecated, use .global.jobs.kubectl instead |
6669
| nodeSelector | object | `{}` | Set the node selector for the Capsule pod |
6770
| podAnnotations | object | `{}` | Annotations to add to the capsule pod. |
71+
| podLabels | object | `{}` | Labels to add to the capsule pod. |
6872
| podSecurityContext | object | `{"enabled":true,"runAsGroup":1002,"runAsNonRoot":true,"runAsUser":1002,"seccompProfile":{"type":"RuntimeDefault"}}` | Set the securityContext for the Capsule pod |
6973
| ports | list | `[]` | Set additional ports for the deployment |
7074
| priorityClassName | string | `""` | Set the priority class name of the Capsule pod |
@@ -88,8 +92,13 @@ The following Values have changed key or Value:
8892

8993
| Key | Type | Default | Description |
9094
|-----|------|---------|-------------|
95+
| manager.daemonsetStrategy | object | `{"type":"RollingUpdate"}` | [Daemonset Strategy](https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/#creating-a-daemonset-with-rollingupdate-update-strategy) |
96+
| manager.deploymentStrategy | object | `{"type":"RollingUpdate"}` | [Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) |
97+
| manager.env | list | `[]` | Additional Environment Variables |
98+
| manager.extraArgs | list | `["--enable-leader-election=true"]` | A list of extra arguments for the capsule controller |
9199
| manager.hostNetwork | bool | `false` | Specifies if the container should be started in hostNetwork mode. Required for use in some managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico), because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working |
92100
| manager.hostPID | bool | `false` | Specifies if the container should be started in hostPID mode. |
101+
| manager.hostUsers | bool | `true` | Don't use Host Users (User Namespaces) |
93102
| manager.image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy. |
94103
| manager.image.registry | string | `"ghcr.io"` | Set the image registry of capsule. |
95104
| manager.image.repository | string | `"projectcapsule/capsule"` | Set the image repository of capsule. |

‎charts/capsule/crds/capsule.clastix.io_tenants.yaml‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -700,11 +700,11 @@ spec:
700700
podSelector:
701701
description: |-
702702
podSelector selects the pods to which this NetworkPolicy object applies.
703-
The array of ingress rules is applied to any pods selected by this field.
703+
The array of rules is applied to any pods selected by this field. An empty
704+
selector matches all pods in the policy's namespace.
704705
Multiple network policies can select the same set of pods. In this case,
705706
the ingress rules for each are combined additively.
706-
This field is NOT optional and follows standard label selector semantics.
707-
An empty podSelector matches all pods in this namespace.
707+
This field is optional. If it is not specified, it defaults to an empty selector.
708708
properties:
709709
matchExpressions:
710710
description: matchExpressions is a list of label selector
@@ -768,8 +768,6 @@ spec:
768768
type: string
769769
type: array
770770
x-kubernetes-list-type: atomic
771-
required:
772-
- podSelector
773771
type: object
774772
type: array
775773
type: object
@@ -1928,11 +1926,11 @@ spec:
19281926
podSelector:
19291927
description: |-
19301928
podSelector selects the pods to which this NetworkPolicy object applies.
1931-
The array of ingress rules is applied to any pods selected by this field.
1929+
The array of rules is applied to any pods selected by this field. An empty
1930+
selector matches all pods in the policy's namespace.
19321931
Multiple network policies can select the same set of pods. In this case,
19331932
the ingress rules for each are combined additively.
1934-
This field is NOT optional and follows standard label selector semantics.
1935-
An empty podSelector matches all pods in this namespace.
1933+
This field is optional. If it is not specified, it defaults to an empty selector.
19361934
properties:
19371935
matchExpressions:
19381936
description: matchExpressions is a list of label selector
@@ -1996,8 +1994,6 @@ spec:
19961994
type: string
19971995
type: array
19981996
x-kubernetes-list-type: atomic
1999-
required:
2000-
- podSelector
20011997
type: object
20021998
type: array
20031999
type: object

‎charts/capsule/templates/_pod.tpl‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
{{- define "capsule.pod" -}}
2+
metadata:
3+
{{- with .Values.podAnnotations }}
4+
annotations:
5+
{{- toYaml . | nindent 4 }}
6+
{{- end }}
7+
labels:
8+
{{- include "capsule.labels" . | nindent 4 }}
9+
{{- with .Values.podLabels }}
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
spec:
13+
{{- with .Values.imagePullSecrets }}
14+
imagePullSecrets:
15+
{{- toYaml . | nindent 4 }}
16+
{{- end }}
17+
serviceAccountName: {{ include "capsule.serviceAccountName" . }}
18+
{{- if .Values.podSecurityContext.enabled }}
19+
securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 4 }}
20+
{{- end }}
21+
hostUsers: {{ .Values.manager.hostUsers }}
22+
{{- if .Values.manager.hostNetwork }}
23+
hostNetwork: true
24+
dnsPolicy: ClusterFirstWithHostNet
25+
{{- end }}
26+
{{- if .Values.manager.hostPID }}
27+
hostPID: {{ .Values.manager.hostPID }}
28+
{{- else }}
29+
hostPID: false
30+
{{- end }}
31+
priorityClassName: {{ .Values.priorityClassName }}
32+
{{- with .Values.nodeSelector }}
33+
nodeSelector:
34+
{{- toYaml . | nindent 4 }}
35+
{{- end }}
36+
{{- with .Values.tolerations }}
37+
tolerations:
38+
{{- toYaml . | nindent 4 }}
39+
{{- end }}
40+
{{- with .Values.affinity }}
41+
affinity:
42+
{{- toYaml . | nindent 4 }}
43+
{{- end }}
44+
{{- with .Values.topologySpreadConstraints }}
45+
topologySpreadConstraints:
46+
{{- toYaml . | nindent 4 }}
47+
{{- end }}
48+
volumes:
49+
- name: cert
50+
secret:
51+
defaultMode: 420
52+
secretName: {{ include "capsule.secretTlsName" . }}
53+
{{- if .Values.manager.volumes }}
54+
{{- toYaml .Values.manager.volumes | nindent 4 }}
55+
{{- end }}
56+
containers:
57+
- name: manager
58+
args:
59+
- --webhook-port={{ .Values.manager.webhookPort }}
60+
- --zap-log-level={{ default 4 .Values.manager.options.logLevel }}
61+
- --configuration-name={{ .Values.manager.options.capsuleConfiguration }}
62+
{{- with .Values.manager.extraArgs }}
63+
{{- toYaml . | nindent 8 }}
64+
{{- end }}
65+
image: {{ include "capsule.managerFullyQualifiedDockerImage" . }}
66+
imagePullPolicy: {{ .Values.manager.image.pullPolicy }}
67+
env:
68+
- name: NAMESPACE
69+
valueFrom:
70+
fieldRef:
71+
fieldPath: metadata.namespace
72+
{{- with .Values.manager.env }}
73+
{{- toYaml . | nindent 6 }}
74+
{{- end }}
75+
ports:
76+
{{- if not (.Values.manager.hostNetwork) }}
77+
- name: webhook-server
78+
containerPort: {{ .Values.manager.webhookPort }}
79+
protocol: TCP
80+
- name: metrics
81+
containerPort: 8080
82+
protocol: TCP
83+
- name: health-api
84+
containerPort: 10080
85+
protocol: TCP
86+
{{- end }}
87+
{{- with .Values.manager.ports }}
88+
{{- . | nindent 8 }}
89+
{{- end }}
90+
livenessProbe:
91+
{{- toYaml .Values.manager.livenessProbe | nindent 8 }}
92+
readinessProbe:
93+
{{- toYaml .Values.manager.readinessProbe | nindent 8 }}
94+
volumeMounts:
95+
- mountPath: /tmp/k8s-webhook-server/serving-certs
96+
name: cert
97+
readOnly: true
98+
{{- if .Values.manager.volumeMounts }}
99+
{{- toYaml .Values.manager.volumeMounts | nindent 8 }}
100+
{{- end }}
101+
resources:
102+
{{- toYaml .Values.manager.resources | nindent 8 }}
103+
{{- if .Values.manager.securityContext }}
104+
securityContext:
105+
{{- omit .Values.manager.securityContext "enabled" | toYaml | nindent 8 }}
106+
{{- else if .Values.securityContext.enabled }}
107+
securityContext:
108+
{{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }}
109+
{{- end }}
110+
{{- end -}}

‎charts/capsule/templates/crd-lifecycle/job.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,31 @@ metadata:
1717
labels:
1818
app.kubernetes.io/component: {{ include "capsule.crds.component" . | quote }}
1919
{{- include "capsule.labels" . | nindent 4 }}
20+
{{- with $Values.labels }}
21+
{{- . | toYaml | nindent 4 }}
22+
{{- end }}
2023
spec:
2124
backoffLimit: {{ $Values.backoffLimit }}
2225
ttlSecondsAfterFinished: {{ $Values.ttlSecondsAfterFinished }}
2326
template:
2427
metadata:
2528
name: "{{ include "capsule.crds.name" . }}"
29+
annotations:
30+
{{- with $Values.podAnnotations }}
31+
{{- toYaml . | nindent 8 }}
32+
{{- end }}
33+
{{- with $.Values.podAnnotations }}
34+
{{- toYaml . | nindent 8 }}
35+
{{- end }}
2636
labels:
2737
app.kubernetes.io/component: {{ include "capsule.crds.component" . | quote }}
2838
{{- include "capsule.selectorLabels" . | nindent 8 }}
39+
{{- with $Values.podLabels }}
40+
{{- toYaml . | nindent 8 }}
41+
{{- end }}
42+
{{- with $.Values.podLabels }}
43+
{{- toYaml . | nindent 8 }}
44+
{{- end }}
2945
spec:
3046
restartPolicy: {{ $Values.restartPolicy }}
3147
{{- if $Values.podSecurityContext.enabled }}

0 commit comments

Comments
 (0)