Merge branch 'main' into annotations

* main: Upgrade runtimes bases (kyma-project#16714) Enable managed fluent-bit (kyma-project#16668) Fix content-type header check in python runtime (kyma-project#16706) Adding configuration to debug python function and example of custom HTTP response in python to docs (kyma-project#16669) # Conflicts: # components/telemetry-operator/config/rbac/role.yaml # resources/telemetry/charts/fluent-bit/templates/service.yaml # resources/telemetry/charts/fluent-bit/values.yaml # resources/telemetry/charts/operator/templates/fluent-bit/service-monitor.yaml # resources/telemetry/charts/operator/templates/role.yaml # resources/telemetry/values.yaml
a-thaler · Feb 2, 2023 · 1507287 · 1507287
2 parents a39fdd6 + 93374cd
commit 1507287
Show file tree

Hide file tree

Showing 46 changed files with 647 additions and 1,399 deletions.
diff --git a/components/function-runtimes/nodejs14/Dockerfile b/components/function-runtimes/nodejs14/Dockerfile
@@ -26,8 +26,8 @@
 # We use this code to manually use newest alpine and nodejs.
 # Use official build when it will be available.
 
-# image base on alpine:3.17.0
-FROM alpine@sha256:c0d488a800e4127c334ad20d61d7bc21b4097540327217dfab52262adc02380c
+# image base on alpine:3.17.1
+FROM alpine@sha256:93d5a28ff72d288d69b5997b8ba47396d2cbb62a72b5d87cd3351094b5d578a0
 
 ENV NODE_VERSION 14.21.2
 

diff --git a/components/function-runtimes/nodejs16/Dockerfile b/components/function-runtimes/nodejs16/Dockerfile
@@ -1,7 +1,6 @@
 # image base on 16.19.0-alpine3.17
 FROM node@sha256:e427ffd1ba7915ca8d8aeba45806ef3f1f1e6b65ce152b363645cd7428f8d75a
 
-
 ARG NODE_ENV
 ENV NODE_ENV $NODE_ENV
 ENV npm_config_cache /tmp/

diff --git a/components/function-runtimes/python39/Dockerfile b/components/function-runtimes/python39/Dockerfile
@@ -7,8 +7,8 @@
 # We use this code to manually use newest alpine and nodejs.
 # Use official build when it will be available.
 
-# image base on alpine:3.17.0
-FROM alpine@sha256:c0d488a800e4127c334ad20d61d7bc21b4097540327217dfab52262adc02380c
+# image base on alpine:3.17.1
+FROM alpine@sha256:93d5a28ff72d288d69b5997b8ba47396d2cbb62a72b5d87cd3351094b5d578a0
 
 SHELL ["/bin/ash", "-o", "pipefail", "-c"]
 

diff --git a/components/function-runtimes/python39/kubeless/kubeless.py b/components/function-runtimes/python39/kubeless/kubeless.py
@@ -103,7 +103,7 @@ def handler():
             t.start()
             try:
                 res = que.get(block=True, timeout=timeout)
-                if hasattr(res, 'headers') and res.headers["content-type"]:
+                if hasattr(res, 'headers') and 'content-type' in res.headers:
                     bottle.response.content_type = res.headers["content-type"]
             except queue.Empty:
                 return bottle.HTTPError(408, "Timeout while processing the function")

diff --git a/components/telemetry-operator/config/rbac/role.yaml b/components/telemetry-operator/config/rbac/role.yaml
@@ -10,36 +10,48 @@ rules:
   resources:
   - configmaps
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
   - watch
 - apiGroups:
   - ""
   resources:
   - secrets
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+  - list
   - watch
 - apiGroups:
   - ""
   resources:
   - services
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - admissionregistration.k8s.io
@@ -53,18 +65,30 @@ rules:
   resources:
   - daemonsets
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - apps
   resources:
   - deployments
   verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - replicasets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrolebindings
+  verbs:
   - create
   - delete
   - get
@@ -73,12 +97,16 @@ rules:
   - update
   - watch
 - apiGroups:
-  - apps
+  - rbac.authorization.k8s.io
   resources:
-  - replicasets
+  - clusterroles
   verbs:
+  - create
+  - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - telemetry.kyma-project.io
@@ -152,3 +180,80 @@ rules:
   - get
   - patch
   - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  creationTimestamp: null
+  name: manager-role
+  namespace: kyma-system
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - daemonsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
diff --git a/components/telemetry-operator/controller/logpipeline/controller.go b/components/telemetry-operator/controller/logpipeline/controller.go
@@ -35,16 +35,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
 )
 
-const checksumAnnotationKey = "checksum/logpipeline-config"
-
 type Config struct {
 	DaemonSet         types.NamespacedName
 	SectionsConfigMap types.NamespacedName
 	FilesConfigMap    types.NamespacedName
 	EnvSecret         types.NamespacedName
 	OverrideConfigMap types.NamespacedName
 	PipelineDefaults  configbuilder.PipelineDefaults
-	ManageFluentBit   bool
 	Overrides         overrides.Config
 }
 
@@ -62,19 +59,17 @@ type Reconciler struct {
 	client.Client
 	config                  Config
 	prober                  DaemonSetProber
-	annotator               DaemonSetAnnotator
 	allLogPipelines         prometheus.Gauge
 	unsupportedLogPipelines prometheus.Gauge
 	syncer                  syncer
 	globalConfig            overrides.GlobalConfigHandler
 }
 
-func NewReconciler(client client.Client, config Config, prober DaemonSetProber, annotator DaemonSetAnnotator, handler *overrides.Handler) *Reconciler {
+func NewReconciler(client client.Client, config Config, prober DaemonSetProber, handler *overrides.Handler) *Reconciler {
 	var r Reconciler
 	r.Client = client
 	r.config = config
 	r.prober = prober
-	r.annotator = annotator
 	r.allLogPipelines = prometheus.NewGauge(prometheus.GaugeOpts{Name: "telemetry_all_logpipelines", Help: "Number of log pipelines."})
 	r.unsupportedLogPipelines = prometheus.NewGauge(prometheus.GaugeOpts{Name: "telemetry_unsupported_logpipelines", Help: "Number of log pipelines with custom filters or outputs."})
 	metrics.Registry.MustRegister(r.allLogPipelines, r.unsupportedLogPipelines)
@@ -130,37 +125,43 @@ func (r *Reconciler) doReconcile(ctx context.Context, pipeline *telemetryv1alpha
 		return err
 	}
 
-	if r.config.ManageFluentBit {
-		name := r.config.DaemonSet
-		if err = r.reconcileFluentBit(ctx, name, pipeline); err != nil {
-			return err
-		}
-	}
-
 	if err = r.syncer.syncFluentBitConfig(ctx, pipeline); err != nil {
 		return err
 	}
 
-	if err = cleanupFinalizersIfNeeded(ctx, r.Client, pipeline); err != nil {
+	var checksum string
+	if checksum, err = r.calculateChecksum(ctx); err != nil {
 		return err
 	}
 
-	var checksum string
-	if checksum, err = r.calculateChecksum(ctx); err != nil {
+	name := r.config.DaemonSet
+	if err = r.reconcileFluentBit(ctx, name, pipeline, checksum); err != nil {
 		return err
 	}
 
-	if err = r.annotator.SetAnnotation(ctx, r.config.DaemonSet, checksumAnnotationKey, checksum); err != nil {
+	if err = cleanupFinalizersIfNeeded(ctx, r.Client, pipeline); err != nil {
 		return err
 	}
 
 	return err
 }
 
-func (r *Reconciler) reconcileFluentBit(ctx context.Context, name types.NamespacedName, pipeline *telemetryv1alpha1.LogPipeline) error {
+func (r *Reconciler) reconcileFluentBit(ctx context.Context, name types.NamespacedName, pipeline *telemetryv1alpha1.LogPipeline, checksum string) error {
 	if isNotMarkedForDeletion(pipeline) {
-		ds := resources.MakeDaemonSet(name)
-		if err := utils.CreateOrUpdateDaemonSet(ctx, r, ds); err != nil {
+		serviceAccount := resources.MakeServiceAccount(name)
+		if err := utils.CreateOrUpdateServiceAccount(ctx, r, serviceAccount); err != nil {
+			return fmt.Errorf("failed to create fluent bit service account: %w", err)
+		}
+		clusterRole := resources.MakeClusterRole(name)
+		if err := utils.CreateOrUpdateClusterRole(ctx, r, clusterRole); err != nil {
+			return fmt.Errorf("failed to create fluent bit cluster role: %w", err)
+		}
+		clusterRoleBinding := resources.MakeClusterRoleBinding(name)
+		if err := utils.CreateOrUpdateClusterRoleBinding(ctx, r, clusterRoleBinding); err != nil {
+			return fmt.Errorf("failed to create fluent bit cluster role Binding: %w", err)
+		}
+		daemonSet := resources.MakeDaemonSet(name, checksum)
+		if err := utils.CreateOrUpdateDaemonSet(ctx, r, daemonSet); err != nil {
 			return fmt.Errorf("failed to reconcile fluent bit daemonset: %w", err)
 		}
 		exporterMetricsService := resources.MakeExporterMetricsService(name)