Upgrade Role's apiVersion

[haf]

customresourcedefinition.apiextensions.k8s.io/sealedsecrets.bitnami.com configured
serviceaccount/sealed-secrets-controller unchanged
Warning: rbac.authorization.k8s.io/v1beta1 Role is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 Role
role.rbac.authorization.k8s.io/sealed-secrets-key-admin unchanged
role.rbac.authorization.k8s.io/sealed-secrets-service-proxier unchanged
Warning: rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole
clusterrole.rbac.authorization.k8s.io/secrets-unsealer unchanged
Warning: rbac.authorization.k8s.io/v1beta1 RoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 RoleBinding
rolebinding.rbac.authorization.k8s.io/sealed-secrets-controller unchanged
rolebinding.rbac.authorization.k8s.io/sealed-secrets-service-proxier unchanged
Warning: rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding
clusterrolebinding.rbac.authorization.k8s.io/sealed-secrets-controller unchanged

Like the warnings say

[dewe]

• Migrate manifests and API clients to use the rbac.authorization.k8s.io/v1 API version, available since v1.8.
• All existing persisted objects are accessible via the new APIs
• No notable changes

https://kubernetes.io/docs/reference/using-api/deprecation-guide/#rbac-resources-v122

[chriscardillo]

Thanks for raising this issue.

I am still a little confused. Does that mean sealed-secrets 0.16.0 will not work with k8s 1.22+ currently until the manifests are updated?

[haf]

The manifests with the old versions will stop working yes. If they have already been applied and GKE performs the upgrade on its own it means the existing code will also stop working immediately.

[dosmanak]

Is it correct the fix is single sed command?

[cawolf]

@dosmanak do you want to provide a PR for this?

[dosmanak]

Awaiting aproval to run the tests in PR #627

[xak2000]

AFAIK, GKE clusters will soon be updated to Kubernetes v1.22 in stable branch, so this issue is pretty important.

Btw, the issue name is strange to me: it's not about "Role's namespace". It's about deprecated api version. :)

[dosmanak]

Awaiting aproval to run the tests in PR #627

A month later I still wait for approval to run the tests etc. Anyone with particular permission, please respond.

[chriscardillo]

@dosmanak - I tested #627 and it looks good as best I can tell. Awaiting word from @mkmik.

[benreynolds-drizly]

Would love to see this change released ASAP.

[dosmanak]

#627 has been merged after some procedural strugle. @haf you can close the issue finally 🥳.