Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update LBC to 2.4.0 #13267

Merged
merged 1 commit into from
Feb 17, 2022
Merged

Update LBC to 2.4.0 #13267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions cmd/kops/integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -519,7 +519,7 @@ func TestAWSLBController(t *testing.T) {
withOIDCDiscovery().
withServiceAccountRole("dns-controller.kube-system", true).
withServiceAccountRole("aws-load-balancer-controller.kube-system", true).
withAddons("aws-load-balancer-controller.addons.k8s.io-k8s-1.9",
withAddons("aws-load-balancer-controller.addons.k8s.io-k8s-1.19",
"certmanager.io-k8s-1.16",
dnsControllerAddon).
runTestTerraformAWS(t)
Expand All @@ -528,7 +528,7 @@ func TestAWSLBController(t *testing.T) {
func TestManyAddons(t *testing.T) {
newIntegrationTest("minimal.example.com", "many-addons").
withAddons("aws-ebs-csi-driver.addons.k8s.io-k8s-1.17",
"aws-load-balancer-controller.addons.k8s.io-k8s-1.9",
"aws-load-balancer-controller.addons.k8s.io-k8s-1.19",
"certmanager.io-k8s-1.16",
"cluster-autoscaler.addons.k8s.io-k8s-1.15",
"networking.amazon-vpc-routed-eni-k8s-1.16",
Expand All @@ -549,7 +549,7 @@ func TestManyAddonsCCMIRSA(t *testing.T) {
withServiceAccountRole("aws-node-termination-handler.kube-system", true).
withAddons(
"aws-ebs-csi-driver.addons.k8s.io-k8s-1.17",
"aws-load-balancer-controller.addons.k8s.io-k8s-1.9",
"aws-load-balancer-controller.addons.k8s.io-k8s-1.19",
"certmanager.io-k8s-1.16",
"cluster-autoscaler.addons.k8s.io-k8s-1.15",
"networking.amazon-vpc-routed-eni-k8s-1.16",
Expand All @@ -564,12 +564,14 @@ func TestManyAddonsCCMIRSA(t *testing.T) {
func TestManyAddonsCCMIRSA23(t *testing.T) {
newIntegrationTest("minimal.example.com", "many-addons-ccm-irsa23").
withOIDCDiscovery().
withServiceAccountRole("aws-load-balancer-controller.kube-system", true).
withServiceAccountRole("dns-controller.kube-system", true).
withServiceAccountRole("aws-cloud-controller-manager.kube-system", true).
withServiceAccountRole("cluster-autoscaler.kube-system", true).
withServiceAccountRole("ebs-csi-controller-sa.kube-system", true).
withServiceAccountRole("aws-node-termination-handler.kube-system", true).
withAddons(
"aws-load-balancer-controller.addons.k8s.io-k8s-1.19",
"aws-ebs-csi-driver.addons.k8s.io-k8s-1.17",
"certmanager.io-k8s-1.16",
"cluster-autoscaler.addons.k8s.io-k8s-1.15",
Expand All @@ -587,7 +589,7 @@ func TestCCM(t *testing.T) {
newIntegrationTest("minimal.example.com", "many-addons-ccm").
withAddons(
"aws-ebs-csi-driver.addons.k8s.io-k8s-1.17",
"aws-load-balancer-controller.addons.k8s.io-k8s-1.9",
"aws-load-balancer-controller.addons.k8s.io-k8s-1.19",
"certmanager.io-k8s-1.16",
"cluster-autoscaler.addons.k8s.io-k8s-1.15",
"networking.amazon-vpc-routed-eni-k8s-1.16",
Expand Down
4 changes: 0 additions & 4 deletions pkg/apis/kops/validation/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,10 +159,6 @@ func validateClusterSpec(spec *kops.ClusterSpec, c *kops.Cluster, fieldPath *fie
allErrs = append(allErrs, validateKubelet(spec.MasterKubelet, c, fieldPath.Child("masterKubelet"))...)
}

if spec.AWSLoadBalancerController != nil && fi.BoolValue(spec.AWSLoadBalancerController.Enabled) && c.IsKubernetesGTE("1.22") {
allErrs = append(allErrs, field.Forbidden(fieldPath.Child("awsLoadBalancerController", "enabled"), "AWS load balancer controller is supported only for Kubernetes 1.21 and lower"))
}

if spec.Networking != nil {
allErrs = append(allErrs, validateNetworking(c, spec.Networking, fieldPath.Child("networking"))...)
if spec.Networking.Calico != nil {
Expand Down
4 changes: 0 additions & 4 deletions tests/e2e/scenarios/aws-lb-controller/run-test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,6 @@ OVERRIDES="${OVERRIDES} --set=cluster.spec.certManager.enabled=true"
# shellcheck disable=SC2034
ZONES="eu-west-1a,eu-west-1b,eu-west-1c"

# TODO remove when kops#11689 is addressed
K8S_VERSION="1.21.6"
export K8S_VERSION

kops-up

VPC=$(${KOPS} toolbox dump -o json | jq -r .vpc.id)
Expand Down
41 changes: 37 additions & 4 deletions ...-controller.addons.k8s.io-k8s-1.9_content → ...controller.addons.k8s.io-k8s-1.19_content
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -889,7 +889,7 @@ spec:
value: arn:aws-test:iam::123456789012:role/aws-load-balancer-controller.kube-system.sa.minimal.example.com
- name: AWS_WEB_IDENTITY_TOKEN_FILE
value: /var/run/secrets/amazonaws.com/token
image: amazon/aws-alb-ingress-controller:v2.3.1
image: amazon/aws-alb-ingress-controller:v2.4.0
livenessProbe:
failureThreshold: 2
httpGet:
Expand Down Expand Up @@ -926,7 +926,8 @@ spec:
serviceAccountName: aws-load-balancer-controller
terminationGracePeriodSeconds: 10
tolerations:
- operator: Exists
- key: node-role.kubernetes.io/master
operator: Exists
topologySpreadConstraints:
- labelSelector:
matchLabels:
Expand Down Expand Up @@ -1086,18 +1087,50 @@ webhooks:
service:
name: aws-load-balancer-webhook-service
namespace: kube-system
path: /validate-networking-v1beta1-ingress
path: /validate-networking-v1-ingress
failurePolicy: Fail
matchPolicy: Equivalent
name: vingress.elbv2.k8s.aws
rules:
- apiGroups:
- networking.k8s.io
apiVersions:
- v1beta1
- v1
operations:
- CREATE
- UPDATE
resources:
- ingresses
sideEffects: None

---

apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
creationTimestamp: null
labels:
addon.kops.k8s.io/name: aws-load-balancer-controller.addons.k8s.io
app.kubernetes.io/managed-by: kops
app.kubernetes.io/name: aws-load-balancer-controller
k8s-addon: aws-load-balancer-controller.addons.k8s.io
name: alb

---

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
creationTimestamp: null
labels:
addon.kops.k8s.io/name: aws-load-balancer-controller.addons.k8s.io
app.kubernetes.io/managed-by: kops
app.kubernetes.io/name: aws-load-balancer-controller
k8s-addon: aws-load-balancer-controller.addons.k8s.io
name: alb
spec:
controller: ingress.k8s.aws/alb
parameters:
apiGroup: elbv2.k8s.aws
kind: IngressClassParams
name: alb
6 changes: 3 additions & 3 deletions .../aws-lb-controller/data/aws_s3_bucket_object_minimal.example.com-addons-bootstrap_content
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,9 +51,9 @@ spec:
name: certmanager.io
selector: null
version: 9.99.0
- id: k8s-1.9
manifest: aws-load-balancer-controller.addons.k8s.io/k8s-1.9.yaml
manifestHash: 1bb026be85f6a5a3fd73d996e3f5bb33df7c5eb9dc859347d55ec2ae4c97949e
- id: k8s-1.19
manifest: aws-load-balancer-controller.addons.k8s.io/k8s-1.19.yaml
manifestHash: a26e4a85ef790c4c02077118857d90a856ab6bc219ac895af8ee458485e6c0b2
name: aws-load-balancer-controller.addons.k8s.io
needsPKI: true
selector:
Expand Down
6 changes: 3 additions & 3 deletions tests/integration/update_cluster/aws-lb-controller/kubernetes.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -634,10 +634,10 @@ resource "aws_s3_bucket_object" "manifests-static-kube-apiserver-healthcheck" {
server_side_encryption = "AES256"
}

resource "aws_s3_bucket_object" "minimal-example-com-addons-aws-load-balancer-controller-addons-k8s-io-k8s-1-9" {
resource "aws_s3_bucket_object" "minimal-example-com-addons-aws-load-balancer-controller-addons-k8s-io-k8s-1-19" {
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_minimal.example.com-addons-aws-load-balancer-controller.addons.k8s.io-k8s-1.9_content")
key = "clusters.example.com/minimal.example.com/addons/aws-load-balancer-controller.addons.k8s.io/k8s-1.9.yaml"
content = file("${path.module}/data/aws_s3_bucket_object_minimal.example.com-addons-aws-load-balancer-controller.addons.k8s.io-k8s-1.19_content")
key = "clusters.example.com/minimal.example.com/addons/aws-load-balancer-controller.addons.k8s.io/k8s-1.19.yaml"
provider = aws.files
server_side_encryption = "AES256"
}
Expand Down
41 changes: 37 additions & 4 deletions ...-controller.addons.k8s.io-k8s-1.9_content → ...controller.addons.k8s.io-k8s-1.19_content
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -889,7 +889,7 @@ spec:
value: arn:aws-test:iam::123456789012:role/aws-load-balancer-controller.kube-system.sa.minimal.example.com
- name: AWS_WEB_IDENTITY_TOKEN_FILE
value: /var/run/secrets/amazonaws.com/token
image: amazon/aws-alb-ingress-controller:v2.3.1
image: amazon/aws-alb-ingress-controller:v2.4.0
livenessProbe:
failureThreshold: 2
httpGet:
Expand Down Expand Up @@ -926,7 +926,8 @@ spec:
serviceAccountName: aws-load-balancer-controller
terminationGracePeriodSeconds: 10
tolerations:
- operator: Exists
- key: node-role.kubernetes.io/master
operator: Exists
topologySpreadConstraints:
- labelSelector:
matchLabels:
Expand Down Expand Up @@ -1086,18 +1087,50 @@ webhooks:
service:
name: aws-load-balancer-webhook-service
namespace: kube-system
path: /validate-networking-v1beta1-ingress
path: /validate-networking-v1-ingress
failurePolicy: Fail
matchPolicy: Equivalent
name: vingress.elbv2.k8s.aws
rules:
- apiGroups:
- networking.k8s.io
apiVersions:
- v1beta1
- v1
operations:
- CREATE
- UPDATE
resources:
- ingresses
sideEffects: None

---

apiVersion: elbv2.k8s.aws/v1beta1
kind: IngressClassParams
metadata:
creationTimestamp: null
labels:
addon.kops.k8s.io/name: aws-load-balancer-controller.addons.k8s.io
app.kubernetes.io/managed-by: kops
app.kubernetes.io/name: aws-load-balancer-controller
k8s-addon: aws-load-balancer-controller.addons.k8s.io
name: alb

---

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
creationTimestamp: null
labels:
addon.kops.k8s.io/name: aws-load-balancer-controller.addons.k8s.io
app.kubernetes.io/managed-by: kops
app.kubernetes.io/name: aws-load-balancer-controller
k8s-addon: aws-load-balancer-controller.addons.k8s.io
name: alb
spec:
controller: ingress.k8s.aws/alb
parameters:
apiGroup: elbv2.k8s.aws
kind: IngressClassParams
name: alb
6 changes: 3 additions & 3 deletions ...ny-addons-ccm-irsa/data/aws_s3_bucket_object_minimal.example.com-addons-bootstrap_content
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,9 +101,9 @@ spec:
selector:
k8s-addon: node-termination-handler.aws
version: 9.99.0
- id: k8s-1.9
manifest: aws-load-balancer-controller.addons.k8s.io/k8s-1.9.yaml
manifestHash: 1bb026be85f6a5a3fd73d996e3f5bb33df7c5eb9dc859347d55ec2ae4c97949e
- id: k8s-1.19
manifest: aws-load-balancer-controller.addons.k8s.io/k8s-1.19.yaml
manifestHash: a26e4a85ef790c4c02077118857d90a856ab6bc219ac895af8ee458485e6c0b2
name: aws-load-balancer-controller.addons.k8s.io
needsPKI: true
selector:
Expand Down
6 changes: 3 additions & 3 deletions tests/integration/update_cluster/many-addons-ccm-irsa/kubernetes.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -754,10 +754,10 @@ resource "aws_s3_bucket_object" "minimal-example-com-addons-aws-ebs-csi-driver-a
server_side_encryption = "AES256"
}

resource "aws_s3_bucket_object" "minimal-example-com-addons-aws-load-balancer-controller-addons-k8s-io-k8s-1-9" {
resource "aws_s3_bucket_object" "minimal-example-com-addons-aws-load-balancer-controller-addons-k8s-io-k8s-1-19" {
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_minimal.example.com-addons-aws-load-balancer-controller.addons.k8s.io-k8s-1.9_content")
key = "clusters.example.com/minimal.example.com/addons/aws-load-balancer-controller.addons.k8s.io/k8s-1.9.yaml"
content = file("${path.module}/data/aws_s3_bucket_object_minimal.example.com-addons-aws-load-balancer-controller.addons.k8s.io-k8s-1.19_content")
key = "clusters.example.com/minimal.example.com/addons/aws-load-balancer-controller.addons.k8s.io/k8s-1.19.yaml"
provider = aws.files
server_side_encryption = "AES256"
}
Expand Down
17 changes: 17 additions & 0 deletions .../data/aws_iam_role_aws-load-balancer-controller.kube-system.sa.minimal.example.com_policy
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{
"Statement": [
{
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"discovery.example.com/minimal.example.com:sub": "system:serviceaccount:kube-system:aws-load-balancer-controller"
}
},
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws-test:iam::123456789012:oidc-provider/discovery.example.com/minimal.example.com"
}
}
],
"Version": "2012-10-17"
}
40 changes: 40 additions & 0 deletions ...ws_iam_role_policy_aws-load-balancer-controller.kube-system.sa.minimal.example.com_policy
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
{
"Statement": [
{
"Action": [
"acm:DescribeCertificate",
"acm:ListCertificates",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeNetworkInterfaces",
"elasticloadbalancing:CreateRule",
"elasticloadbalancing:DescribeListenerCertificates",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:DescribeTargetHealth"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteSecurityGroup",
"ec2:RevokeSecurityGroupIngress",
"elasticloadbalancing:AddTags",
"elasticloadbalancing:DeleteRule",
"elasticloadbalancing:ModifyRule",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:RemoveTags"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/KubernetesCluster": "minimal.example.com"
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
2 changes: 2 additions & 0 deletions ...e_cluster/many-addons-ccm-irsa23/data/aws_s3_bucket_object_cluster-completed.spec_content
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ spec:
dns: {}
authorization:
alwaysAllow: {}
awsLoadBalancerController:
enabled: true
certManager:
enabled: true
channel: stable
Expand Down
Loading