Skip to content

Commit 51ad8b0

Browse files
agoose77agoose77
authored
feat: add skip-crds flag for support deployment (#7902)
This makes it slightly faster when we know we don't need to.
1 parent 1fdb7e4 commit 51ad8b0

File tree

2 files changed

+75
-68
lines changed

2 files changed

+75
-68
lines changed

‎deployer/commands/deployer.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,11 @@ def deploy_support(
5858
"--dry-run",
5959
help="When present, the `--dry-run` flag will be passed to the `helm upgrade` command.",
6060
),
61+
skip_crds: bool = typer.Option(
62+
False,
63+
"--skip-crds",
64+
help="When present, the `--skip-crds` flag will cause the deployer to skip external CRD deployments.",
65+
),
6166
):
6267
"""
6368
Deploy support components to a cluster
@@ -73,6 +78,7 @@ def deploy_support(
7378
cert_manager_version=cert_manager_version,
7479
debug=debug,
7580
dry_run=dry_run,
81+
skip_crds=skip_crds,
7682
)
7783

7884

‎deployer/infra_components/cluster.py‎

Lines changed: 69 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -71,87 +71,88 @@ def auth(self, silent=False):
7171
else:
7272
raise ValueError(f"Provider {self.spec['provider']} not supported")
7373

74-
def deploy_support(self, cert_manager_version, debug, dry_run):
75-
cert_manager_url = "https://charts.jetstack.io"
76-
77-
print_colour("Provisioning cert-manager...")
78-
subprocess.check_call(
79-
[
80-
"kubectl",
81-
"apply",
82-
"-f",
83-
f"https://github.com/cert-manager/cert-manager/releases/download/{cert_manager_version}/cert-manager.crds.yaml",
84-
]
85-
)
86-
subprocess.check_call(
87-
[
88-
"helm",
89-
"upgrade",
90-
"cert-manager", # given release name (aka. installation name)
91-
"cert-manager", # helm chart to install
92-
f"--repo={cert_manager_url}",
93-
"--install",
94-
"--create-namespace",
95-
"--namespace=cert-manager",
96-
f"--version={cert_manager_version}",
97-
]
98-
)
99-
print_colour("Done!")
74+
def deploy_support(self, cert_manager_version, debug, skip_crds, dry_run):
75+
if not skip_crds:
76+
cert_manager_url = "https://charts.jetstack.io"
10077

101-
if self.spec["provider"] == "aws":
102-
print_colour("Provisioning tigera operator...")
103-
# Hardcoded here, as we want to upgrade everywhere together
104-
# Ideally this would be a subchart of our support chart,
105-
# but helm has made some unfortunate architectural choices
106-
# with respect to CRDs and they seem super unreliable when
107-
# used as subcharts. So we install it here directly from the
108-
# manifests.
109-
# We unconditionally install this on all AWS clusters - however,
110-
# that doesn't actually turn NetworkPolicy enforcement on. That
111-
# requires setting `calico.enabled` to True in `support` so a
112-
# calico `Installation` object can be set up.
113-
# I deeply loathe the operator *singleton* pattern.
114-
tigera_operator_version = "v3.29.3"
78+
print_colour("Provisioning cert-manager...")
11579
subprocess.check_call(
11680
[
11781
"kubectl",
11882
"apply",
119-
"--force-conflicts", # This gives ownership to the resource, back to kubectl https://kubernetes.io/docs/reference/using-api/server-side-apply/#conflicts
120-
"--server-side", # https://github.com/projectcalico/calico/issues/7826
12183
"-f",
122-
f"https://raw.githubusercontent.com/projectcalico/calico/{tigera_operator_version}/manifests/tigera-operator.yaml",
84+
f"https://github.com/cert-manager/cert-manager/releases/download/{cert_manager_version}/cert-manager.crds.yaml",
85+
]
86+
)
87+
subprocess.check_call(
88+
[
89+
"helm",
90+
"upgrade",
91+
"cert-manager", # given release name (aka. installation name)
92+
"cert-manager", # helm chart to install
93+
f"--repo={cert_manager_url}",
94+
"--install",
95+
"--create-namespace",
96+
"--namespace=cert-manager",
97+
f"--version={cert_manager_version}",
12398
]
12499
)
125100
print_colour("Done!")
126101

127-
# Patch the tigera operator to remove the NoSchedule toleration
128-
# otherwise it will schedule on tainted nodes
129-
print_colour("Patching tigera operator...")
130-
patch_tolerations = {
131-
"spec": {
132-
"template": {
133-
"spec": {
134-
"tolerations": [
135-
{"effect": "NoExecute", "operator": "Exists"},
136-
],
102+
if self.spec["provider"] == "aws":
103+
print_colour("Provisioning tigera operator...")
104+
# Hardcoded here, as we want to upgrade everywhere together
105+
# Ideally this would be a subchart of our support chart,
106+
# but helm has made some unfortunate architectural choices
107+
# with respect to CRDs and they seem super unreliable when
108+
# used as subcharts. So we install it here directly from the
109+
# manifests.
110+
# We unconditionally install this on all AWS clusters - however,
111+
# that doesn't actually turn NetworkPolicy enforcement on. That
112+
# requires setting `calico.enabled` to True in `support` so a
113+
# calico `Installation` object can be set up.
114+
# I deeply loathe the operator *singleton* pattern.
115+
tigera_operator_version = "v3.29.3"
116+
subprocess.check_call(
117+
[
118+
"kubectl",
119+
"apply",
120+
"--force-conflicts", # This gives ownership to the resource, back to kubectl https://kubernetes.io/docs/reference/using-api/server-side-apply/#conflicts
121+
"--server-side", # https://github.com/projectcalico/calico/issues/7826
122+
"-f",
123+
f"https://raw.githubusercontent.com/projectcalico/calico/{tigera_operator_version}/manifests/tigera-operator.yaml",
124+
]
125+
)
126+
print_colour("Done!")
127+
128+
# Patch the tigera operator to remove the NoSchedule toleration
129+
# otherwise it will schedule on tainted nodes
130+
print_colour("Patching tigera operator...")
131+
patch_tolerations = {
132+
"spec": {
133+
"template": {
134+
"spec": {
135+
"tolerations": [
136+
{"effect": "NoExecute", "operator": "Exists"},
137+
],
138+
}
137139
}
138140
}
139141
}
140-
}
141-
patch_tolerations_json = json.dumps(patch_tolerations)
142-
subprocess.check_call(
143-
[
144-
"kubectl",
145-
"--namespace",
146-
"tigera-operator",
147-
"patch",
148-
"deployment",
149-
"tigera-operator",
150-
"--patch",
151-
patch_tolerations_json,
152-
],
153-
)
154-
print_colour("Done!")
142+
patch_tolerations_json = json.dumps(patch_tolerations)
143+
subprocess.check_call(
144+
[
145+
"kubectl",
146+
"--namespace",
147+
"tigera-operator",
148+
"patch",
149+
"deployment",
150+
"tigera-operator",
151+
"--patch",
152+
patch_tolerations_json,
153+
],
154+
)
155+
print_colour("Done!")
155156

156157
print_colour("Provisioning support charts...")
157158

0 commit comments

Comments
 (0)