Skip to content

Migrate away from deprecated kustomize features #3091

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
james-callahan wants to merge 11 commits into
base: main
Choose a base branch
from
+196 −1,817
Open

Migrate away from deprecated kustomize features #3091

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
5c39ccf
Clean up kustomizations
james-callahan Mar 6, 2023
daf9742
Use commonLabels
james-callahan Mar 6, 2023
08e7f57
Add ports declaration to controller container
james-callahan Mar 6, 2023
6436d73
Consolidate cert-manager kustomize pieces into the one component
james-callahan Mar 6, 2023
df9bb50
Consolidate webhook kustomize pieces into the one component
james-callahan Mar 6, 2023
161762c
Kustomize deprecated `vars`, use `replacements`
james-callahan Mar 6, 2023
ad1dea1
Use CRD v1 form
james-callahan Mar 22, 2023
00a83c6
caBundle doesn't need to be set
james-callahan Mar 23, 2023
e5b7b41
Remove hardcoded namespaces
james-callahan Apr 17, 2023
5d9f82e
clean up AGA CRD handling
james-callahan Dec 29, 2025
b7b9c73
clean up gateway CRD handling
james-callahan Dec 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 2 additions & 22 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,18 +18,6 @@ CRD_OPTIONS ?= "crd:crdVersions=v1"
# Whether to override AWS SDK models. set to 'y' when we need to build against custom AWS SDK models.
AWS_SDK_MODEL_OVERRIDE ?= "n"

# Move Gateway API CRDs from bases directory to gateway directory
MOVE_GATEWAY_CRDS = mv config/crd/bases/gateway.k8s.aws_* config/crd/gateway/

# Move AGA CRDs from bases directory to aga directory
MOVE_AGA_CRDS = mkdir -p config/crd/aga && mv config/crd/bases/aga.k8s.aws_* config/crd/aga/

# Copy combined Gateway API CRDs from bases directory to helm directory
COPY_GATEWAY_CRDS_TO_HELM = cp config/crd/gateway/gateway-crds.yaml helm/aws-load-balancer-controller/crds/gateway-crds.yaml

# Copy combined AGA CRDs from aga directory to helm directory
COPY_AGA_CRDS_TO_HELM = cp config/crd/aga/aga-crds.yaml helm/aws-load-balancer-controller/crds/aga-crds.yaml

# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
ifeq (,$(shell go env GOBIN))
GOBIN=$(shell go env GOPATH)/bin
Expand Down Expand Up @@ -73,17 +61,9 @@ manifests: controller-gen kustomize
yq eval '.metadata.name = "webhook"' -i config/webhook/manifests.yaml

crds: manifests
$(MOVE_GATEWAY_CRDS)
$(MOVE_AGA_CRDS)
$(KUSTOMIZE) build config/crd > helm/aws-load-balancer-controller/crds/crds.yaml
$(KUSTOMIZE) build config/crd/gateway > config/crd/gateway/gateway-crds.yaml
echo '---' > config/crd/gateway/gateway-crds.yaml
$(KUSTOMIZE) build config/crd/gateway >> config/crd/gateway/gateway-crds.yaml
$(COPY_GATEWAY_CRDS_TO_HELM)
$(KUSTOMIZE) build config/crd/aga > config/crd/aga/aga-crds.yaml
echo '---' > config/crd/aga/aga-crds.yaml
$(KUSTOMIZE) build config/crd/aga >> config/crd/aga/aga-crds.yaml
$(COPY_AGA_CRDS_TO_HELM)
$(KUSTOMIZE) build config/crd/gateway > helm/aws-load-balancer-controller/crds/gateway-crds.yaml
$(KUSTOMIZE) build config/crd/aga > helm/aws-load-balancer-controller/crds/aga-crds.yaml

# Run go fmt against code
fmt:
Expand Down
3 changes: 2 additions & 1 deletion ...es/cainjection_in_ingressclassparams.yaml → ...njection_in_ingressclassparams_patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,6 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
Copy link
Collaborator

@zac-nixon zac-nixon Jun 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a behavior change

# `default` and `serving-cert` may be substituted by kustomize
cert-manager.io/inject-ca-from: default/serving-cert
name: ingressclassparams.elbv2.k8s.aws
3 changes: 2 additions & 1 deletion ...s/cainjection_in_targetgroupbindings.yaml → ...jection_in_targetgroupbindings_patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,6 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
# `default` and `serving-cert` may be substituted by kustomize
cert-manager.io/inject-ca-from: default/serving-cert
Copy link
Collaborator

@zac-nixon zac-nixon Jun 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Again, behavior change.

Copy link
Author

@james-callahan james-callahan Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default is swapped out by the replacements block here: https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3091/files#diff-c006b1ef995eeeb57408cce42bd84db8dfc0cbe18df03222857665cebb1ac6fdR31

name: targetgroupbindings.elbv2.k8s.aws
6 changes: 3 additions & 3 deletions config/certmanager/certificate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ kind: Certificate
metadata:
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
spec:
# $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize
# `webhook-service` and `default` may be substituted by kustomize
dnsNames:
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local
- webhook-service.default.svc
Copy link
Collaborator

@zac-nixon zac-nixon Jun 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Behavior change, normally this webhook isn't in the default namespace

Copy link
Author

@james-callahan james-callahan Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default is swapped out by the replacements block here: https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3091/files#diff-c006b1ef995eeeb57408cce42bd84db8dfc0cbe18df03222857665cebb1ac6fdR31

- webhook-service.default.svc.cluster.local
issuerRef:
kind: Issuer
name: selfsigned-issuer
Expand Down
22 changes: 19 additions & 3 deletions config/certmanager/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,21 @@
resources:
- certificate.yaml

apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
configurations:
- kustomizeconfig.yaml
resources:
- certificate.yaml
patches:
# patches here are for enabling the CA injection for each CRD
- path: cainjection_in_targetgroupbindings_patch.yaml
- path: cainjection_in_ingressclassparams_patch.yaml
# This patch add annotation to admission webhook config, `default` and
# `serving-cert` may be substituted by kustomize
- target:
kind: (MutatingWebhookConfiguration|ValidatingWebhookConfiguration)
patch: |-
apiVersion: admissionregistration.k8s.io/v1
kind: dummy
metadata:
name: webhook
annotations:
cert-manager.io/inject-ca-from: default/serving-cert
10 changes: 1 addition & 9 deletions config/certmanager/kustomizeconfig.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,8 @@
# This configuration is for teaching kustomize how to update name ref and var substitution
# This configuration is for teaching kustomize how to update name ref
nameReference:
- kind: Issuer
group: cert-manager.io
fieldSpecs:
- kind: Certificate
group: cert-manager.io
path: spec/issuerRef/name

varReference:
- kind: Certificate
group: cert-manager.io
path: spec/commonName
- kind: Certificate
group: cert-manager.io
path: spec/dnsNames
22 changes: 11 additions & 11 deletions config/controller/controller.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,24 +2,14 @@ apiVersion: v1
kind: ServiceAccount
metadata:
name: controller
labels:
Copy link
Collaborator

@zac-nixon zac-nixon Jun 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this removed?

Copy link
Author

@james-callahan james-callahan Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's added via commonLabels instead.

app.kubernetes.io/component: controller
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: controller
labels:
app.kubernetes.io/component: controller
spec:
selector:
matchLabels:
app.kubernetes.io/component: controller
replicas: 1
template:
metadata:
labels:
app.kubernetes.io/component: controller
spec:
containers:
- name: controller
Expand All @@ -34,6 +24,16 @@ spec:
requests:
cpu: 100m
memory: 200Mi
ports:
- containerPort: 9443
name: webhook
protocol: TCP
- containerPort: 8080
name: metrics
protocol: TCP
- containerPort: 61779
name: healthprobe
protocol: TCP
livenessProbe:
failureThreshold: 2
httpGet:
Expand All @@ -44,4 +44,4 @@ spec:
timeoutSeconds: 10
terminationGracePeriodSeconds: 10
priorityClassName: system-cluster-critical
serviceAccountName: controller
serviceAccountName: controller
13 changes: 7 additions & 6 deletions config/controller/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
resources:
- controller.yaml
patchesStrategicMerge:
- iam_for_sa_patch.yaml
- security_context_patch.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonLabels:
app.kubernetes.io/component: controller
resources:
- controller.yaml
patches:
- path: iam_for_sa_patch.yaml
- path: security_context_patch.yaml
images:
- name: controller
newName: public.ecr.aws/eks/aws-load-balancer-controller
Expand Down
Loading