Merge branch 'dev' into vthupili

Vinay Thupili · Vinay Thupili · commit 010bab769273 · 2025-06-11T12:33:57.000+02:00
diff --git a/cluster/config-defaults.yaml b/cluster/config-defaults.yaml
@@ -51,6 +51,9 @@ karpenter_in_transit_support_required: "false"
 # t type instances have burstable CPU, which can be undesirable in production
 karpenter_instance_family_t_enabled: "false"
 
+# configure whether spot instances should be enabled in Karpenter's capacity-types
+karpenter_enable_spot: "true"
+
 # ALB config created by kube-aws-ingress-controller
 kube_aws_ingress_controller_ssl_policy: "ELBSecurityPolicy-TLS13-1-2-2021-06"
 kube_aws_ingress_controller_idle_timeout: "1m"
@@ -397,12 +400,6 @@ event_rate_limit_enable: "true"
 event_rate_limit_config_qps: "500"
 event_rate_limit_config_burst: "1000"
 
-# cadvisor settings
-cadvisor_cpu: "150m"
-cadvisor_memory: "150Mi"
-cadvisor_profiling_enabled: "false"
-cadvisor_enabled: "false"
-
 # settings for enabling the kubelet-summary-metrics proxy and prometheus metric
 # collection.
 kubelet_summary_metrics_enabled: "true"
diff --git a/cluster/manifests/02-admission-control/deployment.yaml b/cluster/manifests/02-admission-control/deployment.yaml
@@ -33,7 +33,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
       - name: admission-controller
-        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-259
+        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-260
         lifecycle:
           preStop:
             sleep:
diff --git a/cluster/manifests/aws-cloud-controller-manager/daemonset.yaml b/cluster/manifests/aws-cloud-controller-manager/daemonset.yaml
@@ -28,7 +28,7 @@ spec:
         - --cloud-provider=aws
         - --use-service-account-credentials=true
         - --configure-cloud-routes=false
-        image: container-registry.zalando.net/teapot/aws-cloud-controller-manager-internal:v1.32.1-master-140
+        image: container-registry.zalando.net/teapot/aws-cloud-controller-manager-internal:v1.32.3-master-147
         name: aws-cloud-controller-manager
         resources:
           requests:
diff --git a/cluster/manifests/fabric-gateway/deployment.yaml b/cluster/manifests/fabric-gateway/deployment.yaml
@@ -1,4 +1,4 @@
-# {{ $image := "container-registry.zalando.net/gwproxy/fabric-gateway:master-329" }}
+# {{ $image := "container-registry.zalando.net/gwproxy/fabric-gateway:master-330" }}
 # {{ $version := index (split $image ":") 1 }}
 apiVersion: apps/v1
 kind: Deployment
diff --git a/cluster/manifests/kube-metrics-adapter/deployment.yaml b/cluster/manifests/kube-metrics-adapter/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: custom-metrics-apiserver
       containers:
       - name: kube-metrics-adapter
-        image: container-registry.zalando.net/teapot/kube-metrics-adapter:v0.2.4-29-g2ed22f0
+        image: container-registry.zalando.net/teapot/kube-metrics-adapter:v0.2.4-31-gc5017c7
         env:
         - name: AWS_REGION
           value: {{ .Cluster.Region }}
diff --git a/cluster/manifests/kube-proxy/daemonset.yaml b/cluster/manifests/kube-proxy/daemonset.yaml
@@ -58,7 +58,7 @@ spec:
           httpGet:
             host: 127.0.0.1
             port: 10256
-            path: /healthz
+            path: /livez
         resources:
           requests:
             cpu: {{.Cluster.ConfigItems.kube_proxy_cpu}}
diff --git a/cluster/manifests/kube-static-egress-controller/deployment.yaml b/cluster/manifests/kube-static-egress-controller/deployment.yaml
@@ -30,7 +30,7 @@ spec:
       serviceAccountName: kube-static-egress-controller
       containers:
       - name: controller
-        image: container-registry.zalando.net/teapot/kube-static-egress-controller:v0.3.3-master-52
+        image: container-registry.zalando.net/teapot/kube-static-egress-controller:v0.3.4-master-53
         args:
         - "--provider=aws"
         - "--vpc-id={{.Cluster.ConfigItems.vpc_id}}"
diff --git a/cluster/manifests/node-monitor/daemonset.yaml b/cluster/manifests/node-monitor/daemonset.yaml
@@ -30,55 +30,6 @@ spec:
       priorityClassName: system-node-critical
       serviceAccountName: node-monitor
       containers:
-{{- if eq .Cluster.ConfigItems.cadvisor_enabled "true" }}
-        - name: cadvisor
-          image: container-registry.zalando.net/teapot/cadvisor:v0.47.0-master-11
-          args:
-            - --port=9101
-{{- if eq .Cluster.ConfigItems.cadvisor_profiling_enabled "true" }}
-            - --profiling
-{{- end }}
-            - --housekeeping_interval=10s
-            - --max_housekeeping_interval=15s
-            - --event_storage_event_limit=default=0
-            - --event_storage_age_limit=default=0
-            - --disable_metrics=sched,percpu,tcp,udp,cpu_topology,advtcp
-            - --docker_only
-            - --raw_cgroup_prefix_whitelist=/system.slice/kubelet.service
-            - --store_container_labels=false
-            - --whitelisted_container_labels=io.kubernetes.container.name,io.kubernetes.pod.name,io.kubernetes.pod.namespace,io.kubernetes.pod.uid,application,component
-          resources:
-            requests:
-              cpu: "{{ .Cluster.ConfigItems.cadvisor_cpu }}"
-              memory: "{{ .Cluster.ConfigItems.cadvisor_memory }}"
-              ephemeral-storage: 256Mi
-            limits:
-              cpu: "{{ .Cluster.ConfigItems.cadvisor_cpu }}"
-              memory: "{{ .Cluster.ConfigItems.cadvisor_memory }}"
-          securityContext:
-            privileged: true # allows reading /dev/kmsg
-          volumeMounts:
-            - name: rootfs
-              mountPath: /rootfs
-              readOnly: true
-            - name: var-run
-              mountPath: /var/run
-              readOnly: true
-            - name: sys
-              mountPath: /sys
-              readOnly: true
-            - name: containerd
-              mountPath: /opt/podruntime/containerd
-              readOnly: true
-            - name: kmsg
-              mountPath: /dev/kmsg
-              readOnly: true
-          ports:
-            - name: cadvisor
-              containerPort: 9101
-              hostPort: 9101
-              protocol: TCP
-{{- end }}
         - image: container-registry.zalando.net/teapot/prometheus-node-exporter:v1.9.1-master-24
           args:
 {{- if eq .Cluster.ConfigItems.node_exporter_experimental_metrics "true" }}
diff --git a/cluster/manifests/node-monitor/service.yaml b/cluster/manifests/node-monitor/service.yaml
@@ -8,12 +8,6 @@ metadata:
 spec:
   type: ClusterIP
   ports:
-{{- if eq .Cluster.ConfigItems.cadvisor_enabled "true" }}
-    - name: cadvisor
-      port: 80
-      targetPort: 9101
-      protocol: TCP
-{{- end }}
     - name: node-exporter
       port: 81
       targetPort: 9100
diff --git a/cluster/manifests/nvidia/nvidia-gpu-device-plugin.yaml b/cluster/manifests/nvidia/nvidia-gpu-device-plugin.yaml
@@ -60,7 +60,7 @@ spec:
 {{- end}}
       containers:
       - name: nvidia-gpu-device-plugin
-        image: container-registry.zalando.net/teapot/nvidia-gpu-device-plugin:v0.17.1-master-18
+        image: container-registry.zalando.net/teapot/nvidia-gpu-device-plugin:v0.17.2-master-19
         args:
         - --pass-device-specs
         resources:
@@ -79,7 +79,7 @@ spec:
           mountPath: /var/lib/kubelet/device-plugins
 {{- if eq .Cluster.ConfigItems.nvidia_dcgm_exporter_enabled "true" }}
       - name: dcgm-exporter
-        image: container-registry.zalando.net/teapot/nvidia-dcgm-exporter:v4.2.0-4.1.0-ubuntu22.04-master-18
+        image: container-registry.zalando.net/teapot/nvidia-dcgm-exporter:v4.2.0-4.1.0-ubuntu22.04-master-19
         args:
         - --kubernetes
         - --address=:9400
diff --git a/cluster/manifests/prometheus/configmap.yaml b/cluster/manifests/prometheus/configmap.yaml
@@ -354,50 +354,6 @@ data:
       - action: replace
         source_labels: ['__meta_kubernetes_pod_node_name']
         target_label: node_name
-{{- if eq .Cluster.ConfigItems.cadvisor_enabled "true" }}
-    - job_name: 'cadvisor'
-      scheme: http
-      honor_labels: true
-      kubernetes_sd_configs:
-      - role: endpointslice
-        namespaces:
-          names:
-            - kube-system
-      relabel_configs:
-      - source_labels: [__meta_kubernetes_endpointslice_name]
-        action: keep
-        regex: "node-monitor-.*"
-      - source_labels: [__meta_kubernetes_endpointslice_port_name]
-        action: keep
-        regex: cadvisor
-      - action: replace
-        source_labels: ['__meta_kubernetes_pod_node_name']
-        target_label: node_name
-      metric_relabel_configs:
-{{- if eq .Cluster.ConfigItems.disable_zmon_appliance_worker_tracking "true" }}
-      - action: drop
-        source_labels: ["container_label_application", "container_label_component"]
-        regex: "zmon-appliance;worker"
-{{- end }}
-      - action: replace
-        source_labels: ['container_label_application']
-        target_label: application
-      - action: replace
-        source_labels: ['container_label_io_kubernetes_container_name']
-        target_label: container_name
-      - action: replace
-        source_labels: ['container_label_io_kubernetes_pod_name']
-        target_label: pod_name
-      - action: replace
-        source_labels: ['container_label_io_kubernetes_pod_namespace']
-        target_label: namespace
-      - action: replace
-        source_labels: ['container_label_io_kubernetes_pod_uid']
-        target_label: uid
-      - source_labels: [__name__]
-        action: keep
-        regex: '(container_cpu_cfs_throttled_seconds_total|container_cpu_usage_seconds_total|container_memory_working_set_bytes|container_memory_rss|container_memory_cache|container_network_receive_bytes_total|container_network_receive_packets_dropped_total|container_network_transmit_bytes_total|container_network_transmit_packets_dropped_total|container_fs_usage_bytes|container_fs_limit_bytes|container_fs_reads_bytes_total|container_fs_writes_bytes_total|container_threads|container_threads_max|container_file_descriptors{{ if eq .Cluster.ConfigItems.node_exporter_experimental_metrics "true" }}|ethtool{{end}})'
-{{- end }}
     - job_name: 'node-exporter'
       scheme: http
       honor_labels: true
diff --git a/cluster/manifests/prometheus/statefulset.yaml b/cluster/manifests/prometheus/statefulset.yaml
@@ -57,7 +57,7 @@ spec:
           mountPath: /prometheus
       containers:
       - name: prometheus
-        image: container-registry.zalando.net/teapot/prometheus:v3.2.1-master-63
+        image: container-registry.zalando.net/teapot/prometheus:v3.4.1-master-64
         args:
         - "--config.file=/prometheus/prometheus.yaml"
         - "--storage.tsdb.path=/prometheus/"
diff --git a/cluster/manifests/s3-csi-driver/daemonset.yaml b/cluster/manifests/s3-csi-driver/daemonset.yaml
@@ -95,7 +95,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: container-registry.zalando.net/teapot/node-driver-registrar:v2.12.0-eks-1-31-10-master-29
+        image: container-registry.zalando.net/teapot/node-driver-registrar:v2.13.0-eks-1-32-14-master-30
         imagePullPolicy: IfNotPresent
         name: node-driver-registrar
         resources:
diff --git a/cluster/manifests/skipper/deployment.yaml b/cluster/manifests/skipper/deployment.yaml
@@ -1,6 +1,6 @@
 {{/* image-updater-bot detects *image variables so use print to disable it for main image */}}
 
-{{ $main_image := print "container-registry.zalando.net/teapot/skipper-internal:" "v0.22.31-1138" }}
+{{ $main_image := print "container-registry.zalando.net/teapot/skipper-internal:" "v0.22.43-1150" }}
 {{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.22.43-1150" }}
 
 {{/* Optional canary arguments separated by "[cf724afc]" to allow whitespaces, e.g. "-foo=has a whitespace[cf724afc]-baz=qux" */}}
diff --git a/cluster/manifests/z-karpenter/07-karpenter.k8s.aws_ec2nodeclasses.yaml b/cluster/manifests/z-karpenter/07-karpenter.k8s.aws_ec2nodeclasses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: ec2nodeclasses.karpenter.k8s.aws
 spec:
   group: karpenter.k8s.aws
@@ -195,6 +195,17 @@ spec:
                               Valid Range: Minimum value of 125. Maximum value of 1000.
                             format: int64
                             type: integer
+                          volumeInitializationRate:
+                            description: |-
+                              VolumeInitializationRate specifies the Amazon EBS Provisioned Rate for Volume Initialization,
+                              in MiB/s, at which to download the snapshot blocks from Amazon S3 to the volume. This is also known as volume
+                              initialization. Specifying a volume initialization rate ensures that the volume is initialized at a
+                              predictable and consistent rate after creation. Only allowed if SnapshotID is set.
+                              Valid Range: Minimum value of 100. Maximum value of 300.
+                            format: int32
+                            maximum: 300
+                            minimum: 100
+                            type: integer
                           volumeSize:
                             description: |-
                               VolumeSize in `Gi`, `G`, `Ti`, or `T`. You must specify either a snapshot ID or
@@ -228,6 +239,8 @@ spec:
                         x-kubernetes-validations:
                           - message: snapshotID or volumeSize must be defined
                             rule: has(self.snapshotID) || has(self.volumeSize)
+                          - message: snapshotID must be set when volumeInitializationRate is set
+                            rule: '!has(self.volumeInitializationRate) || (has(self.snapshotID) && self.snapshotID != '''')'
                       rootVolume:
                         description: |-
                           RootVolume is a flag indicating if this device is mounted as kubelet root dir. You can
diff --git a/cluster/manifests/z-karpenter/08-karpenter.sh_nodeclaims.yaml b/cluster/manifests/z-karpenter/08-karpenter.sh_nodeclaims.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: nodeclaims.karpenter.sh
 spec:
   group: karpenter.sh
diff --git a/cluster/manifests/z-karpenter/09-karpenter.sh_nodepools.yaml b/cluster/manifests/z-karpenter/09-karpenter.sh_nodepools.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: nodepools.karpenter.sh
 spec:
   group: karpenter.sh
diff --git a/cluster/manifests/z-karpenter/deployment.yaml b/cluster/manifests/z-karpenter/deployment.yaml
@@ -30,16 +30,19 @@ spec:
         prometheus.io/scheme: "http"
         prometheus.io/scrape: "true"
     spec:
-      dnsPolicy: Default
       automountServiceAccountToken: true
       serviceAccountName: karpenter
       securityContext:
         fsGroup: 65532
+        runAsNonRoot: false
+        seccompProfile:
+          type: RuntimeDefault
       priorityClassName: "{{ .Cluster.ConfigItems.system_priority_class }}"
       dnsPolicy: ClusterFirst
       containers:
         - name: controller
           securityContext:
+            privileged: false
             runAsUser: 65532
             runAsGroup: 65532
             runAsNonRoot: true
@@ -50,11 +53,11 @@ spec:
               drop:
                 - ALL
             readOnlyRootFilesystem: true
-          image: "container-registry.zalando.net/teapot/karpenter:1.4.0-main-38.patched"
+          image: "container-registry.zalando.net/teapot/karpenter:1.5.0-main-39.patched"
           imagePullPolicy: IfNotPresent
           env:
             - name: KUBERNETES_MIN_VERSION
-              value: 1.22.0-0
+              value: 1.19.0-0
             - name: AWS_REGION
               value: "{{ .Cluster.Region }}"
             - name: CLUSTER_ENDPOINT
@@ -88,13 +91,11 @@ spec:
                   divisor: "0"
                   resource: limits.memory
             - name: FEATURE_GATES
-              value: "Drift=false,SpotToSpotConsolidation=true,NodeRepair=false"
+              value: "ReservedCapacity=false,SpotToSpotConsolidation=true,NodeRepair=false"
             - name: BATCH_MAX_DURATION
               value: "10s"
             - name: BATCH_IDLE_DURATION
               value: "1s"
-            - name: ASSUME_ROLE_DURATION
-              value: "15m"
             - name: PREFERENCE_POLICY
               value: "Respect"
             - name: CLUSTER_NAME
@@ -153,13 +154,6 @@ spec:
               matchLabels:
                 deployment: karpenter
             topologyKey: kubernetes.io/hostname
-#      topologySpreadConstraints:
-#        - labelSelector:
-#            matchLabels:
-#              deployment: karpenter
-#          maxSkew: 1
-#          topologyKey: topology.kubernetes.io/zone
-#          whenUnsatisfiable: ScheduleAnyway
       tolerations:
         - key: CriticalAddonsOnly
           operator: Exists
diff --git a/cluster/node-pools/master-default/userdata.yaml b/cluster/node-pools/master-default/userdata.yaml
@@ -219,7 +219,7 @@ write_files:
             limits:
               memory: {{ .Values.InstanceInfo.MemoryFraction (parseInt64 .Cluster.ConfigItems.apiserver_memory_limit_percent)}}
 {{- end }}
-        - image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-259
+        - image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-260
           name: admission-controller
           lifecycle:
             preStop:
diff --git a/cluster/node-pools/worker-karpenter/provisioners.yaml b/cluster/node-pools/worker-karpenter/provisioners.yaml
@@ -249,7 +249,9 @@ spec:
         - key: "karpenter.sh/capacity-type"
           operator: In
           values:
+#{{ if eq .NodePool.ConfigItems.karpenter_enable_spot "true" }}
             - "spot"
+#{{ end }}
             - "on-demand"
         - key: "kubernetes.io/arch"
           operator: In

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-# {{ $image := "container-registry.zalando.net/gwproxy/fabric-gateway:master-329" }}`
	`1`	`+# {{ $image := "container-registry.zalando.net/gwproxy/fabric-gateway:master-330" }}`
`2`	`2`	`# {{ $version := index (split $image ":") 1 }}`
`3`	`3`	`apiVersion: apps/v1`
`4`	`4`	`kind: Deployment`