Merge branch 'dev' into container-registry.zalando.net/teapot/skipper-internal

katyanna · web-flow · commit c761be931573 · 2024-12-12T13:47:44.000+01:00
diff --git a/cluster/config-defaults.yaml b/cluster/config-defaults.yaml
@@ -127,6 +127,8 @@ skipper_edit_route_placeholders: ""
 skipper_ingress_inline_routes: ""
 skipper_ingress_refuse_payload: ""
 skipper_endpointslices_enabled: "true"
+skipper_kubernetes_annotation_predicates: ''
+skipper_kubernetes_east_west_range_annotation_predicates: ''
 
 skipper_compress_encodings: "gzip,deflate,br"
 
diff --git a/cluster/manifests/02-kube-aws-iam-controller/deployment.yaml b/cluster/manifests/02-kube-aws-iam-controller/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       hostNetwork: true
       containers:
       - name: kube-aws-iam-controller
-        image: container-registry.zalando.net/teapot/kube-aws-iam-controller:v0.3.0-45-gf22c994
+        image: container-registry.zalando.net/teapot/kube-aws-iam-controller:v0.3.0-47-g26136a1
         env:
         - name: AWS_DEFAULT_REGION
           value: "{{.Cluster.Region}}"
diff --git a/cluster/manifests/03-ebs-csi/controller.yaml b/cluster/manifests/03-ebs-csi/controller.yaml
@@ -35,7 +35,7 @@ spec:
         runAsUser: 1000
       containers:
         - name: ebs-plugin
-          image: container-registry.zalando.net/teapot/aws-ebs-csi-driver:v1.35.0-master-21
+          image: container-registry.zalando.net/teapot/aws-ebs-csi-driver:v1.37.0-master-23
           args:
             - controller
             - --endpoint=$(CSI_ENDPOINT)
@@ -82,7 +82,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
         - name: csi-provisioner
-          image: container-registry.zalando.net/teapot/external-provisioner:v5.1.0-eks-1-31-4-master-21
+          image: container-registry.zalando.net/teapot/external-provisioner:v5.1.0-eks-1-31-8-master-23
           args:
             - --csi-address=$(ADDRESS)
             - --v=2
@@ -107,7 +107,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
         - name: csi-attacher
-          image: container-registry.zalando.net/teapot/external-attacher:v4.7.0-eks-1-31-4-master-21
+          image: container-registry.zalando.net/teapot/external-attacher:v4.7.0-eks-1-31-8-master-23
           args:
             - --csi-address=$(ADDRESS)
             - --v=2
@@ -129,7 +129,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
         - name: csi-resizer
-          image: container-registry.zalando.net/teapot/external-resizer:v1.12.0-eks-1-31-4-master-21
+          image: container-registry.zalando.net/teapot/external-resizer:v1.12.0-eks-1-31-8-master-23
           args:
             - --csi-address=$(ADDRESS)
             - --v=2
@@ -151,7 +151,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
         - name: liveness-probe
-          image: container-registry.zalando.net/teapot/livenessprobe:v2.14.0-eks-1-31-4-master-21
+          image: container-registry.zalando.net/teapot/livenessprobe:v2.14.0-eks-1-31-8-master-23
           args:
             - --csi-address=/csi/csi.sock
           resources:
diff --git a/cluster/manifests/03-ebs-csi/node.yaml b/cluster/manifests/03-ebs-csi/node.yaml
@@ -34,7 +34,7 @@ spec:
         runAsUser: 0
       containers:
         - name: ebs-plugin
-          image: container-registry.zalando.net/teapot/aws-ebs-csi-driver:v1.35.0-master-21
+          image: container-registry.zalando.net/teapot/aws-ebs-csi-driver:v1.37.0-master-23
           args:
             - node
             - --endpoint=$(CSI_ENDPOINT)
@@ -77,7 +77,7 @@ spec:
             privileged: true
             readOnlyRootFilesystem: true
         - name: node-driver-registrar
-          image: container-registry.zalando.net/teapot/node-driver-registrar:v2.12.0-eks-1-31-4-master-21
+          image: container-registry.zalando.net/teapot/node-driver-registrar:v2.12.0-eks-1-31-8-master-23
           args:
             - --csi-address=$(ADDRESS)
             - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
@@ -114,7 +114,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
         - name: liveness-probe
-          image: container-registry.zalando.net/teapot/livenessprobe:v2.14.0-eks-1-31-4-master-21
+          image: container-registry.zalando.net/teapot/livenessprobe:v2.14.0-eks-1-31-8-master-23
           args:
             - --csi-address=/csi/csi.sock
           volumeMounts:
diff --git a/cluster/manifests/audittrail-adapter/daemonset.yaml b/cluster/manifests/audittrail-adapter/daemonset.yaml
@@ -33,7 +33,7 @@ spec:
       hostNetwork: true
       containers:
       - name: audittrail-adapter
-        image: container-registry.zalando.net/teapot/audittrail-adapter:master-66
+        image: container-registry.zalando.net/teapot/audittrail-adapter:master-71
         env:
           - name: AWS_REGION
             value: "{{ .Cluster.Region }}"
diff --git a/cluster/manifests/aws-cloud-controller-manager/daemonset.yaml b/cluster/manifests/aws-cloud-controller-manager/daemonset.yaml
@@ -27,7 +27,7 @@ spec:
         - --cloud-provider=aws
         - --use-service-account-credentials=true
         - --configure-cloud-routes=false
-        image: container-registry.zalando.net/teapot/aws-cloud-controller-manager-internal:v1.31.1-master-133
+        image: container-registry.zalando.net/teapot/aws-cloud-controller-manager-internal:v1.31.4-master-135
         name: aws-cloud-controller-manager
         resources:
           requests:
diff --git a/cluster/manifests/coredns-local/daemonset-coredns.yaml b/cluster/manifests/coredns-local/daemonset-coredns.yaml
@@ -163,7 +163,7 @@ spec:
             memory: {{.Cluster.ConfigItems.dns_dnsmasq_sidecar_mem}}
 {{ end }}
       - name: coredns
-        image: container-registry.zalando.net/teapot/coredns:1.11.3-master-24
+        image: container-registry.zalando.net/teapot/coredns:1.12.0-master-25
         args: [ "-conf", "/etc/coredns/Corefile" ]
         env:
         - name: ZONE
diff --git a/cluster/manifests/deletions.yaml b/cluster/manifests/deletions.yaml
@@ -313,6 +313,8 @@ post_apply:
 - name: role-sync-controller
   kind: CronJob
   namespace: kube-system
+- name: role-sync-controller
+  kind: ClusterRole
 - name: role-sync-controller
   kind: ClusterRoleBinding
 - name: role-sync-controller
diff --git a/cluster/manifests/emergency-access-service/deployment.yaml b/cluster/manifests/emergency-access-service/deployment.yaml
@@ -41,7 +41,7 @@ spec:
             cpu: 25m
             memory: 25Mi
       - name: emergency-access-service
-        image: "container-registry.zalando.net/teapot/emergency-access-service:master-96"
+        image: "container-registry.zalando.net/teapot/emergency-access-service:master-97"
         args:
         - --insecure-http
         - --community={{ .Cluster.Owner }}
diff --git a/cluster/manifests/flannel/daemonset.yaml b/cluster/manifests/flannel/daemonset.yaml
@@ -57,7 +57,7 @@ spec:
           failureThreshold: 30
           periodSeconds: 10
       - name: kube-flannel
-        image: container-registry.zalando.net/teapot/flannel:v0.26.0-master-31
+        image: container-registry.zalando.net/teapot/flannel:v0.26.1-master-32
         command:
         - /opt/bin/flanneld
         args:
diff --git a/cluster/manifests/kube-metrics-adapter/deployment.yaml b/cluster/manifests/kube-metrics-adapter/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: custom-metrics-apiserver
       containers:
       - name: kube-metrics-adapter
-        image: container-registry.zalando.net/teapot/kube-metrics-adapter:kube-metrics-adapter-0.2.3-35-g498f85e
+        image: container-registry.zalando.net/teapot/kube-metrics-adapter:kube-metrics-adapter-0.2.3-38-gca90312
         env:
         - name: AWS_REGION
           value: {{ .Cluster.Region }}
@@ -39,6 +39,7 @@ spec:
         - --scaling-schedule
         - --scaling-schedule-default-scaling-window={{.Cluster.ConfigItems.kube_metrics_adapter_default_scaling_window}}
         - --scaling-schedule-ramp-steps={{.Cluster.ConfigItems.kube_metrics_adapter_scaling_schedule_ramp_steps}}
+        - --horizontal-pod-autoscaler-tolerance={{.Cluster.ConfigItems.horizontal_pod_autoscaler_tolerance}}
         - --aws-external-metrics
         - --aws-region={{.Cluster.Region}}
         - --aws-region=eu-west-1
diff --git a/cluster/manifests/kube-state-metrics/deployment.yaml b/cluster/manifests/kube-state-metrics/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: kube-state-metrics
       containers:
       - name: kube-state-metrics
-        image: container-registry.zalando.net/teapot/kube-state-metrics:v2.12.0-master-27
+        image: container-registry.zalando.net/teapot/kube-state-metrics:v2.14.0-master-28
         args:
         - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
         - --metric-labels-allowlist=pods=[{{.Cluster.ConfigItems.observability_metrics_pods_labels}}],ingresses=[{{.Cluster.ConfigItems.observability_metrics_ingresses_labels}}],nodes=[topology.kubernetes.io/zone,node.kubernetes.io/instance-type,node.kubernetes.io/node-pool,node.kubernetes.io/role,node.kubernetes.io/profile,dedicated]
diff --git a/cluster/manifests/kubenurse/prometheus.yaml b/cluster/manifests/kubenurse/prometheus.yaml
@@ -37,7 +37,7 @@ spec:
           value: "1"
       containers:
       - name: prometheus
-        image: container-registry.zalando.net/teapot/prometheus:v2.55.0-master-59
+        image: container-registry.zalando.net/teapot/prometheus:v3.0.1-master-60
         args:
         - "--config.file=/etc/prometheus/prometheus.yml"
         - "--storage.tsdb.path=/prometheus/"
diff --git a/cluster/manifests/kubernetes-lifecycle-metrics/deployment.yaml b/cluster/manifests/kubernetes-lifecycle-metrics/deployment.yaml
@@ -31,7 +31,7 @@ spec:
       serviceAccountName: kubernetes-lifecycle-metrics
       containers:
         - name: kubernetes-lifecycle-metrics
-          image: "container-registry.zalando.net/teapot/kubernetes-lifecycle-metrics:master-24"
+          image: "container-registry.zalando.net/teapot/kubernetes-lifecycle-metrics:master-25"
           ports:
             - containerPort: 9090
               protocol: TCP
diff --git a/cluster/manifests/nvidia/nvidia-gpu-device-plugin.yaml b/cluster/manifests/nvidia/nvidia-gpu-device-plugin.yaml
@@ -60,7 +60,7 @@ spec:
 {{- end}}
       containers:
       - name: nvidia-gpu-device-plugin
-        image: container-registry.zalando.net/teapot/nvidia-gpu-device-plugin:v0.16.2-master-14
+        image: container-registry.zalando.net/teapot/nvidia-gpu-device-plugin:v0.17.0-master-16
         args:
         - --pass-device-specs
         resources:
@@ -79,7 +79,7 @@ spec:
           mountPath: /var/lib/kubelet/device-plugins
 {{- if eq .Cluster.ConfigItems.nvidia_dcgm_exporter_enabled "true" }}
       - name: dcgm-exporter
-        image: container-registry.zalando.net/teapot/nvidia-dcgm-exporter:v3.3.6-3.4.2-ubuntu22.04-master-14
+        image: container-registry.zalando.net/teapot/nvidia-dcgm-exporter:v3.3.9-3.6.1-ubuntu22.04-master-16
         args:
         - --kubernetes
         - --address=:9400
diff --git a/cluster/manifests/prometheus/statefulset.yaml b/cluster/manifests/prometheus/statefulset.yaml
@@ -57,7 +57,7 @@ spec:
           mountPath: /prometheus
       containers:
       - name: prometheus
-        image: container-registry.zalando.net/teapot/prometheus:v2.55.0-master-59
+        image: container-registry.zalando.net/teapot/prometheus:v3.0.1-master-60
         args:
         - "--config.file=/prometheus/prometheus.yaml"
         - "--storage.tsdb.path=/prometheus/"
diff --git a/cluster/manifests/role-sync-controller/cronjob.yaml b/cluster/manifests/role-sync-controller/cronjob.yaml
@@ -26,7 +26,7 @@ spec:
           restartPolicy: OnFailure
           containers:
           - name: role-sync-controller
-            image: container-registry.zalando.net/teapot/role-sync-controller:main-2
+            image: container-registry.zalando.net/teapot/role-sync-controller:main-4
             args:
               - --subject-group=PowerUser
               - --subject-group=Manual
diff --git a/cluster/manifests/role-sync-controller/rbac.yaml b/cluster/manifests/role-sync-controller/rbac.yaml
@@ -1,5 +1,40 @@
 {{ if eq .Cluster.ConfigItems.role_sync_controller_enabled "true" }}
 apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: role-sync-controller
+  labels:
+    application: kubernetes
+    component: role-sync-controller
+rules:
+  # Allow the controller to list namespaces
+  - apiGroups:
+    - ""
+    resources:
+    - "namespaces"
+    verbs:
+    - "list"
+  # Allow the controller to manage Roles and Rolebindings
+  - apiGroups:
+    - rbac.authorization.k8s.io
+    resources:
+    - roles
+    - rolebindings
+    verbs:
+    - "get"
+    - "create"
+    - "update"
+  # Allow the controller to manage roles based on reading Secrets
+  - apiGroups:
+    - ""
+    resources:
+    - secrets
+    verbs:
+    - "get"
+    - "list"
+    - "watch"
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: role-sync-controller
@@ -9,7 +44,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: poweruser
+  name: role-sync-controller
 subjects:
 - kind: ServiceAccount
   name: role-sync-controller
diff --git a/cluster/manifests/s3-csi-driver/daemonset.yaml b/cluster/manifests/s3-csi-driver/daemonset.yaml
@@ -48,7 +48,7 @@ spec:
               fieldPath: spec.nodeName
         - name: HOST_PLUGIN_DIR
           value: /opt/podruntime/kubelet/plugins/s3.csi.aws.com/
-        image: container-registry.zalando.net/teapot/aws-mountpoint-s3-csi-driver:v1.9.0-master-21
+        image: container-registry.zalando.net/teapot/aws-mountpoint-s3-csi-driver:v1.11.0-master-23
         resources:
           requests:
             cpu: 1m
@@ -95,7 +95,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: container-registry.zalando.net/teapot/node-driver-registrar:v2.12.0-eks-1-31-4-master-21
+        image: container-registry.zalando.net/teapot/node-driver-registrar:v2.12.0-eks-1-31-8-master-23
         imagePullPolicy: IfNotPresent
         name: node-driver-registrar
         resources:
@@ -114,7 +114,7 @@ spec:
       - args:
         - --csi-address=/csi/csi.sock
         - --health-port=9810
-        image: container-registry.zalando.net/teapot/livenessprobe:v2.14.0-eks-1-31-4-master-21
+        image: container-registry.zalando.net/teapot/livenessprobe:v2.14.0-eks-1-31-8-master-23
         imagePullPolicy: IfNotPresent
         name: liveness-probe
         resources:
@@ -134,7 +134,7 @@ spec:
         env:
         - name: MOUNTPOINT_INSTALL_DIR
           value: /target
-        image: container-registry.zalando.net/teapot/aws-mountpoint-s3-csi-driver:v1.9.0-master-21
+        image: container-registry.zalando.net/teapot/aws-mountpoint-s3-csi-driver:v1.11.0-master-23
         imagePullPolicy: IfNotPresent
         name: install-mountpoint
         resources:
diff --git a/cluster/manifests/skipper-canary-controller/canary-cronjob.yaml b/cluster/manifests/skipper-canary-controller/canary-cronjob.yaml
@@ -29,7 +29,7 @@ spec:
           containers:
           - name: skipper-canary-controller
             terminationMessagePolicy: FallbackToLogsOnError
-            image: container-registry.zalando.net/gwproxy/skipper-canary-controller:main-29
+            image: container-registry.zalando.net/gwproxy/skipper-canary-controller:main-32
             env:
             - name: POD_NAME
               valueFrom:
diff --git a/cluster/manifests/skipper/deployment.yaml b/cluster/manifests/skipper/deployment.yaml
@@ -3,7 +3,6 @@
 {{ $main_image := print "container-registry.zalando.net/teapot/skipper-internal:" "v0.21.224-1047" }}
 {{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.21.228-1051" }}
 
-
 {{/* Optional canary arguments separated by "[cf724afc]" to allow whitespaces, e.g. "-foo=has a whitespace[cf724afc]-baz=qux" */}}
 {{ $canary_args := "" }}
 
diff --git a/cluster/node-pools/master-default/userdata.yaml b/cluster/node-pools/master-default/userdata.yaml
@@ -247,7 +247,7 @@ write_files:
               name: admission-controller-kubeconfig
               readOnly: true
         - name: skipper-admission-webhook
-          image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.21.223
+          image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.21.227
           args:
             - webhook
             - --address=:9085
@@ -424,7 +424,7 @@ write_files:
             value: {{ .Cluster.ConfigItems.apiserver_business_partner_ids }}
 {{ end }}
         - name: skipper-proxy
-          image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.21.223
+          image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.21.227
           args:
           - skipper
           - -access-log-strip-query
@@ -475,7 +475,7 @@ write_files:
             name: ssl-certs-kubernetes
             readOnly: true
         - name: skipper-metrics
-          image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.21.223
+          image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.21.227
           args:
           - skipper
           - -access-log-strip-query
diff --git a/test/e2e/authorization.go b/test/e2e/authorization.go
@@ -185,7 +185,9 @@ var _ = g.Describe("Authorization [RBAC] [Zalando]", func() {
 
 		g.It("should allow read access to Secrets in namespaces other than kube-system and visibility", func() {
 			tc.data.resources = []string{"secrets"}
-			tc.data.namespaces = []string{"default", "teapot"}
+			// The namespace must exist for the test case to pass, otherwise access
+			// remains undecided.
+			tc.data.namespaces = []string{"default"}
 			tc.data.verbs = readOperations
 			tc.run(context.TODO(), cs, true)
 			gomega.Expect(tc.output.passed).To(gomega.BeTrue(), tc.output.String())
