BREAKING CHANGE: the controller container is now executed under 65534:65534 (userid:groupid). This change may break deployments that hard-coded the user name 'controller' in their PodSecurityPolicy.
Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>
Further restricts the SecurityContext that the controller runs under, by enabling the default seccomp profile and dropping all linux capabilities.
This was set at container-level to ensure backwards compatibility with
use cases in which sidecars are injected into the source-controller pod
without setting less restrictive settings.
BREAKING CHANGE: The use of new seccomp API requires Kubernetes 1.19.
Co-authored-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>
Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>
- Prevents a deadlock in active-passive HA setups with multiple
replicas and during upgrades that previously occurred. As the
leader election would be held hostage by the previous replica
set due to the rolling update strategy.
- Ensures backing persistent (RW) volumes can safely be used, as
they can not be shared and will not become available to the next
pod without recreating all.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This commit upgrades the `controller-runtime` dependency to `v0.7.0`,
including all changes required to make all wiring work again.
- Upgrade `runtime` to v0.6.0 to include `controller-runtime` changes.
- Loggers have been removed from the reconcilers and are now retrieved
from the `context.Context` passed to the `Reconcile` method and
downwards functions.
- Logger configuration flags are now bound to the flag set using
`BindFlags` from `runtime/logger`, ensuring the same contract across
GitOps Toolkit controllers, and the `--log-json` flag has been
deprecated in favour of the `--log-encoding=json` default.
- The `ChangePredicate` from `runtime` has changed to a
`ReconcilateAtChangedPredicate`, and is now chained with the
`GenerationChangedPredicate` from `controller-runtime` using
`predicate.Or`.
- Signatures that made use of `runtime.Object` have changed to
`client.Object`, removing the requirement to e.g. call
`runtime.Object#Object`.
- The `client.MatchingField` function was deprecated, and has been
replaced with `client.MatchingFields{}`.
- The `leader-election-role` was changed, as leader election now works
via the `coordination/v1` API.
Other notable changes:
- `util.ObjectKey` was added to easily construct a `client.ObjectKey` /
`types.NamespacedName` from a `metav1.Object`.
- The `SourceIndexKey` constant has been split out into
`{GitRepository,HelmRepository,Bucket}IndexKey` constants.
Signed-off-by: Hidde Beydals <hello@hidde.co>
The added `--storage-adv-addr` flag allows overwriting the HTTP address
advertised in the status objects of the sources. This allows for finer
grain configuration in setups where a modified service is used, or where
the DNS resolution differs from the Kubernetes defaults.
When the flag is omitted, an attempt is made to determine the address
based on the configured `--storage-addr` and the `HOSTNAME`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
- Add the HelmChart types and controller
- Semver expressions are found by utilizing Helm repository index
helpers. As Helm makes use of `masterminds/semver`, the support
for i.e. ranges less mature than the `GitRepository` implementation.
- Recorded semver is as defined in the metadata of the chart. The
used name for the artifact does however include the checksum of the
chart archive, as chart maintainers may not always properly apply
semver.
- Switches to `sigs.k8s.io/yaml` for YAML operations as this among
other things is able to properly unmarshal embedded structures.
- Directly requeues on transient errors instead of using the defined
interval as a back-off strategy is applied on repeated failures.
Hidde Beydals
Stefan Prodan
Maksym Voitko
Paulo Gomes
Sunny