Bump vela to v1.4.12 (#87)

* Bump vela to v1.4.8

Signed-off-by: qiaozp <qiaozhongpei.qzp@alibaba-inc.com>

* backport change host kubeconfig to loopback IP

Signed-off-by: qiaozp <qiaozhongpei.qzp@alibaba-inc.com>

.github/workflows/build.yaml

@@ -1,26 +0,0 @@
-name: Build
-
-on:
-  push:
-    branches:
-      - main
-      - release-*
-  workflow_dispatch: { }
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Install dependencies
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.17
-      - name: Build linux
-        run: make linux-amd64
-      - name: Build darwin
-        run: |
-          GOOS=darwin GOARCH=amd64 make darwin-amd64
-      - name: Build windows
-        run: |
-          GOOS=windows GOARCH=amd64 make windows-amd64

.github/workflows/code-lint.yaml

@@ -39,7 +39,8 @@ jobs:
       - name: Download resources
         run: |
           make download_vela_images_addons
-          make download_k3s
+          make download_k3s_images
+          make download_k3s_bin_script
           make download_k3d
           make pack_vela_chart
 
@@ -76,7 +77,8 @@ jobs:
       - name: Download resources
         run: |
           make download_vela_images_addons
-          make download_k3s
+          make download_k3s_images
+          make download_k3s_bin_script
           make download_k3d
           make pack_vela_chart
 
@@ -116,7 +118,8 @@ jobs:
       - name: Download resources
         run: |
           make download_vela_images_addons
-          make download_k3s
+          make download_k3s_images
+          make download_k3s_bin_script
           make download_k3d
           make pack_vela_chart
 

.github/workflows/e2e-test.yaml

@@ -24,20 +24,28 @@ jobs:
         uses: actions/setup-go@v2
         with:
           go-version: 1.17
-      - name: Build linux
+      - name: Build linux amd64
         run: |
-          GOOS=linux GOARCH=amd64 make linux-amd64
+          OS=linux ARCH=amd64 make linux-amd64
+      - name: Build linux arm64
+        run: |
+          OS=linux ARCH=arm64 make linux-arm64
       - name: Build darwin
         run: |
-          GOOS=darwin GOARCH=amd64 make darwin-amd64
+          OS=darwin ARCH=amd64 make darwin-amd64
       - name: Build windows
         run: |
-          GOOS=windows GOARCH=amd64 make windows-amd64
+          OS=windows ARCH=amd64 make windows-amd64
-      - name: Upload linux artifacts
+      - name: Upload linux amd64 artifacts
         uses: actions/upload-artifact@v3
         with:
           path: bin/velad-linux-amd64
           name: velad-linux-amd64
+      - name: Upload linux arm64 artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          path: bin/velad-linux-arm64
+          name: velad-linux-arm64
       - name: Upload darwin artifacts
         uses: actions/upload-artifact@v3
         with:
@@ -68,6 +76,21 @@ jobs:
         uses: docker-practice/actions-setup-docker@master
       - run: chmod u+x velad-darwin-amd64 && mv velad-darwin-amd64 velad
       - run: ./velad install
+      - run: vela def list
+#  test-linux-arm64:
+#    runs-on: ubuntu-20.04
+#    needs: [ build-artifact ]
+#    steps:
+#      - uses: actions/download-artifact@v3
+#        with:
+#          name: velad-darwin-amd64
+#      - run: chmod u+x velad-linux-amd64 && mv velad-linux-amd64 velad
+#      - name: pguyot/arm-runner-action@v2
+#        with:
+#          commands: |
+#            sudo ./velad install
+#            sudo vela def list
+
 #  test-windows:
 #    runs-on: windows-2022
 #    needs: [ build-artifact ]

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
     name: build
     strategy:
       matrix:
-        TARGETS: [ linux/amd64, darwin/amd64, windows/amd64 ]
+        TARGETS: [ linux/amd64, darwin/amd64, windows/amd64, linux/arm64, darwin/arm64]
     env:
       VELA_VERSION_KEY: github.com/oam-dev/velad/version.VelaVersion
       VELAUX_VERSION_KEY: github.com/oam-dev/velad/version.VelaUXVersion
@@ -62,7 +62,8 @@ jobs:
       - name: Build
         run: |
           make download_vela_images_addons
-          make download_k3s
+          make download_k3s_images
+          make download_k3s_bin_script
           make download_k3d
           make pack_vela_chart
           ${{ env.GO_BUILD_ENV }} GOOS=${{ steps.get_matrix.outputs.OS }} GOARCH=${{ steps.get_matrix.outputs.ARCH }} \

Makefile

@@ -2,39 +2,40 @@ include makefiles/dependency.mk
 
 K3S_VERSION ?= v1.21.10+k3s1
 STATIC_DIR := pkg/resources/static
-VELA_VERSION ?= v1.4.3
+VELA_VERSION ?= v1.4.12
-VELAUX_VERSION ?= v1.4.3
+VELAUX_VERSION ?= v1.4.7
-GOOS ?= linux
+LDFLAGS= "-X github.com/oam-dev/velad/version.VelaUXVersion=${VELAUX_VERSION} -X github.com/oam-dev/velad/version.VelaVersion=${VELA_VERSION}"
-GOARCH ?= amd64
+OS ?= linux
+ARCH ?= amd64
 
 .DEFAULT_GOAL := linux-amd64
-linux-amd64: download_vela_images_addons download_k3s pack_vela_chart
+linux-amd64 linux-arm64: download_vela_images_addons pack_vela_chart download_k3s_bin_script download_k3s_images
-	go build -o bin/velad-${GOOS}-${GOARCH} \
+	GOOS=${OS} GOARCH=${ARCH} \
-	-ldflags="-X github.com/oam-dev/velad/version.VelaUXVersion=${VELAUX_VERSION} -X github.com/oam-dev/velad/version.VelaVersion=${VELA_VERSION}" \
+	go build -o bin/velad-${OS}-${ARCH} \
+	-ldflags=${LDFLAGS} \
 	github.com/oam-dev/velad/cmd/velad
 
-
+darwin-amd64 darwin-arm64 windows-amd64: download_vela_images_addons download_k3d pack_vela_chart download_k3s_images
-darwin-amd64 windows-amd64: download_vela_images_addons download_k3d pack_vela_chart download_k3s_images
+	GOOS=${OS} GOARCH=${ARCH} \
-	GOOS=${GOOS} GOARCH=${GOARCH} \
+	go build -o bin/velad-${OS}-${ARCH} \
-	go build -o bin/velad-${GOOS}-${GOARCH} \
+	-ldflags=${LDFLAGS} \
-	-ldflags="-X github.com/oam-dev/velad/version.VelaUXVersion=${VELAUX_VERSION} -X github.com/oam-dev/velad/version.VelaVersion=${VELA_VERSION}" \
 	github.com/oam-dev/velad/cmd/velad
 
 download_vela_images_addons:
-	./hack/download_vela_images.sh ${VELA_VERSION} ${VELAUX_VERSION}
+	./hack/download_vela_images.sh ${VELA_VERSION} ${VELAUX_VERSION} ${ARCH}
 	./hack/download_addons.sh ${VELAUX_VERSION}
 
 download_k3d:
-	./hack/download_k3d_images.sh
+	./hack/download_k3d_images.sh ${ARCH}
 
-download_k3s: download_k3s_images
+download_k3s_bin_script:
 	mkdir -p ${STATIC_DIR}/k3s/other
 	curl -Lo ${STATIC_DIR}/k3s/other/k3s https://github.com/k3s-io/k3s/releases/download/${K3S_VERSION}/k3s
 	curl -Lo ${STATIC_DIR}/k3s/other/setup.sh https://get.k3s.io
 
 download_k3s_images:
 	mkdir -p ${STATIC_DIR}/k3s/images
-	curl -Lo ${STATIC_DIR}/k3s/images/k3s-airgap-images-amd64.tar.gz https://github.com/k3s-io/k3s/releases/download/${K3S_VERSION}/k3s-airgap-images-amd64.tar.gz
+	curl -Lo ${STATIC_DIR}/k3s/images/k3s-airgap-images.tar.gz https://github.com/k3s-io/k3s/releases/download/${K3S_VERSION}/k3s-airgap-images-${ARCH}.tar.gz
 
 CHART_DIR := ${STATIC_DIR}/vela/charts
 pack_vela_chart:

README.md

@@ -4,7 +4,7 @@ Lightweight Deploy tool, helps setup [KubeVela](https://github.com/kubevela/kube
 
 English | [简体中文](docs/readme-zh.md)
 
-![Build](https://github.com/kubevela/velad/actions/workflows/build.yaml/badge.svg)
+![E2E Test](https://github.com/kubevela/velad/actions/workflows/e2e-test.yaml/badge.svg)
 
 ## Introduction
 
@@ -73,3 +73,7 @@ velad uninstall
 ### More example
 
 Please check [docs](./docs/) for more VelaD example
+
+## Known issues
+
+- Installation on darwin-arm64 (Apple chip) machine isn't fully air-gapped. Please track #64 for more info.

docs/contribute.md

@@ -0,0 +1,77 @@
+# Contribution Guide
+
+This guild helps you get started developing VelaD
+
+### Prerequisites
+
+1. Golang version 1.17+
+2. Docker (for non-linux user)
+3. golangci-lint 1.38.0+, it will install automatically if you run make, you can install it [manually](https://golangci-lint.run/usage/install/#local-installation) if the installation is too slow.
+
+### Build
+
+1. Clone this project
+```shell
+git clone https://github.com/kubevela/velad.git
+cd velad
+```
+2. Build VelaD
+
+```shell
+make
+```
+This will build amd64-linux version of VelaD by default. To build other version, you need to specify `OS` and `ARCH`
+and the target. For example, you can build a darwin-amd64 version by:
+
+```shell
+OS=darwin ARCH=amd64 make darwin-amd64
+```
+
+### Debug
+
+When use IDE to debug VelaD, you need to do several things
+
+1. Download resources needed
+
+If you want build linux version, run 
+```shell
+VELAUX_VERSION=v1.x.y VELA_VERSION=v1.z.w make download_vela_images_addons 
+make download_k3s_bin_script 
+make download_k3s_images
+make pack_vela_chart
+```
+
+If you want to build non-linux version, run
+
+```shell
+VELAUX_VERSION=v1.x.y VELA_VERSION=v1.z.w make download_vela_images_addons 
+make download_k3d 
+make pack_vela_chart 
+make download_k3s_images
+```
+
+`VELAUX_VERSION=v1.x.y VELA_VERSION=v1.z.w` is optional environment variables if you want to change the default version in makefile.
+
+2. Build VelaD
+
+If you are using macOS with intel chip, the complete build command is like:
+
+```shell
+OS=darwin ARCH=amd64 \
+go build -ldflags="-X github.com/oam-dev/velad/version.VelaVersion=v1.x.y -X github.com/oam-dev/velad/version.VelaUXVersion=v1.x.y"  \
+-o bin/velad \
+cmd/velad/main.go
+```
+
+> Ldflags can help to inject vela-core and VelaUX version. (Can be different)
+> If you are using IDE to debug, remember to add `-ldflags="-X github.com...` part to build option.
+
+
+### Create a pull request
+
+Before you submit a PR, run this command to ensure it is ready:
+
+```shell
+make reviewable
+```
+For other PR things you can check the document [here](https://kubevela.net/docs/contributor/code-contribute#create-a-pull-request).

go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/fatih/color v1.13.0
 	github.com/k3d-io/k3d/v5 v5.4.1
 	github.com/kyokomi/emoji/v2 v2.2.9
-	github.com/oam-dev/kubevela v1.4.3
+	github.com/oam-dev/kubevela v1.4.12
 	github.com/pkg/errors v0.9.1
 	github.com/spf13/cobra v1.4.0
 	github.com/stretchr/testify v1.7.1
@@ -244,10 +244,10 @@ require (
 	go4.org/intern v0.0.0-20211027215823-ae77deb06f29 // indirect
 	go4.org/unsafe/assume-no-moving-gc v0.0.0-20211027215541-db492cf91b37 // indirect
 	golang.org/x/crypto v0.0.0-20220507011949-2cf3adece122 // indirect
-	golang.org/x/net v0.0.0-20220516155154-20f960328961 // indirect
+	golang.org/x/net v0.0.0-20220906165146-f3363e06e74c // indirect
 	golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5 // indirect
 	golang.org/x/sync v0.0.0-20220513210516-0976fa681c29 // indirect
-	golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a // indirect
+	golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
 	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect

go.sum

@@ -1473,8 +1473,8 @@ github.com/oam-dev/cluster-gateway v1.4.0 h1:ZZcNRYsUDRWM5JnNX28/zdSPRKERGstcAY+
 github.com/oam-dev/cluster-gateway v1.4.0/go.mod h1:qnCczkXtTY7h0SqxjZqAAyKQPwrJjLIFy+IdeoaYKCU=
 github.com/oam-dev/cluster-register v1.0.4-0.20220325092210-cee4a3d3fb7d h1:ZZsBkksYDzwJEjqx9/XBD+VwlhHz8flkZvMJYzO4ASA=
 github.com/oam-dev/cluster-register v1.0.4-0.20220325092210-cee4a3d3fb7d/go.mod h1:nKEUMfuEB8pHKsaSah9IA+UQzezrPYebBdRozyNtlZc=
-github.com/oam-dev/kubevela v1.4.3 h1:0Bc6MTM6y5XmlbHKJXcMnrLBPdSERQi4ypAqmyn27Tk=
+github.com/oam-dev/kubevela v1.4.12 h1:GD9T0RICDpP/SnQNP03qpbxuHdpyT1/4ycxXaUNxLJ4=
-github.com/oam-dev/kubevela v1.4.3/go.mod h1:is+qvJUeuJM3UbfdL7gtQbG3VwVhljhfc2o+74T8ffo=
+github.com/oam-dev/kubevela v1.4.12/go.mod h1:XYBSEgJe6DObdFBFAcS0YEpqCvSYvUUIEf6sL1juC1Y=
 github.com/oam-dev/stern v1.13.2 h1:jlGgtJbKmIVhzkH44ft5plkgs8XEfvxbFrQdX60CQR4=
 github.com/oam-dev/stern v1.13.2/go.mod h1:0pLjZt0amXE/ErF16Rdrgd98H2owN8Hmn3/7CX5+AeA=
 github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28 h1:tD8HiFKnt0jnwdTWjeqUnfnUYLD/+Nsmj8ZGIxqDWiU=
@@ -2237,8 +2237,8 @@ golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220421235706-1d1ef9303861/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220516155154-20f960328961 h1:+W/iTMPG0EL7aW+/atntZwZrvSRIj3m3yX414dSULUU=
+golang.org/x/net v0.0.0-20220906165146-f3363e06e74c h1:yKufUcDwucU5urd+50/Opbt4AYpqthk7wHpHok8f1lo=
-golang.org/x/net v0.0.0-20220516155154-20f960328961/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220906165146-f3363e06e74c/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2420,8 +2420,8 @@ golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a h1:N2T1jUrTQE9Re6TFF5PhvEHXHCguynGhKjWVsIUt5cY=
+golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 h1:WIoqL4EROvwiPdUtaip4VcDdpZ4kha7wBWZrbVKCIZg=
-golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

hack/download_k3d_images.sh

@@ -1,16 +1,31 @@
 #!/bin/bash
 
+set -e
+set -x
+
 K3D_IMAGE_DIR=pkg/resources/static/k3d/images
 mkdir -p "$K3D_IMAGE_DIR"
 
-vela_images=("ghcr.io/k3d-io/k3d-tools:5.4.1"
+function download_k3d_images() {
-  "ghcr.io/k3d-io/k3d-proxy:5.4.1"
+  vela_images=("ghcr.io/k3d-io/k3d-tools:5.4.1"
-  "docker.io/rancher/k3s:v1.21.10-k3s1")
+    "ghcr.io/k3d-io/k3d-proxy:5.4.1"
+    "docker.io/rancher/k3s:v1.21.10-k3s1")
 
-for IMG in ${vela_images[*]}; do
+  for IMG in ${vela_images[*]}; do
-  IMAGE_NAME=$(echo "$IMG" | cut -f1 -d: | cut -f3 -d/)
+    IMAGE_NAME=$(echo "$IMG" | cut -f1 -d: | cut -f3 -d/)
-  echo saving "$IMG" to "$K3D_IMAGE_DIR"/"$IMAGE_NAME".tar
+    echo saving "$IMG" to "$K3D_IMAGE_DIR"/"$IMAGE_NAME".tar
-  docker pull "$IMG"
+    $DOCKER_PULL "$IMG"
-  docker save -o "$K3D_IMAGE_DIR"/"$IMAGE_NAME".tar "$IMG"
+    docker save -o "$K3D_IMAGE_DIR"/"$IMAGE_NAME".tar "$IMG"
-  gzip -f "$K3D_IMAGE_DIR"/"$IMAGE_NAME".tar
+    gzip -f "$K3D_IMAGE_DIR"/"$IMAGE_NAME".tar
-done
+  done
+}
+
+function determine_pull_command() {
+  DOCKER_PULL="docker pull --platform=linux/amd64"
+  if [ "$1" == "arm64" ]; then
+      DOCKER_PULL="docker pull --platform=linux/arm64"
+  fi
+}
+
+determine_pull_command "$ARCH"
+download_k3d_images

hack/download_vela_images.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -e
+set -x
 
 VELA_IMAGE_DIR=pkg/resources/static/vela/images
 rm -rf "$VELA_IMAGE_DIR"
@@ -24,6 +25,9 @@ else
   velaux_version=v$2
 fi
 
+# optional, amd64 if not set
+ARCH=$3
+
 function set_cluster_gateway_version() {
     cluster_gateway_version=UNKNOWN
     image_tag=$(cat pkg/resources/static/vela/charts/vela-core/values.yaml | grep -A 1 oamdev/cluster-gateway | grep tag)
@@ -49,12 +53,21 @@ function download_images() {
     do
       IMAGE_NAME=$(echo "$IMG" | cut -f1 -d: | cut -f2 -d/)
       echo saving "$IMG" to "$VELA_IMAGE_DIR"/"$IMAGE_NAME".tar.gz
-      docker pull "$IMG"
+      $DOCKER_PULL "$IMG"
       docker save -o "$VELA_IMAGE_DIR"/"$IMAGE_NAME".tar "$IMG"
       gzip -f "$VELA_IMAGE_DIR"/"$IMAGE_NAME".tar
     done
 }
 
+function determine_pull_command() {
+  DOCKER_PULL="docker pull --platform=linux/amd64"
+  if [ "$1" == "arm64" ]; then
+      DOCKER_PULL="docker pull --platform=linux/arm64"
+  fi
+}
+
+
+determine_pull_command "$ARCH"
 set_cluster_gateway_version
 set_certgen_version
 download_images

hack/upgrade_vela.sh

@@ -27,9 +27,16 @@ popd
 
 mv kubevela/"$PATCH_FILE_NAME" .
 
-echo "Patching charts..."
+
-git apply -v --check --reject --apply --directory $WORKDIR "$PATCH_FILE_NAME"
+if [ -s "$PATCH_FILE_NAME" ]; then
-echo "Patching done"
+    # The file is not-empty.
+    echo "Patch file is not empty, applying patch..."
+    git apply -v --check --reject --apply --directory $WORKDIR "$PATCH_FILE_NAME"
+    echo "Patching done"
+else
+    # The file is empty.
+    echo "Patch file is empty, no need to apply patch"
+fi
 
 rm "$PATCH_FILE_NAME"
 rm -rf kubevela

pkg/cluster/common.go

@@ -12,7 +12,7 @@ func GetK3sServerArgs(args apis.InstallArgs) []string {
 		serverArgs = append(serverArgs, "--datastore-endpoint="+args.DBEndpoint)
 	}
 	if args.BindIP != "" {
-		serverArgs = append(serverArgs, "--tls-san="+args.BindIP)
+		serverArgs = append(serverArgs, "--tls-san="+args.BindIP, "--node-external-ip="+args.BindIP)
 	}
 	if args.Token != "" {
 		serverArgs = append(serverArgs, "--token="+args.Token)

pkg/cluster/k3d.go

@@ -115,34 +115,23 @@ func (d *K3dHandler) GenKubeconfig(bindIP string) error {
 	var err error
 	var cluster = d.cfg.Cluster.Name
 	// 1. kubeconfig for access from host
-	cfg := configPath(cluster)
+	cfgHost := configPath(cluster)
-	if _, err := k3dClient.KubeconfigGetWrite(context.Background(), runtimes.SelectedRuntime, &d.cfg.Cluster, cfg,
+	info("Generating host kubeconfig into", cfgHost)
+	if _, err := k3dClient.KubeconfigGetWrite(context.Background(), runtimes.SelectedRuntime, &d.cfg.Cluster, cfgHost,
 		&k3dClient.WriteKubeConfigOptions{UpdateExisting: true, OverwriteExisting: false, UpdateCurrentContext: true}); err != nil {
 		return errors.Wrap(err, "failed to gen kubeconfig")
 	}
 
-	cfgContent, err := os.ReadFile(cfg)
+	_cfgContent, err := os.ReadFile(cfgHost)
 	if err != nil {
 		return errors.Wrap(err, "read kubeconfig")
 	}
-	// 2. kubeconfig for access from other VelaD cluster
+
-	// Basically we replace the IP with IP inside the docker network
+	var (
-	cfgIn := configPathInternal(cluster)
+		hostToReplace string
-	networks, err := dockerCli.NetworkInspect(d.ctx, apis.VelaDDockerNetwork, types.NetworkInspectOptions{})
+		kubeConfig    = string(_cfgContent)
-	if err != nil {
+	)
-		klog.ErrorS(err, "inspect docker network")
+
-		return err
-	}
-	var containerIP string
-	cs := networks.Containers
-	for _, c := range cs {
-		if c.Name == fmt.Sprintf("k3d-%s-server-0", d.cfg.Cluster.Name) {
-			containerIP = strings.TrimSuffix(c.IPv4Address, "/16")
-		}
-	}
-	kubeConfig := string(cfgContent)
-	var re *regexp.Regexp
-	var hostToReplace string
 	switch {
 	case strings.Contains(kubeConfig, "0.0.0.0"):
 		hostToReplace = "0.0.0.0"
@@ -151,7 +140,31 @@ func (d *K3dHandler) GenKubeconfig(bindIP string) error {
 	default:
 		return errors.Wrap(err, "unrecognized kubeconfig format")
 	}
-	re = regexp.MustCompile(hostToReplace + `:\d{4}`)
+
+	// Replace host config with loop back address
+	cfgHostContent := strings.ReplaceAll(kubeConfig, hostToReplace, "127.0.0.1")
+	err = ioutil.WriteFile(cfgHost, []byte(cfgHostContent), 0600)
+	if err != nil {
+		errf("Fail to re-write host kubeconfig")
+	}
+
+	// 2. kubeconfig for access from other VelaD cluster
+	// Basically we replace the IP with IP inside the docker network
+	cfgIn := configPathInternal(cluster)
+	info("Generating internal kubeconfig into", cfgIn)
+	var containerIP string
+	networks, err := dockerCli.NetworkInspect(d.ctx, apis.VelaDDockerNetwork, types.NetworkInspectOptions{})
+	if err != nil {
+		klog.ErrorS(err, "inspect docker network")
+		return err
+	}
+	cs := networks.Containers
+	for _, c := range cs {
+		if c.Name == fmt.Sprintf("k3d-%s-server-0", d.cfg.Cluster.Name) {
+			containerIP = strings.TrimSuffix(c.IPv4Address, "/16")
+		}
+	}
+	re := regexp.MustCompile(hostToReplace + `:\d{4}`)
 	cfgInContent := re.ReplaceAllString(kubeConfig, fmt.Sprintf("%s:6443", containerIP))
 	err = ioutil.WriteFile(cfgIn, []byte(cfgInContent), 0600)
 	if err != nil {
@@ -164,7 +177,7 @@ func (d *K3dHandler) GenKubeconfig(bindIP string) error {
 	if bindIP != "" {
 		cfgOut := configPathExternal(cluster)
 		info("Generating external kubeconfig for remote access into ", cfgOut)
-		cfgOutContent := strings.Replace(string(cfgContent), hostToReplace, bindIP, 1)
+		cfgOutContent := strings.Replace(kubeConfig, hostToReplace, bindIP, 1)
 		err = os.WriteFile(cfgOut, []byte(cfgOutContent), 0600)
 		if err != nil {
 			return err
@@ -408,7 +421,7 @@ func runClusterIfNotExist(ctx context.Context, cluster config.ClusterConfig) err
 
 // PrepareK3sImages extracts k3s images to ~/.vela/velad/k3s/images.tg
 func PrepareK3sImages() error {
-	embedK3sImage, err := resources.K3sImage.Open("static/k3s/images/k3s-airgap-images-amd64.tar.gz")
+	embedK3sImage, err := resources.K3sImage.Open("static/k3s/images/k3s-airgap-images.tar.gz")
 	if err != nil {
 		return err
 	}
@@ -419,7 +432,8 @@ func PrepareK3sImages() error {
 	if err != nil {
 		return err
 	}
-	k3sImagesPath := filepath.Join(k3sImagesDir, "k3s-airgap-images-amd64.tgz")
+	k3sImagesPath := filepath.Join(k3sImagesDir, "k3s-airgap-images.tgz")
+	info("Saving k3s image airgap install tarball to", k3sImagesPath)
 	// #nosec
 	k3sImagesFile, err := os.OpenFile(k3sImagesPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
 	if err != nil {

pkg/cluster/k3s.go

@@ -68,7 +68,7 @@ func (l K3sHandler) SetKubeconfig() error {
 // LoadImage load imageTar to k3s cluster
 func (l K3sHandler) LoadImage(imageTar string) error {
 	// #nosec
-	importCmd := exec.Command("k3s", "ctr", "images", "import", imageTar)
+	importCmd := exec.Command("k3s", "ctr", "images", "import", "--all-platforms", imageTar)
 	output, err := importCmd.CombinedOutput()
 	utils.InfoBytes(output)
 	if err != nil {
@@ -150,7 +150,7 @@ func fillVelaStatus(status *apis.ClusterStatus) {
 
 // PrepareK3sImages Write embed images
 func PrepareK3sImages() error {
-	embedK3sImage, err := resources.K3sImage.Open("static/k3s/images/k3s-airgap-images-amd64.tar.gz")
+	embedK3sImage, err := resources.K3sImage.Open("static/k3s/images/k3s-airgap-images.tar.gz")
 	if err != nil {
 		return err
 	}

pkg/resources/common.go

@@ -10,7 +10,7 @@ var (
 	// K3sImageDir is the directory to save the k3s air-gap image
 	K3sImageDir = "/var/lib/rancher/k3s/agent/images/"
 	// K3sImageLocation is where to save k3s air-gap images
-	K3sImageLocation = "/var/lib/rancher/k3s/agent/images/k3s-airgap-images-amd64.tar.gz"
+	K3sImageLocation = "/var/lib/rancher/k3s/agent/images/k3s-airgap-images.tar.gz"
 )
 
 var (

pkg/resources/static/vela/charts/vela-core/Chart.yaml

@@ -14,11 +14,11 @@ type: application
 
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.4.3
+version: v1.4.12
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.4.3
+appVersion: v1.4.12
 
 home: https://kubevela.io
 icon: https://kubevela.io/img/logo.svg

pkg/resources/static/vela/charts/vela-core/templates/defwithtemplate/affinity.yaml

@@ -4,7 +4,7 @@ apiVersion: core.oam.dev/v1beta1
 kind: TraitDefinition
 metadata:
   annotations:
-    definition.oam.dev/description: affinity specify affinity and tolerationon K8s pod for your workload which follows the pod spec in path 'spec.template'.
+    definition.oam.dev/description: Affinity specifies affinity and toleration K8s pod for your workload which follows the pod spec in path 'spec.template'.
   labels:
     custom.definition.oam.dev/ui-hidden: "true"
   name: affinity

pkg/resources/static/vela/charts/vela-core/templates/defwithtemplate/cron-task.yaml

@@ -196,14 +196,14 @@ spec:
         		// +usage=Specifies a source the value of this var should come from
         		valueFrom?: {
         			// +usage=Selects a key of a secret in the pod's namespace
-        			secretKeyRef: {
+        			secretKeyRef?: {
         				// +usage=The name of the secret in the pod's namespace to select from
         				name: string
         				// +usage=The key of the secret to select from. Must be a valid secret key
         				key: string
         			}
         			// +usage=Selects a key of a config map in the pod's namespace
-        			configMapKeyRef: {
+        			configMapKeyRef?: {
         				// +usage=The name of the config map in the pod's namespace to select from
         				name: string
         				// +usage=The key of the config map to select from. Must be a valid secret key

pkg/resources/static/vela/charts/vela-core/templates/defwithtemplate/init-container.yaml

@@ -43,7 +43,7 @@ spec:
         		volumeMounts: [{
         			name:      parameter.mountName
         			mountPath: parameter.initMountPath
-        		}]
+        		}] + parameter.extraVolumeMounts
         	}]
         	// +patchKey=name
         	volumes: [{
@@ -97,5 +97,13 @@ spec:
 
         	// +usage=Specify the mount path of init container
         	initMountPath: string
+
+        	// +usage=Specify the extra volume mounts for the init container
+        	extraVolumeMounts: [...{
+        		// +usage=The name of the volume to be mounted
+        		name: string
+        		// +usage=The mountPath for mount in the init container
+        		mountPath: string
+        	}]
         }
 

pkg/resources/static/vela/charts/vela-core/templates/defwithtemplate/ref-objects.yaml

@@ -14,12 +14,18 @@ spec:
     cue:
       template: |
         #K8sObject: {
-        	apiVersion: string
+        	// +usage=The resource type for the Kubernetes objects
-        	kind:       string
+        	resource?: string
-        	metadata: {
+        	// +usage=The group name for the Kubernetes objects
-        		name: string
+        	group?: string
-        		...
+        	// +usage=If specified, fetch the Kubernetes objects with the name, exclusive to labelSelector
-        	}
+        	name?: string
+        	// +usage=If specified, fetch the Kubernetes objects from the namespace. Otherwise, fetch from the application's namespace.
+        	namespace?: string
+        	// +usage=If specified, fetch the Kubernetes objects from the cluster. Otherwise, fetch from the local cluster.
+        	cluster?: string
+        	// +usage=If specified, fetch the Kubernetes objects according to the label selector, exclusive to name
+        	labelSelector?: [string]: string
         	...
         }
         output: parameter.objects[0]
@@ -30,7 +36,12 @@ spec:
         		}
         	}
         }
-        parameter: objects: [...#K8sObject]
+        parameter: {
+        	// +usage=If specified, application will fetch native Kubernetes objects according to the object description
+        	objects?: [...#K8sObject]
+        	// +usage=If specified, the objects in the urls will be loaded.
+        	urls?: [...string]
+        }
   status:
     customStatus: |-
       if context.output.apiVersion == "apps/v1" && context.output.kind == "Deployment" {

pkg/resources/static/vela/charts/vela-core/templates/defwithtemplate/service-account.yaml

@@ -14,10 +14,114 @@ spec:
   schematic:
     cue:
       template: |
+        #Privileges: {
+        	// +usage=Specify the verbs to be allowed for the resource
+        	verbs: [...string]
+        	// +usage=Specify the apiGroups of the resource
+        	apiGroups?: [...string]
+        	// +usage=Specify the resources to be allowed
+        	resources?: [...string]
+        	// +usage=Specify the resourceNames to be allowed
+        	resourceNames?: [...string]
+        	// +usage=Specify the resource url to be allowed
+        	nonResourceURLs?: [...string]
+        	// +usage=Specify the scope of the privileges, default to be namespace scope
+        	scope: *"namespace" | "cluster"
+        }
         parameter: {
         	// +usage=Specify the name of ServiceAccount
         	name: string
+        	// +usage=Specify whether to create new ServiceAccount or not
+        	create: *false | bool
+        	// +usage=Specify the privileges of the ServiceAccount, if not empty, RoleBindings(ClusterRoleBindings) will be created
+        	privileges?: [...#Privileges]
         }
         // +patchStrategy=retainKeys
         patch: spec: template: spec: serviceAccountName: parameter.name
+        _clusterPrivileges: [ for p in parameter.privileges if p.scope == "cluster" {p}]
+        _namespacePrivileges: [ for p in parameter.privileges if p.scope == "namespace" {p}]
+        outputs: {
+        	if parameter.create {
+        		"service-account": {
+        			apiVersion: "v1"
+        			kind:       "ServiceAccount"
+        			metadata: name: parameter.name
+        		}
+        	}
+        	if parameter.privileges != _|_ {
+        		if len(_clusterPrivileges) > 0 {
+        			"cluster-role": {
+        				apiVersion: "rbac.authorization.k8s.io/v1"
+        				kind:       "ClusterRole"
+        				metadata: name: "\(context.namespace):\(parameter.name)"
+        				rules: [ for p in _clusterPrivileges {
+        					verbs: p.verbs
+        					if p.apiGroups != _|_ {
+        						apiGroups: p.apiGroups
+        					}
+        					if p.resources != _|_ {
+        						resources: p.resources
+        					}
+        					if p.resourceNames != _|_ {
+        						resourceNames: p.resourceNames
+        					}
+        					if p.nonResourceURLs != _|_ {
+        						nonResourceURLs: p.nonResourceURLs
+        					}
+        				}]
+        			}
+        			"cluster-role-binding": {
+        				apiVersion: "rbac.authorization.k8s.io/v1"
+        				kind:       "ClusterRoleBinding"
+        				metadata: name: "\(context.namespace):\(parameter.name)"
+        				roleRef: {
+        					apiGroup: "rbac.authorization.k8s.io"
+        					kind:     "ClusterRole"
+        					name:     "\(context.namespace):\(parameter.name)"
+        				}
+        				subjects: [{
+        					kind:      "ServiceAccount"
+        					name:      parameter.name
+        					namespace: "\(context.namespace)"
+        				}]
+        			}
+        		}
+        		if len(_namespacePrivileges) > 0 {
+        			role: {
+        				apiVersion: "rbac.authorization.k8s.io/v1"
+        				kind:       "Role"
+        				metadata: name: parameter.name
+        				rules: [ for p in _namespacePrivileges {
+        					verbs: p.verbs
+        					if p.apiGroups != _|_ {
+        						apiGroups: p.apiGroups
+        					}
+        					if p.resources != _|_ {
+        						resources: p.resources
+        					}
+        					if p.resourceNames != _|_ {
+        						resourceNames: p.resourceNames
+        					}
+        					if p.nonResourceURLs != _|_ {
+        						nonResourceURLs: p.nonResourceURLs
+        					}
+        				}]
+        			}
+        			"role-binding": {
+        				apiVersion: "rbac.authorization.k8s.io/v1"
+        				kind:       "RoleBinding"
+        				metadata: name: parameter.name
+        				roleRef: {
+        					apiGroup: "rbac.authorization.k8s.io"
+        					kind:     "Role"
+        					name:     parameter.name
+        				}
+        				subjects: [{
+        					kind: "ServiceAccount"
+        					name: parameter.name
+        				}]
+        			}
+        		}
+        	}
+        }
 

pkg/resources/static/vela/charts/vela-core/templates/defwithtemplate/sidecar.yaml

@@ -82,6 +82,11 @@ spec:
         				// +usage=The key of the config map to select from. Must be a valid secret key
         				key: string
         			}
+        			// +usage=Specify the field reference for env
+        			fieldRef?: {
+        				// +usage=Specify the field path for env
+        				fieldPath: string
+        			}
         		}
         	}]
 

pkg/resources/static/vela/charts/vela-core/templates/defwithtemplate/storage.yaml

@@ -64,6 +64,9 @@ spec:
         			{
         				name:      "pvc-" + v.name
         				mountPath: v.mountPath
+        				if v.subPath != _|_ {
+        					subPath: v.subPath
+        				}
         			}
         		}
         	},
@@ -73,6 +76,9 @@ spec:
         		{
         			name:      "configmap-" + v.name
         			mountPath: v.mountPath
+        			if v.subPath != _|_ {
+        				subPath: v.subPath
+        			}
         		}
         	},
         ] | []
@@ -114,6 +120,9 @@ spec:
         		{
         			name:      "secret-" + v.name
         			mountPath: v.mountPath
+        			if v.subPath != _|_ {
+        				subPath: v.subPath
+        			}
         		}
         	},
         ] | []
@@ -155,6 +164,9 @@ spec:
         		{
         			name:      "emptydir-" + v.name
         			mountPath: v.mountPath
+        			if v.subPath != _|_ {
+        				subPath: v.subPath
+        			}
         		}
         	},
         ] | []
@@ -163,12 +175,28 @@ spec:
         		{
         			name:       "pvc-" + v.name
         			devicePath: v.mountPath
+        			if v.subPath != _|_ {
+        				subPath: v.subPath
+        			}
         		}
         	},
         ] | []
+        volumesList: pvcVolumesList + configMapVolumesList + secretVolumesList + emptyDirVolumesList
+        deDupVolumesArray: [
+        	for val in [
+        		for i, vi in volumesList {
+        			for j, vj in volumesList if j < i && vi.name == vj.name {
+        				_ignore: true
+        			}
+        			vi
+        		},
+        	] if val._ignore == _|_ {
+        		val
+        	},
+        ]
         patch: spec: template: spec: {
         	// +patchKey=name
-        	volumes: pvcVolumesList + configMapVolumesList + secretVolumesList + emptyDirVolumesList
+        	volumes: deDupVolumesArray
 
         	containers: [{
         		// +patchKey=name
@@ -256,6 +284,7 @@ spec:
         		name:              string
         		mountOnly:         *false | bool
         		mountPath:         string
+        		subPath?:          string
         		volumeMode:        *"Filesystem" | string
         		volumeName?:       string
         		accessModes:       *["ReadWriteOnce"] | [...string]
@@ -297,6 +326,7 @@ spec:
         			configMapKey: string
         		}]
         		mountPath?:  string
+        		subPath?:    string
         		defaultMode: *420 | int
         		readOnly:    *false | bool
         		data?: {...}
@@ -320,6 +350,7 @@ spec:
         			secretKey: string
         		}]
         		mountPath?:  string
+        		subPath?:    string
         		defaultMode: *420 | int
         		readOnly:    *false | bool
         		stringData?: {...}
@@ -335,6 +366,7 @@ spec:
         	emptyDir?: [...{
         		name:      string
         		mountPath: string
+        		subPath?:  string
         		medium:    *"" | "Memory"
         	}]
         }

pkg/resources/static/vela/charts/vela-core/templates/defwithtemplate/task.yaml

@@ -149,14 +149,14 @@ spec:
         		// +usage=Specifies a source the value of this var should come from
         		valueFrom?: {
         			// +usage=Selects a key of a secret in the pod's namespace
-        			secretKeyRef: {
+        			secretKeyRef?: {
         				// +usage=The name of the secret in the pod's namespace to select from
         				name: string
         				// +usage=The key of the secret to select from. Must be a valid secret key
         				key: string
         			}
         			// +usage=Selects a key of a config map in the pod's namespace
-        			configMapKeyRef: {
+        			configMapKeyRef?: {
         				// +usage=The name of the config map in the pod's namespace to select from
         				name: string
         				// +usage=The key of the config map to select from. Must be a valid secret key

pkg/resources/static/vela/charts/vela-core/templates/defwithtemplate/webservice.yaml

@@ -20,7 +20,10 @@ spec:
         		for v in parameter.volumeMounts.pvc {
         			{
         				mountPath: v.mountPath
-        				name:      v.name
+        				if v.subPath != _|_ {
+        					subPath: v.subPath
+        				}
+        				name: v.name
         			}
         		},
         	] | []
@@ -29,7 +32,10 @@ spec:
         			for v in parameter.volumeMounts.configMap {
         			{
         				mountPath: v.mountPath
-        				name:      v.name
+        				if v.subPath != _|_ {
+        					subPath: v.subPath
+        				}
+        				name: v.name
         			}
         		},
         	] | []
@@ -38,7 +44,10 @@ spec:
         		for v in parameter.volumeMounts.secret {
         			{
         				mountPath: v.mountPath
-        				name:      v.name
+        				if v.subPath != _|_ {
+        					subPath: v.subPath
+        				}
+        				name: v.name
         			}
         		},
         	] | []
@@ -47,7 +56,10 @@ spec:
         			for v in parameter.volumeMounts.emptyDir {
         			{
         				mountPath: v.mountPath
-        				name:      v.name
+        				if v.subPath != _|_ {
+        					subPath: v.subPath
+        				}
+        				name: v.name
         			}
         		},
         	] | []
@@ -56,7 +68,10 @@ spec:
         			for v in parameter.volumeMounts.hostPath {
         			{
         				mountPath: v.mountPath
-        				name:      v.name
+        				if v.subPath != _|_ {
+        					subPath: v.subPath
+        				}
+        				name: v.name
         			}
         		},
         	] | []
@@ -119,6 +134,19 @@ spec:
         		},
         	] | []
         }
+        volumesList: volumesArray.pvc + volumesArray.configMap + volumesArray.secret + volumesArray.emptyDir + volumesArray.hostPath
+        deDupVolumesArray: [
+        	for val in [
+        		for i, vi in volumesList {
+        			for j, vj in volumesList if j < i && vi.name == vj.name {
+        				_ignore: true
+        			}
+        			vi
+        		},
+        	] if val._ignore == _|_ {
+        		val
+        	},
+        ]
         output: {
         	apiVersion: "apps/v1"
         	kind:       "Deployment"
@@ -262,7 +290,7 @@ spec:
         				}
 
         				if parameter["volumeMounts"] != _|_ {
-        					volumes: volumesArray.pvc + volumesArray.configMap + volumesArray.secret + volumesArray.emptyDir + volumesArray.hostPath
+        					volumes: deDupVolumesArray
         				}
         			}
         		}
@@ -375,6 +403,7 @@ spec:
         		pvc?: [...{
         			name:      string
         			mountPath: string
+        			subPath?:  string
         			// +usage=The name of the PVC
         			claimName: string
         		}]
@@ -382,6 +411,7 @@ spec:
         		configMap?: [...{
         			name:        string
         			mountPath:   string
+        			subPath?:    string
         			defaultMode: *420 | int
         			cmName:      string
         			items?: [...{
@@ -394,6 +424,7 @@ spec:
         		secret?: [...{
         			name:        string
         			mountPath:   string
+        			subPath?:    string
         			defaultMode: *420 | int
         			secretName:  string
         			items?: [...{
@@ -406,12 +437,14 @@ spec:
         		emptyDir?: [...{
         			name:      string
         			mountPath: string
+        			subPath?:  string
         			medium:    *"" | "Memory"
         		}]
         		// +usage=Mount HostPath type volume
         		hostPath?: [...{
         			name:      string
         			mountPath: string
+        			subPath?:  string
         			path:      string
         		}]
         	}

pkg/resources/static/vela/charts/vela-core/templates/kubevela-controller.yaml

@@ -123,6 +123,7 @@ metadata:
   name: {{ include "kubevela.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
+    controller.oam.dev/name: vela-core
   {{- include "kubevela.labels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}

pkg/vela/kubevela.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/exec"
 	"path"
+	"runtime"
 	"strings"
 
 	"github.com/oam-dev/kubevela/pkg/utils/system"
@@ -50,6 +51,11 @@ func PrepareVelaChart() (string, error) {
 
 // LoadVelaImages load vela-core and velaUX images
 func LoadVelaImages() error {
+	if runtime.GOOS == apis.GoosDarwin && runtime.GOARCH == "arm64" {
+		info("Skip importing vela-core and VelaUX image on darwin-arm64")
+		return nil
+	}
+	var err error
 	dir, err := resources.VelaImages.ReadDir("static/vela/images")
 	if err != nil {
 		return err