Update Rust Kubernetes dependencies (#9454)

* Update kubert to v0.10
* Update kube-rs to v0.75 (fixes #9339)
* Update k8s-openapi to v0.16
* Update k8s-gateway-api to v0.7

Signed-off-by: Oliver Gould <ver@buoyant.io>

Cargo.lock

@@ -4,10 +4,11 @@ version = 3
 
 [[package]]
 name = "ahash"
-version = "0.7.6"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "57e6e951cfbb2db8de1828d49073a113a29fd7117b1596caa781a258c7e38d72"
 dependencies = [
+ "cfg-if",
  "getrandom",
  "once_cell",
  "version_check",
@@ -772,9 +773,9 @@ dependencies = [
 
 [[package]]
 name = "k8s-gateway-api"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6079533b6a72618338101c3e227eb80e7a990cc23a0444f4bacc5a08708e9b1c"
+checksum = "c2b1071248ff409397c864c1587a946acd60b8fba8698828623c8c1cd687274d"
 dependencies = [
  "k8s-openapi",
  "kube",
@@ -785,9 +786,9 @@ dependencies = [
 
 [[package]]
 name = "k8s-openapi"
-version = "0.15.0"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ae2c04fcee6b01b04e3aadd56bb418932c8e0a9d8a93f48bc68c6bdcdb559d"
+checksum = "6d9455388f4977de4d0934efa9f7d36296295537d774574113a20f6082de03da"
 dependencies = [
  "base64",
  "bytes",
@@ -803,9 +804,9 @@ dependencies = [
 
 [[package]]
 name = "kube"
-version = "0.74.0"
+version = "0.75.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a527a8001a61d8d470dab27ac650889938760c243903e7cd90faaf7c60a34bdd"
+checksum = "9bb19108692aeafebb108fd0a1c381c06ac4c03859652599420975165e939b8a"
 dependencies = [
  "k8s-openapi",
  "kube-client",
@@ -816,9 +817,9 @@ dependencies = [
 
 [[package]]
 name = "kube-client"
-version = "0.74.0"
+version = "0.75.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0d48f42df4e8342e9f488c4b97e3759d0042c4e7ab1a853cc285adb44409480"
+checksum = "97e1a80ecd1b1438a2fc004549e155d47250b9e01fbfcf4cfbe9c8b56a085593"
 dependencies = [
  "base64",
  "bytes",
@@ -858,9 +859,9 @@ dependencies = [
 
 [[package]]
 name = "kube-core"
-version = "0.74.0"
+version = "0.75.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91f56027f862fdcad265d2e9616af416a355e28a1c620bb709083494753e070d"
+checksum = "f4d780f2bb048eeef64a4c6b2582d26a0fe19e30b4d3cc9e081616e1779c5d47"
 dependencies = [
  "chrono",
  "form_urlencoded",
@@ -876,9 +877,9 @@ dependencies = [
 
 [[package]]
 name = "kube-derive"
-version = "0.74.0"
+version = "0.75.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66d74121eb41af4480052901f31142d8d9bbdf1b7c6b856da43bcb02f5b1b177"
+checksum = "98459d53b2841237392cd6959956185b2df15c19d32c3b275ed6ca7b7ee1adae"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -889,9 +890,9 @@ dependencies = [
 
 [[package]]
 name = "kube-runtime"
-version = "0.74.0"
+version = "0.75.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fdcf5a20f968768e342ef1a457491bb5661fccd81119666d626c57500b16d99"
+checksum = "7769af142ee2e46bfa44bd393cf7f40b9d8b80d2e11f6317399551ed17760beb"
 dependencies = [
  "ahash",
  "backoff",
@@ -913,9 +914,9 @@ dependencies = [
 
 [[package]]
 name = "kubert"
-version = "0.9.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b8b65e116e2617ea081f5fcbd31d508243ab0c1c6da3fa2a7177680a61af855"
+checksum = "13ec7d98e64388b846dfd2c741c73e0850428ef9fafa9314c987a8e56a2e5358"
 dependencies = [
  "ahash",
  "clap",

policy-controller/Cargo.toml

@@ -20,8 +20,8 @@ clap = { version = "3", default-features = false, features = [
 ] }
 drain = "0.1"
 futures = { version = "0.3", default-features = false }
-k8s-gateway-api = "0.6"
-k8s-openapi = { version = "0.15", features = ["v1_20"] }
+k8s-gateway-api = "0.7"
+k8s-openapi = { version = "0.16", features = ["v1_20"] }
 hyper = { version = "0.14", features = ["http1", "http2", "runtime", "server"] }
 ipnet = { version = "2", default-features = false }
 linkerd-policy-controller-core = { path = "./core" }
@@ -36,12 +36,12 @@ tokio-stream = { version = "0.1", features = ["sync"] }
 tracing = "0.1"
 
 [dependencies.kube]
-version = "0.74"
+version = "0.75"
 default-features = false
 features = ["admission", "derive"]
 
 [dependencies.kubert]
-version = "0.9"
+version = "0.10"
 default-features = false
 features = ["clap", "index", "runtime", "server"]
 

policy-controller/core/Cargo.toml

@@ -6,7 +6,7 @@ license = "Apache-2.0"
 publish = false
 
 [dependencies]
-ahash = "0.7"
+ahash = "0.8"
 anyhow = "1"
 async-trait = "0.1"
 chrono = { version = "0.4.22", default_features = false }

policy-controller/k8s/api/Cargo.toml

@@ -6,9 +6,15 @@ license = "Apache-2.0"
 publish = false
 
 [dependencies]
-k8s-openapi = { version = "0.15", default-features = false, features = ["v1_20"] }
-k8s-gateway-api = "0.6.0"
-kube = { version = "0.74", default-features = false, features = ["client", "derive", "runtime"] }
+k8s-openapi = { version = "0.16", default-features = false, features = [
+    "v1_20",
+] }
+k8s-gateway-api = "0.7"
+kube = { version = "0.75", default-features = false, features = [
+    "client",
+    "derive",
+    "runtime",
+] }
 ipnet = { version = "2.5", features = ["json"] }
 schemars = "0.8"
 serde = { version = "1", features = ["derive"] }

policy-controller/k8s/api/src/policy/httproute.rs

@@ -46,7 +46,9 @@ pub struct HttpRouteSpec {
 /// HTTPRouteRule defines semantics for matching an HTTP request based on
 /// conditions (matches), processing it (filters), and forwarding the request to
 /// an API object (backendRefs).
-#[derive(Clone, Debug, PartialEq, serde::Deserialize, serde::Serialize, schemars::JsonSchema)]
+#[derive(
+    Clone, Debug, PartialEq, Eq, serde::Deserialize, serde::Serialize, schemars::JsonSchema,
+)]
 #[serde(rename_all = "camelCase")]
 pub struct HttpRouteRule {
     /// Matches define conditions used for matching the rule against incoming
@@ -132,7 +134,9 @@ pub struct HttpRouteRule {
 /// Some examples include request or response modification, implementing
 /// authentication strategies, rate-limiting, and traffic shaping. API
 /// guarantee/conformance is defined based on the type of the filter.
-#[derive(Clone, Debug, PartialEq, serde::Deserialize, serde::Serialize, schemars::JsonSchema)]
+#[derive(
+    Clone, Debug, PartialEq, Eq, serde::Deserialize, serde::Serialize, schemars::JsonSchema,
+)]
 #[serde(tag = "type", rename_all = "PascalCase")]
 pub enum HttpRouteFilter {
     /// RequestHeaderModifier defines a schema for a filter that modifies request

policy-controller/k8s/index/Cargo.toml

@@ -6,11 +6,11 @@ license = "Apache-2.0"
 publish = false
 
 [dependencies]
-ahash = "0.7"
+ahash = "0.8"
 anyhow = "1"
 futures = { version = "0.3", default-features = false }
-k8s-gateway-api = "0.6"
-kubert = { version = "0.9", default-features = false, features = ["index"] }
+k8s-gateway-api = "0.7"
+kubert = { version = "0.10", default-features = false, features = ["index"] }
 linkerd-policy-controller-core = { path = "../../core" }
 linkerd-policy-controller-k8s-api = { path = "../api" }
 parking_lot = "0.12"

policy-test/Cargo.toml

@@ -10,8 +10,8 @@ anyhow = "1"
 hyper = { version = "0.14", features = ["client", "http2"] }
 futures = { version = "0.3", default-features = false }
 ipnet = "2"
-k8s-gateway-api = "0.6"
-k8s-openapi = { version = "0.15", features = ["v1_20"] }
+k8s-gateway-api = "0.7"
+k8s-openapi = { version = "0.16", features = ["v1_20"] }
 linkerd-policy-controller-core = { path = "../policy-controller/core" }
 linkerd-policy-controller-k8s-api = { path = "../policy-controller/k8s/api" }
 linkerd2-proxy-api = { version = "0.7", features = ["inbound"] }
@@ -26,7 +26,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
 [dependencies.kube]
-version = "0.74"
+version = "0.75"
 default-features = false
 features = ["client", "openssl-tls", "runtime", "ws"]
 

policy-test/src/admission.rs

@@ -7,7 +7,7 @@ where
         + Send
         + Sync
         + std::fmt::Debug
-        + kube::Resource
+        + kube::Resource<Scope = kube::core::NamespaceResourceScope>
         + serde::de::DeserializeOwned
         + serde::Serialize,
     T::DynamicType: Default,
@@ -28,7 +28,7 @@ where
         + Send
         + Sync
         + std::fmt::Debug
-        + kube::Resource
+        + kube::Resource<Scope = kube::core::NamespaceResourceScope>
         + serde::de::DeserializeOwned
         + serde::Serialize,
     T::DynamicType: Default,

policy-test/src/lib.rs

@@ -17,19 +17,39 @@ pub enum LinkerdInject {
     Disabled,
 }
 
-pub async fn create<T>(client: &kube::Client, obj: T) -> T
+/// Creates a cluster-scoped resource.
+async fn create_cluster_scoped<T>(client: &kube::Client, obj: T) -> T
 where
-    T: kube::Resource + serde::Serialize + serde::de::DeserializeOwned + Clone + std::fmt::Debug,
+    T: kube::Resource<Scope = kube::core::ClusterResourceScope>,
+    T: serde::Serialize + serde::de::DeserializeOwned + Clone + std::fmt::Debug,
     T::DynamicType: Default,
 {
     let params = kube::api::PostParams {
         field_manager: Some("linkerd-policy-test".to_string()),
         ..Default::default()
     };
-    let api = match obj.namespace() {
-        Some(ns) => kube::Api::<T>::namespaced(client.clone(), &ns),
-        None => kube::Api::<T>::all(client.clone()),
+    let api = kube::Api::<T>::all(client.clone());
+    tracing::trace!(?obj, "Creating");
+    api.create(&params, &obj)
+        .await
+        .expect("failed to create resource")
+}
+
+/// Creates a namespace-scoped resource.
+pub async fn create<T>(client: &kube::Client, obj: T) -> T
+where
+    T: kube::Resource<Scope = kube::core::NamespaceResourceScope>,
+    T: serde::Serialize + serde::de::DeserializeOwned + Clone + std::fmt::Debug,
+    T::DynamicType: Default,
+{
+    let params = kube::api::PostParams {
+        field_manager: Some("linkerd-policy-test".to_string()),
+        ..Default::default()
     };
+    let api = obj
+        .namespace()
+        .map(|ns| kube::Api::<T>::namespaced(client.clone(), &*ns))
+        .unwrap_or_else(|| kube::Api::<T>::default_namespaced(client.clone()));
     tracing::trace!(?obj, "Creating");
     api.create(&params, &obj)
         .await
@@ -43,8 +63,8 @@ pub async fn await_condition<T>(
     cond: impl kube::runtime::wait::Condition<T>,
 ) -> Option<T>
 where
-    T: kube::Resource + serde::Serialize + serde::de::DeserializeOwned,
-    T: Clone + std::fmt::Debug + Send + 'static,
+    T: kube::Resource<Scope = kube::core::NamespaceResourceScope>,
+    T: serde::Serialize + serde::de::DeserializeOwned + Clone + std::fmt::Debug + Send + 'static,
     T::DynamicType: Default,
 {
     let api = kube::Api::namespaced(client.clone(), ns);
@@ -161,7 +181,7 @@ where
 
     let name = format!("linkerd-policy-test-{}", random_suffix(6));
     tracing::debug!(namespace = %name, "Creating");
-    let ns = create(
+    let ns = create_cluster_scoped(
         &client,
         k8s::Namespace {
             metadata: k8s::ObjectMeta {
@@ -212,10 +232,12 @@ where
         drop(_tracing);
     }
 
-    tracing::debug!(ns = %ns.name_unchecked(), "Deleting");
-    api.delete(&ns.name_unchecked(), &kube::api::DeleteParams::background())
-        .await
-        .expect("failed to delete Namespace");
+    if std::env::var("POLICY_TEST_NO_CLEANUP").is_err() {
+        tracing::debug!(ns = %ns.name_unchecked(), "Deleting");
+        api.delete(&ns.name_unchecked(), &kube::api::DeleteParams::background())
+            .await
+            .expect("failed to delete Namespace");
+    }
     if let Err(err) = res {
         std::panic::resume_unwind(err.into_panic());
     }