feat: bump Istio to latest, migrate ratelimit to its own subchart

admin/hooks-1.31.sh

@@ -20,20 +20,28 @@ post_control_plane_upgrade_cluster() {
 
 # All things AFTER all contollers are on the new version
 pre_cluster_upgrade_final() {
+  set +e
 
   if [ "$PLATFORM" == "aws" ];then
     # cleanup aws-iam-authenticator
-    kubectl delete clusterrolebinding aws-iam-authenticator || true
+    kubectl delete clusterrolebinding aws-iam-authenticator
-    kubectl delete clusterrole aws-iam-authenticator || true
+    kubectl delete clusterrole aws-iam-authenticator
-    kubectl delete serviceaccount aws-iam-authenticator -n kube-system || true
+    kubectl delete serviceaccount aws-iam-authenticator -n kube-system
-    kubectl delete cm aws-iam-authenticator -n kube-system || true
+    kubectl delete cm aws-iam-authenticator -n kube-system
-    kubectl delete ds aws-iam-authenticator -n kube-system || true
+    kubectl delete ds aws-iam-authenticator -n kube-system
-    kubectl delete IAMIdentityMapping kubezero-worker-nodes || true
+    kubectl delete IAMIdentityMapping kubezero-worker-nodes
-    kubectl delete IAMIdentityMapping kubernetes-admin || true
+    kubectl delete IAMIdentityMapping kubernetes-admin
-    kubectl delete crd iamidentitymappings.iamauthenticator.k8s.aws || true
+    kubectl delete crd iamidentitymappings.iamauthenticator.k8s.aws
-
+    kubectl delete secret aws-iam-certs -n kube-system
-    kubectl delete secret aws-iam-certs -n kube-system || true
   fi
+
+  # Remove any helm hook related resources
+  kubectl delete rolebinding argo-argocd-redis-secret-init -n argocd
+  kubectl delete sa argo-argocd-redis-secret-init -n argocd
+  kubectl delete role argo-argocd-redis-secret-init -n argocd
+  kubectl delete job argo-argocd-redis-secret-init -n argocd
+
+  set -e
 }
 
 

charts/envoy-ratelimit/.gitignore

@@ -0,0 +1,3 @@
+istioctl
+istio
+istio.zdt

charts/envoy-ratelimit/.helmignore

@@ -0,0 +1,32 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+
+README.md.gotmpl
+*.patch
+*.sh
+*.py
+
+istioctl
+istio
+istio.zdt

charts/envoy-ratelimit/Chart.yaml

@@ -0,0 +1,19 @@
+apiVersion: v2
+name: envoy-ratelimit
+description: Envoy gobal ratelimiting service - part of KubeZero
+type: application
+version: 0.1.0
+home: https://kubezero.com
+icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
+keywords:
+  - kubezero
+  - envoy
+  - istio
+maintainers:
+  - name: Stefan Reimer
+    email: stefan@zero-downtime.net
+dependencies:
+  - name: kubezero-lib
+    version: 0.2.1
+    repository: https://cdn.zero-downtime.net/charts/
+kubeVersion: ">= 1.31.0-0"

charts/envoy-ratelimit/README.md

@@ -0,0 +1,37 @@
+# envoy-ratelimit
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+
+Envoy gobal ratelimiting service - part of KubeZero
+
+**Homepage:** <https://kubezero.com>
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| Stefan Reimer | <stefan@zero-downtime.net> |  |
+
+## Requirements
+
+Kubernetes: `>= 1.31.0-0`
+
+| Repository | Name | Version |
+|------------|------|---------|
+| https://cdn.zero-downtime.net/charts/ | kubezero-lib | 0.2.1 |
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| descriptors.ingress[0].key | string | `"remote_address"` |  |
+| descriptors.ingress[0].rate_limit.requests_per_unit | int | `10` |  |
+| descriptors.ingress[0].rate_limit.unit | string | `"second"` |  |
+| descriptors.privateIngress[0].key | string | `"remote_address"` |  |
+| descriptors.privateIngress[0].rate_limit.requests_per_unit | int | `10` |  |
+| descriptors.privateIngress[0].rate_limit.unit | string | `"second"` |  |
+| failureModeDeny | bool | `false` |  |
+| localCacheSize | int | `1048576` |  |
+| log.format | string | `"json"` |  |
+| log.level | string | `"warn"` |  |
+| metrics.enabled | bool | `true` |  |

charts/envoy-ratelimit/README.md.gotmpl

@@ -0,0 +1,16 @@
+{{ template "chart.header" . }}
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}
+
+{{ template "chart.description" . }}
+
+{{ template "chart.homepageLine" . }}
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}

charts/envoy-ratelimit/templates/config-statds-exporter.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rateLimiting.enabled }}
+{{- if .Values.metrics.enabled }}
 apiVersion: v1
 kind: ConfigMap
 metadata:

charts/envoy-ratelimit/templates/config.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.rateLimiting.enabled }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -10,10 +9,9 @@ data:
   ingress.yaml: |
     domain: ingress
     descriptors:
-    {{- toYaml .Values.rateLimiting.descriptors.ingress | nindent 4 }}
+    {{- toYaml .Values.descriptors.ingress | nindent 4 }}
 
   private-ingress.yaml: |
     domain: private-ingress
     descriptors:
-    {{- toYaml .Values.rateLimiting.descriptors.privateIngress | nindent 4 }}
+    {{- toYaml .Values.descriptors.privateIngress | nindent 4 }}
-{{- end }}

charts/envoy-ratelimit/templates/deployment.yaml

@@ -1,71 +1,3 @@
-{{- if .Values.rateLimiting.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: ratelimit-redis
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: ratelimit-redis
-spec:
-  ports:
-  - name: redis
-    port: 6379
-  selector:
-    app: ratelimit-redis
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ratelimit-redis
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ratelimit-redis
-  template:
-    metadata:
-      labels:
-        app: ratelimit-redis
-    spec:
-      containers:
-      - image: redis:6-alpine
-        imagePullPolicy: IfNotPresent
-        name: redis
-        ports:
-        - name: redis
-          containerPort: 6379
-      restartPolicy: Always
-      serviceAccountName: ""
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: ratelimit
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: ratelimit
-spec:
-  ports:
-  #- name: http-port
-  #  port: 8080
-  #  targetPort: 8080
-  #  protocol: TCP
-  - name: grpc-port
-    port: 8081
-    targetPort: 8081
-    protocol: TCP
-  #- name: http-debug
-  #  port: 6070
-  #  targetPort: 6070
-  #  protocol: TCP
-  - name: http-monitoring
-    port: 9102
-    targetPort: 9102
-    protocol: TCP
-  selector:
-    app: ratelimit
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -90,9 +22,9 @@ spec:
         command: ["/bin/ratelimit"]
         env:
         - name: LOG_LEVEL
-          value: {{ default "WARN" .Values.rateLimiting.log.level }}
+          value: {{ default "WARN" .Values.log.level }}
         - name: LOG_FORMAT
-          value: {{ default "text" .Values.rateLimiting.log.format }}
+          value: {{ default "text" .Values.log.format }}
         - name: REDIS_SOCKET_TYPE
           value: tcp
         - name: REDIS_URL
@@ -112,7 +44,7 @@ spec:
         - name: RUNTIME_IGNOREDOTFILES
           value: "true"
         - name: LOCAL_CACHE_SIZE_IN_BYTES
-          value: "{{ default 0 .Values.rateLimiting.localCacheSize | int }}"
+          value: "{{ default 0 .Values.localCacheSize | int }}"
         ports:
         #- containerPort: 8080
         - containerPort: 8081
@@ -151,4 +83,3 @@ spec:
       - name: statsd-exporter-config
         configMap:
           name: ratelimit-statsd-exporter-config
-{{- end }}

charts/envoy-ratelimit/templates/envoyfilter-cluster.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.rateLimiting.enabled }}
 apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
@@ -27,7 +26,7 @@ spec:
           typed_config:
             "@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
             domain: ingress
-            failure_mode_deny: {{ .Values.rateLimiting.failureModeDeny }}
+            failure_mode_deny: {{ .Values.failureModeDeny }}
             timeout: 0.5s
             rate_limit_service:
               grpc_service:
@@ -85,7 +84,7 @@ spec:
           typed_config:
             "@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
             domain:  private-ingress
-            failure_mode_deny: {{ .Values.rateLimiting.failureModeDeny }}
+            failure_mode_deny: {{ .Values.failureModeDeny }}
             timeout: 0.5s
             rate_limit_service:
               grpc_service:
@@ -113,4 +112,3 @@ spec:
                      socket_address:
                       address: ratelimit.istio-system
                       port_value: 8081
-{{- end }}

charts/envoy-ratelimit/templates/redis-deployment.yaml

@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ratelimit-redis
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ratelimit-redis
+  template:
+    metadata:
+      labels:
+        app: ratelimit-redis
+    spec:
+      containers:
+      - image: redis:6-alpine
+        imagePullPolicy: IfNotPresent
+        name: redis
+        ports:
+        - name: redis
+          containerPort: 6379
+      restartPolicy: Always
+      serviceAccountName: ""

charts/envoy-ratelimit/templates/redis-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ratelimit-redis
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: ratelimit-redis
+spec:
+  ports:
+  - name: redis
+    port: 6379
+  selector:
+    app: ratelimit-redis

charts/envoy-ratelimit/templates/service.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ratelimit
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: ratelimit
+spec:
+  ports:
+  #- name: http-port
+  #  port: 8080
+  #  targetPort: 8080
+  #  protocol: TCP
+  - name: grpc-port
+    port: 8081
+    targetPort: 8081
+    protocol: TCP
+  #- name: http-debug
+  #  port: 6070
+  #  targetPort: 6070
+  #  protocol: TCP
+  - name: http-monitoring
+    port: 9102
+    targetPort: 9102
+    protocol: TCP
+  selector:
+    app: ratelimit

charts/envoy-ratelimit/templates/servicemonitor.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.istiod.telemetry.enabled .Values.rateLimiting.enabled }}
+{{- if and .Values.metrics.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:

charts/envoy-ratelimit/update.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -ex
+
+. ../../scripts/lib-update.sh
+
+#login_ecr_public
+update_helm
+
+update_docs

charts/envoy-ratelimit/values.yaml

@@ -0,0 +1,26 @@
+log:
+  level: warn
+  format: json
+
+# 1MB local cache for already reached limits to reduce calls to Redis
+localCacheSize: 1048576
+
+# Wether to block requests if ratelimiting is down
+failureModeDeny: false
+
+# rate limit descriptors for each domain, examples 10 req/s per sourceIP
+descriptors:
+  ingress:
+  - key: remote_address
+    rate_limit:
+      unit: second
+      requests_per_unit: 10
+
+  privateIngress:
+  - key: remote_address
+    rate_limit:
+      unit: second
+      requests_per_unit: 10
+
+metrics:
+  enabled: true

charts/kubezero-istio-gateway/README.md

@@ -1,6 +1,6 @@
 # kubezero-istio-gateway
 
-![Version: 0.24.2](https://img.shields.io/badge/Version-0.24.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.24.3](https://img.shields.io/badge/Version-0.24.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 KubeZero Umbrella Chart for Istio gateways
 
@@ -20,8 +20,8 @@ Kubernetes: `>= 1.30.0-0`
 
 | Repository | Name | Version |
 |------------|------|---------|
-| https://cdn.zero-downtime.net/charts/ | kubezero-lib | >= 0.1.6 |
+| https://cdn.zero-downtime.net/charts/ | kubezero-lib | 0.2.1 |
-| https://istio-release.storage.googleapis.com/charts | gateway | 1.24.2 |
+| https://istio-release.storage.googleapis.com/charts | gateway | 1.24.3 |
 
 ## Values
 
@@ -32,8 +32,8 @@ Kubernetes: `>= 1.30.0-0`
 | gateway.autoscaling.maxReplicas | int | `4` |  |
 | gateway.autoscaling.minReplicas | int | `1` |  |
 | gateway.autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
-| gateway.minReadySeconds | int | `120` |  |
+| gateway.minReadySeconds | int | `10` |  |
-| gateway.podAnnotations."proxy.istio.io/config" | string | `"{ \"terminationDrainDuration\": \"20s\" }"` |  |
+| gateway.podAnnotations."proxy.istio.io/config" | string | `"{ \"terminationDrainDuration\": \"90s\" }"` |  |
 | gateway.replicaCount | int | `1` |  |
 | gateway.resources.limits.memory | string | `"512Mi"` |  |
 | gateway.resources.requests.cpu | string | `"50m"` |  |

charts/kubezero-istio-gateway/charts/gateway/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.24.2
+appVersion: 1.24.3
 description: Helm chart for deploying Istio gateways
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
@@ -9,4 +9,4 @@ name: gateway
 sources:
 - https://github.com/istio/istio
 type: application
-version: 1.24.2
+version: 1.24.3

charts/kubezero-istio-gateway/charts/gateway/templates/deployment.yaml

@@ -77,7 +77,7 @@ spec:
             allowPrivilegeEscalation: false
             privileged: false
             readOnlyRootFilesystem: true
-            {{- if not (eq .Values.platform "openshift") }}
+            {{- if not (eq (.Values.platform | default "") "openshift") }}
             runAsUser: 1337
             runAsGroup: 1337
             {{- end }}

charts/kubezero-istio-gateway/charts/gateway/templates/zzz_profile.yaml

@@ -49,7 +49,7 @@ Finally, we can set all of that under .Values so the chart behaves without aware
 {{- $a := mustMergeOverwrite $defaults $profile }}
 {{- end }}
 #  Flatten globals, if defined on a per-chart basis
-{{- if false }}
+{{- if true }}
 {{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
 {{- end }}
 {{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}

charts/kubezero-istio/Chart.yaml

@@ -15,6 +15,10 @@ dependencies:
   - name: kubezero-lib
     version: 0.2.1
     repository: https://cdn.zero-downtime.net/charts/
+  - name: envoy-ratelimit
+    version: 0.1.0
+    repository: https://cdn.zero-downtime.net/charts/
+    condition: envoy-ratelimit.enabled
   - name: base
     version: 1.24.3
     repository: https://istio-release.storage.googleapis.com/charts

charts/kubezero-istio/README.md

@@ -1,6 +1,6 @@
 # kubezero-istio
 
-![Version: 0.24.2](https://img.shields.io/badge/Version-0.24.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.24.3](https://img.shields.io/badge/Version-0.24.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 KubeZero Umbrella Chart for Istio
 
@@ -20,15 +20,27 @@ Kubernetes: `>= 1.30.0-0`
 
 | Repository | Name | Version |
 |------------|------|---------|
-| https://cdn.zero-downtime.net/charts/ | kubezero-lib | >= 0.1.6 |
+| https://cdn.zero-downtime.net/charts/ | envoy-ratelimit | 0.1.0 |
-| https://istio-release.storage.googleapis.com/charts | base | 1.24.2 |
+| https://cdn.zero-downtime.net/charts/ | kubezero-lib | 0.2.1 |
-| https://istio-release.storage.googleapis.com/charts | istiod | 1.24.2 |
+| https://istio-release.storage.googleapis.com/charts | base | 1.24.3 |
-| https://kiali.org/helm-charts | kiali-server | 2.5.0 |
+| https://istio-release.storage.googleapis.com/charts | istiod | 1.24.3 |
+| https://kiali.org/helm-charts | kiali-server | 2.6.0 |
 
 ## Values
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
+| envoy-ratelimit.descriptors.ingress[0].key | string | `"remote_address"` |  |
+| envoy-ratelimit.descriptors.ingress[0].rate_limit.requests_per_unit | int | `10` |  |
+| envoy-ratelimit.descriptors.ingress[0].rate_limit.unit | string | `"second"` |  |
+| envoy-ratelimit.descriptors.privateIngress[0].key | string | `"remote_address"` |  |
+| envoy-ratelimit.descriptors.privateIngress[0].rate_limit.requests_per_unit | int | `10` |  |
+| envoy-ratelimit.descriptors.privateIngress[0].rate_limit.unit | string | `"second"` |  |
+| envoy-ratelimit.enabled | bool | `false` |  |
+| envoy-ratelimit.failureModeDeny | bool | `false` |  |
+| envoy-ratelimit.localCacheSize | int | `1048576` |  |
+| envoy-ratelimit.log.format | string | `"json"` |  |
+| envoy-ratelimit.log.level | string | `"warn"` |  |
 | global.defaultPodDisruptionBudget.enabled | bool | `false` |  |
 | global.logAsJson | bool | `true` |  |
 | global.variant | string | `"distroless"` |  |
@@ -50,17 +62,6 @@ Kubernetes: `>= 1.30.0-0`
 | kiali-server.istio.enabled | bool | `false` |  |
 | kiali-server.istio.gateway | string | `"istio-ingress/private-ingressgateway"` |  |
 | kiali-server.server.metrics_enabled | bool | `false` |  |
-| rateLimiting.descriptors.ingress[0].key | string | `"remote_address"` |  |
-| rateLimiting.descriptors.ingress[0].rate_limit.requests_per_unit | int | `10` |  |
-| rateLimiting.descriptors.ingress[0].rate_limit.unit | string | `"second"` |  |
-| rateLimiting.descriptors.privateIngress[0].key | string | `"remote_address"` |  |
-| rateLimiting.descriptors.privateIngress[0].rate_limit.requests_per_unit | int | `10` |  |
-| rateLimiting.descriptors.privateIngress[0].rate_limit.unit | string | `"second"` |  |
-| rateLimiting.enabled | bool | `false` |  |
-| rateLimiting.failureModeDeny | bool | `false` |  |
-| rateLimiting.localCacheSize | int | `1048576` |  |
-| rateLimiting.log.format | string | `"json"` |  |
-| rateLimiting.log.level | string | `"warn"` |  |
 
 ## Resources
 

charts/kubezero-istio/values.yaml

@@ -56,7 +56,7 @@ kiali-server:
     #url: "kiali.example.com"
 
 
-rateLimiting:
+envoy-ratelimit:
   enabled: false
 
   log:

charts/kubezero/values.yaml

@@ -64,13 +64,13 @@ storage:
 istio:
   enabled: false
   namespace: istio-system
-  targetRevision: 0.24.2
+  targetRevision: 0.24.3
 
 istio-ingress:
   enabled: false
   chart: kubezero-istio-gateway
   namespace: istio-ingress
-  targetRevision: 0.24.2
+  targetRevision: 0.24.3
   gateway:
     service: {}
 
@@ -78,7 +78,7 @@ istio-private-ingress:
   enabled: false
   chart: kubezero-istio-gateway
   namespace: istio-ingress
-  targetRevision: 0.24.2
+  targetRevision: 0.24.3
   gateway:
     service: {}