feat: make operators work on GKE

Reviewed-on: #28

charts/kubezero-argo/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 description: KubeZero Argo - Events, Workflow, CD
 name: kubezero-argo
-version: 0.2.6
+version: 0.2.7
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
 keywords:
@@ -18,11 +18,11 @@ dependencies:
     version: ">= 0.1.6"
     repository: https://cdn.zero-downtime.net/charts/
   - name: argo-events
-    version: 2.4.8
+    version: 2.4.9
     repository: https://argoproj.github.io/argo-helm
     condition: argo-events.enabled
   - name: argo-cd
-    version: 7.7.2
+    version: 7.7.7
     repository: https://argoproj.github.io/argo-helm
     condition: argo-cd.enabled
   - name: argocd-apps

charts/kubezero-argo/values.yaml

@@ -45,7 +45,9 @@ argo-cd:
       format: json
     image:
       repository: public.ecr.aws/zero-downtime/zdt-argocd
-      tag: v2.13.0
+      tag: v2.13.1
+    networkPolicy:
+      create: true
 
   configs:
     styles: |
@@ -54,8 +56,8 @@ argo-cd:
       .sidebar { background: linear-gradient(to bottom, #6A4D79, #493558, #2D1B30, #0D0711); }
 
     cm:
-      ui.bannercontent: "KubeZero v1.30 - Release notes"
+      ui.bannercontent: "KubeZero v1.31 - Release notes"
-      ui.bannerurl: "https://kubezero.com/releases/v1.30"
+      ui.bannerurl: "https://kubezero.com/releases/v1.31"
       ui.bannerpermanent: "true"
       ui.bannerposition: "bottom"
 

charts/kubezero-ci/values.yaml

@@ -2,7 +2,7 @@ gitea:
   enabled: false
 
   image:
-    tag: 1.22.4
+    tag: 1.22.6
     rootless: true
 
   repliaCount: 1

charts/kubezero-lib/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubezero-lib
 description: KubeZero helm library - common helm functions and blocks
 type: library
-version: 0.2.0
+version: 0.2.1
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
 keywords:
@@ -10,4 +10,4 @@ keywords:
 maintainers:
   - name: Stefan Reimer
     email: stefan@zero-downtime.net
-kubeVersion: ">= 1.20.0"
+kubeVersion: ">= 1.30.0"

charts/kubezero-lib/README.md

@@ -2,7 +2,7 @@ kubezero-lib
 ============
 KubeZero helm library - common helm functions and blocks
 
-Current chart version is `0.1.0`
+Current chart version is `0.2.1`
 
 Source code can be found [here](https://kubezero.com)
 

charts/kubezero-lib/templates/_commons.tpl

@@ -0,0 +1,10 @@
+{{- /*
+maps pods to the kube control-plane
+*/ -}}
+{{- define "kubezero-lib.control-plane" -}}
+nodeSelector:
+  node-role.kubernetes.io/control-plane: ""
+tolerations:
+- key: node-role.kubernetes.io/control-plane
+  effect: NoSchedule
+{{- end -}}

charts/kubezero-lib/templates/_helpers.tpl

@@ -25,9 +25,9 @@ Common naming functions
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
-{{/*
+{{- /*
 Selector labels
-*/}}
+*/ -}}
 {{- define "kubezero-lib.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "kubezero-lib.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
@@ -49,7 +49,7 @@ This takes an array of three values:
 - the top context
 - the template name of the overrides (destination)
 - the template name of the base (source)
-*/}}
+*/ -}}
 {{- define "kubezero-lib.util.merge" -}}
 {{- $top := first . -}}
 {{- $overrides := fromYaml (include (index . 1) $top) | default (dict ) -}}

charts/kubezero-network/values.yaml

@@ -18,7 +18,7 @@ multus:
   enabled: false
   image:
     repository: ghcr.io/k8snetworkplumbingwg/multus-cni
-    tag: v4.1.4
+    tag: v3.9.3
 
   clusterNetwork: "cilium"
   defaultNetworks: []

charts/kubezero-operators/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubezero-operators
 description: Various operators supported by KubeZero
 type: application
-version: 0.1.7
+version: 0.1.8
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
 keywords:

charts/kubezero-operators/values.yaml

@@ -13,28 +13,12 @@ opensearch-operator:
       - name: SKIP_INIT_CONTAINER
         value: "true"
 
-  tolerations:
-  - key: node-role.kubernetes.io/control-plane
-    effect: NoSchedule
-  nodeSelector:
-    node-role.kubernetes.io/control-plane: ""
-
 eck-operator:
   enabled: false
   installCRDs: false
-  tolerations:
-  - key: node-role.kubernetes.io/control-plane
-    effect: NoSchedule
-  nodeSelector:
-    node-role.kubernetes.io/control-plane: ""
 
 cloudnative-pg:
   enabled: false
-  tolerations:
-  - key: node-role.kubernetes.io/control-plane
-    effect: NoSchedule
-  nodeSelector:
-    node-role.kubernetes.io/control-plane: ""
 
   monitoring:
     podMonitorEnabled: false
@@ -51,12 +35,6 @@ strimzi-kafka-operator:
   leaderElection:
     enable: false
 
-  tolerations:
-  - key: node-role.kubernetes.io/control-plane
-    effect: NoSchedule
-  nodeSelector:
-    node-role.kubernetes.io/control-plane: ""
-
   resources:
     requests:
       cpu: 20m

charts/kubezero/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubezero
 description: KubeZero - Root App of Apps chart
 type: application
-version: 1.30.6
+version: 1.31.4-alpha
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
 keywords:
@@ -13,6 +13,6 @@ maintainers:
     email: stefan@zero-downtime.net
 dependencies:
   - name: kubezero-lib
-    version: ">= 0.1.6"
+    version: ">= 0.2.1"
     repository: https://cdn.zero-downtime.net/charts
-kubeVersion: ">= 1.26.0-0"
+kubeVersion: ">= 1.29.0-0"

charts/kubezero/Makefile

@@ -1,5 +0,0 @@
-.PHONY: sync
-
-sync:
-	rm -rf scripts templates
-	cp -r ../../kubezero/charts/kubezero/* .

charts/kubezero/README.md

@@ -1,6 +1,6 @@
 # kubezero
 
-![Version: 1.30.5](https://img.shields.io/badge/Version-1.30.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 1.31.3](https://img.shields.io/badge/Version-1.31.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 KubeZero - Root App of Apps chart
 
@@ -18,7 +18,7 @@ Kubernetes: `>= 1.26.0-0`
 
 | Repository | Name | Version |
 |------------|------|---------|
-| https://cdn.zero-downtime.net/charts | kubezero-lib | >= 0.1.6 |
+| https://cdn.zero-downtime.net/charts | kubezero-lib | >= 0.2.1 |
 
 ## Values
 
@@ -32,16 +32,16 @@ Kubernetes: `>= 1.26.0-0`
 | addons.external-dns.enabled | bool | `false` |  |
 | addons.forseti.enabled | bool | `false` |  |
 | addons.sealed-secrets.enabled | bool | `false` |  |
-| addons.targetRevision | string | `"0.8.9"` |  |
+| addons.targetRevision | string | `"0.8.11"` |  |
 | argo.argo-cd.enabled | bool | `false` |  |
 | argo.argo-cd.istio.enabled | bool | `false` |  |
 | argo.argocd-image-updater.enabled | bool | `false` |  |
 | argo.enabled | bool | `false` |  |
 | argo.namespace | string | `"argocd"` |  |
-| argo.targetRevision | string | `"0.2.4"` |  |
+| argo.targetRevision | string | `"0.2.6"` |  |
 | cert-manager.enabled | bool | `false` |  |
 | cert-manager.namespace | string | `"cert-manager"` |  |
-| cert-manager.targetRevision | string | `"0.9.9"` |  |
+| cert-manager.targetRevision | string | `"0.9.10"` |  |
 | falco.enabled | bool | `false` |  |
 | falco.k8saudit.enabled | bool | `false` |  |
 | falco.targetRevision | string | `"0.1.2"` |  |
@@ -54,35 +54,35 @@ Kubernetes: `>= 1.26.0-0`
 | istio-ingress.enabled | bool | `false` |  |
 | istio-ingress.gateway.service | object | `{}` |  |
 | istio-ingress.namespace | string | `"istio-ingress"` |  |
-| istio-ingress.targetRevision | string | `"0.22.3-1"` |  |
+| istio-ingress.targetRevision | string | `"0.23.2"` |  |
 | istio-private-ingress.chart | string | `"kubezero-istio-gateway"` |  |
 | istio-private-ingress.enabled | bool | `false` |  |
 | istio-private-ingress.gateway.service | object | `{}` |  |
 | istio-private-ingress.namespace | string | `"istio-ingress"` |  |
-| istio-private-ingress.targetRevision | string | `"0.22.3-1"` |  |
+| istio-private-ingress.targetRevision | string | `"0.23.2"` |  |
 | istio.enabled | bool | `false` |  |
 | istio.namespace | string | `"istio-system"` |  |
-| istio.targetRevision | string | `"0.22.3-1"` |  |
+| istio.targetRevision | string | `"0.23.2"` |  |
 | kubezero.defaultTargetRevision | string | `"*"` |  |
 | kubezero.gitSync | object | `{}` |  |
 | kubezero.repoURL | string | `"https://cdn.zero-downtime.net/charts"` |  |
 | kubezero.server | string | `"https://kubernetes.default.svc"` |  |
 | logging.enabled | bool | `false` |  |
 | logging.namespace | string | `"logging"` |  |
-| logging.targetRevision | string | `"0.8.12"` |  |
+| logging.targetRevision | string | `"0.8.13"` |  |
 | metrics.enabled | bool | `false` |  |
 | metrics.istio.grafana | object | `{}` |  |
 | metrics.istio.prometheus | object | `{}` |  |
 | metrics.kubezero.prometheus.prometheusSpec.additionalScrapeConfigs | list | `[]` |  |
 | metrics.namespace | string | `"monitoring"` |  |
-| metrics.targetRevision | string | `"0.10.0"` |  |
+| metrics.targetRevision | string | `"0.10.2"` |  |
 | network.cilium.cluster | object | `{}` |  |
 | network.enabled | bool | `true` |  |
 | network.retain | bool | `true` |  |
 | network.targetRevision | string | `"0.5.5"` |  |
 | operators.enabled | bool | `false` |  |
 | operators.namespace | string | `"operators"` |  |
-| operators.targetRevision | string | `"0.1.4"` |  |
+| operators.targetRevision | string | `"0.1.6"` |  |
 | storage.aws-ebs-csi-driver.enabled | bool | `false` |  |
 | storage.aws-efs-csi-driver.enabled | bool | `false` |  |
 | storage.enabled | bool | `false` |  |
@@ -90,7 +90,10 @@ Kubernetes: `>= 1.26.0-0`
 | storage.k8up.enabled | bool | `false` |  |
 | storage.lvm-localpv.enabled | bool | `false` |  |
 | storage.snapshotController.enabled | bool | `false` |  |
-| storage.targetRevision | string | `"0.8.8"` |  |
+| storage.targetRevision | string | `"0.8.9"` |  |
 | telemetry.enabled | bool | `false` |  |
 | telemetry.namespace | string | `"telemetry"` |  |
-| telemetry.targetRevision | string | `"0.4.0"` |  |
+| telemetry.targetRevision | string | `"0.4.1"` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

charts/kubezero/templates/cert-manager.yaml

@@ -10,26 +10,13 @@ cert-manager:
   {{- end }}
 
   {{- if eq .Values.global.platform "aws" }}
-  # map everything to the control-plane
+  {{- include "kubezero-lib.control-plane" . | nindent 2 }}
-  nodeSelector:
-    node-role.kubernetes.io/control-plane: ""
-  tolerations:
-  - key: node-role.kubernetes.io/control-plane
-    effect: NoSchedule
 
   webhook:
-    tolerations:
+    {{- include "kubezero-lib.control-plane" . | nindent 4 }}
-    - key: node-role.kubernetes.io/control-plane
-      effect: NoSchedule
-    nodeSelector:
-      node-role.kubernetes.io/control-plane: ""
 
   cainjector:
-    tolerations:
+    {{- include "kubezero-lib.control-plane" . | nindent 4 }}
-    - key: node-role.kubernetes.io/control-plane
-      effect: NoSchedule
-    nodeSelector:
-      node-role.kubernetes.io/control-plane: ""
 
   extraEnv:
   - name: AWS_REGION

charts/kubezero/templates/istio.yaml

@@ -14,11 +14,7 @@ istiod:
     enabled: {{ $.Values.metrics.enabled }}
   pilot:
     {{- if eq .Values.global.platform "aws" }}
-    nodeSelector:
+    {{- include "kubezero-lib.control-plane" . | nindent 4 }}
-      node-role.kubernetes.io/control-plane: ""
-    tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      effect: NoSchedule
     {{- end }}
     {{- if .Values.global.highAvailable }}
     replicaCount: 2

charts/kubezero/templates/operators.yaml

@@ -2,16 +2,28 @@
 
 {{- with index .Values "operators" "opensearch-operator" }}
 opensearch-operator:
+  {{- if eq $.Values.global.platform "aws" }}
+  {{- include "kubezero-lib.control-plane" . | nindent 2 }}
+  {{- end }}
+
   {{- toYaml . | nindent 2 }}
 {{- end }}
 
 {{- with index .Values "operators" "eck-operator" }}
 eck-operator:
+  {{- if eq $.Values.global.platform "aws" }}
+  {{- include "kubezero-lib.control-plane" . | nindent 2 }}
+  {{- end }}
+
   {{- toYaml . | nindent 2 }}
 {{- end }}
 
 {{- with index .Values "operators" "cloudnative-pg" }}
 cloudnative-pg:
+  {{- if eq $.Values.global.platform "aws" }}
+  {{- include "kubezero-lib.control-plane" . | nindent 2 }}
+  {{- end }}
+
   {{- toYaml . | nindent 2 }}
 
   {{- with $.Values.metrics }}
@@ -22,6 +34,10 @@ cloudnative-pg:
 
 {{- with index .Values "operators" "strimzi-kafka-operator" }}
 strimzi-kafka-operator:
+  {{- if eq $.Values.global.platform "aws" }}
+  {{- include "kubezero-lib.control-plane" . | nindent 2 }}
+  {{- end }}
+
   {{- toYaml . | nindent 2 }}
 
   {{- with $.Values.metrics }}

charts/kubezero/templates/storage.yaml

@@ -57,11 +57,13 @@ aws-efs-csi-driver:
   enabled: {{ default false (index .Values "storage" "aws-efs-csi-driver" "enabled")}}
   replicaCount: {{ ternary 2 1 .Values.global.highAvailable }}
   controller:
+    {{- with index .Values "storage" "aws-efs-csi-driver" "IamArn" }}
     extraEnv:
     - name: AWS_ROLE_ARN
-      value: {{ index .Values "storage" "aws-efs-csi-driver" "IamArn" | quote }}
+      value: {{ . | quote }}
     - name: AWS_WEB_IDENTITY_TOKEN_FILE
       value: "/var/run/secrets/sts.amazonaws.com/serviceaccount/token"
+    {{- end }}
 
     # The EFS controller steel needs hostnetwork and cannot update on single node control planes otherwise
     {{- if not .Values.global.highAvailable }}

charts/kubezero/update.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -ex
+
+. ../../scripts/lib-update.sh
+
+login_ecr_public
+update_helm
+
+update_docs

charts/kubezero/values.yaml

@@ -96,7 +96,7 @@ telemetry:
 operators:
   enabled: false
   namespace: operators
-  targetRevision: 0.1.6
+  targetRevision: 0.1.8
 
 metrics:
   enabled: false

docs/v1.31.md

@@ -0,0 +1,17 @@
+# ![k8s-v1.31](images/k8s-1.31.png)  KubeZero 1.31 - Elli
+
+## What's new - Major themes
+- all KubeZero and support AMIs based on Alpine 3.21
+
+## Features and fixes
+
+## Version upgrades
+<WIP>
+- cilium 1.16.3
+- istio 1.22.3
+- ArgoCD 2.13.0 [custom ZDT image](https://git.zero-downtime.net/ZeroDownTime/zdt-argocd)
+- Prometheus 2.55.1 / Grafana 11.3.0
+- Nvidia container toolkit 1.17, drivers  565.57.01, Cuda 12.7
+
+## Resources
+- [Kubernetes v1.31 upstream release blog](https://kubernetes.io/blog/2024/08/13/kubernetes-v1-31-release/)