Skip to content

Commit fdfc318

Browse files
evenhevenh
authored
Merge pull request #555 from kartverket/istio-v1
Istio: Upgrade to V1 of APIs
2 parents cd6b1fb + 42ed502 commit fdfc318

File tree

63 files changed

+213
-203
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+213
-203
lines changed

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ PROMETHEUS_VERSION := $(call extract-version,github.com/promethe
2323

2424
#### VARS ####
2525
SKIPERATOR_CONTEXT ?= kind-$(KIND_CLUSTER_NAME)
26-
KUBERNETES_VERSION = 1.29.0
26+
KUBERNETES_VERSION = 1.30.0
2727
KIND_IMAGE ?= kindest/node:v$(KUBERNETES_VERSION)
2828
KIND_CLUSTER_NAME ?= skiperator
2929

‎config/crd/skiperator.kartverket.no_applications.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.16.2
6+
controller-gen.kubebuilder.io/version: v0.16.4
77
name: applications.skiperator.kartverket.no
88
spec:
99
group: skiperator.kartverket.no

‎config/crd/skiperator.kartverket.no_routings.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.16.2
6+
controller-gen.kubebuilder.io/version: v0.16.4
77
name: routings.skiperator.kartverket.no
88
spec:
99
group: skiperator.kartverket.no

‎config/crd/skiperator.kartverket.no_skipjobs.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.16.2
6+
controller-gen.kubebuilder.io/version: v0.16.4
77
name: skipjobs.skiperator.kartverket.no
88
spec:
99
group: skiperator.kartverket.no

‎internal/controllers/application.go

+11-10
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ package controllers
33
import (
44
"context"
55
"fmt"
6+
"regexp"
7+
68
certmanagerv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
79
skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
810
"github.com/kartverket/skiperator/internal/controllers/common"
@@ -30,8 +32,8 @@ import (
3032
nais_io_v1 "github.com/nais/liberator/pkg/apis/nais.io/v1"
3133
pov1 "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1"
3234
"golang.org/x/exp/maps"
33-
networkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
34-
securityv1beta1 "istio.io/client-go/pkg/apis/security/v1beta1"
35+
istionetworkingv1 "istio.io/client-go/pkg/apis/networking/v1"
36+
securityv1 "istio.io/client-go/pkg/apis/security/v1"
3537
telemetryv1 "istio.io/client-go/pkg/apis/telemetry/v1"
3638
appsv1 "k8s.io/api/apps/v1"
3739
autoscalingv2 "k8s.io/api/autoscaling/v2"
@@ -42,7 +44,6 @@ import (
4244
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
4345
"k8s.io/apimachinery/pkg/types"
4446
"k8s.io/apimachinery/pkg/util/validation/field"
45-
"regexp"
4647
ctrl "sigs.k8s.io/controller-runtime"
4748
"sigs.k8s.io/controller-runtime/pkg/builder"
4849
"sigs.k8s.io/controller-runtime/pkg/client"
@@ -83,18 +84,18 @@ func (r *ApplicationReconciler) SetupWithManager(mgr ctrl.Manager) error {
8384
Owns(&appsv1.Deployment{}).
8485
Owns(&corev1.Service{}).
8586
Owns(&corev1.ConfigMap{}).
86-
Owns(&networkingv1beta1.ServiceEntry{}).
87-
Owns(&networkingv1beta1.Gateway{}, builder.WithPredicates(
88-
util.MatchesPredicate[*networkingv1beta1.Gateway](isIngressGateway),
87+
Owns(&istionetworkingv1.ServiceEntry{}).
88+
Owns(&istionetworkingv1.Gateway{}, builder.WithPredicates(
89+
util.MatchesPredicate[*istionetworkingv1.Gateway](isIngressGateway),
8990
)).
9091
Owns(&telemetryv1.Telemetry{}).
9192
Owns(&autoscalingv2.HorizontalPodAutoscaler{}).
92-
Owns(&networkingv1beta1.VirtualService{}).
93-
Owns(&securityv1beta1.PeerAuthentication{}).
93+
Owns(&istionetworkingv1.VirtualService{}).
94+
Owns(&securityv1.PeerAuthentication{}).
9495
Owns(&corev1.ServiceAccount{}).
9596
Owns(&policyv1.PodDisruptionBudget{}).
9697
Owns(&networkingv1.NetworkPolicy{}).
97-
Owns(&securityv1beta1.AuthorizationPolicy{}).
98+
Owns(&securityv1.AuthorizationPolicy{}).
9899
Owns(&nais_io_v1.MaskinportenClient{}).
99100
Owns(&nais_io_v1.IDPortenClient{}).
100101
Owns(&pov1.ServiceMonitor{}).
@@ -385,7 +386,7 @@ func handleApplicationCertRequest(_ context.Context, obj client.Object) []reconc
385386
return requests
386387
}
387388

388-
func isIngressGateway(gateway *networkingv1beta1.Gateway) bool {
389+
func isIngressGateway(gateway *istionetworkingv1.Gateway) bool {
389390
match, _ := regexp.MatchString("^.*-ingress-.*$", gateway.Name)
390391

391392
return match

‎internal/controllers/namespace.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package controllers
33
import (
44
"context"
55
"fmt"
6+
67
skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
78
"github.com/kartverket/skiperator/internal/controllers/common"
89
"github.com/kartverket/skiperator/pkg/log"
@@ -12,7 +13,7 @@ import (
1213
"github.com/kartverket/skiperator/pkg/resourcegenerator/networkpolicy/defaultdeny"
1314
"github.com/kartverket/skiperator/pkg/resourcegenerator/resourceutils"
1415
"github.com/kartverket/skiperator/pkg/util"
15-
istionetworkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
16+
istionetworkingv1 "istio.io/client-go/pkg/apis/networking/v1"
1617
corev1 "k8s.io/api/core/v1"
1718
networkingv1 "k8s.io/api/networking/v1"
1819
"k8s.io/apimachinery/pkg/api/errors"
@@ -37,7 +38,7 @@ func (r *NamespaceReconciler) SetupWithManager(mgr ctrl.Manager) error {
3738
return ctrl.NewControllerManagedBy(mgr).
3839
For(&corev1.Namespace{}).
3940
Owns(&networkingv1.NetworkPolicy{}).
40-
Owns(&istionetworkingv1beta1.Sidecar{}).
41+
Owns(&istionetworkingv1.Sidecar{}).
4142
Owns(&corev1.Secret{}, builder.WithPredicates(
4243
util.MatchesPredicate[*corev1.Secret](github.IsImagePullSecret),
4344
)).

‎internal/controllers/routing.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package controllers
33
import (
44
"context"
55
"fmt"
6+
67
certmanagerv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
78
skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
89
"github.com/kartverket/skiperator/internal/controllers/common"
@@ -13,7 +14,7 @@ import (
1314
"github.com/kartverket/skiperator/pkg/resourcegenerator/istio/virtualservice"
1415
networkpolicy "github.com/kartverket/skiperator/pkg/resourcegenerator/networkpolicy/dynamic"
1516
"github.com/kartverket/skiperator/pkg/resourcegenerator/resourceutils"
16-
istionetworkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
17+
istionetworkingv1 "istio.io/client-go/pkg/apis/networking/v1"
1718
networkingv1 "k8s.io/api/networking/v1"
1819
"k8s.io/apimachinery/pkg/api/errors"
1920
"k8s.io/apimachinery/pkg/types"
@@ -37,9 +38,9 @@ type RoutingReconciler struct {
3738
func (r *RoutingReconciler) SetupWithManager(mgr ctrl.Manager) error {
3839
return ctrl.NewControllerManagedBy(mgr).
3940
For(&skiperatorv1alpha1.Routing{}).
40-
Owns(&istionetworkingv1beta1.Gateway{}).
41+
Owns(&istionetworkingv1.Gateway{}).
4142
Owns(&networkingv1.NetworkPolicy{}).
42-
Owns(&istionetworkingv1beta1.VirtualService{}).
43+
Owns(&istionetworkingv1.VirtualService{}).
4344
Watches(&certmanagerv1.Certificate{}, handler.EnqueueRequestsFromMapFunc(r.skiperatorRoutingCertRequests)).
4445
Watches(
4546
&skiperatorv1alpha1.Application{},

‎internal/controllers/skipjob.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package controllers
33
import (
44
"context"
55
"fmt"
6+
67
skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
78
"github.com/kartverket/skiperator/internal/controllers/common"
89
"github.com/kartverket/skiperator/pkg/log"
@@ -15,7 +16,7 @@ import (
1516
"github.com/kartverket/skiperator/pkg/resourcegenerator/podmonitor"
1617
"github.com/kartverket/skiperator/pkg/resourcegenerator/resourceutils"
1718
"github.com/kartverket/skiperator/pkg/resourcegenerator/serviceaccount"
18-
istionetworkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
19+
istionetworkingv1 "istio.io/client-go/pkg/apis/networking/v1"
1920
telemetryv1 "istio.io/client-go/pkg/apis/telemetry/v1"
2021
batchv1 "k8s.io/api/batch/v1"
2122
corev1 "k8s.io/api/core/v1"
@@ -76,7 +77,7 @@ func (r *SKIPJobReconciler) SetupWithManager(mgr ctrl.Manager) error {
7677
return nil
7778
})).
7879
Owns(&networkingv1.NetworkPolicy{}).
79-
Owns(&istionetworkingv1beta1.ServiceEntry{}).
80+
Owns(&istionetworkingv1.ServiceEntry{}).
8081
Owns(&telemetryv1.Telemetry{}).
8182
// Some NetPol entries are not added unless an application is present. If we reconcile all jobs when there has been changes to NetPols, we can assume
8283
// that changes to an Applications AccessPolicy will cause a reconciliation of Jobs

‎pkg/resourcegenerator/istio/authorizationpolicy/authorization_policy.go

+13-12
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@ package authorizationpolicy
22

33
import (
44
"fmt"
5+
56
skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
67
"github.com/kartverket/skiperator/pkg/reconciliation"
78
"github.com/kartverket/skiperator/pkg/util"
8-
securityv1beta1api "istio.io/api/security/v1beta1"
9+
securityv1api "istio.io/api/security/v1"
910
typev1beta1 "istio.io/api/type/v1beta1"
10-
securityv1beta1 "istio.io/client-go/pkg/apis/security/v1beta1"
11+
securityv1 "istio.io/client-go/pkg/apis/security/v1"
1112
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1213
)
1314

@@ -54,29 +55,29 @@ func Generate(r reconciliation.Reconciliation) error {
5455
return nil
5556
}
5657

57-
func getGeneralFromRule() []*securityv1beta1api.Rule_From {
58-
return []*securityv1beta1api.Rule_From{
58+
func getGeneralFromRule() []*securityv1api.Rule_From {
59+
return []*securityv1api.Rule_From{
5960
{
60-
Source: &securityv1beta1api.Source{
61+
Source: &securityv1api.Source{
6162
Namespaces: []string{"istio-gateways"},
6263
},
6364
},
6465
}
6566
}
6667

67-
func getDefaultDenyPolicy(application *skiperatorv1alpha1.Application, denyPaths []string) securityv1beta1.AuthorizationPolicy {
68-
return securityv1beta1.AuthorizationPolicy{
68+
func getDefaultDenyPolicy(application *skiperatorv1alpha1.Application, denyPaths []string) securityv1.AuthorizationPolicy {
69+
return securityv1.AuthorizationPolicy{
6970
ObjectMeta: metav1.ObjectMeta{
7071
Namespace: application.Namespace,
7172
Name: application.Name + "-deny",
7273
},
73-
Spec: securityv1beta1api.AuthorizationPolicy{
74-
Action: securityv1beta1api.AuthorizationPolicy_DENY,
75-
Rules: []*securityv1beta1api.Rule{
74+
Spec: securityv1api.AuthorizationPolicy{
75+
Action: securityv1api.AuthorizationPolicy_DENY,
76+
Rules: []*securityv1api.Rule{
7677
{
77-
To: []*securityv1beta1api.Rule_To{
78+
To: []*securityv1api.Rule_To{
7879
{
79-
Operation: &securityv1beta1api.Operation{
80+
Operation: &securityv1api.Operation{
8081
Paths: denyPaths,
8182
},
8283
},

‎pkg/resourcegenerator/istio/gateway/application.go

+10-10
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ import (
66
skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
77
"github.com/kartverket/skiperator/pkg/reconciliation"
88
"github.com/kartverket/skiperator/pkg/util"
9-
networkingv1beta1api "istio.io/api/networking/v1beta1"
10-
networkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
9+
networkingv1api "istio.io/api/networking/v1"
10+
networkingv1 "istio.io/client-go/pkg/apis/networking/v1"
1111
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1212
)
1313

@@ -36,15 +36,15 @@ func generateForApplication(r reconciliation.Reconciliation) error {
3636
// Generate separate gateway for each ingress
3737
for _, h := range hosts.AllHosts() {
3838
name := fmt.Sprintf("%s-ingress-%x", application.Name, util.GenerateHashFromName(h.Hostname))
39-
gateway := networkingv1beta1.Gateway{ObjectMeta: metav1.ObjectMeta{Namespace: application.Namespace, Name: name}}
39+
gateway := networkingv1.Gateway{ObjectMeta: metav1.ObjectMeta{Namespace: application.Namespace, Name: name}}
4040

4141
gateway.Spec.Selector = util.GetIstioGatewayLabelSelector(h.Hostname)
4242

43-
gatewayServersToAdd := []*networkingv1beta1api.Server{}
43+
gatewayServersToAdd := []*networkingv1api.Server{}
4444

45-
baseHttpGatewayServer := &networkingv1beta1api.Server{
45+
baseHttpGatewayServer := &networkingv1api.Server{
4646
Hosts: []string{h.Hostname},
47-
Port: &networkingv1beta1api.Port{
47+
Port: &networkingv1api.Port{
4848
Number: 80,
4949
Name: "http",
5050
Protocol: "HTTP",
@@ -56,15 +56,15 @@ func generateForApplication(r reconciliation.Reconciliation) error {
5656
determinedCredentialName = *h.CustomCertificateSecret
5757
}
5858

59-
httpsGatewayServer := &networkingv1beta1api.Server{
59+
httpsGatewayServer := &networkingv1api.Server{
6060
Hosts: []string{h.Hostname},
61-
Port: &networkingv1beta1api.Port{
61+
Port: &networkingv1api.Port{
6262
Number: 443,
6363
Name: "https",
6464
Protocol: "HTTPS",
6565
},
66-
Tls: &networkingv1beta1api.ServerTLSSettings{
67-
Mode: networkingv1beta1api.ServerTLSSettings_SIMPLE,
66+
Tls: &networkingv1api.ServerTLSSettings{
67+
Mode: networkingv1api.ServerTLSSettings_SIMPLE,
6868
CredentialName: determinedCredentialName,
6969
},
7070
}

‎pkg/resourcegenerator/istio/gateway/routing.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ import (
66
skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
77
"github.com/kartverket/skiperator/pkg/reconciliation"
88
"github.com/kartverket/skiperator/pkg/util"
9-
networkingv1beta1api "istio.io/api/networking/v1beta1"
10-
networkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
9+
networkingv1api "istio.io/api/networking/v1"
10+
networkingv1 "istio.io/client-go/pkg/apis/networking/v1"
1111
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1212
)
1313

@@ -32,7 +32,7 @@ func generateForRouting(r reconciliation.Reconciliation) error {
3232
return err
3333
}
3434

35-
gateway := networkingv1beta1.Gateway{ObjectMeta: metav1.ObjectMeta{Namespace: routing.Namespace, Name: routing.GetGatewayName()}}
35+
gateway := networkingv1.Gateway{ObjectMeta: metav1.ObjectMeta{Namespace: routing.Namespace, Name: routing.GetGatewayName()}}
3636

3737
var determinedCredentialName string
3838
if h.UsesCustomCert() {
@@ -45,24 +45,24 @@ func generateForRouting(r reconciliation.Reconciliation) error {
4545
}
4646

4747
gateway.Spec.Selector = util.GetIstioGatewayLabelSelector(h.Hostname)
48-
gateway.Spec.Servers = []*networkingv1beta1api.Server{
48+
gateway.Spec.Servers = []*networkingv1api.Server{
4949
{
5050
Hosts: []string{h.Hostname},
51-
Port: &networkingv1beta1api.Port{
51+
Port: &networkingv1api.Port{
5252
Number: 80,
5353
Name: "http",
5454
Protocol: "HTTP",
5555
},
5656
},
5757
{
5858
Hosts: []string{h.Hostname},
59-
Port: &networkingv1beta1api.Port{
59+
Port: &networkingv1api.Port{
6060
Number: 443,
6161
Name: "https",
6262
Protocol: "HTTPS",
6363
},
64-
Tls: &networkingv1beta1api.ServerTLSSettings{
65-
Mode: networkingv1beta1api.ServerTLSSettings_SIMPLE,
64+
Tls: &networkingv1api.ServerTLSSettings{
65+
Mode: networkingv1api.ServerTLSSettings_SIMPLE,
6666
CredentialName: determinedCredentialName,
6767
},
6868
},

‎pkg/resourcegenerator/istio/peerauthentication/peer_authentication.go

+7-6
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@ package peerauthentication
22

33
import (
44
"fmt"
5+
56
skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
67
"github.com/kartverket/skiperator/pkg/reconciliation"
78
"github.com/kartverket/skiperator/pkg/util"
8-
securityv1beta1api "istio.io/api/security/v1beta1"
9+
securityv1api "istio.io/api/security/v1"
910
typev1beta1 "istio.io/api/type/v1beta1"
10-
securityv1beta1 "istio.io/client-go/pkg/apis/security/v1beta1"
11+
securityv1 "istio.io/client-go/pkg/apis/security/v1"
1112
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1213
)
1314

@@ -24,14 +25,14 @@ func Generate(r reconciliation.Reconciliation) error {
2425
}
2526
ctxLog.Debug("Attempting to generate peer authentication for application", "application", application.Name)
2627

27-
peerAuthentication := securityv1beta1.PeerAuthentication{ObjectMeta: metav1.ObjectMeta{Namespace: application.Namespace, Name: application.Name}}
28+
peerAuthentication := securityv1.PeerAuthentication{ObjectMeta: metav1.ObjectMeta{Namespace: application.Namespace, Name: application.Name}}
2829

29-
peerAuthentication.Spec = securityv1beta1api.PeerAuthentication{
30+
peerAuthentication.Spec = securityv1api.PeerAuthentication{
3031
Selector: &typev1beta1.WorkloadSelector{
3132
MatchLabels: util.GetPodAppSelector(application.Name),
3233
},
33-
Mtls: &securityv1beta1api.PeerAuthentication_MutualTLS{
34-
Mode: securityv1beta1api.PeerAuthentication_MutualTLS_STRICT,
34+
Mtls: &securityv1api.PeerAuthentication_MutualTLS{
35+
Mode: securityv1api.PeerAuthentication_MutualTLS_STRICT,
3536
},
3637
}
3738

0 commit comments

Comments
 (0)