Merge pull request #102 from signadot/release-v1.2.0

Release v1.2.0

Author: scott-cotton

.github/workflows/release.yml

@@ -1,9 +1,15 @@
 name: Release Charts
 
+# This workflow creates a new chart release when changes are merged to the release branch.
+# The release branch should only receive changes through pull requests from main.
+# Each merge commit to release represents a deliberate release decision.
+
 on:
   push:
     branches:
-      - main
+      - release
+  workflow_dispatch:
+    # Allow manual trigger for releases
 
 jobs:
   release:

signadot/operator/Chart.yaml

@@ -6,10 +6,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: "1.0.0"
+version: "1.2.0"
+
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.0.0"
+
+appVersion: "1.2.0"
+

signadot/operator/README.md

@@ -1,10 +1,13 @@
 {{ if not .Values.disableAgent }}
-
+{{- if and (hasKey .Values "controlPlane") (hasKey .Values.controlPlane "clusterToken") }}
+Please visit https://app.signadot.com to verify that your cluster has been
+successfully registered.
+{{- else }}
 Please visit https://app.signadot.com to register this cluster and create a cluster token.
 
 Then populate the cluster token in a Secret by running the following command
 with "..." replaced by the token value.
 
-kubectl -n signadot create secret generic cluster-agent --from-literal=token=...
-
+kubectl -n signadot create secret generic cluster-token --from-literal=token=...
+{{- end }}
 {{ end }}

signadot/operator/templates/NOTES.txt

@@ -5,8 +5,30 @@ cluster config template
 {{- define "compileClusterConfig" -}}
 {{- $allowedNamespaces := (include "getAllowedNamespaces" . | fromJsonArray) -}}
 allowedNamespaces: {{ if gt (len $allowedNamespaces) 0 }}{{ printf "\n" }}{{ toYaml $allowedNamespaces | indent 2}}{{- else -}}[]{{- end }}
+{{- if (hasKey .Values "controlPlane") }}
 controlPlane:
-  proxy: {{ if and (hasKey .Values "controlPlane") (hasKey .Values.controlPlane "proxy") -}}{{ .Values.controlPlane.proxy }}{{- else -}}enabled{{- end }}
+{{- if (hasKey .Values.controlPlane "proxy") }}
+  proxy: {{ .Values.controlPlane.proxy }}
+{{- end }}
+{{- if (hasKey .Values.controlPlane "controlAPI") }}
+  controlAPI: {{ .Values.controlPlane.controlAPI }}
+{{- end }}
+{{- if (hasKey .Values.controlPlane "tunnelAddr") }}
+  tunnelAddr: {{ .Values.controlPlane.tunnelAddr }}
+{{- end }}
+{{- if (hasKey .Values.controlPlane "tunnelTLS") }}
+  tunnelTLS: {{ .Values.controlPlane.tunnelTLS }}
+{{- end }}
+{{- if (hasKey .Values.controlPlane "proxyURL") }}
+  proxyURL: {{ .Values.controlPlane.proxyURL }}
+{{- end }}
+{{- if (hasKey .Values.controlPlane "artifactsAPI") }}
+  artifactsAPI: {{ .Values.controlPlane.artifactsAPI }}
+{{- end }}
+{{- if (hasKey .Values.controlPlane "trafficmodelsAPI") }}
+  trafficmodelsAPI: {{ .Values.controlPlane.trafficmodelsAPI }}
+{{- end }}
+{{- end }}
 allowOrphanedResources: {{ if hasKey .Values "allowOrphanedResources" -}}{{ toString .Values.allowOrphanedResources }}{{- else -}}false{{- end }}
 routing:
   istio:
@@ -26,8 +48,8 @@ routing:
     {{- end}}
   iptablesMode: {{ if and (hasKey .Values "routing") (hasKey .Values.routing "iptablesMode") -}}{{ .Values.routing.iptablesMode }}{{- else -}}legacy{{- end }}
   customHeaders: {{ with .Values }}{{ with .routing }}{{ with .customHeaders }}{{ printf "\n" }}{{ toYaml . | indent 4}}{{- else -}}[]{{- end }}{{- else -}}[]{{- end }}{{- else -}}[]{{- end }}
-sandboxTrafficManager:
-  enabled: {{ if and (hasKey .Values "sandboxTrafficManager") (hasKey .Values.sandboxTrafficManager "enabled") -}}{{ toString .Values.sandboxTrafficManager.enabled }}{{- else -}}true{{- end }}
+trafficManager:
+  enabled: {{ if and (hasKey .Values "trafficManager") (hasKey .Values.trafficManager "enabled") -}}{{ toString .Values.trafficManager.enabled }}{{- else -}}true{{- end }}
 trafficCapture:
   enabled: {{ if and (hasKey .Values "trafficCapture") (hasKey .Values.trafficCapture "enabled") -}}{{ toString .Values.trafficCapture.enabled }}{{- else -}}true{{- end }}
   requestHeadersElide: {{ with .Values }}{{ with .trafficCapture }}{{ with .requestHeadersElide }}{{ printf "\n" }}{{ toYaml . | indent 4}}{{- else -}}[]{{- end }}{{- else -}}[]{{- end }}{{- else -}}[]{{- end }}

signadot/operator/templates/_helpers.tpl

@@ -27,14 +27,14 @@ spec:
   template:
     metadata:
       annotations:
+        cluster-config-checksum: '{{ include (print $.Template.BasePath "/cluster-config-configmap.yaml")
+          . | sha256sum }}'
         {{- range $key, $val := .Values.commonAnnotations }}
         {{ $key | quote }}: {{ $val | quote }}
         {{- end }}
         {{- range $key, $val := .Values.podAnnotations }}
         {{ $key | quote }}: {{ $val | quote }}
         {{- end }}
-        cluster-config-checksum: '{{ include (print $.Template.BasePath "/signadot-cluster-config-configmap.yaml")
-          . | sha256sum }}'
         {{- if $linkerdEnabled }}
         {{- if and (hasKey .Values.linkerd "operator") (hasKey .Values.linkerd.operator "podAnnotations") (.Values.linkerd.operator.podAnnotations)}}
         {{- range $key, $val := .Values.linkerd.operator.podAnnotations }}
@@ -63,16 +63,7 @@ spec:
         {{- end }}
     spec:
       containers:
-      - args:
-        - --api-url=https://api.signadot.com
-        - --tunnel-addr=tunnel.signadot.com:443
-        env:
-        - name: AGENT_TOKEN
-          valueFrom:
-            secretKeyRef:
-              key: token
-              name: cluster-agent
-        image: {{ with .Values }}{{ with .agent }}{{ with .image }}{{ . | quote}}{{- else -}}signadot/agent:v1.0.0{{- end }}{{- else -}}signadot/agent:v1.0.0{{- end }}{{- else -}}signadot/agent:v1.0.0{{- end }}
+      - image: {{ with .Values }}{{ with .agent }}{{ with .image }}{{ . | quote}}{{- else -}}signadot/agent:v1.2.0{{- end }}{{- else -}}signadot/agent:v1.2.0{{- end }}{{- else -}}signadot/agent:v1.2.0{{- end }}
         imagePullPolicy: {{ with .Values }}{{ with .agent }}{{ with .imagePullPolicy }}{{ . | quote}}{{- else -}}IfNotPresent{{- end }}{{- else -}}IfNotPresent{{- end }}{{- else -}}IfNotPresent{{- end }}
         livenessProbe:
           httpGet:
@@ -89,5 +80,29 @@ spec:
         resources:
 {{ toYaml . | indent 10 }}
 {{- else -}}{{- end }}{{- else -}}{{- end }}{{- else -}}{{- end }}
+        volumeMounts:
+        - mountPath: /etc/signadot/
+          name: signadot-config
+          readOnly: true
       serviceAccountName: agent
+      volumes:
+      - name: signadot-config
+        projected:
+          sources:
+          - secret:
+              items:
+              - key: token
+                path: token
+              name: '{{ $oldSecret := (lookup "v1" "Secret" "signadot" "cluster-agent")
+                }} {{- with .Values }} {{- with .controlPlane }} {{- with .tokenSecret
+                }} {{- . }} {{- else }} {{- if $oldSecret }}{{- $oldSecret.metadata.name
+                }} {{- else }}cluster-token {{- end }} {{- end }} {{- else }} {{-
+                if $oldSecret }}{{- $oldSecret.metadata.name }} {{- else }}cluster-token
+                {{- end }} {{- end }} {{- else }} {{- if $oldSecret }}{{- $oldSecret.metadata.name
+                }} {{- else }}cluster-token {{- end }} {{- end }}'
+          - configMap:
+              items:
+              - key: cluster_config.yaml
+                path: cluster_config.yaml
+              name: cluster-config
 {{ end }}

signadot/operator/templates/agent-deployment.yaml

@@ -3,12 +3,15 @@
 }}
 {{ fail "istio and linkerd cannot be enabled at the same time" }}
 {{- end }}
+{{- if and (hasKey .Values "istio") (hasKey .Values.istio "enableDeprecatedHostRouting") }}
+{{ fail "istio host routing is no longer supported" }}
+{{- end }}
 
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: signadot-cluster-config
+  name: cluster-config
   namespace: signadot
 data:
   cluster_config.yaml: |
-    {{- include "compileClusterConfig" . | nindent 4 }}
+    {{- include "compileClusterConfig" . | nindent 4 }}

…s/signadot-cluster-config-configmap.yaml …/templates/cluster-config-configmap.yamlsignadot/operator/templates/signadot-cluster-config-configmap.yaml renamed to signadot/operator/templates/cluster-config-configmap.yaml signadot/operator/templates/signadot-cluster-config-configmap.yaml renamed to signadot/operator/templates/cluster-config-configmap.yaml

@@ -0,0 +1,10 @@
+{{- if and (hasKey .Values "controlPlane") (hasKey .Values.controlPlane "clusterToken")
+}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ with .Values }}{{ with .controlPlane }}{{ with .tokenSecret }}{{ . }}{{- else -}}"cluster-token"{{- end }}{{- else -}}"cluster-token"{{- end }}{{- else -}}"cluster-token"{{- end }}
+  namespace: signadot
+data:
+  token: {{ .Values.controlPlane.clusterToken | b64enc | quote }}
+{{- end }}

signadot/operator/templates/cluster-token-secret.yaml

@@ -72,6 +72,7 @@ spec:
                 - name
                 type: object
               disableSandboxTrafficManager:
+                description: 'DEPRECATED: this field is no longer needed.'
                 type: boolean
               patches:
                 description: List of patches to be applied to the baseline workload

signadot/operator/templates/forkedworkloads.signadot.com-customresourcedefinition.yaml

@@ -13,7 +13,9 @@ metadata:
   name: io-context-server
   namespace: signadot
 spec:
-  replicas: 1
+{{- with .Values }}{{- with .ioContextServer }}{{- with .replicas }}
+  replicas: {{ . }}
+{{- else -}}{{- end }}{{- else -}}{{- end }}{{- else -}}{{- end }}
   selector:
     matchLabels:
       app: io-context-server
@@ -40,7 +42,7 @@ spec:
         - /app/io-context-server
         - -tls=secretns=signadot
         - -port=8443
-        image: {{ with .Values }}{{ with .ioContextServer }}{{ with .image }}{{ . | quote}}{{- else -}}signadot/io-context-server:v1.0.0{{- end }}{{- else -}}signadot/io-context-server:v1.0.0{{- end }}{{- else -}}signadot/io-context-server:v1.0.0{{- end }}
+        image: {{ with .Values }}{{ with .ioContextServer }}{{ with .image }}{{ . | quote}}{{- else -}}signadot/io-context-server:v1.2.0{{- end }}{{- else -}}signadot/io-context-server:v1.2.0{{- end }}{{- else -}}signadot/io-context-server:v1.2.0{{- end }}
         imagePullPolicy: {{ with .Values }}{{ with .ioContextServer }}{{ with .imagePullPolicy }}{{ . | quote}}{{- else -}}IfNotPresent{{- end }}{{- else -}}IfNotPresent{{- end }}{{- else -}}IfNotPresent{{- end }}
         name: io-context-server
         ports: