upgrade components - closes #430

Signed-off-by: Marcin Fabrykowski git@fabrykowski.pl

chart/templates/cilium/cilium_addresspool.yml

+{{ if .Values.cilium.lb_pools }}
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: "lb-pool-{{ .Release.Name }}"
+spec:
+  blocks:
+{{- range .Values.cilium.lb_pools }}
+  - {{ toYaml . }}
+{{- end }}
+{{- end }}

chart/templates/cilium/cilium_announcement_policy.yml

+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: policy1
+spec:
+  nodeSelector:
+    matchExpressions:
+      - key: node-role.kubernetes.io/control-plane
+        operator: DoesNotExist
+  interfaces:
+  - "enx*"
+  externalIPs: true
+  loadBalancerIPs: true

chart/templates/dex/dex-k8s-authenticator.yml

@@ -6,8 +6,8 @@ metadata:
 spec:
   project: exphost
   source:
-    #repoURL: 'https://mintel.github.io/helm-charts'
-    repoURL: 'https://gitlab.exphost.pl/charts'
+    repoURL: 'https://mintel.github.io/helm-charts'
+    #repoURL: 'https://gitlab.exphost.pl/charts'
     targetRevision: v1.2.0
     chart: dex-k8s-authenticator
     helm:

chart/templates/dex/dex.yml

@@ -34,7 +34,6 @@ spec:
             nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS"
             nginx.ingress.kubernetes.io/cors-allow-origin: "*"
             nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
-        priorityClassName: high-priority
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: dex

chart/templates/external-dns/external-dns.yml

@@ -8,14 +8,14 @@ spec:
   source:
     repoURL: 'https://charts.bitnami.com/bitnami'
     chart: external-dns
-    targetRevision: 8.2.3
+    targetRevision: 8.3.4
     helm:
       values: |
-        image:
-          registry: registry.gitlab.exphost.pl
-          repository: torgiren/external-dns
-          tag: v1.0.0-mf
-          pullPolicy: Always
+        #image:
+        #  registry: registry.gitlab.exphost.pl
+        #  repository: torgiren/external-dns
+        #  tag: v1.0.0-mf
+        #  pullPolicy: Always
         sources:
           - crd
           - ingress
@@ -34,6 +34,8 @@ spec:
             enabled: true
         logLevel: debug
         crd:
+          # temporary workaround
+          #create: false
           create: true
         policy: sync
         publishHostIP: true

chart/templates/external-dns/temporary_crd.yml

+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+    api-approved.kubernetes.io: "https://github.com/kubernetes-sigs/external-dns/pull/2007"
+  name: dnsendpoints.externaldns.k8s.io
+spec:
+  group: externaldns.k8s.io
+  names:
+    kind: DNSEndpoint
+    listKind: DNSEndpointList
+    plural: dnsendpoints
+    singular: dnsendpoint
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: DNSEndpointSpec defines the desired state of DNSEndpoint
+            properties:
+              endpoints:
+                items:
+                  description: Endpoint is a high-level way of a connection between
+                    a service and an IP
+                  properties:
+                    dnsName:
+                      description: The hostname of the DNS record
+                      type: string
+                    labels:
+                      additionalProperties:
+                        type: string
+                      description: Labels stores labels defined for the Endpoint
+                      type: object
+                    providerSpecific:
+                      description: ProviderSpecific stores provider specific config
+                      items:
+                        description: ProviderSpecificProperty holds the name and value
+                          of a configuration which is specific to individual DNS providers
+                        properties:
+                          name:
+                            type: string
+                          value:
+                            type: string
+                        type: object
+                      type: array
+                    recordTTL:
+                      description: TTL for the record
+                      format: int64
+                      type: integer
+                    recordType:
+                      description: RecordType type of record, e.g. CNAME, A, AAAA,
+                        SRV, TXT etc
+                      type: string
+                    setIdentifier:
+                      description: Identifier to distinguish multiple records with
+                        the same name and type (e.g. Route53 records with routing
+                        policies other than 'simple')
+                      type: string
+                    targets:
+                      description: The targets the DNS record points to
+                      items:
+                        type: string
+                      type: array
+                  type: object
+                type: array
+            type: object
+          status:
+            description: DNSEndpointStatus defines the observed state of DNSEndpoint
+            properties:
+              observedGeneration:
+                description: The generation observed by the external-dns controller.
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

chart/templates/longhorn/longhorn.yml

@@ -32,6 +32,8 @@ spec:
         metrics:
           serviceMonitor:
             enabled: true
+        preUpgradeChecker:
+          jobEnabled: false
 
   destination:
     server: 'https://kubernetes.default.svc'

chart/templates/longhorn/longhorn_oauth2.yml

-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: oauth2-longhorn
-  namespace: argocd
-spec:
-  project: exphost
-  source:
-    repoURL: 'https://charts.bitnami.com/bitnami'
-    chart: oauth2-proxy
-    targetRevision: 3.4.9
-    helm:
-      values: |
-        ingress:
-          enabled: true
-          hostname: "longhorn.{{ .Values.domain}}"
-          path: /oauth2
-          pathType: Prefix
-          tls: true
-          annotations:
-            cert-manager.io/cluster-issuer: acme-issuer
-        configuration:
-          existingSecret: oauth2-longhorn-oauth2-proxy
-          content: |
-            provider = "oidc"
-            oidc_issuer_url = "https://auth.{{ .Values.domain }}/dex"
-            allowed_groups = ["k8s-admins"]
-            email_domains = [ "*" ]
-            upstreams = [ "file:///dev/null" ]
-        redis:
-          auth:
-            existingSecret: oauth2-longhorn-redis
-
-  destination:
-    server: 'https://kubernetes.default.svc'
-    namespace: longhorn-system
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
+#apiVersion: argoproj.io/v1alpha1
+#kind: Application
+#metadata:
+#  name: oauth2-longhorn
+#  namespace: argocd
+#spec:
+#  project: exphost
+#  source:
+#    repoURL: 'https://charts.bitnami.com/bitnami'
+#    chart: oauth2-proxy
+#    targetRevision: 3.4.9
+#    helm:
+#      values: |
+#        ingress:
+#          enabled: true
+#          hostname: "longhorn.{{ .Values.domain}}"
+#          path: /oauth2
+#          pathType: Prefix
+#          tls: true
+#          annotations:
+#            cert-manager.io/cluster-issuer: acme-issuer
+#        configuration:
+#          existingSecret: oauth2-longhorn-oauth2-proxy
+#          content: |
+#            provider = "oidc"
+#            oidc_issuer_url = "https://auth.{{ .Values.domain }}/dex"
+#            allowed_groups = ["k8s-admins"]
+#            email_domains = [ "*" ]
+#            upstreams = [ "file:///dev/null" ]
+#        redis:
+#          auth:
+#            existingSecret: oauth2-longhorn-redis
+#
+#  destination:
+#    server: 'https://kubernetes.default.svc'
+#    namespace: longhorn-system
+#  syncPolicy:
+#    automated:
+#      prune: true
+#      selfHeal: true
+#    syncOptions:
+#      - CreateNamespace=true

chart/templates/longhorn/prometheus_metrics.yml

-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: longhorn-prometheus-servicemonitor
-  namespace: longhorn-system
-  labels:
-    name: longhorn-prometheus-servicemonitor
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  selector:
-    matchLabels:
-      app: longhorn-manager
-  namespaceSelector:
-    matchNames:
-    - longhorn-system
-  endpoints:
-  - port: manager

chart/templates/metallb/metallb.yml

-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: metallb
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "-5"
-spec:
-  project: exphost
-  source:
-    repoURL: 'https://charts.bitnami.com/bitnami'
-    targetRevision: 6.3.8
-    chart: metallb
-    helm:
-      values: |
-        controller:
-          metrics:
-            enabled: true
-            serviceMonitor:
-              enabled: true
-        speaker:
-            enabled: true
-            serviceMonitor:
-              enabled: true
-
-  destination:
-    server: 'https://kubernetes.default.svc'
-    namespace: metallb-system
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
+#apiVersion: argoproj.io/v1alpha1
+#kind: Application
+#metadata:
+#  name: metallb
+#  namespace: argocd
+#  annotations:
+#    argocd.argoproj.io/sync-wave: "-5"
+#spec:
+#  project: exphost
+#  source:
+#    repoURL: 'https://charts.bitnami.com/bitnami'
+#    targetRevision: 6.3.8
+#    chart: metallb
+#    helm:
+#      values: |
+#        controller:
+#          metrics:
+#            enabled: true
+#            serviceMonitor:
+#              enabled: true
+#        speaker:
+#            enabled: true
+#            serviceMonitor:
+#              enabled: true
+#
+#  destination:
+#    server: 'https://kubernetes.default.svc'
+#    namespace: metallb-system
+#  syncPolicy:
+#    automated:
+#      prune: true
+#      selfHeal: true

chart/templates/metallb/metallb_addresspool.yml

+#{{ if .Values.metallb.pools }}
+#{{- range .Values.metallb.pools }}
+#---
+#apiVersion: metallb.io/v1beta1
+#kind: IPAddressPool
+#metadata:
+#  name: {{ .name }}
+#  namespace: metallb-system
+#  annotations:
+#    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+#spec:
+#  addresses: {{ .addresses }}
+#{{- end }}
+#{{- end }}

chart/templates/metallb/metallb_namespace.yml

----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: metallb-system
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-  annotations:
-    argocd.argoproj.io/sync-wave: "-5"
+#---
+#apiVersion: v1
+#kind: Namespace
+#metadata:
+#  name: metallb-system
+#  labels:
+#    pod-security.kubernetes.io/enforce: privileged
+#  annotations:
+#    argocd.argoproj.io/sync-wave: "-5"

chart/templates/named/named.yml

@@ -13,6 +13,8 @@ spec:
       values: |
         domain: {{ .Values.domain }}
         {{- tpl (toYaml .Values.named) . | nindent 8 }}
+        image:
+          tag: "9.20"
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: named

chart/templates/prometheus/alertmanager_oauth2.yml

-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: oauth2-alertmanager
-  namespace: argocd
-spec:
-  project: exphost
-  source:
-    repoURL: 'https://charts.bitnami.com/bitnami'
-    chart: oauth2-proxy
-    targetRevision: 3.4.9
-    helm:
-      values: |
-        ingress:
-          enabled: true
-          hostname: "alertmanager.{{ .Values.domain}}"
-          path: /oauth2
-          pathType: Prefix
-          tls: true
-          annotations:
-            cert-manager.io/cluster-issuer: acme-issuer
-        configuration:
-          existingSecret: oauth2-alertmanager-oauth2-proxy
-          content: |
-            provider = "oidc"
-            oidc_issuer_url = "https://auth.{{ .Values.domain }}/dex"
-            allowed_groups = ["k8s-admins"]
-            email_domains = [ "*" ]
-            upstreams = [ "file:///dev/null" ]
-        redis:
-          auth:
-            existingSecret: oauth2-alertmanager-redis
-
-  destination:
-    server: 'https://kubernetes.default.svc'
-    namespace: prometheus-system
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
+#apiVersion: argoproj.io/v1alpha1
+#kind: Application
+#metadata:
+#  name: oauth2-alertmanager
+#  namespace: argocd
+#spec:
+#  project: exphost
+#  source:
+#    repoURL: 'https://charts.bitnami.com/bitnami'
+#    chart: oauth2-proxy
+#    targetRevision: 3.4.9
+#    helm:
+#      values: |
+#        ingress:
+#          enabled: true
+#          hostname: "alertmanager.{{ .Values.domain}}"
+#          path: /oauth2
+#          pathType: Prefix
+#          tls: true
+#          annotations:
+#            cert-manager.io/cluster-issuer: acme-issuer
+#        configuration:
+#          existingSecret: oauth2-alertmanager-oauth2-proxy
+#          content: |
+#            provider = "oidc"
+#            oidc_issuer_url = "https://auth.{{ .Values.domain }}/dex"
+#            allowed_groups = ["k8s-admins"]
+#            email_domains = [ "*" ]
+#            upstreams = [ "file:///dev/null" ]
+#        redis:
+#          auth:
+#            existingSecret: oauth2-alertmanager-redis
+#
+#  destination:
+#    server: 'https://kubernetes.default.svc'
+#    namespace: prometheus-system
+#  syncPolicy:
+#    automated:
+#      prune: true
+#      selfHeal: true
+#    syncOptions:
+#      - CreateNamespace=true

chart/templates/prometheus/prometheus.yml

@@ -32,7 +32,7 @@ spec:
               operator: "Exists"
               effect: "NoSchedule"
           extraArgs:
-            collector.filesystem.ignored-mount-points: "^/(dev|proc|sys|var/lib/docker/.+|run/ns/.+|run/k3s/containerd|run|var/lib/kubelet/.+)($|/)"
+            #collector.filesystem.ignored-mount-points: "^/(dev|proc|sys|var/lib/docker/.+|run/ns/.+|run/k3s/containerd|run|var/lib/kubelet/.+)($|/)"
             path.rootfs: "/host/root"
             log.level: "debug"
           extraVolumes: