-
Notifications
You must be signed in to change notification settings - Fork 208
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement cilium upgrade
using Helm
#1492
Merged
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
asauber
added
the
dont-merge/preview-only
Only for preview or testing, don't merge it.
label
Apr 5, 2023
asauber
force-pushed
the
pr/asauber/clustermesh
branch
from
April 5, 2023 22:10
d5c39d0
to
8149f4b
Compare
asauber
force-pushed
the
pr/asauber/clustermesh
branch
from
April 10, 2023 20:01
8149f4b
to
53f34b6
Compare
asauber
force-pushed
the
pr/asauber/clustermesh
branch
from
April 13, 2023 14:06
356ec9c
to
dffba91
Compare
asauber
changed the title
Helm implementation for
Implement Apr 13, 2023
clustermesh
commandscilium upgrade
using Helm. This also provides an implementation for the clustermesh {enable,disable}
commands.
asauber
changed the title
Implement
Implement Apr 13, 2023
cilium upgrade
using Helm. This also provides an implementation for the clustermesh {enable,disable}
commands.cilium upgrade
using Helm. Provides an implementation for the clustermesh {enable,disable}
commands.
asauber
changed the title
Implement
Implement Apr 13, 2023
cilium upgrade
using Helm. Provides an implementation for the clustermesh {enable,disable}
commands.cilium upgrade
using Helm
asauber
force-pushed
the
pr/asauber/clustermesh
branch
from
April 13, 2023 19:28
34fc1ee
to
5885e00
Compare
asauber
commented
Apr 13, 2023
asauber
commented
Apr 13, 2023
asauber
removed
the
dont-merge/preview-only
Only for preview or testing, don't merge it.
label
Apr 14, 2023
asauber
commented
Apr 14, 2023
Fix dry run |
asauber
force-pushed
the
pr/asauber/clustermesh
branch
from
April 17, 2023 21:56
b038ac7
to
38814f5
Compare
asauber
force-pushed
the
pr/asauber/clustermesh
branch
from
April 18, 2023 14:49
38814f5
to
d3fa870
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm once the conflict is resolved
asauber
force-pushed
the
pr/asauber/clustermesh
branch
from
April 18, 2023 15:05
d3fa870
to
164a58a
Compare
This makes the early-return explicit, and works towards making the preflight checks more understandable. Signed-off-by: Andrew Sauber <[email protected]>
Adds upgrade implementation using a Helm update action directly if the environment variable CILIUM_CLI_MODE=helm is set. Signed-off-by: Andrew Sauber <[email protected]>
Signed-off-by: Andrew Sauber <[email protected]>
The chart version is either that of the current release or initialized during k.getHelmValues Signed-off-by: Andrew Sauber <[email protected]>
* Rename UpgradeCurrentRelease to Upgrade * Move Chart parameter into params struct * Don't query for latest chart when we don't need to Signed-off-by: Andrew Sauber <[email protected]>
Previously, we were defaulting Helm's reuseValues flag to true. This ended up not giving us the expected behavior when only our --version flag was passed to an upgrade command (the most common case for this flag). The result was that prior image versions from the current release would override that version. By defaulting this flag to false, we get the expect behavior in the common case. Signed-off-by: Andrew Sauber <[email protected]>
asauber
force-pushed
the
pr/asauber/clustermesh
branch
from
April 18, 2023 15:51
164a58a
to
54f3d05
Compare
michi-covalent
approved these changes
Apr 18, 2023
removing github-sec and ci-structure from reviewers. this pr got updated, and now it's only modifying files owned by cli and sig-hubble teams. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Implements the
cilium upgrade
command using a thin wrapper around Helm rather than direct Kubernetes API calls.A few of the self-contained features are broken down into separate commits.
Motivation
This implementation allows for more consistent documentation and behavior among Cilium installation methods, such as those docs which use only Helm directly.
This implementation includes an alternate implementation for the
cilium {clustermesh,hubble} {enable,disable}
family of commands. The "legacy" implementation of those commands came from a time when using Helm was insecure (it installed a daemon into the cluster withcluster-admin
privileges. Helm is now relatively safe to use, thus we use Helm here as a library to implement all features for Cilium installation, upgrade, and feature enable/disable whcih are currently implemented in the Cilium Helm chart.Example Usage
For example, we can use this new upgrade command to enable Cluster Mesh on a set of two Cilium clusters with the following procedure.
Create a kind cluster with the following config
Test that the kind cluster came up with
k get pods -A
Install Cilium using the CLI, making sure to set a Cluster ID and Cluster Name
Create a second cluster using kind with the following config
Check that you are authed for Cluster
kind-c2
Run
k get pods -A
and look forkube-apiserver-c2-control-plane
Install Cilium using the CLI, making sure to set a Cluster ID and Cluster Name
Enable clustermesh on Cluster 1 using the new Helm upgrade command
Prep environment for the clustermesh enable.
Extract the CA cert from Cluster 1 and install it into Cluster 2, then restart Cilium on Cluster 2
Enable clustermesh on Cluster 2 using the new Helm upgrade command
Move the secrets expected by the
cilium clustermesh connect
command (this quirk to be fixed with a helm-mode PR for that command)Connect the two clusters using ClusterMesh
Run the Multi-Cluster connectivity tests.
(This has been included as a CI workflow)
closes #1493