Merge pull request #3605 from emissary-ingress/rel/v1.13.10

[v1.13.10] Release Branch

.circleci/config.yml

@@ -919,10 +919,12 @@ jobs:
     - job-yaml-publish-s3:
         update-stable: false
 _anchors:
-  filter-rc-only:
+  filter-rc-hf-only:
     filters:
       tags:
-        only: /^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
+        only:
+        - /^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
+        - /^v[0-9]+\.[0-9]+\.[0-9]+-hf\.[0-9]+\+[0-9]+$/
       branches:
         ignore: /.*/
   filter-ga-only:
@@ -953,13 +955,15 @@ workflows:
             only: /^v[0-9]+\.[0-9]+\.[0-9]+$/
           branches:
             ignore: /.*/
-  'OSS: Release Candidate':
+  'OSS: Release Candidate or Hotfix':
     jobs:
     - oss-promote-dev-to-rc:
         name: "oss-release-promote-dev-to-rc"
         filters:
           tags:
-            only: /^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
+            only:
+            - /^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
+            - /^v[0-9]+\.[0-9]+\.[0-9]+-hf\.[0-9]+\+[0-9]+$/
           branches:
             ignore: /.*/
   'OSS: Dev':
@@ -1107,6 +1111,7 @@ workflows:
         - oss-dev-gotest-fastreconfigure
         - oss-dev-gotest
         - oss-dev-generate
+        - oss-dev-images
         name: "oss-dev-promote-to-passed"
         filters:
           branches:

.circleci/config.yml.d/amb_oss.yml

@@ -152,10 +152,12 @@ _anchors:
   # All of these filters assume that "Only build pull requests" is turned on at
   # https://app.circleci.com/settings/project/github/emissary-ingress/emissary/advanced
 
-  "filter-rc-only": &filter-rc-only
+  "filter-rc-hf-only": &filter-rc-hf-only
     filters:
       tags:
-        only: /^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
+        only:
+          - /^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
+          - /^v[0-9]+\.[0-9]+\.[0-9]+-hf\.[0-9]+\+[0-9]+$/
       branches:
         ignore: /.*/
 
@@ -188,10 +190,10 @@ workflows:
           name: "oss-release-promote-to-ga"
 
 
-  "OSS: Release Candidate":
+  "OSS: Release Candidate or Hotfix":
     jobs:
       - "oss-promote-dev-to-rc":
-          <<: *filter-rc-only
+          <<: *filter-rc-hf-only
           name: "oss-release-promote-dev-to-rc"
 
 
@@ -334,6 +336,7 @@ workflows:
             - oss-dev-gotest-fastreconfigure
             - oss-dev-gotest
             - oss-dev-generate
+            - oss-dev-images
           name: "oss-dev-promote-to-passed"
           <<: *filter-master-release-branches-only
 

CHANGELOG.md

@@ -63,6 +63,32 @@ Please see the [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest
 
 ## RELEASE NOTES
 
+## [1.13.10] (TBD)
+[1.13.10]: https://github.com/emissary-ingress/emissary/compare/v1.13.9...v1.13.10
+
+### Emissary Ingress and Ambassador Edge Stack
+
+- Bugfix: Fixed a regression when specifying a comma separated string for `cors.origins` on the
+  `Mapping` resource. ([#3609])
+- Change: Envoy-configuration snapshots get saved (as `ambex-#.json`) in `/ambassador/snapshots`.
+  The number of snapshots is controlled by the `AMBASSADOR_AMBEX_SNAPSHOT_COUNT` environment
+  variable; set it to 0 to disable. The default is 30.
+- Change: Set `AMBASSADOR_AMBEX_NO_RATELIMIT` to `true` to completely disable ratelimiting Envoy
+  reconfiguration under memory pressure. This can help performance with the endpoint or Consul
+  resolvers, but could make OOMkills more likely with large configurations. The default is `false`,
+  meaning that the rate limiter is active.
+
+### Ambassador Edge Stack only
+
+- Bugfix: The `Mapping` resource can now specify `docs.timeout_ms` to set the timeout when the 
+  Dev Portal is fetching API specifications.
+- Bugfix: The Dev Portal will now strip HTML tags when displaying search results, showing just
+  the actual content of the search result.
+- Change: Consul certificate-rotation logging now includes the fingerprints and validity
+  timestamps of certificates being rotated.
+
+[#3609]: https://github.com/emissary-ingress/emissary/issues/3609
+
 ## [1.13.9] June 30, 2021
 [1.13.9]: https://github.com/emissary-ingress/emissary/compare/v1.13.8...v1.13.9
 

Makefile

@@ -49,3 +49,32 @@ SHELL = bash
 	ln -s $(OSS_HOME)/tools/hooks/prepare-commit-msg $(OSS_HOME)/.git/hooks/prepare-commit-msg
 
 githooks: .git/hooks/prepare-commit-msg
+
+preflight-dev-kubeconfig:
+	@if [ -z "$(DEV_KUBECONFIG)" ] ; then \
+		echo "DEV_KUBECONFIG must be set"; \
+		exit 1; \
+	fi
+.PHONY: preflight-dev-kubeconfig
+
+deploy: push preflight-cluster
+	$(MAKE) deploy-only
+.PHONY: deploy
+
+deploy-only: preflight-dev-kubeconfig
+	mkdir -p $(OSS_HOME)/build/helm/ && \
+	(kubectl --kubeconfig $(DEV_KUBECONFIG) create ns ambassador || true) && \
+	helm template ambassador --include-crds --output-dir $(OSS_HOME)/build/helm -n ambassador charts/ambassador/ \
+		--set createNamespace=true \
+		--set service.selector.service=ambassador \
+		--set replicaCount=1 \
+		--set enableAES=false \
+		--set image.fullImageOverride=$$(sed -n 2p docker/ambassador.docker.push.remote) && \
+	kubectl --kubeconfig $(DEV_KUBECONFIG) apply -f $(OSS_HOME)/build/helm/ambassador/crds/ && \
+	kubectl --kubeconfig $(DEV_KUBECONFIG) apply -f $(OSS_HOME)/build/helm/ambassador/templates && \
+	rm -rf $(OSS_HOME)/build/helm
+	kubectl --kubeconfig $(DEV_KUBECONFIG) -n ambassador wait --for condition=available --timeout=90s deploy --all
+	@printf "$(GRN)Your ambassador service IP:$(END) $(BLD)$$(kubectl --kubeconfig $(DEV_KUBECONFIG) get -n ambassador service ambassador -o 'go-template={{range .status.loadBalancer.ingress}}{{print .ip "\n"}}{{end}}')$(END)\n"
+	@printf "$(GRN)Your ambassador image:$(END) $(BLD)$$(kubectl --kubeconfig $(DEV_KUBECONFIG) get -n ambassador deploy ambassador -o 'go-template={{(index .spec.template.spec.containers 0).image}}')$(END)\n"
+	@printf "$(GRN)Your built image:$(END) $(BLD)$$(sed -n 2p docker/ambassador.docker.push.remote)$(END)\n"
+.PHONY: deploy-only

builder/builder.mk

@@ -595,7 +595,7 @@ setup-venv:
 			pip install orjson==3.3.1; \
 			rm -f venv/lib/python3.8/site-packages/_manylinux.py; \
 		else \
-			pip install orjson==3.3.1; \
+			pip install orjson; \
 		fi; \
 		pip install -r $(OSS_HOME)/builder/requirements.txt; \
 		pip install -e $(OSS_HOME)/python; \
@@ -774,7 +774,8 @@ release/promote-oss/to-ea-latest:
 
 release/promote-oss/dev-to-rc:
 	@test -n "$(RELEASE_REGISTRY)" || (printf "$${RELEASE_REGISTRY_ERR}\n"; exit 1)
-	@[[ "$(RELEASE_VERSION)" =~ ^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$$ ]] || (printf '$(RED)ERROR: RELEASE_VERSION=%s does not look like an RC tag\n' "$(RELEASE_VERSION)"; exit 1)
+	@[[ ( "$(RELEASE_VERSION)" =~ ^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$$ ) || \
+	    ( "$(RELEASE_VERSION)" =~ ^[0-9]+\.[0-9]+\.[0-9]+-hf\.[0-9]+\+[0-9]+$$ ) ]] || (printf '$(RED)ERROR: RELEASE_VERSION=%s does not look like an RC tag\n' "$(RELEASE_VERSION)"; exit 1)
 	@set -e; { \
 		if [ -n "$(IS_DIRTY)" ]; then \
 			echo "release/promote-oss/dev-to-rc: tree must be clean" >&2 ;\
@@ -788,10 +789,11 @@ release/promote-oss/dev-to-rc:
 		fi ;\
 		printf "$(CYN)==> $(GRN)found version $(BLU)$$dev_version$(GRN) for $(BLU)$$commit$(GRN) in S3...$(END)\n" ;\
 		veroverride=$(RELEASE_VERSION) ; \
+		tag=$$(echo $(RELEASE_VERSION) | tr '+' '-') ; \
 		$(MAKE) release/promote-oss/.main \
 			PROMOTE_FROM_VERSION="$$dev_version" \
 			PROMOTE_FROM_REPO=$(DEV_REGISTRY) \
-			PROMOTE_TO_VERSION=$(RELEASE_VERSION) \
+			PROMOTE_TO_VERSION="$$tag" \
 			PROMOTE_CHANNEL=test ; \
 		chartsuffix=$(RELEASE_VERSION) ; \
 		chartsuffix=$${chartsuffix#*-} ; \

builder/builder.sh

@@ -315,8 +315,8 @@ module_version() {
         dirty=""
     fi
     # The _previous_ tag, plus a git delta, like 'v1.13.3-117-g2434c437f'... or, if we're _on_
-    # a tag, just something like 'v1.13.3'.
-    GIT_DESCRIPTION=$(git describe --tags --match 'v*')
+    # a tag, just something like 'v1.13.3'. Don't let hotfix tags appear here.
+    GIT_DESCRIPTION=$(git describe --tags --match 'v*' --exclude '*-hf.*')
     echo GIT_DESCRIPTION="\"$GIT_DESCRIPTION\""
 
     # Do we have a '-' in our GIT_DESCRIPTION?

charts/ambassador/crds/getambassador.io_devportals.yaml

@@ -63,6 +63,9 @@ spec:
                   service:
                     description: Service is the service being documented
                     type: string
+                  timeout_ms:
+                    description: Timeout specifies the amount of time devportal will wait for the downstream service to report an openapi spec back
+                    type: integer
                   url:
                     description: URL is the URL used for obtaining docs
                     type: string

charts/ambassador/crds/getambassador.io_mappings.yaml

@@ -148,9 +148,7 @@ spec:
                   - type: string
                   - type: array
                 origins:
-                  description: StringOrStringList is just what it says on the tin, but note that it will always marshal as a list of strings right now.
-                  items:
-                    type: string
+                  description: StringLiteralOrStringList is mostly like StringOrStringList, but instead of always forcing a list of strings, it will marshal a string literal as a string.
                   oneOf:
                   - type: string
                   - type: array
@@ -164,6 +162,8 @@ spec:
                   type: boolean
                 path:
                   type: string
+                timeout_ms:
+                  type: integer
                 url:
                   type: string
               type: object