Merge pull request #5389 from zalando-incubator/beta-to-stable

beta to stable
zalando-incubator · Sep 23, 2022 · b395cfc · b395cfc
2 parents 3d88ef7 + e2bfe77
commit b395cfc
Show file tree

Hide file tree

Showing 5 changed files with 55 additions and 11 deletions.
diff --git a/cluster/config-defaults.yaml b/cluster/config-defaults.yaml
@@ -277,7 +277,8 @@ skipper_cluster_scaling_schedules: ""
 #   - production: adds "True() && True()" predicates to routes, updates FabricGateway status
 #
 fabric_gateway_controller_mode: "disabled"
-
+fabric_gateway_controller_cpu: "100m"
+fabric_gateway_controller_memory: "1Gi"
 fabric_gateway_crd_v1_enabled: "false"
 
 # kube-api-server settings

diff --git a/cluster/manifests/01-vertical-pod-autoscaler/rbac.yaml b/cluster/manifests/01-vertical-pod-autoscaler/rbac.yaml
@@ -284,7 +284,7 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: system:admission-controller
+  name: system:vpa-admission-controller
   labels:
     application: kubernetes
     component: vpa-admission-controller
@@ -325,19 +325,56 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - "coordination.k8s.io"
+    resources:
+      - leases
+    verbs:
+      - create
+      - update
+      - get
+      - list
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: system:admission-controller
+  name: system:vpa-admission-controller
   labels:
     application: kubernetes
     component: vpa-admission-controller
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: system:admission-controller
+  name: system:vpa-admission-controller
 subjects:
   - kind: ServiceAccount
     name: vpa-admission-controller
     namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:vpa-status-reader
+rules:
+  - apiGroups:
+      - "coordination.k8s.io"
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system:vpa-status-reader-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:vpa-status-reader
+subjects:
+- kind: ServiceAccount
+  name: vpa-updater
+  namespace: kube-system
diff --git a/cluster/manifests/deletions.yaml b/cluster/manifests/deletions.yaml
@@ -39,6 +39,11 @@ pre_apply:
     component: metrics-scraper
   namespace: kube-system
   kind: Deployment
+# cleanup old vpa related roles
+- name: system:admission-controller
+  kind: ClusterRole
+- name: system:admission-controller
+  kind: ClusterRoleBinding
 
 # everything defined under here will be deleted after applying the manifests
 post_apply:

diff --git a/cluster/manifests/fabric-gateway/deployment.yaml b/cluster/manifests/fabric-gateway/deployment.yaml
@@ -1,4 +1,4 @@
-{{ $version := "master-120" }}
+{{ $version := "master-126" }}
 
 apiVersion: apps/v1
 kind: Deployment
@@ -53,7 +53,8 @@ spec:
             - -log-level=info
           resources:
             requests:
-              cpu: 100m
-              memory: 1Gi
+              cpu: {{ .ConfigItems.fabric_gateway_controller_cpu }}
+              memory: {{ .ConfigItems.fabric_gateway_controller_memory }}
             limits:
-              memory: 1Gi
+              cpu: {{ .ConfigItems.fabric_gateway_controller_cpu }}
+              memory: {{ .ConfigItems.fabric_gateway_controller_memory }}
diff --git a/cluster/manifests/ingress-controller/deployment.yaml b/cluster/manifests/ingress-controller/deployment.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: kube-ingress-aws-controller
-    version: v0.13.14
+    version: v0.13.23
 spec:
   replicas: 1
   selector:
@@ -15,7 +15,7 @@ spec:
     metadata:
       labels:
         application: kube-ingress-aws-controller
-        version: v0.13.14
+        version: v0.13.23
       annotations:
         logging/destination: "{{.Cluster.ConfigItems.log_destination_both}}"
         prometheus.io/path: /metrics
@@ -30,7 +30,7 @@ spec:
       serviceAccountName: kube-ingress-aws-controller
       containers:
       - name: controller
-        image: container-registry.zalando.net/teapot/kube-ingress-aws-controller:v0.13.14
+        image: container-registry.zalando.net/teapot/kube-ingress-aws-controller:v0.13.23
         args:
         - --stack-termination-protection
         - --ssl-policy={{ .ConfigItems.kube_aws_ingress_controller_ssl_policy }}