Merge pull request #9835 from zalando-incubator/dev-to-stable

dev to stable

Author: mikkeloscar

cluster/config-defaults.yaml

@@ -406,6 +406,7 @@ fabric_gateway_controller_snapshots_history_limit: "1"
 fabric_gateway_controller_enable_versioning: "true"
 fabric_gateway_controller_ssl_policy: ""
 fabric_gateway_controller_log_level: "INFO"
+fabric_gateway_custom_validation_enabled: "true"
 
 # kube-api-server settings
 

cluster/manifests/02-admission-control/deployment.yaml

@@ -33,7 +33,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
       - name: admission-controller
-        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-268
+        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-269
         lifecycle:
           preStop:
             exec:

cluster/manifests/02-skipper-validation-webhook/deployment.yaml

@@ -32,7 +32,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
       - name: skipper-admission-webhook
-        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.22.73
+        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.22.102
         args:
           - webhook
           - --address=:9085

cluster/manifests/deletions.yaml

@@ -30,6 +30,14 @@ post_apply:
   namespace: cron
   kind: LimitRange
 {{ end }}
+{{ if ne .Cluster.ConfigItems.fabric_gateway_custom_validation_enabled "true" }}
+- name: "fabricgateway-policy.zalando.org"
+  namespace: default
+  kind: ValidatingAdmissionPolicy
+- name: "fabricgateway-policy.zalando.org"
+  namespace: default
+  kind: ValidatingAdmissionPolicyBinding
+{{ end }}
 {{ if ne .Cluster.ConfigItems.polarsignals_enabled "true" }}
 - name: polarsignals
   namespace: polarsignals

cluster/manifests/deployment-service/controller-statefulset.yaml

@@ -29,7 +29,7 @@ spec:
       terminationGracePeriodSeconds: 300
       containers:
         - name: "deployment-service-controller"
-          image: "container-registry.zalando.net/teapot/deployment-controller:master-271"
+          image: "container-registry.zalando.net/teapot/deployment-controller:master-272"
           args:
             - "--config-namespace=kube-system"
             - "--decrypt-kms-alias-arn=arn:aws:kms:{{ .Cluster.Region }}:{{ .Cluster.InfrastructureAccountID }}:alias/deployment-secret"

cluster/manifests/deployment-service/status-service-deployment.yaml

@@ -1,4 +1,4 @@
-# {{ $image   := "container-registry.zalando.net/teapot/deployment-status-service:master-271" }}
+# {{ $image   := "container-registry.zalando.net/teapot/deployment-status-service:master-272" }}
 # {{ $version := index (split $image ":") 1 }}
 
 apiVersion: apps/v1

cluster/manifests/fabric-gateway/02-validation.yaml

@@ -0,0 +1,26 @@
+# {{ if eq .Cluster.ConfigItems.fabric_gateway_custom_validation_enabled "true" }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "fabricgateway-policy.zalando.org"
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:   ["zalando.org"]
+      apiVersions: ["v1"]
+      operations:  ["CREATE"]
+      resources:   ["fabricgateways"]
+  validations:
+    - expression: 'object.spec.exists(key, key == "x-fabric-service") || (object.spec.exists(key, key == "x-external-service-provider") && object.spec["x-external-service-provider"].exists(key, key == "stackVersion"))'
+      message: "x-external-service-provider.stackVersion must be set if you are using FabricGateway with StackSet to enable FabricGateway versioning."
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "fabricgateway-policy.zalando.org"
+spec:
+  policyName: "fabricgateway-policy.zalando.org"
+  validationActions: [Deny]
+# {{ end }}
+

cluster/manifests/fabric-gateway/deployment.yaml

@@ -1,4 +1,4 @@
-# {{ $image := "container-registry.zalando.net/gwproxy/fabric-gateway:master-335" }}
+# {{ $image := "container-registry.zalando.net/gwproxy/fabric-gateway:master-350" }}
 # {{ $version := index (split $image ":") 1 }}
 apiVersion: apps/v1
 kind: Deployment

cluster/manifests/ingress-controller/deployment.yaml

@@ -1,4 +1,4 @@
-# {{ $image := "926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/kube-ingress-aws-controller:v0.18.8" }}
+# {{ $image := "926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/kube-ingress-aws-controller:v0.18.9" }}
 # {{ $version := index (split $image ":") 1 }}
 
 apiVersion: apps/v1

cluster/manifests/skipper/deployment.yaml

@@ -1,7 +1,7 @@
 {{/* image-updater-bot detects *image variables so use print to disable it for main image */}}
 
-{{ $main_image := print "container-registry.zalando.net/teapot/skipper-internal:" "v0.22.76-1183" }}
-{{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.22.102-1209" }}
+{{ $main_image := print "container-registry.zalando.net/teapot/skipper-internal:v0.22.103-1210" }}
+{{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.22.103-1210" }}
 
 {{/* Optional canary arguments separated by "[cf724afc]" to allow whitespaces, e.g. "-foo=has a whitespace[cf724afc]-baz=qux" */}}
 {{ $canary_args := "" }}