Merge pull request #9819 from zalando-incubator/beta-to-stable

beta to stable

Author: demonCoder95

cluster/cluster.yaml

@@ -156,12 +156,17 @@ Resources:
       GroupDescription: EKS worker to EFS sg
       VpcId: "{{.Cluster.ConfigItems.vpc_id}}"
     Type: 'AWS::EC2::SecurityGroup'
+{{- if eq .Cluster.ConfigItems.eks_control_plane_logging "true" }}
+  ControlPlaneLogGroup:
+    Type: AWS::Logs::LogGroup
+    Properties:
+      LogGroupName: "/aws/eks/{{.Cluster.Name}}/cluster"
+      RetentionInDays: 545
+{{- end }}
   EKSCluster:
     Type: AWS::EKS::Cluster
 {{- if eq .Cluster.ConfigItems.eks_control_plane_logging "true" }}
-{{- if eq .Cluster.ConfigItems.eks_control_plane_logging_migration "true" }}
     DependsOn: ControlPlaneLogGroup
-{{- end }}
 {{- end }}
     Properties:
       Name: "{{.Cluster.Name}}"
@@ -2306,8 +2311,8 @@ Resources:
             Version: 2012-10-17
           PolicyName: root
       RoleName: "{{.Cluster.LocalID}}-etcd-backup"
-{{- end }}
     Type: 'AWS::IAM::Role'
+{{- end }}
   StaticEgressControllerIAMRole:
     Properties:
       AssumeRolePolicyDocument: !Sub
@@ -3003,16 +3008,6 @@ Resources:
                 - BucketArn: !GetAtt AuditTrailBucket.Arn
 {{- end }}
 
-{{- if eq .Cluster.ConfigItems.eks_control_plane_logging "true" }}
-{{- if eq .Cluster.ConfigItems.eks_control_plane_logging_migration "true" }}
-  ControlPlaneLogGroup:
-    Type: AWS::Logs::LogGroup
-    Properties:
-      LogGroupName: "/aws/eks/{{.Cluster.LocalID}}/cluster"
-      RetentionInDays: 545
-{{- end }}
-{{- end }}
-
 {{- if index .Cluster.ConfigItems "session_manager_destination_arn" }}
   SessionManagerLogGroup:
     Type: AWS::Logs::LogGroup

cluster/config-defaults.yaml

@@ -262,7 +262,7 @@ skipper_pod_deletion_cost_controller_resync_interval: "1h"
 # right now only installed on skipper-ingress nodes
 polarsignals_enabled: "false"
 polarsignals_apikey: ""
-polarsignals_memory: 200Mi
+polarsignals_memory: 400Mi
 polarsignals_cpu: 50m
 
 # Kube-Metrics-Adapter
@@ -554,6 +554,8 @@ downscaler_default_uptime: "always"
 downscaler_default_downtime: "never"
 downscaler_enabled: "false"
 {{end}}
+# optionally enable downscaling of statefulsets
+downscaler_scale_statefulsets: "false"
 
 # HPA settings (defaults from https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/)
 horizontal_pod_autoscaler_sync_period: "30s"
@@ -1287,7 +1289,6 @@ wiz_node_feature_rollout : "false"
 
 # EKS specific configuration
 eks_control_plane_logging: "true"
-eks_control_plane_logging_migration: "false"
 eks_ip_family: "ipv4"
 eks_zalando_iam_aws_proxy_cpu: "100m"
 eks_zalando_iam_aws_proxy_memory: "512Mi"

cluster/manifests/01-coredns-local/daemonset-coredns.yaml

@@ -122,7 +122,7 @@ spec:
         {{- if eq .Cluster.Provider "zalando-eks" }}
         image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/coredns:1.12.1-master-26
         {{- else }}
-        image: container-registry.zalando.net/teapot/coredns:1.12.1-master-26
+        image: container-registry.zalando.net/teapot/coredns:1.12.3-master-27
         {{- end }}
         args: [ "-conf", "/etc/coredns/Corefile" ]
         env:

cluster/manifests/kube-downscaler/deployment.yaml

@@ -34,10 +34,10 @@ spec:
           - --interval=30
           - --exclude-namespaces=kube-system,visibility,tracing,wiz
           # do not downscale ourselves, also keep Postgres Operator so excluded DBs can be managed
-          - --exclude-deployments=kube-downscaler,postgres-operator
+          - --exclude-deployments=kube-downscaler{{if ne .Cluster.ConfigItems.downscaler_scale_statefulsets "true"}},postgres-operator{{end}}
           - "--default-uptime={{ .Cluster.ConfigItems.downscaler_default_uptime }}"
           - "--default-downtime={{ .Cluster.ConfigItems.downscaler_default_downtime }}"
-          - --include-resources=deployments,stacks
+          - --include-resources=deployments,stacks{{if eq .Cluster.ConfigItems.downscaler_scale_statefulsets "true"}},statefulsets{{end}}
           - --deployment-time-annotation=deployment-time
         resources:
           limits:

cluster/manifests/polarsignals/daemonset.yaml

@@ -17,13 +17,16 @@ spec:
       application: polarsignals
   template:
     metadata:
+      annotations:
+        prometheus.io/path: /metrics
+        prometheus.io/port: "7071"
+        prometheus.io/scrape: "true"
       labels:
         component: agent
         application: polarsignals
     spec:
       containers:
         - args:
-            - /bin/parca-agent
             - --log-level=info
             - --node=$(NODE_NAME)
             - --http-address=:7071
@@ -37,15 +40,11 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: container-registry.zalando.net/gwproxy/parca-agent:v0.41.0
+          image: container-registry.zalando.net/gwproxy/parca-agent:v0.41.0-main-1
           name: polarsignals-agent
           ports:
             - containerPort: 7071
               name: http
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: http
           resources:
             limits:
               cpu: "{{ .Cluster.ConfigItems.polarsignals_cpu}}"
@@ -85,8 +84,6 @@ spec:
         - effect: NoSchedule
           key: dedicated
           value: skipper-ingress
-        - effect: NoExecute
-          operator: Exists
       volumes:
         - emptyDir: {}
           name: tmp
@@ -114,4 +111,4 @@ spec:
         - secret:
             secretName: polarsignals-agent
           name: token
-{{ end }}
+{{ end }}

cluster/manifests/skipper/deployment.yaml

@@ -1,7 +1,7 @@
 {{/* image-updater-bot detects *image variables so use print to disable it for main image */}}
 
 {{ $main_image := print "container-registry.zalando.net/teapot/skipper-internal:" "v0.22.76-1183" }}
-{{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.22.88-1195" }}
+{{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.22.102-1209" }}
 
 {{/* Optional canary arguments separated by "[cf724afc]" to allow whitespaces, e.g. "-foo=has a whitespace[cf724afc]-baz=qux" */}}
 {{ $canary_args := "" }}

cluster/manifests/skipper/skipper-redis.yaml

@@ -1,9 +1,11 @@
+# {{ $image := "container-registry.zalando.net/library/redis-7-alpine:7.2-alpine-20250805" }}
+# {{ $version := index (split $image ":") 1 }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   labels:
     application: skipper-ingress-redis
-    version: v7.2.4
+    version: "{{ $version }}"
   annotations:
     zalando.org/update-using-hpa-replicas: skipper-ingress-redis
   name: skipper-ingress-redis
@@ -19,7 +21,7 @@ spec:
       labels:
         statefulset: skipper-ingress-redis
         application: skipper-ingress-redis
-        version: v7.2.4
+        version: "{{ $version }}"
       annotations:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
         logging/destination: "{{ .Cluster.ConfigItems.log_destination_both }}"
@@ -49,7 +51,7 @@ spec:
       priorityClassName: "{{ .Cluster.ConfigItems.system_priority_class }}"
       terminationGracePeriodSeconds: 45
       containers:
-      - image: container-registry.zalando.net/library/redis-7-alpine:7.2-alpine-20250805
+      - image: "{{ $image }}"
         name: skipper-ingress-redis
         args:
         - /usr/local/bin/docker-entrypoint.sh

test/e2e/cluster_config.sh

@@ -56,6 +56,7 @@ clusters:
     consolidate_after: "5m"
     wiz_api_client_id: "${WIZ_API_CLIENT_ID}"
     wiz_api_client_token: "${WIZ_API_CLIENT_TOKEN}"
+    eks_control_plane_logging: "false"
   criticality_level: 1
   environment: e2e
   id: ${CLUSTER_ID}