diff --git a/charts/member-agent-arc/templates/crds/networking.yaml b/charts/member-agent-arc/templates/crds/networking.yaml deleted file mode 100644 index bbd9c94b1..000000000 --- a/charts/member-agent-arc/templates/crds/networking.yaml +++ /dev/null @@ -1,630 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: multiclusterservices.networking.fleet.azure.com - labels: - kubernetes.azure.com/managedby: fleet -spec: - group: networking.fleet.azure.com - names: - categories: - - fleet-networking - kind: MultiClusterService - listKind: MultiClusterServiceList - plural: multiclusterservices - shortNames: - - mcs - singular: multiclusterservice - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .spec.serviceImport.name - name: Service-Import - type: string - - jsonPath: .status.loadBalancer.ingress[0].ip - name: External-IP - type: string - - jsonPath: .status.conditions[?(@.type=='Valid')].status - name: Is-Valid - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - description: MultiClusterService is the Schema for creating north-south L4 - load balancer to consume services across clusters. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: MultiClusterServiceSpec defines the desired state of MultiClusterService. - properties: - serviceImport: - description: ServiceImport is the reference to the Service with the - same name exported in the member clusters. - properties: - name: - description: Name is the name of the referent. - maxLength: 63 - pattern: ^([a-z]([-a-z0-9]*[a-z0-9])?)$ - type: string - required: - - name - type: object - type: object - status: - description: MultiClusterServiceStatus represents the current status of - a multi-cluster service. - properties: - conditions: - description: Current service state - items: - description: Condition contains details for one aspect of the current - state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - loadBalancer: - description: |- - LoadBalancerStatus represents the status of a load-balancer. - if one is present. - properties: - ingress: - description: |- - Ingress is a list containing ingress points for the load-balancer. - Traffic intended for the service should be sent to these ingress points. - items: - description: |- - LoadBalancerIngress represents the status of a load-balancer ingress point: - traffic intended for the service should be sent to an ingress point. - properties: - hostname: - description: |- - Hostname is set for load-balancer ingress points that are DNS based - (typically AWS load-balancers) - type: string - ip: - description: |- - IP is set for load-balancer ingress points that are IP based - (typically GCE or OpenStack load-balancers) - type: string - ipMode: - description: |- - IPMode specifies how the load-balancer IP behaves, and may only be specified when the ip field is specified. - Setting this to "VIP" indicates that traffic is delivered to the node with - the destination set to the load-balancer's IP and port. - Setting this to "Proxy" indicates that traffic is delivered to the node or pod with - the destination set to the node's IP and node port or the pod's IP and port. - Service implementations may use this information to adjust traffic routing. - type: string - ports: - description: |- - Ports is a list of records of service ports - If used, every port defined in the service should have an entry in it - items: - properties: - error: - description: |- - Error is to record the problem with the service port - The format of the error shall comply with the following rules: - - built-in error values shall be specified in this file and those shall use - CamelCase names - - cloud provider specific error values must have names that comply with the - format foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - port: - description: Port is the port number of the service - port of which status is recorded here - format: int32 - type: integer - protocol: - default: TCP - description: |- - Protocol is the protocol of the service port of which status is recorded here - The supported values are: "TCP", "UDP", "SCTP" - type: string - required: - - error - - port - - protocol - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - required: - - spec - type: object - x-kubernetes-validations: - - message: metadata.name max length is 63 - rule: size(self.metadata.name) < 64 - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: serviceexports.networking.fleet.azure.com - labels: - kubernetes.azure.com/managedby: fleet -spec: - group: networking.fleet.azure.com - names: - categories: - - fleet-networking - kind: ServiceExport - listKind: ServiceExportList - plural: serviceexports - shortNames: - - svcexport - singular: serviceexport - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=='Valid')].status - name: Is-Valid - type: string - - jsonPath: .status.conditions[?(@.type=='Conflict')].status - name: Is-Conflicted - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - description: |- - ServiceExport declares that the associated service should be exported to other clusters. - The annotation "networking.fleet.azure.com/weight" specifies the proportion of requests forwarded to the cluster - within a serviceImport. - The actual value is the ceiling value of a number computed as weight/(sum of all weights in the serviceImport). - If weight is set to 0, no traffic should be forwarded for this entry. - If unspecified, weight defaults to 1. - The value should be in the range [0, 1000]. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - status: - description: ServiceExportStatus contains the current status of an export. - properties: - conditions: - items: - description: Condition contains details for one aspect of the current - state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - type: object - x-kubernetes-validations: - - message: metadata.name max length is 63 - rule: size(self.metadata.name) < 64 - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=='Valid')].status - name: Is-Valid - type: string - - jsonPath: .status.conditions[?(@.type=='Conflict')].status - name: Is-Conflicted - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - description: |- - ServiceExport declares that the associated service should be exported to other clusters. - The annotation "networking.fleet.azure.com/weight" specifies the proportion of requests forwarded to the cluster - within a serviceImport. - The actual value is the ceiling value of a number computed as weight/(sum of all weights in the serviceImport). - If weight is set to 0, no traffic should be forwarded for this entry. - If unspecified, weight defaults to 1. - The value should be in the range [0, 1000]. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - status: - description: ServiceExportStatus contains the current status of an export. - properties: - conditions: - items: - description: Condition contains details for one aspect of the current - state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - type: object - x-kubernetes-validations: - - message: metadata.name max length is 63 - rule: size(self.metadata.name) < 64 - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.16.0 - name: serviceimports.networking.fleet.azure.com - labels: - kubernetes.azure.com/managedby: fleet -spec: - group: networking.fleet.azure.com - names: - categories: - - fleet-networking - kind: ServiceImport - listKind: ServiceImportList - plural: serviceimports - shortNames: - - svcimport - singular: serviceimport - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: ServiceImport describes a service imported from clusters in a - ClusterSet. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - status: - description: |- - status contains information about the exported services that form - the multi-cluster service referenced by this ServiceImport. - properties: - clusters: - description: clusters is the list of exporting clusters from which - this service was derived. - items: - description: ClusterStatus contains service configuration mapped - to a specific source cluster. - properties: - cluster: - description: cluster is the name of the exporting cluster. Must - be a valid RFC-1123 DNS label. - type: string - required: - - cluster - type: object - type: array - x-kubernetes-list-map-keys: - - cluster - x-kubernetes-list-type: map - ips: - description: ip will be used as the VIP for this service when type - is ClusterSetIP. - items: - type: string - maxItems: 1 - type: array - ports: - items: - description: ServicePort represents the port on which the service - is exposed. - properties: - appProtocol: - description: |- - The application protocol for this port. - This field follows standard Kubernetes label syntax. - Un-prefixed names are reserved for IANA standard service names (as per - RFC-6335 and http://www.iana.org/assignments/service-names). - Non-standard protocols should use prefixed names such as - mycompany.com/my-custom-protocol. - Field can be enabled with ServiceAppProtocol feature gate. - type: string - name: - description: |- - The name of this port within the service. This must be a DNS_LABEL. - All ports within a ServiceSpec must have unique names. When considering the endpoints for a Service, - this must match the 'name' field in the EndpointPort. - Optional if only one ServicePort is defined on this service. - type: string - port: - description: The port that will be exposed by this service. - format: int32 - maximum: 65535 - minimum: 1 - type: integer - protocol: - default: TCP - description: |- - The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". - Default is TCP. - enum: - - TCP - - UDP - - SCTP - type: string - targetPort: - anyOf: - - type: integer - - type: string - description: The port to access on the pods targeted by the - service. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: array - x-kubernetes-list-type: atomic - sessionAffinity: - description: |- - Supports "ClientIP" and "None". Used to maintain session affinity. - Enable client IP based session affinity. - Must be ClientIP or None. - Defaults to None. - Ignored when type is Headless - More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - type: string - sessionAffinityConfig: - description: sessionAffinityConfig contains session affinity configuration. - properties: - clientIP: - description: clientIP contains the configurations of Client IP - based session affinity. - properties: - timeoutSeconds: - description: |- - timeoutSeconds specifies the seconds of ClientIP type session sticky time. - The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". - Default value is 10800(for 3 hours). - format: int32 - type: integer - type: object - type: object - type: - description: |- - type defines the type of this service. - Must be ClusterSetIP or Headless. - enum: - - ClusterSetIP - - Headless - type: string - type: object - type: object - x-kubernetes-validations: - - message: metadata.name max length is 63 - rule: size(self.metadata.name) < 64 - served: true - storage: true - subresources: - status: {} diff --git a/charts/member-agent-arc/templates/deployment.yaml b/charts/member-agent-arc/templates/deployment.yaml index dc977cc66..ff9c9dfc3 100644 --- a/charts/member-agent-arc/templates/deployment.yaml +++ b/charts/member-agent-arc/templates/deployment.yaml @@ -33,7 +33,7 @@ spec: imagePullPolicy: IfNotPresent env: - name: TOKEN_NAMESPACE - value: "fleet-system" + value: "fleet-system" {{- .Values.Azure.Identity.MSIAdapterYaml | nindent 10 }} - name: refresh-token image: "{{ .Values.refreshtoken.repository }}:{{ .Values.refreshtoken.tag }}" @@ -42,6 +42,7 @@ spec: - azure - --clientid=any-client-id - --scope={{ .Values.config.scope }} + - --v={{ .Values.logVerbosity }} resources: limits: cpu: 50m @@ -75,8 +76,10 @@ spec: value: /config/token - name: MEMBER_CLUSTER_NAME value: {{ .Values.config.memberClusterName | quote }} + {{- if .Values.config.hubCA }} - name: HUB_CERTIFICATE_AUTHORITY value: {{ .Values.config.hubCA | quote }} + {{- end }} {{- if .Values.Azure.proxySettings.isProxyEnabled }} - name: HTTPS_PROXY value: {{ .Values.Azure.proxySettings.httpProxy | quote }} @@ -159,7 +162,7 @@ spec: imagePullPolicy: IfNotPresent env: - name: TOKEN_NAMESPACE - value: "fleet-system" + value: "fleet-system" {{- .Values.Azure.Identity.MSIAdapterYaml | nindent 10 }} - name: refresh-token image: "{{ .Values.refreshtoken.repository }}:{{ .Values.refreshtoken.tag }}" @@ -168,6 +171,7 @@ spec: - azure - --clientid=any-client-id - --scope={{ .Values.config.scope }} + - --v={{ .Values.logVerbosity }} resources: limits: cpu: 50m @@ -190,6 +194,7 @@ spec: - --add_dir_header - --enable-v1alpha1-apis={{ .Values.enableV1Alpha1APIs }} - --enable-v1beta1-apis={{ .Values.enableV1Beta1APIs }} + - --enable-networking-features={{ .Values.enableNetworkingFeatures }} securityContext: capabilities: drop: @@ -229,8 +234,10 @@ spec: value: /config/token - name: MEMBER_CLUSTER_NAME value: {{ .Values.config.memberClusterName | quote }} + {{- if .Values.config.hubCA }} - name: HUB_CERTIFICATE_AUTHORITY value: {{ .Values.config.hubCA | quote }} + {{- end }} {{- if .Values.Azure.proxySettings.isProxyEnabled }} - name: HTTPS_PROXY value: {{ .Values.Azure.proxySettings.httpProxy | quote }} @@ -281,7 +288,7 @@ spec: imagePullPolicy: IfNotPresent env: - name: TOKEN_NAMESPACE - value: "fleet-system" + value: "fleet-system" {{- .Values.Azure.Identity.MSIAdapterYaml | nindent 10 }} - name: refresh-token image: "{{ .Values.refreshtoken.repository }}:{{ .Values.refreshtoken.tag }}" @@ -290,6 +297,7 @@ spec: - azure - --clientid=any-client-id - --scope={{ .Values.config.scope }} + - --v={{ .Values.logVerbosity }} resources: limits: cpu: 50m @@ -313,6 +321,7 @@ spec: - --enable-v1alpha1-apis={{ .Values.enableV1Alpha1APIs }} - --enable-v1beta1-apis={{ .Values.enableV1Beta1APIs }} - --enable-traffic-manager-feature={{ .Values.enableTrafficManagerFeature }} + - --enable-networking-features={{ .Values.enableNetworkingFeatures }} ports: - containerPort: 8080 name: hubmetrics @@ -348,8 +357,10 @@ spec: value: /config/token - name: MEMBER_CLUSTER_NAME value: {{ .Values.config.memberClusterName | quote }} + {{- if .Values.config.hubCA }} - name: HUB_CERTIFICATE_AUTHORITY value: {{ .Values.config.hubCA | quote }} + {{- end }} {{- if .Values.Azure.proxySettings.isProxyEnabled }} - name: HTTPS_PROXY value: {{ .Values.Azure.proxySettings.httpProxy | quote }} diff --git a/charts/member-agent-arc/templates/rbac.yaml b/charts/member-agent-arc/templates/rbac.yaml index 0f78df527..12943d26d 100644 --- a/charts/member-agent-arc/templates/rbac.yaml +++ b/charts/member-agent-arc/templates/rbac.yaml @@ -14,7 +14,7 @@ subjects: apiVersion: clusterconfig.azure.com/v1beta1 kind: AzureExtensionIdentity metadata: - name: {{ .Values.Azure.Extension.Name }} + name: {{ .Values.Azure.Extension.Name }}-override namespace: azure-arc # this must be azure-arc, do not change spec: serviceAccounts: # this would the service accounts that are mounted in the extension pods which require azure identity diff --git a/charts/member-agent-arc/values.yaml b/charts/member-agent-arc/values.yaml index a4133302f..5a4ca899b 100644 --- a/charts/member-agent-arc/values.yaml +++ b/charts/member-agent-arc/values.yaml @@ -33,6 +33,7 @@ config: enableV1Alpha1APIs: false enableV1Beta1APIs: true enableTrafficManagerFeature: false +enableNetworkingFeatures: false Azure: proxySettings: