From bb0f77c983e962d2286d13f28d15536202438de2 Mon Sep 17 00:00:00 2001 From: Emterry Date: Thu, 30 Jul 2026 11:41:35 +0100 Subject: [PATCH] add guardduty addon to eks upgrade template --- cmd/create-upgrade-issues/main.go | 28 ++++---- .../cloud-platform-k8s-upgrade-template.md | 64 +++++++++++++++---- cmd/create-upgrade-issues/utils/github.go | 6 +- 3 files changed, 70 insertions(+), 28 deletions(-) diff --git a/cmd/create-upgrade-issues/main.go b/cmd/create-upgrade-issues/main.go index 71c2cac1..b1cf6949 100644 --- a/cmd/create-upgrade-issues/main.go +++ b/cmd/create-upgrade-issues/main.go @@ -61,19 +61,21 @@ func main() { {Title: "Update vpc-cni to latest supported release for current EKS version", Int: 2}, {Title: "Update kube-proxy to latest supported release for current EKS version", Int: 3}, {Title: "Update core-dns to latest supported release for current EKS version", Int: 4}, - {Title: "Test EKS " + *upgradeVersion + " on test cluster", Int: 5}, - {Title: "Test EKS " + *upgradeVersion + " on live-like cluster", Int: 6}, - {Title: "EKS: Upgrade Production clusters to Kubernetes " + *upgradeVersion, Int: 7}, - {Title: "Update vpc-cni to latest supported release for upgraded EKS version", Int: 8}, - {Title: "Update kube-proxy to latest supported release for upgraded EKS version", Int: 9}, - {Title: "Update core-dns to latest supported release for upgraded EKS version", Int: 10}, - {Title: "Review cluster components for upgrading", Int: 11}, - {Title: "Review and upgrade kube-state-metrics for the upgraded EKS version " + *upgradeVersion, Int: 12}, - {Title: "Upgrade cluster autoscaler for EKS version " + *upgradeVersion, Int: 13}, - {Title: "Upgrade cluster descheduler for EKS version " + *upgradeVersion, Int: 14}, - {Title: "Post EKS version " + *upgradeVersion + " Cleanup", Int: 15}, - {Title: "Add deprecated apis from " + *upgradeVersion + " to Gatekeeper", Int: 16}, - {Title: "Update Upgrade runbook and Cluster Upgrade Issue Template", Int: 17}, + {Title: "Update guardduty to latest supported release for current EKS version", Int: 5}, + {Title: "Test EKS " + *upgradeVersion + " on test cluster", Int: 6}, + {Title: "Test EKS " + *upgradeVersion + " on live-like cluster", Int: 7}, + {Title: "EKS: Upgrade Production clusters to Kubernetes " + *upgradeVersion, Int: 8}, + {Title: "Update vpc-cni to latest supported release for upgraded EKS version", Int: 9}, + {Title: "Update kube-proxy to latest supported release for upgraded EKS version", Int: 10}, + {Title: "Update core-dns to latest supported release for upgraded EKS version", Int: 11}, + {Title: "Update guardduty to latest supported release for upgraded EKS version", Int: 12}, + {Title: "Review cluster components for upgrading", Int: 13}, + {Title: "Review and upgrade kube-state-metrics for the upgraded EKS version " + *upgradeVersion, Int: 14}, + {Title: "Upgrade cluster autoscaler for EKS version " + *upgradeVersion, Int: 15}, + {Title: "Upgrade cluster descheduler for EKS version " + *upgradeVersion, Int: 16}, + {Title: "Post EKS version " + *upgradeVersion + " Cleanup", Int: 17}, + {Title: "Add deprecated apis from " + *upgradeVersion + " to Gatekeeper", Int: 18}, + {Title: "Update Upgrade runbook and Cluster Upgrade Issue Template", Int: 19}, } client, err := utils.AppClient(ghAccess.Key, ghAccess.AppID, ghAccess.InstallID) diff --git a/cmd/create-upgrade-issues/template/cloud-platform-k8s-upgrade-template.md b/cmd/create-upgrade-issues/template/cloud-platform-k8s-upgrade-template.md index 65232b46..e22b640f 100644 --- a/cmd/create-upgrade-issues/template/cloud-platform-k8s-upgrade-template.md +++ b/cmd/create-upgrade-issues/template/cloud-platform-k8s-upgrade-template.md @@ -81,17 +81,37 @@ See the [Amazon EKS add-ons](https://docs.aws.amazon.com/eks/latest/userguide/ek ## Issue 5: +### Update guardduty to latest supported release for current EKS version + +Check for the latest supported addon release for the current EKS version and update the clusters +[Runbook link](https://runbooks.cloud-platform.service.justice.gov.uk/upgrade-eks-addons.html#listing-available-eks-upgrades) + +Production Clusters Checklist: + +- [ ] live-2 +- [ ] manager +- [ ] live + +See the [Amazon EKS add-ons](https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html) documentation for more information about addons, or find the latest versions for these EKS add-ons directly: + +- [coredns](https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html) +- [kube-proxy](https://docs.aws.amazon.com/eks/latest/userguide/managing-kube-proxy.html) +- [vpc-cni](https://docs.aws.amazon.com/eks/latest/userguide/managing-vpc-cni.html) +- [runtime-monitoring](https://docs.aws.amazon.com/guardduty/latest/ug/how-does-runtime-monitoring-work.html) + +## Issue 6: + ### Test EKS on test cluster Follow instructions from Upgrade runbook: https://runbooks.cloud-platform.service.justice.gov.uk/upgrade-eks-cluster.html#upgrade-eks-cluster -## Issue 6: +## Issue 7: ### Test EKS on live-like cluster Follow instructions from creating a live like cluster runbook: https://runbooks.cloud-platform.service.justice.gov.uk/creating-a-live-like.html#creating-a-live-like-cluster -## Issue 7: +## Issue 8: ### EKS: Upgrade Production clusters to Kubernetes @@ -103,7 +123,7 @@ Production Clusters Checklist: - [ ] manager - [ ] live -## Issue 8: +## Issue 9: ### Update vpc-cni to latest supported release for upgraded EKS version @@ -123,7 +143,7 @@ See the [Amazon EKS add-ons](https://docs.aws.amazon.com/eks/latest/userguide/ek - [vpc-cni](https://docs.aws.amazon.com/eks/latest/userguide/managing-vpc-cni.html) - [runtime-monitoring](https://docs.aws.amazon.com/guardduty/latest/ug/how-does-runtime-monitoring-work.html) -## Issue 9: +## Issue 10: ### Update kube-proxy to latest supported release for upgraded EKS version @@ -143,7 +163,7 @@ See the [Amazon EKS add-ons](https://docs.aws.amazon.com/eks/latest/userguide/ek - [vpc-cni](https://docs.aws.amazon.com/eks/latest/userguide/managing-vpc-cni.html) - [runtime-monitoring](https://docs.aws.amazon.com/guardduty/latest/ug/how-does-runtime-monitoring-work.html) -## Issue 10: +## Issue 11: ### Update core-dns to latest supported release for upgraded EKS version @@ -163,7 +183,27 @@ See the [Amazon EKS add-ons](https://docs.aws.amazon.com/eks/latest/userguide/ek - [vpc-cni](https://docs.aws.amazon.com/eks/latest/userguide/managing-vpc-cni.html) - [runtime-monitoring](https://docs.aws.amazon.com/guardduty/latest/ug/how-does-runtime-monitoring-work.html) -## Issue 11: +## Issue 12: + +### Update guardduty to latest supported release for upgraded EKS version + +Check for the latest supported addon version for the upgraded EKS version and update the clusters +[Runbook link](https://runbooks.cloud-platform.service.justice.gov.uk/upgrade-eks-addons.html#listing-available-eks-upgrades) + +Production Clusters Checklist: + +- [ ] live-2 +- [ ] manager +- [ ] live + +See the [Amazon EKS add-ons](https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html) documentation for more information about addons, or find the latest versions for these EKS add-ons directly: + +- [coredns](https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html) +- [kube-proxy](https://docs.aws.amazon.com/eks/latest/userguide/managing-kube-proxy.html) +- [vpc-cni](https://docs.aws.amazon.com/eks/latest/userguide/managing-vpc-cni.html) +- [runtime-monitoring](https://docs.aws.amazon.com/guardduty/latest/ug/how-does-runtime-monitoring-work.html) + +## Issue 13: ### Review cluster components for upgrading @@ -171,7 +211,7 @@ https://runbooks.cloud-platform.service.justice.gov.uk/container-images.html#con Review the compatibility matrix for all cluster components and verify if the image is compatible with the upgraded Kubernetes version -## Issue 12: +## Issue 14: ### Review and upgrade kube-state-metrics for the upgraded EKS version @@ -181,7 +221,7 @@ https://github.com/kubernetes/kube-state-metrics?tab=readme-ov-file#compatibilit Review the compatibility matrix of kube-state-metrics and verify if the image is compatible with the upgraded Kubernetes version. If the version is a mismatch, check if the whole kube-prometheus-chart needs updating to get the default version of kube-state-metrics from the chart-> values. Otherwise, pin the kube-state-metrics image to match the Kubernetes version. -## Issue 13: +## Issue 15: ### Upgrade cluster autoscaler for EKS version @@ -190,7 +230,7 @@ The Cloud Platform EKS Cluster is in Kubernetes version . Hence https://github.com/kubernetes/autoscaler/tree/master/charts/cluster-autoscaler https://github.com/ministryofjustice/cloud-platform-terraform-cluster-autoscaler -## Issue 14: +## Issue 16: ### Upgrade cluster descheduler for EKS version @@ -199,7 +239,7 @@ The Cloud Platform EKS Cluster is in Kubernetes version . Hence https://github.com/kubernetes-sigs/descheduler?tab=readme-ov-file#%EF%B8%8F--documentation-versions-by-release https://github.com/ministryofjustice/cloud-platform-terraform-descheduler -## Issue 15: +## Issue 17: ### Post EKS version Cleanup @@ -210,13 +250,13 @@ Update tools-image for kubectl version Update cloud-platform-cli for kubectl version Update concourse pipelines to use updated tools-image and cli -## Issue 16: +## Issue 18: ### Add deprecated apis from to Gatekeeper Following upgrade to EKS , create a new [gatekeeper constraint](https://github.com/ministryofjustice/cloud-platform-terraform-gatekeeper/tree/main/resources/constraints) that stops people from using any apis that are now deprecated as a part of the upgrade. -## Issue 17: +## Issue 19: ### Update Upgrade runbook and Cluster Upgrade Issue Template diff --git a/cmd/create-upgrade-issues/utils/github.go b/cmd/create-upgrade-issues/utils/github.go index 014ec6fe..e901d3f7 100644 --- a/cmd/create-upgrade-issues/utils/github.go +++ b/cmd/create-upgrade-issues/utils/github.go @@ -66,11 +66,11 @@ func CreateIssue(client *github.Client, ghAccess GitHubAccess, issue string, upg if issue.Title == title { found = true switch issue.Int { - case 1, 2, 3, 4, 5, 6: + case 1, 2, 3, 4, 5, 6, 7: labels = append(labels, "eks-"+upgradeVersion+"-upgrade", "eks-pre-upgrade") - case 7: + case 8: labels = append(labels, "eks-"+upgradeVersion+"-upgrade") - case 8, 9, 11, 12, 13, 14, 15, 16: + case 9, 10, 11, 12, 13, 14, 15, 16, 17, 18: labels = append(labels, "eks-"+upgradeVersion+"-upgrade", "eks-post-upgrade") default: fmt.Println("This issue isnt listed please add to Issues struct via variable issuesTitles, default label added:", title)