Update install and upgrade code to use the new helm charts by ihcsim · Pull Request #3229 · linkerd/linkerd2

ihcsim · 2019-08-12T03:57:41Z

This PR updates the linkerd install and linkerd upgrade commands to use the new Helm chart.

The following commands were executed to install and upgrade the control plane. Their YAML output are also diff'ed with that of edge-19.8.2:

bin/linkerd install
bin/linkerd install --ha
bin/linkerd install config
bin/linkerd install control-plane
bin/linkerd install-cni
bin/linkerd install --linkerd-cni-enabled
bin/linkerd install --ignore-cluster --admin-port=7000 --control-port=7001 --controller-log-level=warn --controller-uid=9009 --disable-h2-upgrade=true --enable-external-profiles=true --identity-clock-skew-allowance=60s --identity-issuance-lifetime=3600s --identity-issuer-key-file=fake-tls/key.pem --identity-trust-anchors-file=fake-tls/crt.pem --identity-issuer-certificate-file=fake-tls/crt.pem --identity-trust-domain=cluster.local --image-pull-policy=Always --inbound-port=7002 --omit-webhook-side-effects=false --outbound-port=7003 --proxy-cpu-limit=2 --proxy-cpu-request=1 --proxy-log-level=debug --proxy-memory-limit=256M --proxy-memory-request=64M --proxy-uid=3000 --skip-inbound-ports=3000,3001 --skip-outbound-ports=4000,4001 --registry=gcr.io/runconduit --restrict-dashboard-privileges=true

# inject, auto-inject and manual inject with emojivoto
bin/linkerd inject https://run.linkerd.io/emojivoto.yml 
bin/linkerd inject --manual https://run.linkerd.io/emojivoto.yml 

# upgrade from stable-2.4.0
bin/linkerd upgrade

Fixes #3127

ihcsim · 2019-08-12T04:05:36Z

charts/linkerd2/templates/proxy-injector-rbac.yaml

  {{ $ca := genCA (printf "linkerd-proxy-injector.%s.svc" .Namespace) 365 -}}
-  crt.pem: {{ b64enc $ca.Cert }}
-  key.pem: {{ b64enc $ca.Key }}
+  crt.pem: {{ ternary (b64enc $ca.Cert) (b64enc .ProxyInjector.CrtPEM) (empty .ProxyInjector.CrtPEM) }}


During upgrade, .ProxyInjector.CrtPEM and .ProxyInjector.KeyPEM will be assigned the values of the existing cert and key, so that they can be re-used. This change is also added to the service profile validator and tap RBAC templates.

Also, the .ProxyInjector.CrtPEM and .ProxyInjector.KeyPEM variables are needed to pin the test fixtures in the install and upgrade tests. Otherwise, Helm will always regenerate the cert/key pairs on every test run. If needed, we can revisit whether it's necessary to use Helm to auto-generate the TLS secrets.

ihcsim · 2019-08-12T04:11:40Z

charts/linkerd2/templates/sp-validator.yaml

  selector:
    matchLabels:
      {{.ControllerComponentLabel}}: sp-validator
-      {{.ControllerNamespaceLabel}}: {{.Namespace}}


Service profile validator already has its own selectors in 2.4. Since these selectors are immutable, adding new match labels here will cause upgrade to fail. Hence, I have to revert this change. The same revert is also added to the proxy injector template.

ihcsim · 2019-08-12T04:14:44Z

cli/cmd/install.go


 	configJSONs struct{ Global, Proxy, Install string }

-	resources   struct{ CPU, Memory constraints }


These are all moved to the common package at pkg/charts/template-values.go.

ihcsim · 2019-08-12T04:15:37Z

cli/cmd/install.go


 		// function pointers that can be overridden for tests
-		generateUUID       func() string
-		generateWebhookTLS func(webhook string) (*tlsValues, error)


During install, the webhook TLS secrets will be generated by Helm functions. During an upgrade, these secrets will be preserved.

ihcsim · 2019-08-12T04:17:03Z

cli/cmd/install.go

 	if err := options.validate(); err != nil {
 		return nil, nil, err
 	}
-	options.handleHA()


See changes in the buildValuesWithoutIdentity() function.

ihcsim · 2019-08-12T04:22:23Z

cli/cmd/install.go

-	return fmt.Sprintf("%s-tls", webhook)
-}
-
-func verifyWebhookTLS(value *tlsValues, webhook string) error {


Move to upgrade.go, since they are now only relevant during upgrade.

l5d-bot · 2019-08-12T04:31:04Z

Integration test results for d61ca13: success 🎉
Log output: https://gist.github.com/4ed51ae09627e9a1061ad959f5269cf3

charts/linkerd2/templates/heartbeat.yaml

pkg/charts/charts.go

pkg/charts/defaults.go

siggy

totally works! mostly questions for my own understanding...

charts/linkerd2/values-ha.yaml

charts/partials/templates/_proxy-init.tpl

cli/cmd/install.go

cli/cmd/upgrade.go

siggy · 2019-08-12T19:52:09Z

charts/linkerd2/values.yaml

-EnablePodAntiAffinity: false
 ImagePullPolicy: &image_pull_policy IfNotPresent

 # control plane version. See Proxy section for proxy version


unrelated to this PR, should this be edge-19.8.2, or something else?

Yes, it should. We are yet to figure out a way to inject the new version numbers into these static files (values.yaml and Chart.yaml) as part of the build.

pkg/charts/defaults.go

pkg/charts/template-values.go

Signed-off-by: Ivan Sim <[email protected]>

These are now handle by Helm functions inside the templates Signed-off-by: Ivan Sim <[email protected]>

Signed-off-by: Ivan Sim <[email protected]>

* Merge the way the 'install' ha and non-ha options are handled into one function * Honor the 'NoInitContainer' option in the components templates * Fail upgrade if the proxy injector, profile validator or tap TLS secrets are missing. These are now auto-generated by Helm during install. And during upgrade, they will be preserved. * Control plane mTLS will not be disabled if identity context in the config map is empty. The data plane mTLS will still be automatically disabled if the context is nil. Signed-off-by: Ivan Sim <[email protected]>

Signed-off-by: Ivan Sim <[email protected]>

During upgrade, these secrets are preserved to ensure they remain synced wih the CA bundle in the webhook configurations. These Helm variables are used to override the defaults in the templates. Signed-off-by: Ivan Sim <[email protected]>

Signed-off-by: Ivan Sim <[email protected]>

When upgrading from an older version that don't have these secrets, fallback to let Helm create them by creating an empty charts.TLS struct. Signed-off-by: Ivan Sim <[email protected]>

In 2.4, the proxy injector and profile validator webhooks already have their selector labels defined. Since these attributes are immutable, the recent change to these selectors introduced by the Helm chart work will cause upgrade to fail. Signed-off-by: Ivan Sim <[email protected]>

Signed-off-by: Ivan Sim <[email protected]>

l5d-bot · 2019-08-13T04:17:12Z

Integration test results for 159a862: success 🎉
Log output: https://gist.github.com/91d008fecc8b2d28997955e56e3b7519

siggy

💥

code updates look good. confirmed fresh install and upgrade from 2.4 both worked!

👍 🚢

alpeb

LGTM! 👍 🌮 🥇

Followup to #3229 Signed-off-by: Alejandro Pedraza <[email protected]>

ihcsim added area/cli priority/P0 Release Blocker area/install labels Aug 12, 2019

ihcsim requested a review from alpeb August 12, 2019 03:57

ihcsim self-assigned this Aug 12, 2019

ihcsim commented Aug 12, 2019

View reviewed changes

alpeb reviewed Aug 12, 2019

View reviewed changes

charts/linkerd2/templates/heartbeat.yaml Show resolved Hide resolved

alpeb reviewed Aug 12, 2019

View reviewed changes

pkg/charts/charts.go Show resolved Hide resolved

alpeb reviewed Aug 12, 2019

View reviewed changes

pkg/charts/defaults.go Show resolved Hide resolved

alpeb reviewed Aug 12, 2019

View reviewed changes

pkg/charts/defaults.go Show resolved Hide resolved

siggy reviewed Aug 12, 2019

View reviewed changes

ihcsim mentioned this pull request Aug 12, 2019

Revisit the different 'Values' types in the CLI install code #3237

Closed

Ivan Sim added 17 commits August 12, 2019 20:19

Delete symlink to old Helm chart

0217e56

Signed-off-by: Ivan Sim <[email protected]>

Update 'install' code to use common Helm template structs

34f188a

Signed-off-by: Ivan Sim <[email protected]>

Remove obsolete TLS assets functions.

216568b

These are now handle by Helm functions inside the templates Signed-off-by: Ivan Sim <[email protected]>

Read defaults from values.yaml and values-ha.yaml

8db9c01

Signed-off-by: Ivan Sim <[email protected]>

Ensure that webhooks TLS assets are retained during upgrade

2677b32

Signed-off-by: Ivan Sim <[email protected]>

Resolve test failures from rebase with master

3cd5660

Signed-off-by: Ivan Sim <[email protected]>

Fix linter issues

39a1b2a

Signed-off-by: Ivan Sim <[email protected]>

Set service account mount path read-only field

fe2d381

Signed-off-by: Ivan Sim <[email protected]>

Remove obsolete 'chart' folder

a178ef3

Signed-off-by: Ivan Sim <[email protected]>

Fix bugs in templates

b274e39

Signed-off-by: Ivan Sim <[email protected]>

Handle missing webhooks and tap TLS assets during upgrade

0089535

When upgrading from an older version that don't have these secrets, fallback to let Helm create them by creating an empty charts.TLS struct. Signed-off-by: Ivan Sim <[email protected]>

Alejandro's feedback

b4da577

Signed-off-by: Ivan Sim <[email protected]>

Siggy's feedback

ef01154

Signed-off-by: Ivan Sim <[email protected]>

Removed redundant unexported custom types

159a862

Signed-off-by: Ivan Sim <[email protected]>

ihcsim force-pushed the isim/install-with-new-charts branch from d61ca13 to 159a862 Compare August 13, 2019 03:50

siggy approved these changes Aug 13, 2019

View reviewed changes

alpeb approved these changes Aug 13, 2019

View reviewed changes

ihcsim merged commit 4d01e37 into master Aug 13, 2019

ihcsim deleted the isim/install-with-new-charts branch August 13, 2019 21:16

alpeb added a commit that referenced this pull request Aug 13, 2019

Update integration test with new Helm values struct

858be84

Followup to #3229 Signed-off-by: Alejandro Pedraza <[email protected]>

alpeb mentioned this pull request Aug 13, 2019

Update integration test with new Helm values struct #3246

Merged

ihcsim pushed a commit that referenced this pull request Aug 14, 2019

Update integration test with new Helm values struct (#3246)

4e65ed1

Followup to #3229 Signed-off-by: Alejandro Pedraza <[email protected]>


		configJSONs struct{ Global, Proxy, Install string }

		resources struct{ CPU, Memory constraints }

Conversation

ihcsim commented Aug 12, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

l5d-bot commented Aug 12, 2019

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

siggy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

l5d-bot commented Aug 13, 2019

Uh oh!

siggy left a comment

Choose a reason for hiding this comment

Uh oh!

alpeb left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants