admin/cozystack
1
0 Fork 0
mirror of https://github.com/cozystack/cozystack.git synced 2026-11-08 21:14:56 +09:00
Code Issues Packages Projects Releases Wiki Activity

[cilium] Strip the entire k8s<1.30 AppArmor block from vendored daemonset

Browse Source 
The previous sed patch removed only the four annotation lines and
left an empty nested '{{- if ... }}{{- end }}{{- end }}{{- end }}'
skeleton behind. That skeleton was dead code, but it also meant that
the next make update would re-fetch the upstream chart with the
annotations back inside the same block, and the sed would strip them
again — leaving the skeleton behind forever.

Replace the per-line sed patch with a single perl -i -0pe multi-line
delete that removes the entire <1.30 AppArmor block in one step, and
apply the same patch to the currently vendored copy for consistency.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
(cherry picked from commit 5a50df800d)
This commit is contained in:
Aleksei Sviridkin authored and github-actions[bot] committed 2026-04-12 09:32:15 +00:00
1 parent d093ec2eb0
commit b23775dc7b
2 files changed
+5 -18
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/system/cilium/Makefile
+5 -9
View File
@@ -12,15 +12,11 @@ update:
helm repo update cilium
helm pull cilium/cilium --untar --untardir charts --version 1.19
$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
# Drop the hardcoded AppArmor unconfined annotations from the cilium-agent
# DaemonSet's k8s<1.30 branch. Cozystack manages these through
# cilium.podAnnotations in values.yaml for all k8s versions, and keeping the
# upstream block would produce duplicate mapping keys on k8s<1.30.
$(SED_INPLACE) \
-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/cilium-agent: "unconfined"/d' \
-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/clean-cilium-state: "unconfined"/d' \
-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/mount-cgroup: "unconfined"/d' \
-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/apply-sysctl-overwrites: "unconfined"/d' \
# Drop the whole k8s<1.30 AppArmor annotations block from the cilium-agent
# DaemonSet. Cozystack manages these annotations through cilium.podAnnotations
# in values.yaml on every k8s version, so keeping the upstream block would
# produce duplicate mapping keys on k8s<1.30.
perl -i -0pe 's|\n \{\{- if not \.Values\.securityContext\.privileged \}\}\n \{\{- if semverCompare "<1\.30\.0".*?\n \{\{- end \}\}\n \{\{- end \}\}\n \{\{- end \}\}||s' \
charts/cilium/templates/cilium-agent/daemonset.yaml
version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
-9
View File
@@ -57,15 +57,6 @@ spec:
# ensure pods roll when configmap updates
cilium.io/cilium-configmap-checksum: {{ include (print $.Template.BasePath "/cilium-configmap.yaml") . | sha256sum | quote }}
{{- end }}
{{- if not .Values.securityContext.privileged }}
{{- if semverCompare "<1.30.0" (printf "%d.%d.0" (semver .Capabilities.KubeVersion.Version).Major (semver .Capabilities.KubeVersion.Version).Minor) }}
# Set app AppArmor's profile to "unconfined". The value of this annotation
# can be modified as long users know which profiles they have available
# in AppArmor.
{{- if .Values.cgroup.autoMount.enabled }}
{{- end }}
{{- end }}
{{- end }}
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}