mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Aleksei Sviridkin
a9c8f206e8
Upgrade vendored MetalLB chart from 0.15.2 to 0.16.1 and rebuild the cozystack-built controller / speaker images at the new version (pinned to linux/amd64 in the Makefile to match the prior baseline and the e2e Talos sandbox arch — without the pin, a contributor building on an arm64 host like Apple Silicon ships single-arch arm64 images that crashloop on amd64 nodes with "exec format error"). Adopt the upstream-default BGP backend: FRR-K8s replaces the deprecated FRR mode. Rotate the cilium-networkpolicy clusterwide host-network port denylist to match the new metallb endpoints. The Makefile now vendors the frr-k8s subchart instead of dropping it, and pins the chart version so future make update invocations are deterministic. Upstream highlights between 0.15.2 and 0.16.1: - 0.16.0: FRR-K8s is the new default BGP backend; legacy FRR is deprecated. - 0.16.0: new probe contract — metallb controller and speaker serve /healthz and /readyz on a dedicated host-local health port 17472 (distinct from the metrics port). The frr-k8s controller uses its own host-local probe port 7572. The cozystack-built image must move in lockstep with the chart so probes resolve against the new endpoints. - 0.16.0: kube-rbac-proxy is replaced by native TLS; metrics endpoints are HTTPS-only, served on the formerly-rbac-proxy port 9120. Default TLS minimum is now 1.3 (was 1.2); operators with TLS 1.2 scrapers override via metallb.tls.minVersion: VersionTLS12. - 0.16.0: new tls.* and networkpolicies.* value blocks (opt-in defaults). - 0.16.1: chart-only patch on top of 0.16.0 — the liveness/readiness probe port is now a configurable value (default unchanged at 17472) and the controller probes drop the hardcoded host: 127.0.0.1; pods, ServiceMonitor and PodMonitor gain prometheus.io/scheme: https for the HTTPS metrics endpoint; the frr-k8s subchart gains an opt-in ServiceMonitor toggle (default off); one CRD numeric field widens from int32 to int64. - 0.15.3: ConfigurationState CRD exposes reconcile errors per component; Helm chart gained NetworkPolicy support and tightened pod SecurityContext. Adaptations: - packages/system/metallb/Makefile: pin helm pull --version 0.16.1; remove the rm -rf charts/metallb/charts/frr-k8s line so the new default BGP backend ships with the chart; add a test: target running helm unittest; hardcode --platform=linux/amd64 on the buildx invocations so the image arch does not depend on the contributor's host. - packages/system/metallb/charts/metallb/: regenerated via make update. - packages/system/metallb/values.yaml: cozystack-built controller and speaker image tags moved to v0.16.1 with fresh linux/amd64 digests pushed to ghcr.io/cozystack/cozystack. The chart's new probe contract requires the v0.16.x binary; leaving the digests on v0.15.2 would CrashLoopBackOff every pod on main between merge and the next release-prep commit. A header comment documents the backend default switch, the metrics-port move (7472 HTTP → 9120 HTTPS), the new TLS 1.3 default, the new host-network ports (9140, 9141, 19443), and the partial nature of the FRR-mode escape hatch — flipping metallb.frrk8s.enabled=false plus metallb.speaker.frr.enabled=true switches the speaker but does not suppress the idle frr-k8s subchart, because Helm evaluates a dep's `condition:` against the declaring chart's own values context and a grandparent override from the umbrella cannot reach that resolution. - packages/system/metallb/tests/metallb_test.yaml: new helm-unittest suite pinning post-bump invariants — speaker is the single-container daemonset, BGP_TYPE is frr-k8s, frr-k8s daemonset and CRDs are installed, NetworkPolicies stay off by default, controller/speaker image tags exactly match the chart appVersion (the test that would have caught the chart / binary skew up-front), and the documented FRR-mode escape hatch is pinned in both halves (speaker switches to four-container FRR layout, frr-k8s subchart still renders idle — the latter test is the contract that a future cleanup must update together with the values.yaml note). - packages/system/cilium-networkpolicy/templates/networkpolicy.yaml: drop the stale FRR-mode metrics port 7473; add every metallb v0.16 host-network listener that this policy file is responsible for — 7946 (speaker memberlist gossip, TCP/UDP; cluster peers still reach it via the same policy's ingress fromEntities[cluster,host] clause), 9120 (speaker metrics), 9121 (legacy FRR metrics, kept defensively so the documented escape hatch stays safe), 9140 (frr-k8s controller metrics), 9141 (frr-k8s FRR metrics), 19443 (frr-k8s statuscleaner webhook). Port 9443 stays in the deny list with a tightened comment: the host-network bind belongs to the etcd kube-rbac-proxy DaemonSet in cozy-monitoring; the metallb controller webhook collides on the same port number but on pod-IP, out of scope for a world-deny. - packages/system/cilium-networkpolicy/tests/networkpolicy_test.yaml: new helm-unittest suite that enumerates every metallb v0.16 host-network port in the deny list (including 7946 memberlist and the escape-hatch 9121), pins port 9443 to its etcd kube-rbac-proxy owner with the pod-IP collision note, and asserts the legacy 7473 entry is gone. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>