Skip to content
This repository was archived by the owner on Oct 12, 2023. It is now read-only.

Commit 38eb916

Browse files
aramasearamase
authored
update manifests and helm chart for v1.6.3 (#797)
1 parent f4fdee2 commit 38eb916

32 files changed

+256
-129
lines changed

‎CHANGELOG-1.6.md

+49
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,54 @@
11
:warning: v1.6.0+ contains breaking changes. Please carefully review this [doc](README.md#v160-breaking-change) before upgrade from 1.x.x versions of pod-identity.
22

3+
# v1.6.3
4+
5+
### Features
6+
7+
- throttling - honor retry after header ([#742](https://github.com/Azure/aad-pod-identity/pull/742))
8+
- reconcile identity assignment on Azure ([#734](https://github.com/Azure/aad-pod-identity/pull/734))
9+
10+
### Bug Fixes
11+
12+
- add certs volume for non-rbac manifests ([#713](https://github.com/Azure/aad-pod-identity/pull/713))
13+
- Report original error from getPodListRetry ([#762](https://github.com/Azure/aad-pod-identity/pull/762))
14+
- initialize klog flags for NMI ([#767](https://github.com/Azure/aad-pod-identity/pull/767))
15+
- ensure stats collector doesn't aggregate stats from multiple runs ([#750](https://github.com/Azure/aad-pod-identity/pull/750))
16+
17+
### Other Improvements
18+
19+
- add deploy manifests and helm charts to staging dir ([#736](https://github.com/Azure/aad-pod-identity/pull/736))
20+
- fix miscellaneous linting problem in the codebase ([#733](https://github.com/Azure/aad-pod-identity/pull/733))
21+
- remove privileged: true for NMI daemonset ([#745](https://github.com/Azure/aad-pod-identity/pull/745))
22+
- Update to go1.15 ([#751](https://github.com/Azure/aad-pod-identity/pull/751))
23+
- automate role assignments and improve troubleshooting guide ([#754](https://github.com/Azure/aad-pod-identity/pull/754))
24+
- set dnspolicy to clusterfirstwithhostnet for NMI ([#776](https://github.com/Azure/aad-pod-identity/pull/776))
25+
- bump debian-base to v2.1.3 and debian-iptables to v12.1.2 ([#783](https://github.com/Azure/aad-pod-identity/pull/783))
26+
- add logs for ignored pods ([#785](https://github.com/Azure/aad-pod-identity/pull/785))
27+
28+
### Documentation
29+
30+
- docs: fix broken test standard link in GitHub Pull Request template ([#710](https://github.com/Azure/aad-pod-identity/pull/710))
31+
- Fixed typo ([#757](https://github.com/Azure/aad-pod-identity/pull/757))
32+
- Fixed Grammar ([#758](https://github.com/Azure/aad-pod-identity/pull/758))
33+
- add doc for deleting/recreating identity with same name ([#786](https://github.com/Azure/aad-pod-identity/pull/786))
34+
- add best practices documentation ([#779](https://github.com/Azure/aad-pod-identity/pull/779))
35+
36+
### Helm
37+
38+
- add release namespace to chart manifests ([#741](https://github.com/Azure/aad-pod-identity/pull/741))
39+
- Add imagePullSecretes to the Helm chart ([#774](https://github.com/Azure/aad-pod-identity/pull/774))
40+
- Expose metrics port ([#777](https://github.com/Azure/aad-pod-identity/pull/777))
41+
- add user managed identity support to helm charts ([#781](https://github.com/Azure/aad-pod-identity/pull/781))
42+
43+
### Test Improvements
44+
45+
- add e2e test for block-instance-metadata ([#715](https://github.com/Azure/aad-pod-identity/pull/715))
46+
- add aks as part of pr and nightly test ([#717](https://github.com/Azure/aad-pod-identity/pull/717))
47+
- add load test pipeline to nightly job ([#744](https://github.com/Azure/aad-pod-identity/pull/744))
48+
- install aad-pod-identity in kube-system namespace ([#747](https://github.com/Azure/aad-pod-identity/pull/747))
49+
- bump golangci-lint to v1.30.0 ([#759](https://github.com/Azure/aad-pod-identity/pull/759))
50+
51+
352
# v1.6.2
453

554
### Features

‎README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ metadata:
247247
spec:
248248
containers:
249249
- name: demo
250-
image: mcr.microsoft.com/k8s/aad-pod-identity/demo:1.2
250+
image: mcr.microsoft.com/oss/azure/aad-pod-identity/demo:v1.6.3
251251
args:
252252
- --subscriptionid=${SUBSCRIPTION_ID}
253253
- --clientid=${IDENTITY_CLIENT_ID}
@@ -270,7 +270,7 @@ spec:
270270
EOF
271271
```
272272

273-
> `mcr.microsoft.com/k8s/aad-pod-identity/demo` is an image that demostrates the use of AAD pod identity. The source code can be found [here](./cmd/demo/main.go).
273+
> `mcr.microsoft.com/oss/azure/aad-pod-identity/demo` is an image that demostrates the use of AAD pod identity. The source code can be found [here](./cmd/demo/main.go).
274274
275275
To verify that the pod is indeed using the identity correctly:
276276

‎charts/aad-pod-identity-2.0.2.tgz

11.2 KB
Binary file not shown.

‎charts/aad-pod-identity/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v1
22
description: Deploy components for aad-pod-identity
33
name: aad-pod-identity
4-
version: 2.0.1
5-
appVersion: 1.6.2
4+
version: 2.0.2
5+
appVersion: 1.6.3
66
home: https://github.com/Azure/aad-pod-identity
77
sources:
88
- https://github.com/Azure/aad-pod-identity

‎charts/aad-pod-identity/README.md

+61-53
Large diffs are not rendered by default.

‎charts/aad-pod-identity/templates/mic-clusterrolebinding.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- if and .Values.rbac.enabled (eq .Values.operationMode "standard") }}
2-
apiVersion: rbac.authorization.k8s.io/v1beta1
2+
apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRoleBinding
44
metadata:
55
name: {{ template "aad-pod-identity.mic.fullname" . }}

‎charts/aad-pod-identity/templates/mic-deployment.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ apiVersion: apps/v1
33
kind: Deployment
44
metadata:
55
name: {{ template "aad-pod-identity.mic.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
67
labels:
78
{{- include "aad-pod-identity.labels" . | nindent 4 }}
89
app.kubernetes.io/component: mic
@@ -24,6 +25,10 @@ spec:
2425
{{ toYaml .Values.mic.podAnnotations | indent 8 }}
2526
{{- end }}
2627
spec:
28+
{{- if .Values.imagePullSecrets }}
29+
imagePullSecrets:
30+
{{ toYaml .Values.imagePullSecrets | indent 8 }}
31+
{{- end }}
2732
{{- if .Values.rbac.enabled }}
2833
serviceAccountName: {{ template "aad-pod-identity.mic.fullname" . }}
2934
{{- end }}
@@ -75,6 +80,9 @@ spec:
7580
{{- if .Values.mic.updateUserMSIRetryInterval }}
7681
- --update-user-msi-retry-interval={{ .Values.mic.updateUserMSIRetryInterval }}
7782
{{- end }}
83+
{{- if .Values.mic.identityAssignmentReconcileInterval }}
84+
- --identity-assignment-reconcile-interval={{ .Values.mic.identityAssignmentReconcileInterval }}
85+
{{- end }}
7886
env:
7987
- name: MIC_POD_NAMESPACE
8088
valueFrom:
@@ -118,7 +126,25 @@ spec:
118126
secretKeyRef:
119127
key: ClientSecret
120128
name: {{ template "aad-pod-identity.mic.fullname" . }}
129+
{{- if .Values.adminsecret.useMSI }}
130+
- name: USE_MSI
131+
valueFrom:
132+
secretKeyRef:
133+
key: UseMSI
134+
name: {{ template "aad-pod-identity.mic.fullname" . }}
135+
- name: USER_ASSIGNED_MSI_CLIENT_ID
136+
valueFrom:
137+
secretKeyRef:
138+
key: UserAssignedMSIClientID
139+
name: {{ template "aad-pod-identity.mic.fullname" . }}
121140
{{- end }}
141+
{{- end }}
142+
{{- if .Values.mic.prometheusPort }}
143+
ports:
144+
- containerPort: {{ .Values.mic.prometheusPort }}
145+
name: metrics
146+
protocol: TCP
147+
{{- end }}
122148
{{- if not .Values.adminsecret }}
123149
volumeMounts:
124150
- name: k8s-azure-file

‎charts/aad-pod-identity/templates/mic-exception.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ apiVersion: "aadpodidentity.k8s.io/v1"
33
kind: AzurePodIdentityException
44
metadata:
55
name: mic
6+
namespace: {{ .Release.Namespace }}
67
spec:
78
podLabels:
89
app: mic

‎charts/aad-pod-identity/templates/mic-secret.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ apiVersion: v1
33
kind: Secret
44
metadata:
55
name: {{ template "aad-pod-identity.mic.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
67
labels:
78
{{- include "aad-pod-identity.labels" . | nindent 4 }}
89
app.kubernetes.io/component: mic
@@ -14,4 +15,8 @@ data:
1415
TenantID: {{ required "A valid cloud tenant id is required" .Values.adminsecret.tenantID | b64enc | quote }}
1516
ClientID: {{ required "A valid client id is required" .Values.adminsecret.clientID | b64enc | quote }}
1617
ClientSecret: {{ required "A valid client secret is required" .Values.adminsecret.clientSecret | b64enc | quote }}
18+
{{- if .Values.adminsecret.useMSI }}
19+
UseMSI: {{ .Values.adminsecret.useMSI | b64enc | quote }}
20+
UserAssignedMSIClientID: {{ .Values.adminsecret.userAssignedMSIClientID | b64enc | quote }}
21+
{{- end }}
1722
{{- end }}

‎charts/aad-pod-identity/templates/mic-serviceaccount.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ apiVersion: v1
33
kind: ServiceAccount
44
metadata:
55
name: {{ template "aad-pod-identity.mic.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
67
labels:
78
{{- include "aad-pod-identity.labels" . | nindent 4 }}
89
app.kubernetes.io/component: mic

‎charts/aad-pod-identity/templates/nmi-clusterrolebinding.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- if .Values.rbac.enabled }}
2-
apiVersion: rbac.authorization.k8s.io/v1beta1
2+
apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRoleBinding
44
metadata:
55
name: {{ template "aad-pod-identity.nmi.fullname" . }}

‎charts/aad-pod-identity/templates/nmi-daemonset.yaml

+15-4
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ apiVersion: apps/v1
22
kind: DaemonSet
33
metadata:
44
name: {{ template "aad-pod-identity.nmi.fullname" . }}
5+
namespace: {{ .Release.Namespace }}
56
labels:
67
{{- include "aad-pod-identity.labels" . | nindent 4 }}
78
app.kubernetes.io/component: nmi
@@ -24,13 +25,18 @@ spec:
2425
{{ toYaml .Values.nmi.podAnnotations | indent 8 }}
2526
{{- end }}
2627
spec:
28+
{{- if .Values.imagePullSecrets }}
29+
imagePullSecrets:
30+
{{ toYaml .Values.imagePullSecrets | indent 8 }}
31+
{{- end }}
2732
{{- if .Values.rbac.enabled }}
2833
serviceAccountName: {{ template "aad-pod-identity.nmi.fullname" . }}
2934
{{- end }}
3035
{{- if .Values.nmi.priorityClassName }}
3136
priorityClassName: {{ .Values.nmi.priorityClassName | quote }}
3237
{{- end }}
3338
hostNetwork: true
39+
dnsPolicy: ClusterFirstWithHostNet
3440
volumes:
3541
- hostPath:
3642
path: /run/xtables.lock
@@ -41,7 +47,7 @@ spec:
4147
image: "{{ .Values.image.repository }}/{{ .Values.nmi.image }}:{{ .Values.nmi.tag }}"
4248
imagePullPolicy: {{ .Values.image.imagePullPolicy }}
4349
args:
44-
{{- if semverCompare "<= 1.6.1" .Values.nmi.tag }}
50+
{{- if semverCompare "<= 1.6.1-0" .Values.nmi.tag }}
4551
- "--host-ip=$(HOST_IP)"
4652
{{- end }}
4753
- "--node=$(NODE_NAME)"
@@ -75,14 +81,14 @@ spec:
7581
{{- if .Values.nmi.metadataHeaderRequired}}
7682
- --metadata-header-required={{ .Values.nmi.metadataHeaderRequired }}
7783
{{- end }}
78-
{{- if semverCompare ">= 1.6.0" .Values.nmi.tag }}
84+
{{- if semverCompare ">= 1.6.0-0" .Values.nmi.tag }}
7985
- --operation-mode={{ .Values.operationMode }}
8086
{{- end}}
8187
{{- if eq .Values.operationMode "managed" }}
8288
- --forceNamespaced
8389
{{- end }}
8490
env:
85-
{{- if semverCompare "<= 1.6.1" .Values.nmi.tag }}
91+
{{- if semverCompare "<= 1.6.1-0" .Values.nmi.tag }}
8692
- name: HOST_IP
8793
valueFrom:
8894
fieldRef:
@@ -96,8 +102,13 @@ spec:
96102
- name: FORCENAMESPACED
97103
value: "{{ .Values.forceNameSpaced }}"
98104
{{- end }}
105+
{{- if .Values.nmi.prometheusPort }}
106+
ports:
107+
- containerPort: {{ .Values.nmi.prometheusPort }}
108+
name: metrics
109+
protocol: TCP
110+
{{- end }}
99111
securityContext:
100-
privileged: true
101112
capabilities:
102113
add:
103114
- NET_ADMIN

‎charts/aad-pod-identity/templates/nmi-serviceaccount.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ apiVersion: v1
33
kind: ServiceAccount
44
metadata:
55
name: {{ template "aad-pod-identity.nmi.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
67
labels:
78
{{- include "aad-pod-identity.labels" . | nindent 4 }}
89
app.kubernetes.io/component: nmi

‎charts/aad-pod-identity/values.yaml

+15-6
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,13 @@ nameOverride: ""
66
fullnameOverride: ""
77

88
image:
9-
repository: mcr.microsoft.com/k8s/aad-pod-identity
9+
repository: mcr.microsoft.com/oss/azure/aad-pod-identity
1010
imagePullPolicy: Always
1111

12+
# One or more secrets to be used when pulling images
13+
# imagePullSecrets:
14+
# - name: myRegistryKeySecretName
15+
1216
# https://github.com/Azure/aad-pod-identity#4-optional-match-pods-in-the-namespace
1317
# By default, AAD Pod Identity matches pods to identities across namespaces.
1418
# To match only pods in the namespace containing AzureIdentity set this to true.
@@ -29,16 +33,17 @@ adminsecret: {}
2933
# resourceGroup: <cluster resource group>
3034
# vmType: <`standard` for normal virtual machine nodes, and `vmss` for cluster deployed with a virtual machine scale set>
3135
# tenantID: <service principal tenant id>
32-
# clientID: <service principal client id>
33-
# clientSecret: <service principal client secret>
34-
36+
# clientID: <service principal client id. Set to `msi` when using a User Managed Identity>
37+
# clientSecret: <service principal client secret. Set to `msi` when using a User Managed Identity>
38+
# useMSI: <set to true when using a User Managed Identity>
39+
# userAssignedMSIClientID: <client id for the User Managed Identity>
3540
# Operation mode for pod-identity. Default is standard mode that has MIC doing identity assignment
3641
# Allowed values: "standard", "managed"
3742
operationMode: "standard"
3843

3944
mic:
4045
image: mic
41-
tag: 1.6.2
46+
tag: v1.6.3
4247

4348
priorityClassName: ""
4449

@@ -111,9 +116,13 @@ mic:
111116
# Default value is 1s
112117
updateUserMSIRetryInterval: ""
113118

119+
# The interval between reconciling identity assignment on Azure based on an existing list of AzureAssignedIdentities
120+
# Default value is 3m
121+
identityAssignmentReconcileInterval: ""
122+
114123
nmi:
115124
image: nmi
116-
tag: 1.6.2
125+
tag: v1.6.3
117126

118127
priorityClassName: ""
119128

0 commit comments

Comments
 (0)