-
Notifications
You must be signed in to change notification settings - Fork 316
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
charts: add ReferenceGrant permissions to Consul API Gateway ClusterRole #1299
charts: add ReferenceGrant permissions to Consul API Gateway ClusterRole #1299
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We'll definitely want a release note for this. If I'm not mistaken, anyone having apiGateway.enabled=true
will have to update their gateway CRDs prior to upgrading to the release of consul-k8s containing this change.
00920a4
to
4875b7d
Compare
CHANGELOG.md
Outdated
@@ -10,6 +10,7 @@ IMPROVEMENTS: | |||
* Added annotations `consul.hashicorp.com/prometheus-ca-file`, `consul.hashicorp.com/prometheus-ca-path`, `consul.hashicorp.com/prometheus-cert-file`, and `consul.hashicorp.com/prometheus-key-file` for configuring TLS scraping on Prometheus metrics endpoints for Envoy sidecars. To enable, set the cert and key file annotations along with one of the ca file/path annotations. [[GH-1303](https://github.com/hashicorp/consul-k8s/pull/1303)] | |||
* Helm | |||
* Added `connectInject.annotations` and `syncCatalog.annotations` values for setting annotations on connect inject and sync catalog deployments. [[GH-775](https://github.com/hashicorp/consul-k8s/pull/775)] | |||
* Added support for Consul API Gateway to read ReferenceGrant custom resources. This will require updating installed CRDs to include ReferenceGrant from the Gateway API v0.5 [Experimental Channel](https://gateway-api.sigs.k8s.io/concepts/versioning/#release-channels-eg-experimental-standard) if setting `apiGateway.enabled=true` [[GH-1299](https://github.com/hashicorp/consul-k8s/pull/1299)] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should we so far as to include the command? If I wasn't a core dev on API Gateway, I feel like it'd be hard for me to determine from the release note here what exactly I need to do.
$ kubectl apply --kustomize "github.com/kubernetes-sigs/gateway-api/config/crd/experimental?ref=v0.5.0-rc1"
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🤔 I think not, because the preferred way to install would be to install our CRDs, which include the necessary upstream ones (and installing directly like ^ will skip installing the deprecated ReferencePolicy CRD by default). However, it may be weird to land this before we have a tagged release that installs upstream CRDs including ReferenceGrant?
kubectl apply --kustomize "github.com/hashicorp/consul-api-gateway/config/crd?ref=v0.4.0"
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Our CRDs don't currently include the necessary ReferenceGrant CRD though and won't for a few weeks until we release API Gateway v0.4.0. There's a pretty good chance consul-k8s will cut a release before v0.4.0 exists. I'm mainly thinking of what consumers of the next version of consul-k8s will do in that interim period.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yea, it's possible we just shouldn't merge this until the release cycle directly before our v0.4.0 release? Not quite sure the best way to handle this or communicate in support matrices.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was previously thinking it best to merge soon so we wouldn't have to ask for a special release of consul-k8s, but I agree with you. Releasing early seems like it will make the practitioner's life more difficult.
4875b7d
to
7a4cc74
Compare
7a4cc74
to
383bbd4
Compare
383bbd4
to
d404ada
Compare
Changes proposed in this PR:
How I've tested this PR:
How I expect reviewers to test this PR:
Checklist: