Merge branch 'main' into alpeb/no-ns-helm-core

linkerd · Dec 9, 2021 · 09e2923 · 09e2923
2 parents 5d3eb2f + 9c0d457
commit 09e2923
Show file tree

Hide file tree

Showing 93 changed files with 1,267 additions and 724 deletions.
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,76 @@
+name: "🐛 Bug Report"
+description: "If something isn't working as expected 🤔."
+labels: ["bug"]
+body:
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue already exists for the bug you encountered.
+      options:
+      - label: I have searched the existing issues
+        required: true
+
+  - type: markdown
+    attributes:
+      value: Thanks for taking the time to file a bug report! Please fill out this form as completely as possible.
+
+  - type: textarea
+    attributes:
+      label: What is the issue?
+      description: A clear and concise description of what Linkerd is doing and what you would expect.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: How can it be reproduced?
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Logs, error output, etc
+      description: If the output is long, please create a [gist](https://gist.github.com/) and paste the link here.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: output of `linkerd check -o short`
+      placeholder: |
+        ```text
+        your output here ...
+        ```
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Environment
+      placeholder: |
+        - Kubernetes Version:
+        - Cluster Environment: (GKE, AKS, kops, ...)
+        - Host OS:
+        - Linkerd version:
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Possible solution
+      description: "If you have suggestions on a fix for the bug."
+
+  - type: textarea
+    attributes:
+      label: Additional context
+      description: "Add any other context about the problem here. Or a screenshot if applicable."
+
+  - type: dropdown
+    attributes:
+      label: Would you like to work on fixing this bug?
+      description: |
+        **NOTE**: Let us know if you would like to submit a PR for this. We are more than happy to help you through the process.
+      options:
+        - "yes"
+        - "no"
+        - "maybe"
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,55 @@
+name: 💡 Feature Request"
+description: I have a suggestion (and may want to implement it 🙂)!
+labels: ["enhancement"]
+body:
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue already exists for the feature you want to request.
+      options:
+      - label: I have searched the existing issues
+        required: true
+
+  - type: markdown
+    attributes:
+      value: Thanks for taking the time to suggest a new feature! Please fill out this form as completely as possible.
+
+  - type: textarea
+    attributes:
+      label: What problem are you trying to solve?
+      description: |
+        A concise description of what the problem is.
+      placeholder: |
+        I have an issue when [...]
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: How should the problem be solved?
+      description: What do you want to happen? Add any considered drawbacks.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Any alternatives you've considered?
+      description: Is there another way to solve this problem that isn't as good a solution?
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: How would users interact with this feature?
+      description: |
+        If you can, explain how users will be able to use this. Maybe come sample CLI output?
+
+  - type: dropdown
+    attributes:
+      label: Would you like to work on this feature?
+      description: |
+        **NOTE**: Let us know if you would like to submit a PR for this. We are more than happy to help you through the process.
+      options:
+        - "yes"
+        - "no"
+        - "maybe"
diff --git a/.github/workflows/integration_tests.yml b/.github/workflows/integration_tests.yml
@@ -51,7 +51,7 @@ jobs:
     # absolute path is used here.
     # https://github.com/actions/upload-artifact/issues/8
     - name: Upload artifact
-      uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074
+      uses: actions/upload-artifact@da838ae9595ac94171fa2d4de5a2f117b3e7ac32
       with:
         name: image-archives
         path: /home/runner/archives
@@ -88,7 +88,7 @@ jobs:
       run: |
         echo "TAG=$(CI_FORCE_CLEAN=1 bin/root-tag)" >> $GITHUB_ENV
     - name: Download image archives
-      uses: actions/download-artifact@3be87be14a055c47b01d3bd88f8fe02320a9bb60
+      uses: actions/download-artifact@f023be2c48cc18debc3bacd34cb396e0295e2869
       with:
         name: image-archives
         path: image-archives

diff --git a/.github/workflows/policy_controller.yml b/.github/workflows/policy_controller.yml
@@ -42,7 +42,7 @@ jobs:
     continue-on-error: ${{ matrix.checks == 'advisories' }}
     steps:
     - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
-    - uses: EmbarkStudios/cargo-deny-action@0ca727bbae7b7b578b9a5f98186caac35aa2a00d
+    - uses: EmbarkStudios/cargo-deny-action@f2d2f98857d524436b31aa639bac5edc10863b08
       with:
         command: check bans licenses sources
 

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -59,7 +59,7 @@ jobs:
     # https://github.com/actions/upload-artifact/issues/8
     - name: Upload artifact
       if: matrix.component == 'cli-bin'
-      uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074
+      uses: actions/upload-artifact@da838ae9595ac94171fa2d4de5a2f117b3e7ac32
       with:
         name: image-archives
         path: /home/runner/archives
@@ -145,7 +145,7 @@ jobs:
       with:
         go-version: '1.17'
     - name: Download image archives
-      uses: actions/download-artifact@3be87be14a055c47b01d3bd88f8fe02320a9bb60
+      uses: actions/download-artifact@f023be2c48cc18debc3bacd34cb396e0295e2869
       with:
         name: image-archives
         path: image-archives
@@ -258,7 +258,7 @@ jobs:
         args: pack bin/win/linkerd.nuspec
     - name: Chocolatey - upload package
       if: startsWith(github.ref, 'refs/tags/stable')
-      uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074
+      uses: actions/upload-artifact@da838ae9595ac94171fa2d4de5a2f117b3e7ac32
       with:
         name: choco
         path: ./linkerd.*.nupkg
@@ -282,7 +282,7 @@ jobs:
         extract_release_notes NOTES.md
     - name: Download choco package
       if: startsWith(github.ref, 'refs/tags/stable')
-      uses: actions/download-artifact@3be87be14a055c47b01d3bd88f8fe02320a9bb60
+      uses: actions/download-artifact@f023be2c48cc18debc3bacd34cb396e0295e2869
       with:
         name: choco
         path: choco

diff --git a/ADOPTERS.md b/ADOPTERS.md
@@ -60,6 +60,7 @@
 - [Purdue University Global](https://www.purdueglobal.edu/)
 - [reDock](https://www.redock.com/)
 - [ReliMail](https://relimail.com/)
+- [S&P Global Platts](https://www.spglobal.com/platts/en)
 - [Salt Security](https://salt.security/)
 - [SCA](https://sca.com.au)
 - [Search365](https://search365.ai/)
@@ -70,6 +71,7 @@
 - [Tradeshift](https://tradeshift.com/)
 - [Transit](https://transit.app)
 - [Vernacular.ai](https://vernacular.ai/)
+- [Web Summit](https://websummit.com)
 - [xCloud](https://www.xbox.com/en-US/xbox-game-streaming/project-xcloud)
 - [YouMail](https://www.youmail.com)
 - [Zimpler](https://www.zimpler.com/)

diff --git a/Cargo.lock b/Cargo.lock
@@ -1533,9 +1533,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.130"
+version = "1.0.131"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f12d06de37cf59146fbdecab66aa99f9fe4f78722e3607577a5375d66bd0c913"
+checksum = "b4ad69dfbd3e45369132cc64e6748c2d65cdfb001a2b1c232d128b4ad60561c1"
 dependencies = [
  "serde_derive",
 ]
@@ -1552,9 +1552,9 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.130"
+version = "1.0.131"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7bc1a1ab1961464eae040d96713baa5a724a8152c1222492465b54322ec508b"
+checksum = "b710a83c4e0dff6a3d511946b95274ad9ca9e5d3ae497b63fda866ac955358d2"
 dependencies = [
  "proc-macro2",
  "quote",

diff --git a/bin/image-load b/bin/image-load
@@ -149,5 +149,5 @@ fi
 
 if [ -n "$k3d" ]; then
   printf 'Importing %s...\n' "${images[@]}"
-  "$bin" "${image_sub_cmd[@]}" "${images[@]}"
+  "$bin" "${image_sub_cmd[@]}" "${images[@]}" -m tools-node
 fi
diff --git a/charts/linkerd-control-plane/README.md b/charts/linkerd-control-plane/README.md
@@ -220,7 +220,7 @@ Kubernetes: `>=1.20.0-0`
 | proxyInit.ignoreOutboundPorts | string | `"4567,4568"` | Default set of outbound ports to skip via iptables - Galera (4567,4568) |
 | proxyInit.image.name | string | `"cr.l5d.io/linkerd/proxy-init"` | Docker image for the proxy-init container |
 | proxyInit.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy-init container Docker image |
-| proxyInit.image.version | string | `"v1.5.1"` | Tag for the proxy-init container Docker image |
+| proxyInit.image.version | string | `"v1.5.2"` | Tag for the proxy-init container Docker image |
 | proxyInit.logFormat | string | plain | Log format (`plain` or `json`) for the proxy-init |
 | proxyInit.logLevel | string | info | Log level for the proxy-init |
 | proxyInit.resources.cpu.limit | string | `"100m"` | Maximum amount of CPU units that the proxy-init container can use |

diff --git a/charts/linkerd-control-plane/values.yaml b/charts/linkerd-control-plane/values.yaml
@@ -180,7 +180,7 @@ proxyInit:
     # @default -- imagePullPolicy
     pullPolicy: ""
     # -- Tag for the proxy-init container Docker image
-    version: v1.5.1
+    version: v1.5.2
   resources:
     cpu:
       # -- Maximum amount of CPU units that the proxy-init container can use

diff --git a/charts/partials/templates/_proxy-init.tpl b/charts/partials/templates/_proxy-init.tpl
@@ -47,7 +47,11 @@ securityContext:
     {{- end }}
     {{- end }}
   {{- if or .Values.proxyInit.closeWaitTimeoutSecs .Values.proxyInit.runAsRoot }}
+  {{- if .Values.proxyInit.closeWaitTimeoutSecs }}
   privileged: true
+  {{- else }}
+  privileged: false
+  {{- end }}
   runAsNonRoot: false
   runAsUser: 0
   {{- else }}

diff --git a/cli/cmd/inject.go b/cli/cmd/inject.go
@@ -486,6 +486,10 @@ func getOverrideAnnotations(values *charts.Values, base *charts.Values) map[stri
 		}
 	}
 
+	if proxy.DefaultInboundPolicy != baseProxy.DefaultInboundPolicy {
+		overrideAnnotations[k8s.ProxyDefaultInboundPolicyAnnotation] = proxy.DefaultInboundPolicy
+	}
+
 	return overrideAnnotations
 }
 

diff --git a/cli/cmd/inject_test.go b/cli/cmd/inject_test.go
@@ -310,6 +310,28 @@ func TestUninjectAndInject(t *testing.T) {
 			injectProxy:      true,
 			testInjectConfig: ingressConfig,
 		},
+		{
+			inputFileName:  "inject_emojivoto_deployment.input.yml",
+			goldenFileName: "inject_emojivoto_deployment_default_inbound_policy.golden.yml",
+			reportFileName: "inject_emojivoto_deployment_default_inbound_policy.golden.report",
+			injectProxy:    false,
+			testInjectConfig: func() *linkerd2.Values {
+				values := defaultConfig()
+				values.Proxy.DefaultInboundPolicy = k8s.AllAuthenticated
+				return values
+			}(),
+		},
+		{
+			inputFileName:  "inject_emojivoto_pod.input.yml",
+			goldenFileName: "inject_emojivoto_pod_default_inbound_policy.golden.yml",
+			reportFileName: "inject_emojivoto_pod_default_inbound_policy.golden.report",
+			injectProxy:    false,
+			testInjectConfig: func() *linkerd2.Values {
+				values := defaultConfig()
+				values.Proxy.DefaultInboundPolicy = k8s.AllAuthenticated
+				return values
+			}(),
+		},
 	}
 
 	for i, tc := range testCases {

diff --git a/cli/cmd/options.go b/cli/cmd/options.go
@@ -397,6 +397,12 @@ func makeProxyFlags(defaults *l5dcharts.Values) ([]flag.Flag, *pflag.FlagSet) {
 				return nil
 			}),
 
+		flag.NewStringFlag(proxyFlags, "default-inbound-policy", defaults.Proxy.DefaultInboundPolicy, "Inbound policy to use to control inbound access to the proxy",
+			func(values *l5dcharts.Values, value string) error {
+				values.Proxy.DefaultInboundPolicy = value
+				return nil
+			}),
+
 		// Deprecated flags
 
 		flag.NewStringFlag(proxyFlags, "proxy-memory", defaults.Proxy.Resources.Memory.Request, "Amount of Memory that the proxy sidecar requests",

diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -163,7 +163,7 @@ spec:
         - 4190,4191,4567,4568
         - --outbound-ports-to-ignore
         - 4567,4568
-        image: cr.l5d.io/linkerd/proxy-init:v1.5.1
+        image: cr.l5d.io/linkerd/proxy-init:v1.5.2
         imagePullPolicy: IfNotPresent
         name: linkerd-init
         resources:
-Original file line number
+Diff line change
@@ Expand Up @@
     		}
     	}
+    	if proxy.DefaultInboundPolicy != baseProxy.DefaultInboundPolicy {
+    		overrideAnnotations[k8s.ProxyDefaultInboundPolicyAnnotation] = proxy.DefaultInboundPolicy
+    	}
     	return overrideAnnotations
     }
@@ Expand Down @@