Merge branch 'aws:main' into nutanix

UPSTREAM_PROJECTS.yaml

@@ -145,7 +145,7 @@ projects:
           - commit: 5b496a72af3d80d64a16a650c85ce9a5882bc014
       - name: image-builder
         versions:
-          - commit: 1b26ed7b1c5fa0b71a00c130d07db5cf6e026f74
+          - commit: ef9fed11d164c58dcb9e56699c56b0fe953f40d9
       - name: kind
         versions:
           - tag: v0.14.0

projects/aws/cluster-api-provider-aws-snow/GIT_TAG

@@ -1 +1 @@
-v0.1.7
+v0.1.8

projects/aws/cluster-api-provider-aws-snow/manifests/infrastructure-components.yaml

@@ -9,13 +9,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: capas-system/capas-serving-cert
     controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: infrastructure-aws-snow
     cluster.x-k8s.io/v1beta1: v1beta1
   name: awssnowclusters.infrastructure.cluster.x-k8s.io
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        caBundle: Cg==
+        service:
+          name: capas-webhook-service
+          namespace: capas-system
+          path: /convert
+      conversionReviewVersions:
+      - v1beta1
   group: infrastructure.cluster.x-k8s.io
   names:
     kind: AWSSnowCluster
@@ -210,13 +221,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: capas-system/capas-serving-cert
     controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: infrastructure-aws-snow
     cluster.x-k8s.io/v1beta1: v1beta1
   name: awssnowmachines.infrastructure.cluster.x-k8s.io
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        caBundle: Cg==
+        service:
+          name: capas-webhook-service
+          namespace: capas-system
+          path: /convert
+      conversionReviewVersions:
+      - v1beta1
   group: infrastructure.cluster.x-k8s.io
   names:
     kind: AWSSnowMachine
@@ -693,13 +715,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: capas-system/capas-serving-cert
     controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
   labels:
     cluster.x-k8s.io/provider: infrastructure-aws-snow
     cluster.x-k8s.io/v1beta1: v1beta1
   name: awssnowmachinetemplates.infrastructure.cluster.x-k8s.io
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        caBundle: Cg==
+        service:
+          name: capas-webhook-service
+          namespace: capas-system
+          path: /convert
+      conversionReviewVersions:
+      - v1beta1
   group: infrastructure.cluster.x-k8s.io
   names:
     categories:
@@ -1309,6 +1342,20 @@ metadata:
   namespace: capas-system
 type: Opaque
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    cluster.x-k8s.io/provider: infrastructure-aws-snow
+  name: capas-webhook-service
+  namespace: capas-system
+spec:
+  ports:
+  - port: 443
+    targetPort: webhook-server
+  selector:
+    cluster.x-k8s.io/provider: infrastructure-aws-snow
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -1348,6 +1395,10 @@ spec:
           initialDelaySeconds: 15
           periodSeconds: 20
         name: manager
+        ports:
+        - containerPort: 9443
+          name: webhook-server
+          protocol: TCP
         readinessProbe:
           httpGet:
             path: /readyz
@@ -1364,14 +1415,171 @@ spec:
         securityContext:
           allowPrivilegeEscalation: false
         volumeMounts:
+        - mountPath: /tmp/k8s-webhook-server/serving-certs
+          name: cert
+          readOnly: true
         - mountPath: /home/.aws
           name: ca-bundle
       serviceAccountName: capas-controller-manager
       terminationGracePeriodSeconds: 10
       volumes:
+      - name: cert
+        secret:
+          defaultMode: 420
+          secretName: capas-webhook-service-cert
       - name: credentials
         secret:
           secretName: capas-manager-bootstrap-credentials
       - name: ca-bundle
         secret:
           secretName: capas-manager-bootstrap-credentials
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  labels:
+    cluster.x-k8s.io/provider: infrastructure-aws-snow
+  name: capas-serving-cert
+  namespace: capas-system
+spec:
+  dnsNames:
+  - capas-webhook-service.capas-system.svc
+  - capas-webhook-service.capas-system.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: capas-selfsigned-issuer
+  secretName: capas-webhook-service-cert
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  labels:
+    cluster.x-k8s.io/provider: infrastructure-aws-snow
+  name: capas-selfsigned-issuer
+  namespace: capas-system
+spec:
+  selfSigned: {}
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: capas-system/capas-serving-cert
+  labels:
+    cluster.x-k8s.io/provider: infrastructure-aws-snow
+  name: capas-mutating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1beta1
+  clientConfig:
+    service:
+      name: capas-webhook-service
+      namespace: capas-system
+      path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-awssnowcluster
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: default.awssnowcluster.infrastructure.cluster.x-k8s.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - awssnowclusters
+  sideEffects: None
+- admissionReviewVersions:
+  - v1beta1
+  clientConfig:
+    service:
+      name: capas-webhook-service
+      namespace: capas-system
+      path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-awssnowmachine
+  failurePolicy: Fail
+  name: mutation.awssnowmachine.infrastructure.cluster.x-k8s.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - awssnowmachines
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: capas-system/capas-serving-cert
+  labels:
+    cluster.x-k8s.io/provider: infrastructure-aws-snow
+  name: capas-validating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1beta1
+  clientConfig:
+    service:
+      name: capas-webhook-service
+      namespace: capas-system
+      path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-awssnowcluster
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: validation.awssnowcluster.infrastructure.cluster.x-k8s.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - awssnowclusters
+  sideEffects: None
+- admissionReviewVersions:
+  - v1beta1
+  clientConfig:
+    service:
+      name: capas-webhook-service
+      namespace: capas-system
+      path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-awssnowmachine
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: validation.awssnowmachine.infrastructure.cluster.x-k8s.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - awssnowmachines
+  sideEffects: None
+- admissionReviewVersions:
+  - v1beta1
+  clientConfig:
+    service:
+      name: capas-webhook-service
+      namespace: capas-system
+      path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-awssnowmachinetemplate
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: validation.awssnowmachinetemplate.infrastructure.x-k8s.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - awssnowmachinetemplates
+  sideEffects: None

projects/kubernetes-sigs/image-builder/GIT_TAG

@@ -1 +1 @@
-1b26ed7b1c5fa0b71a00c130d07db5cf6e026f74
+ef9fed11d164c58dcb9e56699c56b0fe953f40d9

projects/kubernetes-sigs/image-builder/patches/0001-Add-goss-validations-for-EKS-D-artifacts.patch

@@ -1,7 +1,7 @@
-From e9516eb65c18edcb39ef5f7cfe4b3bf1e2250557 Mon Sep 17 00:00:00 2001
+From b67da3f6ef97e1f2db22a4b5e7be6382953ec14a Mon Sep 17 00:00:00 2001
 From: Vignesh Goutham Ganesh <[email protected]>
 Date: Tue, 11 Jan 2022 18:36:56 -0800
-Subject: [PATCH 1/8] Add goss validations for EKS-D artifacts
+Subject: [PATCH 1/9] Add goss validations for EKS-D artifacts
 
 Signed-off-by: Vignesh Goutham Ganesh <[email protected]>
 ---
@@ -31,5 +31,5 @@ index bc9972c8e..45e7a9433 100644
      stderr: []
      timeout: 0
 -- 
-2.24.3 (Apple Git-128)
+2.25.1
 

projects/kubernetes-sigs/image-builder/patches/0002-Install-containerd-from-apt-for-Ubuntu.patch

@@ -1,7 +1,7 @@
-From 50acb2a33a93f39f8f74a882cf62cf747c260541 Mon Sep 17 00:00:00 2001
+From 3588c40c0866c198093f9ab5ae39c688466e2f6f Mon Sep 17 00:00:00 2001
 From: Vignesh Goutham Ganesh <[email protected]>
 Date: Tue, 11 Jan 2022 18:37:06 -0800
-Subject: [PATCH 2/8] Install containerd from apt for Ubuntu
+Subject: [PATCH 2/9] Install containerd from apt for Ubuntu
 
 Signed-off-by: Vignesh Goutham Ganesh <[email protected]>
 ---
@@ -79,5 +79,5 @@ index 4176db434..8aae4002f 100644
      dest: /tmp/cni.tar.gz
      mode: 0755
 -- 
-2.24.3 (Apple Git-128)
+2.25.1
 

projects/kubernetes-sigs/image-builder/patches/0003-Output-vsphere-builds-to-content-library-instead-of-.patch

@@ -1,7 +1,7 @@
-From 2efb247d6ed89766f60e8026b98b289dc6ea8d48 Mon Sep 17 00:00:00 2001
+From 03eda063b3a45ba6b5fca9262ea8981b7ba8d3c1 Mon Sep 17 00:00:00 2001
 From: Vignesh Goutham Ganesh <[email protected]>
 Date: Tue, 11 Jan 2022 21:00:12 -0800
-Subject: [PATCH 3/8] Output vsphere builds to content library instead of
+Subject: [PATCH 3/9] Output vsphere builds to content library instead of
  exports
 
 Signed-off-by: Vignesh Goutham Ganesh <[email protected]>
@@ -10,7 +10,7 @@ Signed-off-by: Vignesh Goutham Ganesh <[email protected]>
  1 file changed, 24 insertions(+), 12 deletions(-)
 
 diff --git a/images/capi/packer/ova/packer-node.json b/images/capi/packer/ova/packer-node.json
-index 019119566..161016bf8 100644
+index 019119566..b70c7459d 100644
 --- a/images/capi/packer/ova/packer-node.json
 +++ b/images/capi/packer/ova/packer-node.json
 @@ -165,6 +165,12 @@
@@ -98,5 +98,5 @@ index 019119566..161016bf8 100644
    }
  }
 -- 
-2.24.3 (Apple Git-128)
+2.25.1
 

projects/kubernetes-sigs/image-builder/patches/0004-Create-etc-pki-tls-certs-dir-as-part-of-image-builds.patch

@@ -1,7 +1,7 @@
-From cbbf54d7897915e560563d94590735362b16fe76 Mon Sep 17 00:00:00 2001
+From 5e8dbf2b9e63897d823ae55e6419593be478c315 Mon Sep 17 00:00:00 2001
 From: Vignesh Goutham Ganesh <[email protected]>
 Date: Tue, 11 Jan 2022 21:05:13 -0800
-Subject: [PATCH 4/8] Create /etc/pki/tls/certs dir as part of image-builds
+Subject: [PATCH 4/9] Create /etc/pki/tls/certs dir as part of image-builds
 
 Signed-off-by: Vignesh Goutham Ganesh <[email protected]>
 ---
@@ -29,5 +29,5 @@ index dd7e705f6..a221651a8 100644
    file:
      path: /etc/systemd/system/containerd.service.d/http-proxy.conf
 -- 
-2.24.3 (Apple Git-128)
+2.25.1