Added all upstream changes to templates

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Updated all templates with changes from upstream release v1.11.9
+
 ## [0.4.2] - 2022-10-14
 
 ### Fixed

helm/cilium/files/nodeinit/prestop.bash

@@ -23,7 +23,7 @@ if ip link show cilium_host; then
 fi
 
 {{- if not (eq .Values.nodeinit.bootstrapFile "") }}
-rm -f {{ .Values.nodeinit.bootstrapFile }}
+rm -f {{ .Values.nodeinit.bootstrapFile | quote }}
 {{- end }}
 
 rm -f /tmp/node-init.cilium.io
@@ -46,7 +46,7 @@ echo "Restarting the kubelet"
 systemctl restart kubelet
 {{- end }}
 
-{{- if (and .Values.gke.enabled (or .Values.masquerade .Values.gke.disableDefaultSnat))}}
+{{- if (and .Values.gke.enabled (or .Values.enableIPv4Masquerade .Values.gke.disableDefaultSnat))}}
 # If the IP-MASQ chain exists, add back default jump rule from the GKE instance configure script
 if iptables -w -t nat -L IP-MASQ > /dev/null; then
   iptables -w -t nat -A POSTROUTING -m comment --comment "ip-masq: ensure nat POSTROUTING directs all non-LOCAL destination traffic to our custom IP-MASQ chain" -m addrtype ! --dst-type LOCAL -j IP-MASQ

helm/cilium/files/nodeinit/startup.bash

@@ -22,9 +22,11 @@ fi
 {{- end }}
 
 {{- if .Values.nodeinit.reconfigureKubelet }}
-# Check if we're running on a GKE containerd flavor.
+# Check if we're running on a GKE containerd flavor as indicated by the presence
+# of the '--container-runtime-endpoint' flag in '/etc/default/kubelet'.
 GKE_KUBERNETES_BIN_DIR="/home/kubernetes/bin"
-if [[ -f "${GKE_KUBERNETES_BIN_DIR}/gke" ]] && command -v containerd &>/dev/null; then
+KUBELET_DEFAULTS_FILE="/etc/default/kubelet"
+if [[ -f "${GKE_KUBERNETES_BIN_DIR}/gke" ]] && [[ $(grep -cF -- '--container-runtime-endpoint' "${KUBELET_DEFAULTS_FILE}") == "1" ]]; then
   echo "GKE *_containerd flavor detected..."
 
   # (GKE *_containerd) Upon node restarts, GKE's containerd images seem to reset
@@ -98,13 +100,13 @@ else
   # (Generic) Alter the kubelet configuration to run in CNI mode
   echo "Changing kubelet configuration to --network-plugin=cni --cni-bin-dir={{ .Values.cni.binPath }}"
   mkdir -p {{ .Values.cni.binPath }}
-  sed -i "s:--network-plugin=kubenet:--network-plugin=cni\ --cni-bin-dir={{ .Values.cni.binPath }}:g" /etc/default/kubelet
+  sed -i "s:--network-plugin=kubenet:--network-plugin=cni\ --cni-bin-dir={{ .Values.cni.binPath }}:g" "${KUBELET_DEFAULTS_FILE}"
 fi
 echo "Restarting the kubelet..."
 systemctl restart kubelet
 {{- end }}
 
-{{- if (and .Values.gke.enabled (or .Values.masquerade .Values.gke.disableDefaultSnat))}}
+{{- if (and .Values.gke.enabled (or .Values.enableIPv4Masquerade .Values.gke.disableDefaultSnat))}}
 # If Cilium is configured to manage masquerading of traffic leaving the node,
 # we need to disable the IP-MASQ chain because even if ip-masq-agent
 # is not installed, the node init script installs some default rules into
@@ -118,7 +120,8 @@ iptables -w -t nat -D POSTROUTING -m comment --comment "ip-masq: ensure nat POST
 {{- end }}
 
 {{- if not (eq .Values.nodeinit.bootstrapFile "") }}
-date > {{ .Values.nodeinit.bootstrapFile }}
+mkdir -p {{ .Values.nodeinit.bootstrapFile | dir | quote }}
+date > {{ .Values.nodeinit.bootstrapFile | quote }}
 {{- end }}
 
 {{- if .Values.azure.enabled }}

helm/cilium/templates/NOTES.txt

@@ -17,6 +17,6 @@
     You have successfully installed {{ title .Chart.Name }}.
 {{- end }}
 
-Your release version is {{ .Chart.AppVersion }}.
+Your release version is {{ .Chart.Version }}.
 
-For any further help, visit https://docs.cilium.io/en/v{{ (semver .Chart.AppVersion).Major }}.{{ (semver .Chart.AppVersion).Minor }}/gettinghelp
+For any further help, visit https://docs.cilium.io/en/v{{ (semver .Chart.Version).Major }}.{{ (semver .Chart.Version).Minor }}/gettinghelp

helm/cilium/templates/_helpers.tpl

@@ -19,8 +19,12 @@ will return `quay.io/cilium/cilium:v1.10.1@abcdefgh`
 */}}
 {{- define "cilium.image" -}}
 {{- $digest := (.useDigest | default false) | ternary (printf "@%s" .digest) "" -}}
+{{- if .override -}}
+{{- printf "%s" .override -}}
+{{- else -}}
 {{- printf "%s:%s%s" .repository .tag $digest -}}
 {{- end -}}
+{{- end -}}
 
 {{/*
 Return user specify priorityClass or default criticalPriorityClass

helm/cilium/templates/cilium-agent/clusterrole.yaml

@@ -28,39 +28,22 @@ rules:
   resources:
   - namespaces
   - services
-  - nodes
-  - endpoints
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
   - pods
-  - pods/finalizers
-  verbs:
-  - get
-  - list
-  - watch
-  - update
-  - delete
-- apiGroups:
-  - ""
-  resources:
+  - endpoints
   - nodes
   verbs:
   - get
   - list
   - watch
-  - update
+{{- if .Values.annotateK8sNode }}
 - apiGroups:
   - ""
   resources:
-  - nodes
   - nodes/status
   verbs:
+  # To annotate the k8s node with Cilium's metadata
   - patch
+{{- end }}
 - apiGroups:
   - apiextensions.k8s.io
   resources:
@@ -89,21 +72,15 @@ rules:
   resources:
   - ciliumnetworkpolicies
   - ciliumnetworkpolicies/status
-  - ciliumnetworkpolicies/finalizers
   - ciliumclusterwidenetworkpolicies
   - ciliumclusterwidenetworkpolicies/status
-  - ciliumclusterwidenetworkpolicies/finalizers
   - ciliumendpoints
   - ciliumendpoints/status
-  - ciliumendpoints/finalizers
   - ciliumnodes
   - ciliumnodes/status
-  - ciliumnodes/finalizers
   - ciliumidentities
-  - ciliumidentities/finalizers
   - ciliumlocalredirectpolicies
   - ciliumlocalredirectpolicies/status
-  - ciliumlocalredirectpolicies/finalizers
   - ciliumegressnatpolicies
   - ciliumendpointslices
   verbs: