Upgrade to CAPA v2.7.1 + fork changes

giantswarm · Nov 12, 2024 · 422c0b7 · 422c0b7
1 parent 1ed0fde
commit 422c0b7
Show file tree

Hide file tree

Showing 17 changed files with 510 additions and 15 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Bump CAPA version `v2.7.1-gs-*`. This bumps CAPA to `v2.7.1` and applies the customizations we already had in our fork.
+
 ## [2.24.0] - 2024-10-17
 
 ### Added

diff --git a/...plane/patches/versions/v1beta1/awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io.yaml b/...plane/patches/versions/v1beta1/awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io.yaml
@@ -328,6 +328,9 @@
                         items:
                           type: string
                         type: array
+                      natGatewaysIPsSource:
+                        description: NatGatewaysIPsSource use the NAT gateways IPs as the source for the ingress rule.
+                        type: boolean
                       protocol:
                         description: Protocol is the protocol for the ingress rule. Accepted values are "-1" (all), "4" (IP in IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
                         enum:
@@ -399,6 +402,13 @@
                         type: object
                       type: array
                   type: object
+                nodePortIngressRuleCidrBlocks:
+                  description: |-
+                    NodePortIngressRuleCidrBlocks is an optional set of CIDR blocks to allow traffic to nodes' NodePort services.
+                    If none are specified here, all IPs are allowed to connect.
+                  items:
+                    type: string
+                  type: array
                 securityGroupOverrides:
                   additionalProperties:
                     type: string
@@ -551,6 +561,39 @@
                         Defaults to 10.0.0.0/16.
                         Mutually exclusive with IPAMPool.
                       type: string
+                    elasticIpPool:
+                      description: |-
+                        ElasticIPPool contains specific configuration to allocate Public IPv4 address (Elastic IP) from user-defined pool
+                        brought to AWS for core infrastructure resources, like NAT Gateways and Public Network Load Balancers for
+                        the API Server.
+                      properties:
+                        publicIpv4Pool:
+                          description: |-
+                            PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources
+                            created in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom
+                            Public IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool
+                            resource ID starts with 'ipv4pool-ec2'.
+                          maxLength: 30
+                          type: string
+                        publicIpv4PoolFallbackOrder:
+                          description: |-
+                            PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,
+                            no more IPv4 address available in the pool.
+
+
+                            When set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the
+                            IPv4 limit, the address will be claimed from Amazon-pool (default).
+
+
+                            When set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.
+                          enum:
+                            - amazon-pool
+                            - none
+                          type: string
+                          x-kubernetes-validations:
+                            - message: allowed values are 'none' and 'amazon-pool'
+                              rule: self in ['none','amazon-pool']
+                      type: object
                     emptyRoutesDefaultVPCSecurityGroup:
                       description: |-
                         EmptyRoutesDefaultVPCSecurityGroup specifies whether the default VPC security group ingress
@@ -653,6 +696,18 @@
                           - ipv4CidrBlock
                         type: object
                       type: array
+                    subnetSchema:
+                      default: PreferPrivate
+                      description: |-
+                        SubnetSchema specifies how CidrBlock should be divided on subnets in the VPC depending on the number of AZs.
+                        PreferPrivate - one private subnet for each AZ plus one other subnet that will be further sub-divided for the public subnets.
+                        PreferPublic - have the reverse logic of PreferPrivate, one public subnet for each AZ plus one other subnet
+                        that will be further sub-divided for the private subnets.
+                        Defaults to PreferPrivate
+                      enum:
+                        - PreferPrivate
+                        - PreferPublic
+                      type: string
                     tags:
                       additionalProperties:
                         type: string
@@ -807,10 +862,15 @@
                                 description: The key to select.
                                 type: string
                               name:
+                                default: ""
                                 description: |-
                                   Name of the referent.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
                                   TODO: Add other useful fields. apiVersion, kind, uid?
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                                 type: string
                               optional:
                                 description: Specify whether the ConfigMap or its key must be defined
@@ -863,10 +923,15 @@
                                 description: The key of the secret to select from.  Must be a valid secret key.
                                 type: string
                               name:
+                                default: ""
                                 description: |-
                                   Name of the referent.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
                                   TODO: Add other useful fields. apiVersion, kind, uid?
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                                 type: string
                               optional:
                                 description: Specify whether the Secret or its key must be defined
@@ -959,6 +1024,9 @@
                 availabilityZone:
                   description: Availability zone of instance
                   type: string
+                capacityReservationId:
+                  description: CapacityReservationID specifies the target Capacity Reservation into which the instance should be launched.
+                  type: string
                 ebsOptimized:
                   description: Indicates whether the instance is optimized for Amazon EBS I/O.
                   type: boolean
@@ -1713,6 +1781,9 @@
                               items:
                                 type: string
                               type: array
+                            natGatewaysIPsSource:
+                              description: NatGatewaysIPsSource use the NAT gateways IPs as the source for the ingress rule.
+                              type: boolean
                             protocol:
                               description: Protocol is the protocol for the ingress rule. Accepted values are "-1" (all), "4" (IP in IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
                               enum:

diff --git a/...plane/patches/versions/v1beta2/awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io.yaml b/...plane/patches/versions/v1beta2/awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io.yaml
@@ -319,6 +319,9 @@
                         items:
                           type: string
                         type: array
+                      natGatewaysIPsSource:
+                        description: NatGatewaysIPsSource use the NAT gateways IPs as the source for the ingress rule.
+                        type: boolean
                       protocol:
                         description: Protocol is the protocol for the ingress rule. Accepted values are "-1" (all), "4" (IP in IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
                         enum:
@@ -390,6 +393,13 @@
                         type: object
                       type: array
                   type: object
+                nodePortIngressRuleCidrBlocks:
+                  description: |-
+                    NodePortIngressRuleCidrBlocks is an optional set of CIDR blocks to allow traffic to nodes' NodePort services.
+                    If none are specified here, all IPs are allowed to connect.
+                  items:
+                    type: string
+                  type: array
                 securityGroupOverrides:
                   additionalProperties:
                     type: string
@@ -542,6 +552,39 @@
                         Defaults to 10.0.0.0/16.
                         Mutually exclusive with IPAMPool.
                       type: string
+                    elasticIpPool:
+                      description: |-
+                        ElasticIPPool contains specific configuration to allocate Public IPv4 address (Elastic IP) from user-defined pool
+                        brought to AWS for core infrastructure resources, like NAT Gateways and Public Network Load Balancers for
+                        the API Server.
+                      properties:
+                        publicIpv4Pool:
+                          description: |-
+                            PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources
+                            created in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom
+                            Public IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool
+                            resource ID starts with 'ipv4pool-ec2'.
+                          maxLength: 30
+                          type: string
+                        publicIpv4PoolFallbackOrder:
+                          description: |-
+                            PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,
+                            no more IPv4 address available in the pool.
+
+
+                            When set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the
+                            IPv4 limit, the address will be claimed from Amazon-pool (default).
+
+
+                            When set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.
+                          enum:
+                            - amazon-pool
+                            - none
+                          type: string
+                          x-kubernetes-validations:
+                            - message: allowed values are 'none' and 'amazon-pool'
+                              rule: self in ['none','amazon-pool']
+                      type: object
                     emptyRoutesDefaultVPCSecurityGroup:
                       description: |-
                         EmptyRoutesDefaultVPCSecurityGroup specifies whether the default VPC security group ingress
@@ -644,6 +687,18 @@
                           - ipv4CidrBlock
                         type: object
                       type: array
+                    subnetSchema:
+                      default: PreferPrivate
+                      description: |-
+                        SubnetSchema specifies how CidrBlock should be divided on subnets in the VPC depending on the number of AZs.
+                        PreferPrivate - one private subnet for each AZ plus one other subnet that will be further sub-divided for the public subnets.
+                        PreferPublic - have the reverse logic of PreferPrivate, one public subnet for each AZ plus one other subnet
+                        that will be further sub-divided for the private subnets.
+                        Defaults to PreferPrivate
+                      enum:
+                        - PreferPrivate
+                        - PreferPublic
+                      type: string
                     tags:
                       additionalProperties:
                         type: string
@@ -724,6 +779,10 @@
             region:
               description: The AWS Region the cluster lives in.
               type: string
+            restrictPrivateSubnets:
+              default: false
+              description: RestrictPrivateSubnets indicates that the EKS control plane should only use private subnets.
+              type: boolean
             roleAdditionalPolicies:
               description: |-
                 RoleAdditionalPolicies allows you to attach additional polices to
@@ -810,10 +869,15 @@
                                 description: The key to select.
                                 type: string
                               name:
+                                default: ""
                                 description: |-
                                   Name of the referent.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
                                   TODO: Add other useful fields. apiVersion, kind, uid?
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                                 type: string
                               optional:
                                 description: Specify whether the ConfigMap or its key must be defined
@@ -866,10 +930,15 @@
                                 description: The key of the secret to select from.  Must be a valid secret key.
                                 type: string
                               name:
+                                default: ""
                                 description: |-
                                   Name of the referent.
-                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  This field is effectively required, but due to backwards compatibility is
+                                  allowed to be empty. Instances of this type with an empty value here are
+                                  almost certainly wrong.
                                   TODO: Add other useful fields. apiVersion, kind, uid?
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                                 type: string
                               optional:
                                 description: Specify whether the Secret or its key must be defined
@@ -962,6 +1031,9 @@
                 availabilityZone:
                   description: Availability zone of instance
                   type: string
+                capacityReservationId:
+                  description: CapacityReservationID specifies the target Capacity Reservation into which the instance should be launched.
+                  type: string
                 ebsOptimized:
                   description: Indicates whether the instance is optimized for Amazon EBS I/O.
                   type: boolean
@@ -1716,6 +1788,9 @@
                               items:
                                 type: string
                               type: array
+                            natGatewaysIPsSource:
+                              description: NatGatewaysIPsSource use the NAT gateways IPs as the source for the ingress rule.
+                              type: boolean
                             protocol:
                               description: Protocol is the protocol for the ingress rule. Accepted values are "-1" (all), "4" (IP in IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
                               enum: