Merge pull request openshift#104 from openshift-cloud-team/rebase-bot…

…-master OCPBUGS-28244: Merge https://github.com/kubernetes-sigs/cloud-provider-azure:master (de765cc) into master
openshift-cloud-team · Mar 20, 2024 · 8c9dff6 · 8c9dff6
2 parents 494bc60 + dc0bb56
commit 8c9dff6
Show file tree

Hide file tree

Showing 5,137 changed files with 911,347 additions and 135,660 deletions.
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: 'Checkout Repository'
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@c74b580d73376b7750d3d2a50bfb8adc2c937507 # v3.1.5
+        uses: actions/dependency-review-action@9129d7d40b8c12c1ed0f60400d00c92d437adcce # v4.1.3
diff --git a/.github/workflows/lint-ci-weekly.yaml b/.github/workflows/lint-ci-weekly.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
       - name: Setup Golang
@@ -23,9 +23,9 @@ jobs:
           go-version: '>=1.21'
           check-latest: true
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
+        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
           version: latest
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           persist-credentials: false
 
@@ -64,7 +64,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: SARIF file
           path: results.sarif

diff --git a/.github/workflows/update-vendor-license.yml b/.github/workflows/update-vendor-license.yml
@@ -37,12 +37,12 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
       with:
         egress-policy: audit
 
     - name: Checkout repository
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
     - name: Set up Go 1.x
       uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
       with:
@@ -54,7 +54,7 @@ jobs:
       run: |
         make update
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v5
+      uses: peter-evans/create-pull-request@v6
       with:
         branch: doc/update-vendorlicense-${{github.ref_name}}
         delete-branch: true

diff --git a/.gitignore b/.gitignore
@@ -38,3 +38,5 @@ _kubeconfig
 _rundir
 
 site/.hugo_build.lock
+
+.kubeconfig/
diff --git a/.pipelines/run-autoscaling-e2e.yml b/.pipelines/run-autoscaling-e2e.yml
@@ -29,7 +29,7 @@ stages:
         - template: ./cnm-image.yml
     - job: create_aks_cluster_and_run_tests_job
       dependsOn: [build_push_ccm_image_job, build_push_cnm_image_job]
-      timeoutInMinutes: 300
+      timeoutInMinutes: 340
       steps:
         - task: GoTool@0
           inputs:

diff --git a/.pipelines/run-autoscaling-multipool-e2e.yml b/.pipelines/run-autoscaling-multipool-e2e.yml
@@ -29,7 +29,7 @@ stages:
         - template: ./cnm-image.yml
     - job: create_aks_cluster_and_run_tests_job
       dependsOn: [build_push_ccm_image_job, build_push_cnm_image_job]
-      timeoutInMinutes: 300
+      timeoutInMinutes: 340
       steps:
         - task: GoTool@0
           inputs:

diff --git a/.pipelines/scripts/run-e2e.sh b/.pipelines/scripts/run-e2e.sh
@@ -79,6 +79,9 @@ if [[ -z "${AZURE_LOCATION:-}" ]]; then
   export AZURE_LOCATION="$(get_random_location)"
 fi
 
+# TODO: remove this and use user-input CUSTOM_CCM_IMAGE_TAG to defined the image tag for
+# cloud provider azure. This will remove dependency on cloud-provider-azure repo, and use
+# explicit variables makes the interface more clear.
 if [[ -z "${IMAGE_TAG:-}" ]]; then
   IMAGE_TAG="$(git describe --tags)"
 fi
@@ -110,12 +113,11 @@ fi
 echo "Choose custom config file: ${CUSTOM_CONFIG_PATH:-}"
 
 if [[ "${SKIP_BUILD_KUBETEST2_AKS:-}" != "true" ]]; then
-  rm -rf kubetest2-aks
-  git clone https://github.com/kubernetes-sigs/cloud-provider-azure.git
-  cp -r cloud-provider-azure/kubetest2-aks .
-  rm -rf cloud-provider-azure
-  git config --global --add safe.directory "$(pwd)" || true
-  pushd kubetest2-aks
+  # Considering building kubetest2-aks has no dependency on cloud-provider-azure repo, and to avoid
+  # the potential conflict between the cloud-provider-azure repo and the kubetest2-aks, we use a
+  # tmp folder to clone the cloud-provider-azure repo and build kubetest2-aks. 
+  git clone https://github.com/kubernetes-sigs/cloud-provider-azure.git /tmp/cloud-provider-azure
+  pushd /tmp/cloud-provider-azure/kubetest2-aks
   go get -d sigs.k8s.io/kubetest2@latest
   go install sigs.k8s.io/kubetest2@latest
   go mod tidy
@@ -125,6 +127,7 @@ if [[ "${SKIP_BUILD_KUBETEST2_AKS:-}" != "true" ]]; then
   else
     sudo GOPATH="/home/vsts/go" make install
   fi
+  rm /tmp/cloud-provider-azure -rf
   popd
 fi
 
@@ -148,9 +151,9 @@ kubetest2 aks --up --rgName "${RESOURCE_GROUP:-}" \
 --config "${CLUSTER_CONFIG_PATH:-}" \
 --customConfig "${CUSTOM_CONFIG_PATH}" \
 --clusterName "${CLUSTER_NAME:-}" \
---ccmImageTag "${IMAGE_TAG:-}" \
+--ccmImageTag "${CUSTOM_CCM_IMAGE_TAG:-$IMAGE_TAG}" \
 --casImageTag "${CUSTOM_CAS_IMAGE:-}" \
---kubernetesImageTag "${IMAGE_TAG:-}" \
+--kubernetesImageTag "${CUSTOM_K8S_IMAGE_TAG:-}" \
 --kubeletURL "${KUBELET_URL:-}" \
 --k8sVersion "${AKS_KUBERNETES_VERSION:-}"
 

diff --git a/.pipelines/templates/customconfiguration-autoscaling-multipool.json b/.pipelines/templates/customconfiguration-autoscaling-multipool.json
@@ -3,17 +3,17 @@
     "kube-cloud-controller-manager": {
       "image": "{CUSTOM_CCM_IMAGE}",
       "config": {
-          "--min-resync-period": "10h0m0s",
-          "--profiling": "false",
-          "--v": "6"
+        "--min-resync-period": "10h0m0s",
+        "--profiling": "false",
+        "--v": "6"
       }
     },
     "kube-cloud-node-manager": {
       "image": "{CUSTOM_CNM_IMAGE}",
       "config": {
-          "--node-name": "$(NODE_NAME)",
-          "kube-api-burst": "50",
-          "kube-api-qps": "50"
+        "--node-name": "$(NODE_NAME)",
+        "--kube-api-burst": "50",
+        "--kube-api-qps": "50"
       }
     },
     "cluster-autoscaler": {
@@ -27,4 +27,4 @@
       }
     }
   }
-}
+}
diff --git a/.pipelines/templates/customconfiguration-autoscaling.json b/.pipelines/templates/customconfiguration-autoscaling.json
@@ -3,17 +3,17 @@
     "kube-cloud-controller-manager": {
       "image": "{CUSTOM_CCM_IMAGE}",
       "config": {
-          "--min-resync-period": "10h0m0s",
-          "--profiling": "false",
-          "--v": "6"
+        "--min-resync-period": "10h0m0s",
+        "--profiling": "false",
+        "--v": "6"
       }
     },
     "kube-cloud-node-manager": {
       "image": "{CUSTOM_CNM_IMAGE}",
       "config": {
-          "--node-name": "$(NODE_NAME)",
-          "kube-api-burst": "50",
-          "kube-api-qps": "50"
+        "--node-name": "$(NODE_NAME)",
+        "--kube-api-burst": "50",
+        "--kube-api-qps": "50"
       }
     },
     "cluster-autoscaler": {
@@ -26,4 +26,4 @@
       }
     }
   }
-}
+}
diff --git a/.pipelines/templates/customconfiguration.json b/.pipelines/templates/customconfiguration.json
@@ -3,18 +3,18 @@
     "kube-cloud-controller-manager": {
       "image": "{CUSTOM_CCM_IMAGE}",
       "config": {
-          "--min-resync-period": "10h0m0s",
-          "--profiling": "false",
-          "--v": "6"
+        "--min-resync-period": "10h0m0s",
+        "--profiling": "false",
+        "--v": "6"
       }
     },
     "kube-cloud-node-manager": {
       "image": "{CUSTOM_CNM_IMAGE}",
       "config": {
-          "--node-name": "$(NODE_NAME)",
-          "kube-api-burst": "50",
-          "kube-api-qps": "50"
+        "--node-name": "$(NODE_NAME)",
+        "--kube-api-burst": "50",
+        "--kube-api-qps": "50"
       }
     }
   }
-}
+}
diff --git a/Dockerfile b/Dockerfile
@@ -14,7 +14,7 @@
 
 # syntax=docker/dockerfile:1
 
-FROM --platform=linux/amd64 golang:1.21-bullseye@sha256:3b4ac7623c123263662ec6c62ef7b97a1e47b8c9e03de9e631651b293f5b8e41 AS builder
+FROM --platform=linux/amd64 golang:1.22-bullseye@sha256:1c3919e932f650b7f7304dc68d4b6a17bd0e9250e19bcf2efb62ad6b6ccd1936 AS builder
 
 ARG ENABLE_GIT_COMMAND=true
 ARG ARCH=amd64

diff --git a/Makefile b/Makefile
@@ -372,7 +372,11 @@ clean: ## Cleanup local builds.
 	rm -rf $(BIN_DIR) $(PKG_CONFIG) $(TEST_RESULTS_DIR)
 
 $(PKG_CONFIG):
+ifeq ($(OVERRIDE_PKG_CONFIG), true)
+	@echo "Overriding pkg-config script. Use an alternate method to generate .pkg_config"
+else
 	ENABLE_GIT_COMMAND=$(ENABLE_GIT_COMMAND) hack/pkg-config.sh > $@
+endif
 
 ## --------------------------------------
 ##@ Release

diff --git a/README.md b/README.md
@@ -17,8 +17,8 @@ This is the "external" or "out-of-tree" cloud provider for Azure. The "in-tree"
 
 The latest release of azure-cloud-controller-manager and azure-cloud-node-manager can be found at
 
-* `mcr.microsoft.com/oss/kubernetes/azure-cloud-controller-manager:v1.28.3`
-* `mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.28.3`
+* `mcr.microsoft.com/oss/kubernetes/azure-cloud-controller-manager:v1.29.0`
+* `mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.29.0`
 
 ### Version matrix
 
@@ -27,6 +27,8 @@ The latest release of azure-cloud-controller-manager and azure-cloud-node-manage
 | Kubernetes version | cloud-provider version | cloud-provider branch |
 |--------------------|------------------------|-----------------------|
 | master             | N/A                    | master                |
+| v1.y.x             | v1.y.z                 | release-1.y           |
+| v1.29.x            | v1.29.z                | release-1.29          |
 | v1.28.x            | v1.28.z                | release-1.28          |
 | v1.27.x            | v1.27.z                | release-1.27          |
 | v1.26.x            | v1.26.z                | release-1.26          |
@@ -41,10 +43,11 @@ Below table shows the cloud-controller-manager and cloud-node-manager versions s
 
 | AKS version                 | cloud-controller-manager version | cloud-node-manager version |
 |-----------------------------|----------------------------------|----------------------------|
-| v1.28.x                     | v1.28.3                          | v1.28.0                    |
-| v1.27.x                     | v1.27.11                         | v1.27.4                    |
-| v1.26.x                     | v1.26.17                         | v1.26.10                   |
-| v1.25.x                     | v1.25.21                         | v1.25.14                   |
+| v1.29.x                     | v1.29.0                          | v1.29.0                    |
+| v1.28.x                     | v1.28.5                          | v1.28.5                    |
+| v1.27.x                     | v1.27.13                         | v1.27.13                   |
+| v1.26.x                     | v1.26.19                         | v1.26.19                   |
+| v1.25.x                     | v1.25.24                         | v1.25.24                   |
 | v1.24.x                     | v1.24.21                         | v1.24.20                   |
 | v1.23.x                     | v1.23.30                         | v1.23.24                   |
 | v1.22.x                     | v1.1.26                          | v1.1.14                    |

diff --git a/cloud-node-manager-windows.Dockerfile b/cloud-node-manager-windows.Dockerfile
@@ -29,5 +29,5 @@ ARG ARCH
 
 COPY --from=servercore-helper /Windows/System32/netapi32.dll /Windows/System32/netapi32.dll
 COPY bin/azure-cloud-node-manager-${ARCH}.exe /cloud-node-manager.exe
-USER ContainerAdministrator
+USER ContainerUser
 ENTRYPOINT ["/azure-cloud-node-manager.exe"]
diff --git a/cloud-node-manager.Dockerfile b/cloud-node-manager.Dockerfile
@@ -14,16 +14,26 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=linux/amd64 golang:1.21-bullseye@sha256:3b4ac7623c123263662ec6c62ef7b97a1e47b8c9e03de9e631651b293f5b8e41 AS builder
+FROM --platform=linux/amd64 golang:1.22-bullseye@sha256:1c3919e932f650b7f7304dc68d4b6a17bd0e9250e19bcf2efb62ad6b6ccd1936 AS builder
 
 ARG ENABLE_GIT_COMMAND=true
 ARG ARCH=amd64
 
 WORKDIR /go/src/sigs.k8s.io/cloud-provider-azure
 COPY . .
 
+# Build the Go app
 RUN make bin/azure-cloud-node-manager ENABLE_GIT_COMMAND=${ENABLE_GIT_COMMAND}
 
+# Use distroless static image for a lean production container.
+# Start a new build stage.
 FROM gcr.io/distroless/static
+
+# Create a group and user
+USER 65532:65532
+
+# Copy the pre-built binary file from the previous stage.
 COPY --from=builder /go/src/sigs.k8s.io/cloud-provider-azure/bin/azure-cloud-node-manager /usr/local/bin/cloud-node-manager
+
+# Run the web service on container startup.
 ENTRYPOINT [ "/usr/local/bin/cloud-node-manager" ]
diff --git a/e2e.Dockerfile b/e2e.Dockerfile
@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.21-bullseye@sha256:3b4ac7623c123263662ec6c62ef7b97a1e47b8c9e03de9e631651b293f5b8e41
+FROM golang:1.22-bullseye@sha256:1c3919e932f650b7f7304dc68d4b6a17bd0e9250e19bcf2efb62ad6b6ccd1936
 
 WORKDIR /go/src/sigs.k8s.io/cloud-provider-azure
 

diff --git a/examples/out-of-tree/cloud-controller-manager.yaml b/examples/out-of-tree/cloud-controller-manager.yaml
@@ -166,7 +166,7 @@ spec:
           effect: NoSchedule
       containers:
         - name: cloud-controller-manager
-          image: mcr.microsoft.com/oss/kubernetes/azure-cloud-controller-manager:v1.28.3
+          image: mcr.microsoft.com/oss/kubernetes/azure-cloud-controller-manager:v1.29.0
           imagePullPolicy: IfNotPresent
           command: ["cloud-controller-manager"]
           args:

diff --git a/examples/out-of-tree/cloud-node-manager.yaml b/examples/out-of-tree/cloud-node-manager.yaml
@@ -79,7 +79,7 @@ spec:
         effect: NoSchedule
       containers:
       - name: cloud-node-manager
-        image: mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.28.3
+        image: mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.29.0
         imagePullPolicy: IfNotPresent
         command:
         - cloud-node-manager
@@ -136,7 +136,7 @@ spec:
         effect: NoSchedule
       containers:
       - name: cloud-node-manager
-        image: mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.28.3
+        image: mcr.microsoft.com/oss/kubernetes/azure-cloud-node-manager:v1.29.0
         imagePullPolicy: IfNotPresent
         command:
         - /cloud-node-manager.exe
Original file line number	Diff line number	Diff line change
Expand Up		@@ -38,3 +38,5 @@ _kubeconfig
		_rundir

		site/.hugo_build.lock

		.kubeconfig/