Merge pull request #471 from turkenh/bump-xp-1.17

Bump Upbound Crossplane to v1.17.0-up.1
upbound · Sep 16, 2024 · b542783 · b542783
2 parents a1520ae + 5f6de35
commit b542783
Show file tree

Hide file tree

Showing 34 changed files with 2,361 additions and 213 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -229,7 +229,7 @@ jobs:
           BUILD_ARGS: "--load"
 
       - name: Publish Artifacts to GitHub
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
         with:
           name: output
           path: _output/**

diff --git a/Makefile b/Makefile
@@ -22,8 +22,8 @@ EKS_ADDON_REGISTRY := 709825985650.dkr.ecr.us-east-1.amazonaws.com
 CROSSPLANE_REPO := https://github.com/upbound/crossplane.git
 # Tag corresponds to Docker image tag while commit is git-compatible signature
 # for pulling. They do not always match.
-CROSSPLANE_TAG := v1.16.0-up.1
-CROSSPLANE_COMMIT := v1.16.0-up.1
+CROSSPLANE_TAG := v1.17.0-up.1
+CROSSPLANE_COMMIT := v1.17.0-up.1
 
 export CROSSPLANE_TAG
 

diff --git a/cluster/charts/universal-crossplane/README.md b/cluster/charts/universal-crossplane/README.md
@@ -46,7 +46,7 @@ planes.
 | hostNetwork | bool | `false` | Enable `hostNetwork` for the Crossplane deployment. Caution: enabling `hostNetwork` grants the Crossplane Pod access to the host network namespace. Consider setting `dnsPolicy` to `ClusterFirstWithHostNet`. |
 | image.pullPolicy | string | `"IfNotPresent"` | The image pull policy used for Crossplane and RBAC Manager pods. |
 | image.repository | string | `"xpkg.upbound.io/upbound/crossplane"` | Repository for the Crossplane pod image. |
-| image.tag | string | `"v1.16.0-up.1"` | The Crossplane image tag. Defaults to the value of `appVersion` in `Chart.yaml`. |
+| image.tag | string | `"v1.17.0-up.1"` | The Crossplane image tag. Defaults to the value of `appVersion` in `Chart.yaml`. |
 | imagePullSecrets | list | `[]` | The imagePullSecret names to add to the Crossplane ServiceAccount. |
 | leaderElection | bool | `true` | Enable [leader election](https://docs.crossplane.io/latest/concepts/pods/#leader-election) for the Crossplane pod. |
 | metrics.enabled | bool | `false` | Enable Prometheus path, port and scrape annotations and expose port 8080 for both the Crossplane and RBAC Manager pods. |
@@ -68,6 +68,7 @@ planes.
 | rbacManager.replicas | int | `1` | The number of RBAC Manager pod `replicas` to deploy. |
 | rbacManager.skipAggregatedClusterRoles | bool | `false` | Don't install aggregated Crossplane ClusterRoles. |
 | rbacManager.tolerations | list | `[]` | Add `tolerations` to the RBAC Manager pod deployment. |
+| rbacManager.topologySpreadConstraints | list | `[]` | Add `topologySpreadConstraints` to the RBAC Manager pod deployment. |
 | registryCaBundleConfig.key | string | `""` | The ConfigMap key containing a custom CA bundle to enable fetching packages from registries with unknown or untrusted certificates. |
 | registryCaBundleConfig.name | string | `""` | The ConfigMap name containing a custom CA bundle to enable fetching packages from registries with unknown or untrusted certificates. |
 | replicas | int | `1` | The number of Crossplane pod `replicas` to deploy. |
@@ -90,5 +91,6 @@ planes.
 | service.customAnnotations | object | `{}` | Configure annotations on the service object. Only enabled when webhooks.enabled = true |
 | serviceAccount.customAnnotations | object | `{}` | Add custom `annotations` to the Crossplane ServiceAccount. |
 | tolerations | list | `[]` | Add `tolerations` to the Crossplane pod deployment. |
+| topologySpreadConstraints | list | `[]` | Add `topologySpreadConstraints` to the Crossplane pod deployment. |
 | webhooks.enabled | bool | `true` | Enable webhooks for Crossplane and installed Provider packages. |
 
diff --git a/cluster/charts/universal-crossplane/templates/crossplane/deployment.yaml b/cluster/charts/universal-crossplane/templates/crossplane/deployment.yaml
@@ -243,6 +243,9 @@ spec:
       {{- if .Values.affinity }}
       affinity: {{ toYaml .Values.affinity | nindent 8 }}
       {{- end }}
+      {{- if .Values.topologySpreadConstraints }}
+      topologySpreadConstraints: {{ toYaml .Values.topologySpreadConstraints | nindent 8 }}
+      {{- end }}
       {{- with .Values.dnsPolicy }}
       dnsPolicy: {{ . }}
       {{- end }}
diff --git a/cluster/charts/universal-crossplane/templates/crossplane/rbac-manager-deployment.yaml b/cluster/charts/universal-crossplane/templates/crossplane/rbac-manager-deployment.yaml
@@ -118,6 +118,9 @@ spec:
       {{- if .Values.rbacManager.tolerations }}
       tolerations: {{ toYaml .Values.rbacManager.tolerations | nindent 6 }}
       {{- end }}
+      {{- if .Values.rbacManager.topologySpreadConstraints }}
+      topologySpreadConstraints: {{ toYaml .Values.rbacManager.topologySpreadConstraints | nindent 6 }}
+      {{- end }}
       {{- if .Values.rbacManager.affinity }}
       affinity: {{ toYaml .Values.rbacManager.affinity | nindent 8 }}
       {{- end }}

diff --git a/...r/charts/universal-crossplane/templates/crossplane/rbac-manager-managed-clusterroles.yaml b/...r/charts/universal-crossplane/templates/crossplane/rbac-manager-managed-clusterroles.yaml
@@ -103,6 +103,10 @@ rules:
   - pkg.crossplane.io
   resources: ["*"]
   verbs: ["*"]
+- apiGroups:
+  - secrets.crossplane.io
+  resources: ["*"]
+  verbs: ["*"]
 # Crossplane administrators have access to view CRDs in order to debug XRDs.
 - apiGroups: [apiextensions.k8s.io]
   resources: [customresourcedefinitions]
@@ -139,6 +143,10 @@ rules:
   - pkg.crossplane.io
   resources: ["*"]
   verbs: ["*"]
+- apiGroups:
+  - secrets.crossplane.io
+  resources: ["*"]
+  verbs: ["*"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -166,6 +174,10 @@ rules:
   - pkg.crossplane.io
   resources: ["*"]
   verbs: [get, list, watch]
+- apiGroups:
+  - secrets.crossplane.io
+  resources: ["*"]
+  verbs: [get, list, watch]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

diff --git a/cluster/charts/universal-crossplane/values.yaml b/cluster/charts/universal-crossplane/values.yaml
@@ -11,7 +11,7 @@ image:
   # -- Repository for the Crossplane pod image.
   repository: xpkg.upbound.io/upbound/crossplane
   # -- The Crossplane image tag. Defaults to the value of `appVersion` in `Chart.yaml`.
-  tag: "v1.16.0-up.1"
+  tag: "v1.17.0-up.1"
   # -- The image pull policy used for Crossplane and RBAC Manager pods.
   pullPolicy: IfNotPresent
 
@@ -21,6 +21,8 @@ nodeSelector: {}
 tolerations: []
 # -- Add `affinities` to the Crossplane pod deployment.
 affinity: {}
+# -- Add `topologySpreadConstraints` to the Crossplane pod deployment.
+topologySpreadConstraints: []
 
 # -- Enable `hostNetwork` for the Crossplane deployment. Caution: enabling `hostNetwork` grants the Crossplane Pod access to the host network namespace. Consider setting `dnsPolicy` to `ClusterFirstWithHostNet`.
 hostNetwork: false
@@ -89,6 +91,8 @@ rbacManager:
   tolerations: []
   # -- Add `affinities` to the RBAC Manager pod deployment.
   affinity: {}
+  # -- Add `topologySpreadConstraints` to the RBAC Manager pod deployment.
+  topologySpreadConstraints: []
 
 # -- The PriorityClass name to apply to the Crossplane and RBAC Manager pods.
 priorityClassName: ""

diff --git a/cluster/crds/apiextensions.crossplane.io_compositeresourcedefinitions.yaml b/cluster/crds/apiextensions.crossplane.io_compositeresourcedefinitions.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -79,6 +80,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: atomic
                   kind:
                     description: |-
                       kind is the serialized kind of the resource. It is normally CamelCase and singular.
@@ -103,6 +105,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: atomic
                   singular:
                     description: singular is the singular name of the resource. It
                       must be all lowercase. Defaults to lowercased `kind`.
@@ -111,6 +114,9 @@ spec:
                 - kind
                 - plural
                 type: object
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               connectionSecretKeys:
                 description: |-
                   ConnectionSecretKeys is the list of keys that will be exposed to the end
@@ -222,6 +228,7 @@ spec:
                         items:
                           type: string
                         type: array
+                        x-kubernetes-list-type: atomic
                     required:
                     - conversionReviewVersions
                     type: object
@@ -268,12 +275,18 @@ spec:
                 required:
                 - name
                 type: object
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               group:
                 description: |-
                   Group specifies the API group of the defined composite resource.
                   Composite resources are served under `/apis/<group>/...`. Must match the
                   name of the XRD (in the form `<names.plural>.<group>`).
                 type: string
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               metadata:
                 description: Metadata specifies the desired metadata for the defined
                   composite resource and claim CRD's.
@@ -312,6 +325,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: atomic
                   kind:
                     description: |-
                       kind is the serialized kind of the resource. It is normally CamelCase and singular.
@@ -336,6 +350,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: atomic
                   singular:
                     description: singular is the singular name of the resource. It
                       must be all lowercase. Defaults to lowercased `kind`.
@@ -344,6 +359,9 @@ spec:
                 - kind
                 - plural
                 type: object
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               versions:
                 description: |-
                   Versions is the list of all API versions of the defined composite

diff --git a/cluster/crds/apiextensions.crossplane.io_compositionrevisions.yaml b/cluster/crds/apiextensions.crossplane.io_compositionrevisions.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -78,6 +79,9 @@ spec:
                 - apiVersion
                 - kind
                 type: object
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               environment:
                 description: |-
                   Environment configures the environment in which resources are rendered.
@@ -584,17 +588,20 @@ spec:
                   Mode controls what type or "mode" of Composition will be used.
 
 
-                  "Resources" (the default) indicates that a Composition uses what is
-                  commonly referred to as "Patch & Transform" or P&T composition. This mode
-                  of Composition uses an array of resources, each a template for a composed
-                  resource.
+                  "Pipeline" indicates that a Composition specifies a pipeline of
+                  Composition Functions, each of which is responsible for producing
+                  composed resources that Crossplane should create or update.
 
 
-                  "Pipeline" indicates that a Composition specifies a pipeline
-                  of Composition Functions, each of which is responsible for producing
-                  composed resources that Crossplane should create or update. THE PIPELINE
-                  MODE IS A BETA FEATURE. It is not honored if the relevant Crossplane
-                  feature flag is disabled.
+                  "Resources" indicates that a Composition uses what is commonly referred
+                  to as "Patch & Transform" or P&T composition. This mode of Composition
+                  uses an array of resources, each a template for a composed resource.
+
+
+                  All Compositions should use Pipeline mode. Resources mode is deprecated.
+                  Resources mode won't be removed in Crossplane 1.x, and will remain the
+                  default to avoid breaking legacy Compositions. However, it's no longer
+                  accepting new features, and only accepting security related bug fixes.
                 enum:
                 - Resources
                 - Pipeline
@@ -608,6 +615,9 @@ spec:
 
                   PatchSets are only used by the "Resources" mode of Composition. They
                   are ignored by other modes.
+
+
+                  Deprecated: Use Composition Functions instead.
                 items:
                   description: |-
                     A PatchSet is a set of patches that can be reused from all resources within
@@ -984,10 +994,6 @@ spec:
 
                   The Pipeline is only used by the "Pipeline" mode of Composition. It is
                   ignored by other modes.
-
-
-                  THIS IS A BETA FIELD. It is not honored if the relevant Crossplane
-                  feature flag is disabled.
                 items:
                   description: A PipelineStep in a Composition Function pipeline.
                   properties:
@@ -1058,6 +1064,9 @@ spec:
                   - step
                   type: object
                 type: array
+                x-kubernetes-list-map-keys:
+                - step
+                x-kubernetes-list-type: map
               publishConnectionDetailsWithStoreConfigRef:
                 default:
                   name: default
@@ -1085,6 +1094,9 @@ spec:
 
                   Resources are only used by the "Resources" mode of Composition. They are
                   ignored by other modes.
+
+
+                  Deprecated: Use Composition Functions instead.
                 items:
                   description: |-
                     ComposedTemplate is used to provide information about how the composed resource
@@ -1578,6 +1590,9 @@ spec:
                 description: Revision number. Newer revisions have larger numbers.
                 format: int64
                 type: integer
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               writeConnectionSecretsToNamespace:
                 description: |-
                   WriteConnectionSecretsToNamespace specifies the namespace in which the
@@ -1711,6 +1726,9 @@ spec:
                 - apiVersion
                 - kind
                 type: object
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               environment:
                 description: |-
                   Environment configures the environment in which resources are rendered.
@@ -2217,17 +2235,20 @@ spec:
                   Mode controls what type or "mode" of Composition will be used.
 
 
-                  "Resources" (the default) indicates that a Composition uses what is
-                  commonly referred to as "Patch & Transform" or P&T composition. This mode
-                  of Composition uses an array of resources, each a template for a composed
-                  resource.
+                  "Pipeline" indicates that a Composition specifies a pipeline of
+                  Composition Functions, each of which is responsible for producing
+                  composed resources that Crossplane should create or update.
 
 
-                  "Pipeline" indicates that a Composition specifies a pipeline
-                  of Composition Functions, each of which is responsible for producing
-                  composed resources that Crossplane should create or update. THE PIPELINE
-                  MODE IS A BETA FEATURE. It is not honored if the relevant Crossplane
-                  feature flag is disabled.
+                  "Resources" indicates that a Composition uses what is commonly referred
+                  to as "Patch & Transform" or P&T composition. This mode of Composition
+                  uses an array of resources, each a template for a composed resource.
+
+
+                  All Compositions should use Pipeline mode. Resources mode is deprecated.
+                  Resources mode won't be removed in Crossplane 1.x, and will remain the
+                  default to avoid breaking legacy Compositions. However, it's no longer
+                  accepting new features, and only accepting security related bug fixes.
                 enum:
                 - Resources
                 - Pipeline
@@ -2241,6 +2262,9 @@ spec:
 
                   PatchSets are only used by the "Resources" mode of Composition. They
                   are ignored by other modes.
+
+
+                  Deprecated: Use Composition Functions instead.
                 items:
                   description: |-
                     A PatchSet is a set of patches that can be reused from all resources within
@@ -2617,10 +2641,6 @@ spec:
 
                   The Pipeline is only used by the "Pipeline" mode of Composition. It is
                   ignored by other modes.
-
-
-                  THIS IS A BETA FIELD. It is not honored if the relevant Crossplane
-                  feature flag is disabled.
                 items:
                   description: A PipelineStep in a Composition Function pipeline.
                   properties:
@@ -2691,6 +2711,9 @@ spec:
                   - step
                   type: object
                 type: array
+                x-kubernetes-list-map-keys:
+                - step
+                x-kubernetes-list-type: map
               publishConnectionDetailsWithStoreConfigRef:
                 default:
                   name: default
@@ -2718,6 +2741,9 @@ spec:
 
                   Resources are only used by the "Resources" mode of Composition. They are
                   ignored by other modes.
+
+
+                  Deprecated: Use Composition Functions instead.
                 items:
                   description: |-
                     ComposedTemplate is used to provide information about how the composed resource
@@ -3211,6 +3237,9 @@ spec:
                 description: Revision number. Newer revisions have larger numbers.
                 format: int64
                 type: integer
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
               writeConnectionSecretsToNamespace:
                 description: |-
                   WriteConnectionSecretsToNamespace specifies the namespace in which the