kube-1.28 to alpha

cluster/config-defaults.yaml

@@ -923,10 +923,12 @@ stackset_ingress_source_switch_ttl: "5m"
 # enable/disable inline configmap support for stackset
 stackset_inline_configmap_support_enabled: "false"
 
+# enable/disable platformCredentialsSet support for stackset
+stackset_pcs_support_enabled: "false"
+
 # Enable/Disable profiling for Kubernetes components
 enable_control_plane_profiling: "false"
 
-okta_auth_enabled: "true"
 okta_auth_issuer_url: ""
 okta_auth_client_id: "kubernetes.cluster.{{.Cluster.Alias}}"
 

cluster/manifests/deletions.yaml

@@ -41,10 +41,6 @@ post_apply:
 - name: spot-node-rescheduler
   kind: ClusterRoleBinding
 {{ end }}
-{{- if ne .Cluster.ConfigItems.okta_auth_enabled "true" }}
-- name: cluster-admin-okta
-  kind: ClusterRoleBinding
-{{- end }}
 
 {{ if ne .Cluster.ConfigItems.skipper_ingress_canary_enabled "true" }}
 - name: skipper-ingress-canary

cluster/manifests/roles/cluster-admin-binding.yaml

@@ -1,4 +1,3 @@
-{{- if eq .Cluster.ConfigItems.okta_auth_enabled "true" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -11,4 +10,3 @@ subjects:
 - apiGroup: rbac.authorization.k8s.io
   kind: Group
   name: okta:common/administrator
-{{- end }}

cluster/manifests/roles/collaborator-roles.yaml

@@ -34,8 +34,6 @@ subjects:
 - kind: Group
   name: CollaboratorEmergency
   apiGroup: rbac.authorization.k8s.io
-{{- if eq .Cluster.ConfigItems.okta_auth_enabled "true" }}
 - kind: Group
   name: "okta:common/collaborator"
   apiGroup: rbac.authorization.k8s.io
-{{- end }}

cluster/manifests/roles/poweruser-binding.yaml

@@ -21,11 +21,9 @@ subjects:
 - kind: Group
   name: Emergency
   apiGroup: rbac.authorization.k8s.io
-{{- if eq .Cluster.ConfigItems.okta_auth_enabled "true" }}
 - kind: Group
   name: "okta:common/engineer"
   apiGroup: rbac.authorization.k8s.io
 - kind: Group
   name: "okta:common/collaborator"
   apiGroup: rbac.authorization.k8s.io
-{{- end }}

cluster/manifests/roles/readonly-binding.yaml

@@ -10,7 +10,6 @@ subjects:
   - kind: Group
     name: ReadOnly
     apiGroup: rbac.authorization.k8s.io
-  # {{ if eq .Cluster.ConfigItems.okta_auth_enabled "true" }}
   - kind: Group
     name: "okta:common/engineer"
     apiGroup: rbac.authorization.k8s.io
@@ -20,7 +19,6 @@ subjects:
   - kind: Group
     name: "okta:common/read-only"
     apiGroup: rbac.authorization.k8s.io
-  # {{ end }}
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -35,7 +33,6 @@ subjects:
   - kind: Group
     name: ReadOnly
     apiGroup: rbac.authorization.k8s.io
-  # {{ if eq .Cluster.ConfigItems.okta_auth_enabled "true" }}
   - kind: Group
     name: "okta:common/engineer"
     apiGroup: rbac.authorization.k8s.io
@@ -45,7 +42,6 @@ subjects:
   - kind: Group
     name: "okta:common/read-only"
     apiGroup: rbac.authorization.k8s.io
-  # {{ end }}
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -60,7 +56,6 @@ subjects:
   - kind: Group
     name: ReadOnly
     apiGroup: rbac.authorization.k8s.io
-  # {{ if eq .Cluster.ConfigItems.okta_auth_enabled "true" }}
   - kind: Group
     name: "okta:common/engineer"
     apiGroup: rbac.authorization.k8s.io
@@ -70,4 +65,3 @@ subjects:
   - kind: Group
     name: "okta:common/read-only"
     apiGroup: rbac.authorization.k8s.io
-  # {{ end }}

cluster/manifests/stackset-controller/01-stack-crd.yaml

@@ -370,6 +370,26 @@ spec:
                           description: Name of the ConfigMap
                           type: string
                       type: object
+{{ end }}
+{{- if eq .Cluster.ConfigItems.stackset_pcs_support_enabled "true" }}
+                    platformCredentialsSet:
+                      description: PlatformCredentialsSet to be created and owned
+                        by Stack
+                      properties:
+                        name:
+                          type: string
+                        tokens:
+                          additionalProperties:
+                            properties:
+                              privileges:
+                                items:
+                                  type: string
+                                type: array
+                            required:
+                            - privileges
+                            type: object
+                          type: object
+                      type: object
 {{ end }}
                     configMapRef:
                       description: ConfigMap to be owned by Stack

cluster/manifests/stackset-controller/01-stackset-crd.yaml

@@ -617,6 +617,26 @@ spec:
                                   description: Name of the ConfigMap
                                   type: string
                               type: object
+{{ end }}
+{{- if eq .Cluster.ConfigItems.stackset_pcs_support_enabled "true" }}
+                            platformCredentialsSet:
+                              description: PlatformCredentialsSet to be created and owned
+                                by Stack
+                              properties:
+                                name:
+                                  type: string
+                                tokens:
+                                  additionalProperties:
+                                    properties:
+                                      privileges:
+                                        items:
+                                          type: string
+                                        type: array
+                                    required:
+                                    - privileges
+                                    type: object
+                                  type: object
+                              type: object
 {{ end }}
                             configMapRef:
                               description: ConfigMap to be owned by Stack

cluster/manifests/z-karpenter/04-clusterrole.yaml

@@ -10,13 +10,13 @@ metadata:
     component: karpenter
 rules:
   # Read
-  - apiGroups: [ "karpenter.k8s.aws" ]
-    resources: [ "ec2nodeclasses" ]
-    verbs: [ "get", "list", "watch" ]
+  - apiGroups: ["karpenter.k8s.aws"]
+    resources: ["ec2nodeclasses"]
+    verbs: ["get", "list", "watch"]
   # Write
-  - apiGroups: [ "karpenter.k8s.aws" ]
-    resources: [ "ec2nodeclasses", "ec2nodeclasses/status" ]
-    verbs: [ "patch", "update" ]
+  - apiGroups: ["karpenter.k8s.aws"]
+    resources: ["ec2nodeclasses", "ec2nodeclasses/status"]
+    verbs: ["patch", "update"]
 ---
 # Source: karpenter/templates/04-clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1

cluster/manifests/z-karpenter/05-clusterrole-core.yaml

@@ -37,7 +37,7 @@ rules:
     verbs: ["create", "patch"]
   - apiGroups: [""]
     resources: ["nodes"]
-    verbs: ["create", "patch", "delete"]
+    verbs: ["patch", "delete"]
   - apiGroups: [""]
     resources: ["pods/eviction"]
     verbs: ["create"]