Add support for Linkerd 2.13

In Linkerd 2.13 the Prometheus instance in
the `linkerd-viz` namespace is now locked behind an
[_AuthorizationPolicy_](https://github.com/linkerd/linkerd2/blob/stable-2.13.1/viz/charts/linkerd-viz/templates/prometheus-policy.yaml)
that only allows access to the `metrics-api` _ServiceAccount_.

This adds an extra _AuthorizationPolicy_ to authorize the `flagger`
_ServiceAccount_. It's created by default when using Kustomize, but
needs to be opted-in when using Helm via the new
`linkerdAuthPolicy.create` value. This also implies that the Flagger
workload has to be injected by the Linkerd proxy, and that can't happen
in the same `linkerd` namespace where the control plane lives, so we're
moving Flagger into the new injected `flagger-system` namespace.

The `namespace` field in `kustomization.yml` was resetting the namespace
for the new _AuthorizationPolicy_ resource, so that gets restored back
  to `linkerd-viz` using a `patchesJson6902` entry. A better way to do
  this would have been to use the `unsetOnly` field in a
  _NamespaceTransformer_ (see kubernetes-sigs/kustomize#4708) but for
  the life of me I couldn't make that work...

Signed-off-by: Alejandro Pedraza <alejandro@buoyant.io>

test/linkerd/install.sh

@@ -2,24 +2,44 @@
 
 set -o errexit
 
-LINKERD_VER="stable-2.11.2"
+LINKERD_VER="stable-2.13.2"
+LINKERD_SMI_VER="0.2.0"
 REPO_ROOT=$(git rev-parse --show-toplevel)
 
 mkdir -p ${REPO_ROOT}/bin
 
 curl -SsL https://github.com/linkerd/linkerd2/releases/download/${LINKERD_VER}/linkerd2-cli-${LINKERD_VER}-linux-amd64 > ${REPO_ROOT}/bin/linkerd
 chmod +x ${REPO_ROOT}/bin/linkerd
+curl -SsL https://github.com/linkerd/linkerd-smi/releases/download/v${LINKERD_SMI_VER}/linkerd-smi-${LINKERD_SMI_VER}-linux-amd64 > ${REPO_ROOT}/bin/linkerd-smi
+chmod +x ${REPO_ROOT}/bin/linkerd-smi
 
 echo ">>> Installing Linkerd ${LINKERD_VER}"
+${REPO_ROOT}/bin/linkerd install --crds | kubectl apply -f -
 ${REPO_ROOT}/bin/linkerd install | kubectl apply -f -
 ${REPO_ROOT}/bin/linkerd check
 
+echo ">>> Installing Linkerd SMI"
+${REPO_ROOT}/bin/linkerd-smi install | kubectl apply -f -
+${REPO_ROOT}/bin/linkerd-smi check
+
 echo ">>> Installing Linkerd Viz"
 ${REPO_ROOT}/bin/linkerd viz install | kubectl apply -f -
+kubectl -n linkerd-viz rollout status deploy/prometheus
 ${REPO_ROOT}/bin/linkerd viz check
 
+# Scale down Deployments we don't need as they take up CPU and block other
+# pods from being scheduled later.
+kubectl -n linkerd-viz scale deploy web --replicas=0
+kubectl -n linkerd-viz scale deploy tap --replicas=0
+kubectl -n linkerd-viz scale deploy tap-injector --replicas=0
+kubectl -n linkerd-viz scale deploy metrics-api --replicas=0
+# Delete this APIService as it blocks the deletion of the test ns later
+# (since we delete the linkerd-viz/tap Deployment which in turns makes the
+# APIService unavailable due to missing Endpoints).
+kubectl delete apiservices v1alpha1.tap.linkerd.io
+
 echo '>>> Installing Flagger'
 kubectl apply -k ${REPO_ROOT}/kustomize/linkerd
 
-kubectl -n linkerd set image deployment/flagger flagger=test/flagger:latest
-kubectl -n linkerd rollout status deployment/flagger
+kubectl -n flagger-system set image deployment/flagger flagger=test/flagger:latest
+kubectl -n flagger-system rollout status deployment/flagger

test/linkerd/run.sh

@@ -8,7 +8,11 @@ DIR="$(cd "$(dirname "$0")" && pwd)"
 "$DIR"/install.sh
 
 "$REPO_ROOT"/test/workloads/init.sh
+# Delete Daemonset as it eats up precious CPU requests and we don't need it anyway.
+kubectl -n test delete ds podinfo-ds
 "$DIR"/test-canary.sh
 
 "$REPO_ROOT"/test/workloads/init.sh
+# Delete Daemonset as it eats up precious CPU requests and we don't need it anyway.
+kubectl -n test delete ds podinfo-ds
 "$DIR"/test-steps.sh

test/linkerd/test-canary.sh

@@ -122,7 +122,7 @@ until ${ok}; do
     sleep 5
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -153,10 +153,10 @@ ok=false
 until ${ok}; do
     kubectl -n test describe deployment/podinfo-primary | grep '6.0.1' && ok=true || ok=false
     sleep 10
-    kubectl -n linkerd logs deployment/flagger --tail 1
+    kubectl -n flagger-system logs deployment/flagger flagger --tail 1
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -171,7 +171,7 @@ until ${ok}; do
     sleep 5
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -232,13 +232,13 @@ ok=false
 until ${ok}; do
     kubectl -n test get canary/podinfo | grep 'Failed' && ok=true || ok=false
     sleep 10
-    kubectl -n linkerd logs deployment/flagger --tail 1
+    kubectl -n flagger-system logs deployment/flagger flagger --tail 1
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
 done
 
-echo '✔ Canary rollback test passed'
+echo '✔ Canary rollback test passed'

test/linkerd/test-steps.sh

@@ -50,7 +50,7 @@ until ${ok}; do
     sleep 5
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -68,10 +68,10 @@ ok=false
 until ${ok}; do
     kubectl -n test describe deployment/podinfo-primary | grep '6.0.1' && ok=true || ok=false
     sleep 10
-    kubectl -n linkerd logs deployment/flagger --tail 1
+    kubectl -n flagger-system logs deployment/flagger flagger --tail 1
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -86,7 +86,7 @@ until ${ok}; do
     sleep 5
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi