Merge pull request #1417 from alpeb/linkerd-2.13

Add support for Linkerd 2.13

charts/flagger/README.md

@@ -40,10 +40,13 @@ $ helm upgrade -i flagger flagger/flagger \
 To install Flagger for **Linkerd** (requires Linkerd Viz extension):
 
 ```console
+# Note that linkerdAuthPolicy.create=true is only required for Linkerd 2.12 and
+# later
 $ helm upgrade -i flagger flagger/flagger \
-    --namespace=linkerd \
+    --namespace=flagger-system \
     --set meshProvider=linkerd \
-    --set metricsServer=http://prometheus.linkerd-viz:9090
+    --set metricsServer=http://prometheus.linkerd-viz:9090 \
+    --set linkerdAuthPolicy.create=true
 ```
 
 To install Flagger for **AWS App Mesh**:

charts/flagger/templates/authorizationpolicy.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.linkerdAuthPolicy.create }}
+apiVersion: policy.linkerd.io/v1alpha1
+kind: AuthorizationPolicy
+metadata:
+  namespace: {{ .Values.linkerdAuthPolicy.namespace }}
+  name: prometheus-admin-flagger
+spec:
+  targetRef:
+    group: policy.linkerd.io
+    kind: Server
+    name: prometheus-admin
+  requiredAuthenticationRefs:
+    - kind: ServiceAccount
+      name: {{ template "flagger.serviceAccountName" . }}
+      namespace: {{ .Release.Namespace }}
+{{- end }}

charts/flagger/values.yaml

@@ -16,6 +16,7 @@ podAnnotations:
   prometheus.io/scrape: "true"
   prometheus.io/port: "8080"
   appmesh.k8s.aws/sidecarInjectorWebhook: disabled
+  linkerd.io/inject: enabled
 
 # priority class name for pod priority configuration
 podPriorityClassName: ""
@@ -123,6 +124,13 @@ crd:
   # crd.create: `true` if custom resource definitions should be created
   create: false
 
+linkerdAuthPolicy:
+  # linkerdAuthPolicy.create: Whether to create an AuthorizationPolicy in
+  # linkerd viz' namespace to allow flagger to reach viz' prometheus service
+  create: false
+  # linkerdAuthPolicy.namespace: linkerd-viz' namespace
+  namespace: linkerd-viz
+
 nameOverride: ""
 fullnameOverride: ""
 

docs/gitbook/tutorials/linkerd-progressive-delivery.md

@@ -8,20 +8,55 @@ This guide shows you how to use Linkerd and Flagger to automate canary deploymen
 
 Flagger requires a Kubernetes cluster **v1.16** or newer and Linkerd **2.10** or newer.
 
-Install Linkerd the Promethues (part of Linkerd Viz):
+Install Linkerd and Prometheus (part of Linkerd Viz):
 
 ```bash
+# For linkerd versions 2.12 and later, the CRDs need to be installed beforehand
 linkerd install --crds | kubectl apply -f -
+
 linkerd install | kubectl apply -f -
 linkerd viz install | kubectl apply -f -
+
+# For linkerd versions 2.12 and later, the SMI extension needs to be install in
+# order to enable TrafficSplits
+curl -sL https://linkerd.github.io/linkerd-smi/install | sh
+linkerd smi install | kubectl apply -f -
 ```
 
-Install Flagger in the linkerd namespace:
+Install Flagger in the flagger-system namespace:
 
 ```bash
 kubectl apply -k github.com/fluxcd/flagger//kustomize/linkerd
 ```
 
+If you prefer Helm, these are the commands to install Linkerd, Linkerd Viz,
+Linkerd-SMI and Flagger:
+
+```bash
+helm repo add linkerd https://helm.linkerd.io/stable
+helm install linkerd-crds linkerd/linkerd-crds -n linkerd --create-namespace
+# See https://linkerd.io/2/tasks/generate-certificates/ for how to generate the
+# certs referred below
+helm install linkerd-control-plane linkerd/linkerd-control-plane \
+  -n linkerd \
+  --set-file identityTrustAnchorsPEM=ca.crt \
+  --set-file identity.issuer.tls.crtPEM=issuer.crt \
+  --set-file identity.issuer.tls.keyPEM=issuer.key \
+
+helm install linkerd-viz linkerd/linkerd-viz -n linkerd-viz --create-namespace
+
+helm repo add l5d-smi https://linkerd.github.io/linkerd-smi
+helm install linkerd-smi l5d-smi/linkerd-smi -n linkerd-smi --create-namespace
+
+# Note that linkerdAuthPolicy.create=true is only required for Linkerd 2.12 and
+# later
+helm install flagger flagger/flagger \
+  --n flagger-system \
+  --set meshProvider=linkerd \
+  --set metricsServer=http://prometheus.linkerd-viz:9090 \
+  --set linkerdAuthPolicy.create=true
+```
+
 ## Bootstrap
 
 Flagger takes a Kubernetes deployment and optionally a horizontal pod autoscaler (HPA),
@@ -310,7 +345,7 @@ watch -n 1 curl http://podinfo-canary:9898/status/404
 Watch Flagger logs:
 
 ```text
-kubectl -n linkerd logs deployment/flagger -f | jq .msg
+kubectl -n flagger-system logs deployment/flagger -f | jq .msg
 
 Starting canary deployment for podinfo.test
 Pre-rollout check acceptance-test passed

kustomize/linkerd/authorizationpolicy.yaml

@@ -0,0 +1,14 @@
+apiVersion: policy.linkerd.io/v1alpha1
+kind: AuthorizationPolicy
+metadata:
+  namespace: linkerd-viz
+  name: prometheus-admin-flagger
+spec:
+  targetRef:
+    group: policy.linkerd.io
+    kind: Server
+    name: prometheus-admin
+  requiredAuthenticationRefs:
+    - kind: ServiceAccount
+      name: flagger
+      namespace: flagger-system

kustomize/linkerd/kustomization.yaml

@@ -1,5 +1,18 @@
-namespace: linkerd
+namespace: flagger-system
 bases:
   - ../base/flagger/
+  - namespace.yaml
+  - authorizationpolicy.yaml
 patchesStrategicMerge:
   - patch.yaml
+# restore overridden namespace field
+patchesJson6902:
+  - target:
+      group: policy.linkerd.io
+      version: v1alpha1
+      kind: AuthorizationPolicy
+      name: prometheus-admin-flagger
+    patch: |-
+      - op: replace
+        path: /metadata/namespace
+        value: linkerd-viz

kustomize/linkerd/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    linkerd.io/inject: enabled
+  name: flagger-system

kustomize/linkerd/patch.yaml

@@ -24,4 +24,4 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: flagger
-    namespace: linkerd
+    namespace: flagger-system

test/linkerd/install.sh

@@ -2,24 +2,44 @@
 
 set -o errexit
 
-LINKERD_VER="stable-2.11.2"
+LINKERD_VER="stable-2.13.2"
+LINKERD_SMI_VER="0.2.0"
 REPO_ROOT=$(git rev-parse --show-toplevel)
 
 mkdir -p ${REPO_ROOT}/bin
 
 curl -SsL https://github.com/linkerd/linkerd2/releases/download/${LINKERD_VER}/linkerd2-cli-${LINKERD_VER}-linux-amd64 > ${REPO_ROOT}/bin/linkerd
 chmod +x ${REPO_ROOT}/bin/linkerd
+curl -SsL https://github.com/linkerd/linkerd-smi/releases/download/v${LINKERD_SMI_VER}/linkerd-smi-${LINKERD_SMI_VER}-linux-amd64 > ${REPO_ROOT}/bin/linkerd-smi
+chmod +x ${REPO_ROOT}/bin/linkerd-smi
 
 echo ">>> Installing Linkerd ${LINKERD_VER}"
+${REPO_ROOT}/bin/linkerd install --crds | kubectl apply -f -
 ${REPO_ROOT}/bin/linkerd install | kubectl apply -f -
 ${REPO_ROOT}/bin/linkerd check
 
+echo ">>> Installing Linkerd SMI"
+${REPO_ROOT}/bin/linkerd-smi install | kubectl apply -f -
+${REPO_ROOT}/bin/linkerd-smi check
+
 echo ">>> Installing Linkerd Viz"
 ${REPO_ROOT}/bin/linkerd viz install | kubectl apply -f -
+kubectl -n linkerd-viz rollout status deploy/prometheus
 ${REPO_ROOT}/bin/linkerd viz check
 
+# Scale down Deployments we don't need as they take up CPU and block other
+# pods from being scheduled later.
+kubectl -n linkerd-viz scale deploy web --replicas=0
+kubectl -n linkerd-viz scale deploy tap --replicas=0
+kubectl -n linkerd-viz scale deploy tap-injector --replicas=0
+kubectl -n linkerd-viz scale deploy metrics-api --replicas=0
+# Delete this APIService as it blocks the deletion of the test ns later
+# (since we delete the linkerd-viz/tap Deployment which in turns makes the
+# APIService unavailable due to missing Endpoints).
+kubectl delete apiservices v1alpha1.tap.linkerd.io
+
 echo '>>> Installing Flagger'
 kubectl apply -k ${REPO_ROOT}/kustomize/linkerd
 
-kubectl -n linkerd set image deployment/flagger flagger=test/flagger:latest
-kubectl -n linkerd rollout status deployment/flagger
+kubectl -n flagger-system set image deployment/flagger flagger=test/flagger:latest
+kubectl -n flagger-system rollout status deployment/flagger

test/linkerd/run.sh

@@ -8,7 +8,11 @@ DIR="$(cd "$(dirname "$0")" && pwd)"
 "$DIR"/install.sh
 
 "$REPO_ROOT"/test/workloads/init.sh
+# Delete Daemonset as it eats up precious CPU requests and we don't need it anyway.
+kubectl -n test delete ds podinfo-ds
 "$DIR"/test-canary.sh
 
 "$REPO_ROOT"/test/workloads/init.sh
+# Delete Daemonset as it eats up precious CPU requests and we don't need it anyway.
+kubectl -n test delete ds podinfo-ds
 "$DIR"/test-steps.sh

test/linkerd/test-canary.sh

@@ -122,7 +122,7 @@ until ${ok}; do
     sleep 5
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -153,10 +153,10 @@ ok=false
 until ${ok}; do
     kubectl -n test describe deployment/podinfo-primary | grep '6.0.1' && ok=true || ok=false
     sleep 10
-    kubectl -n linkerd logs deployment/flagger --tail 1
+    kubectl -n flagger-system logs deployment/flagger flagger --tail 1
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -171,7 +171,7 @@ until ${ok}; do
     sleep 5
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -232,13 +232,13 @@ ok=false
 until ${ok}; do
     kubectl -n test get canary/podinfo | grep 'Failed' && ok=true || ok=false
     sleep 10
-    kubectl -n linkerd logs deployment/flagger --tail 1
+    kubectl -n flagger-system logs deployment/flagger flagger --tail 1
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
 done
 
-echo '✔ Canary rollback test passed'
+echo '✔ Canary rollback test passed'

test/linkerd/test-steps.sh

@@ -50,7 +50,7 @@ until ${ok}; do
     sleep 5
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -68,10 +68,10 @@ ok=false
 until ${ok}; do
     kubectl -n test describe deployment/podinfo-primary | grep '6.0.1' && ok=true || ok=false
     sleep 10
-    kubectl -n linkerd logs deployment/flagger --tail 1
+    kubectl -n flagger-system logs deployment/flagger flagger --tail 1
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi
@@ -86,7 +86,7 @@ until ${ok}; do
     sleep 5
     count=$(($count + 1))
     if [[ ${count} -eq ${retries} ]]; then
-        kubectl -n linkerd logs deployment/flagger
+        kubectl -n flagger-system logs deployment/flagger flagger
         echo "No more retries left"
         exit 1
     fi