mirror of
https://github.com/fluxcd/flagger.git
synced 2026-02-28 16:50:31 +00:00
7242fa7d5c
In Linkerd 2.13 the Prometheus instance in the `linkerd-viz` namespace is now locked behind an [_AuthorizationPolicy_](https://github.com/linkerd/linkerd2/blob/stable-2.13.1/viz/charts/linkerd-viz/templates/prometheus-policy.yaml) that only allows access to the `metrics-api` _ServiceAccount_. This adds an extra _AuthorizationPolicy_ to authorize the `flagger` _ServiceAccount_. It's created by default when using Kustomize, but needs to be opted-in when using Helm via the new `linkerdAuthPolicy.create` value. This also implies that the Flagger workload has to be injected by the Linkerd proxy, and that can't happen in the same `linkerd` namespace where the control plane lives, so we're moving Flagger into the new injected `flagger-system` namespace. The `namespace` field in `kustomization.yml` was resetting the namespace for the new _AuthorizationPolicy_ resource, so that gets restored back to `linkerd-viz` using a `patchesJson6902` entry. A better way to do this would have been to use the `unsetOnly` field in a _NamespaceTransformer_ (see kubernetes-sigs/kustomize#4708) but for the life of me I couldn't make that work... Signed-off-by: Alejandro Pedraza <alejandro@buoyant.io>
46 lines
1.8 KiB
Bash
Executable File
46 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -o errexit
|
|
|
|
LINKERD_VER="stable-2.13.2"
|
|
LINKERD_SMI_VER="0.2.0"
|
|
REPO_ROOT=$(git rev-parse --show-toplevel)
|
|
|
|
mkdir -p ${REPO_ROOT}/bin
|
|
|
|
curl -SsL https://github.com/linkerd/linkerd2/releases/download/${LINKERD_VER}/linkerd2-cli-${LINKERD_VER}-linux-amd64 > ${REPO_ROOT}/bin/linkerd
|
|
chmod +x ${REPO_ROOT}/bin/linkerd
|
|
curl -SsL https://github.com/linkerd/linkerd-smi/releases/download/v${LINKERD_SMI_VER}/linkerd-smi-${LINKERD_SMI_VER}-linux-amd64 > ${REPO_ROOT}/bin/linkerd-smi
|
|
chmod +x ${REPO_ROOT}/bin/linkerd-smi
|
|
|
|
echo ">>> Installing Linkerd ${LINKERD_VER}"
|
|
${REPO_ROOT}/bin/linkerd install --crds | kubectl apply -f -
|
|
${REPO_ROOT}/bin/linkerd install | kubectl apply -f -
|
|
${REPO_ROOT}/bin/linkerd check
|
|
|
|
echo ">>> Installing Linkerd SMI"
|
|
${REPO_ROOT}/bin/linkerd-smi install | kubectl apply -f -
|
|
${REPO_ROOT}/bin/linkerd-smi check
|
|
|
|
echo ">>> Installing Linkerd Viz"
|
|
${REPO_ROOT}/bin/linkerd viz install | kubectl apply -f -
|
|
kubectl -n linkerd-viz rollout status deploy/prometheus
|
|
${REPO_ROOT}/bin/linkerd viz check
|
|
|
|
# Scale down Deployments we don't need as they take up CPU and block other
|
|
# pods from being scheduled later.
|
|
kubectl -n linkerd-viz scale deploy web --replicas=0
|
|
kubectl -n linkerd-viz scale deploy tap --replicas=0
|
|
kubectl -n linkerd-viz scale deploy tap-injector --replicas=0
|
|
kubectl -n linkerd-viz scale deploy metrics-api --replicas=0
|
|
# Delete this APIService as it blocks the deletion of the test ns later
|
|
# (since we delete the linkerd-viz/tap Deployment which in turns makes the
|
|
# APIService unavailable due to missing Endpoints).
|
|
kubectl delete apiservices v1alpha1.tap.linkerd.io
|
|
|
|
echo '>>> Installing Flagger'
|
|
kubectl apply -k ${REPO_ROOT}/kustomize/linkerd
|
|
|
|
kubectl -n flagger-system set image deployment/flagger flagger=test/flagger:latest
|
|
kubectl -n flagger-system rollout status deployment/flagger
|