Deploy releases/k8s-manifests 454249c

.github/workflows/k8s-deploy.yml

@@ -31,10 +31,14 @@ jobs:
         echo -n '' > /tmp/kube.err
 
     - name: 'Apply manifests: CRD resources'
+      # Server-side apply avoids the 256KB metadata.annotations limit hit by
+      # client-side apply's last-applied-configuration on large CRDs (e.g.
+      # cnpg's poolers.postgresql.cnpg.io). --force-conflicts lets us reclaim
+      # ownership from any prior client-side annotation during migration.
       run: |
         if [ -d ./_/CustomResourceDefinition ]; then
           # Capture errors and add context
-          dir_errors=$(kubectl apply -Rf ./_/CustomResourceDefinition 2>&1 1>>/tmp/kube.log || true)
+          dir_errors=$(kubectl apply --server-side --force-conflicts -Rf ./_/CustomResourceDefinition 2>&1 1>>/tmp/kube.log || true)
 
           # Filter and append errors with context if meaningful
           filtered_errors=$(echo "$dir_errors" | \

_/ClusterIssuer/letsencrypt-prod-gateway.yaml

@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod-gateway
+spec:
+  acme:
+    email: services@codeforphilly.org
+    privateKeySecretRef:
+      name: letsencrypt-prod-gateway
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+      - http01:
+          gatewayHTTPRoute:
+            parentRefs:
+              - group: gateway.networking.k8s.io
+                kind: Gateway
+                name: main-gateway
+                namespace: envoy-gateway-system

_/ClusterIssuer/letsencrypt-staging-gateway.yaml

@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging-gateway
+spec:
+  acme:
+    email: services@codeforphilly.org
+    privateKeySecretRef:
+      name: letsencrypt-staging-gateway
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    solvers:
+      - http01:
+          gatewayHTTPRoute:
+            parentRefs:
+              - group: gateway.networking.k8s.io
+                kind: Gateway
+                name: main-gateway
+                namespace: envoy-gateway-system

_/ClusterRole/cert-manager-cainjector.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cainjector
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-cainjector
 rules:
   - apiGroups:

_/ClusterRole/cert-manager-cluster-view.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
     rbac.authorization.k8s.io/aggregate-to-cluster-reader: 'true'
   name: cert-manager-cluster-view
 rules:

_/ClusterRole/cert-manager-controller-approve:cert-manager-io.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-controller-approve:cert-manager-io
 rules:
   - apiGroups:

_/ClusterRole/cert-manager-controller-certificates.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-controller-certificates
 rules:
   - apiGroups:

_/ClusterRole/cert-manager-controller-certificatesigningrequests.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-controller-certificatesigningrequests
 rules:
   - apiGroups:

_/ClusterRole/cert-manager-controller-challenges.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-controller-challenges
 rules:
   - apiGroups:

_/ClusterRole/cert-manager-controller-clusterissuers.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-controller-clusterissuers
 rules:
   - apiGroups:

_/ClusterRole/cert-manager-controller-ingress-shim.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-controller-ingress-shim
 rules:
   - apiGroups:
@@ -50,6 +50,7 @@ rules:
     resources:
       - gateways
       - httproutes
+      - listenersets
     verbs:
       - get
       - list
@@ -59,6 +60,7 @@ rules:
     resources:
       - gateways/finalizers
       - httproutes/finalizers
+      - listenersets/finalizers
     verbs:
       - update
   - apiGroups:

_/ClusterRole/cert-manager-controller-issuers.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-controller-issuers
 rules:
   - apiGroups:

_/ClusterRole/cert-manager-controller-orders.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-controller-orders
 rules:
   - apiGroups:
@@ -50,6 +50,13 @@ rules:
       - orders/finalizers
     verbs:
       - update
+  - apiGroups:
+      - cert-manager.io
+    resources:
+      - clusterissuers/finalizers
+      - issuers/finalizers
+    verbs:
+      - update
   - apiGroups:
       - ''
     resources:

_/ClusterRole/cert-manager-edit.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
     rbac.authorization.k8s.io/aggregate-to-admin: 'true'
     rbac.authorization.k8s.io/aggregate-to-edit: 'true'
   name: cert-manager-edit

_/ClusterRole/cert-manager-view.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
     rbac.authorization.k8s.io/aggregate-to-admin: 'true'
     rbac.authorization.k8s.io/aggregate-to-cluster-reader: 'true'
     rbac.authorization.k8s.io/aggregate-to-edit: 'true'

_/ClusterRole/cert-manager-webhook:subjectaccessreviews.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: webhook
-    app.kubernetes.io/version: v1.10.1
-    helm.sh/chart: cert-manager-v1.10.1
+    app.kubernetes.io/version: v1.20.2
+    helm.sh/chart: cert-manager-v1.20.2
   name: cert-manager-webhook:subjectaccessreviews
 rules:
   - apiGroups:

_/ClusterRole/envoy-gateway-gateway-helm-certgen:envoy-gateway-system.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    helm.sh/hook: pre-install, pre-upgrade
+    helm.sh/hook-weight: '-1'
+  labels:
+    app.kubernetes.io/instance: envoy-gateway
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: gateway-helm
+    app.kubernetes.io/version: v1.7.3
+    helm.sh/chart: gateway-helm-v1.7.3
+  name: envoy-gateway-gateway-helm-certgen:envoy-gateway-system
+rules:
+  - apiGroups:
+      - admissionregistration.k8s.io
+    resources:
+      - mutatingwebhookconfigurations
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - admissionregistration.k8s.io
+    resourceNames:
+      - envoy-gateway-topology-injector.envoy-gateway-system
+    resources:
+      - mutatingwebhookconfigurations
+    verbs:
+      - update
+      - patch