1.34

.devcontainer/devcontainer.json

@@ -11,9 +11,10 @@
 				"files.trimTrailingWhitespace": false
 			},
 			"extensions": [
-				"editorconfig.editorconfig",
 				"davidanson.vscode-markdownlint",
-				"ms-kubernetes-tools.vscode-kubernetes-tools"
+				"editorconfig.editorconfig",
+				"ms-kubernetes-tools.vscode-kubernetes-tools",
+				"streetsidesoftware.code-spell-checker"
 			]
 		},
 		"codespaces": {

.github/workflows/kind-configs/default.yaml

@@ -2,11 +2,11 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
 - role: control-plane
-  image: kindest/node:v1.33.4@sha256:25a6018e48dfcaee478f4a59af81157a437f15e6e140bf103f85a2e7cd0cbbf2
+  image: kindest/node:v1.34.3@sha256:08497ee19eace7b4b5348db5c6a1591d7752b164530a36f855cb0f2bdcbadd48
 - role: worker
-  image: kindest/node:v1.33.4@sha256:25a6018e48dfcaee478f4a59af81157a437f15e6e140bf103f85a2e7cd0cbbf2
+  image: kindest/node:v1.34.3@sha256:08497ee19eace7b4b5348db5c6a1591d7752b164530a36f855cb0f2bdcbadd48
 - role: worker
-  image: kindest/node:v1.33.4@sha256:25a6018e48dfcaee478f4a59af81157a437f15e6e140bf103f85a2e7cd0cbbf2
+  image: kindest/node:v1.34.3@sha256:08497ee19eace7b4b5348db5c6a1591d7752b164530a36f855cb0f2bdcbadd48
 networking:
   podSubnet: "10.10.0.0/16"
   serviceSubnet: "10.11.0.0/16"

.github/workflows/kind-configs/no-cni.yaml

@@ -2,11 +2,11 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
 - role: control-plane
-  image: kindest/node:v1.33.4@sha256:25a6018e48dfcaee478f4a59af81157a437f15e6e140bf103f85a2e7cd0cbbf2
+  image: kindest/node:v1.34.3@sha256:08497ee19eace7b4b5348db5c6a1591d7752b164530a36f855cb0f2bdcbadd48
 - role: worker
-  image: kindest/node:v1.33.4@sha256:25a6018e48dfcaee478f4a59af81157a437f15e6e140bf103f85a2e7cd0cbbf2
+  image: kindest/node:v1.34.3@sha256:08497ee19eace7b4b5348db5c6a1591d7752b164530a36f855cb0f2bdcbadd48
 - role: worker
-  image: kindest/node:v1.33.4@sha256:25a6018e48dfcaee478f4a59af81157a437f15e6e140bf103f85a2e7cd0cbbf2
+  image: kindest/node:v1.34.3@sha256:08497ee19eace7b4b5348db5c6a1591d7752b164530a36f855cb0f2bdcbadd48
 networking:
   disableDefaultCNI: true
   podSubnet: "10.10.0.0/16"

.github/workflows/test-on-kind.yml

@@ -54,10 +54,10 @@ jobs:
     strategy:
       matrix:
         versions:
-        - kind: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
-          kubectl: "v1.34.0"
-        - kind: kindest/node:v1.33.4@sha256:25a6018e48dfcaee478f4a59af81157a437f15e6e140bf103f85a2e7cd0cbbf2
-          kubectl: "v1.33.4"
+        - kind: kindest/node:v1.34.3@sha256:08497ee19eace7b4b5348db5c6a1591d7752b164530a36f855cb0f2bdcbadd48
+          kubectl: "v1.34.3"
+        - kind: kindest/node:v1.35.0@sha256:452d707d4862f52530247495d180205e029056831160e22870e37e3f6c1ac31f
+          kubectl: "v1.35.0"
         module: ${{ fromJSON(needs.get-changed-modules.outputs.matrix) }}
     steps:
     - name: Checkout
@@ -72,7 +72,7 @@ jobs:
       if: matrix.module == 'modules/cni/cilium/base'
       uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
       with:
-        version: v0.30.0
+        version: v0.31.0
         kubectl_version: "${{ matrix.versions.kubectl }}"
         node_image: "${{ matrix.versions.kind }}"
         config: .github/workflows/kind-configs/no-cni.yaml
@@ -82,7 +82,7 @@ jobs:
       if: matrix.module != 'modules/cni/cilium/base'
       uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
       with:
-        version: v0.30.0
+        version: v0.31.0
         kubectl_version: "${{ matrix.versions.kubectl }}"
         node_image: "${{ matrix.versions.kind }}"
         config: .github/workflows/kind-configs/default.yaml

.pre-commit-config.yaml

@@ -17,6 +17,10 @@ repos:
   - id: trailing-whitespace
     name: Trims trailing whitespace
     args: [--markdown-linebreak-ext=md] # add exception for markdown linebreaks
+- repo: https://github.com/streetsidesoftware/cspell-cli
+  rev: v9.4.0
+  hooks:
+  - id: cspell
 - repo: https://github.com/gitleaks/gitleaks
   rev: v8.30.0
   hooks:

README.md

@@ -100,7 +100,7 @@ as possible.
 
 [License]: https://img.shields.io/github/license/mia-platform/distribution?color=informational&style=for-the-badge
 	"Magellano License"
-[Kubernetes]: https://img.shields.io/badge/kubernetes-1.33-success?style=for-the-badge&logo=kubernetes "Supported
+[Kubernetes]: https://img.shields.io/badge/kubernetes-1.34-success?style=for-the-badge&logo=kubernetes "Supported
 	Kubernetes version"
 [`vab`]: https://github.com/mia-platform/vab "cli for handling installation and upgrade of Mia-Platform
 	unofficial distribution"

addons/prometheus-operator/monitoring-stack/CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+- update prometheus to v3.8.1
+- update alertmanager to v0.30.0
+
 ## v2.6.0
 
 ### Changed

addons/prometheus-operator/monitoring-stack/README.md

@@ -51,6 +51,7 @@ This module use the following user, gid and fsGroup:
 | 2.4.x          | 1.31.x                             |
 | 2.5.x          | 1.32.x                             |
 | 2.6.x          | 1.33.x                             |
+| 2.7.x          | 1.34.x                             |
 
 ## User customization
 

addons/prometheus-operator/monitoring-stack/kustomization.yaml

@@ -2,11 +2,11 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
 kind: Component
 images:
 - name: quay.io/prometheus/prometheus
-  newTag: v3.5.0
-  digest: sha256:63805ebb8d2b3920190daf1cb14a60871b16fd38bed42b857a3182bc621f4996
+  newTag: v3.8.1
+  digest: sha256:2b6f734e372c1b4717008f7d0a0152316aedd4d13ae17ef1e3268dbfaf68041b
 - name: quay.io/prometheus/alertmanager
-  newTag: v0.28.1
-  digest: sha256:27c475db5fb156cab31d5c18a4251ac7ed567746a2483ff264516437a39b15ba
+  newTag: v0.30.0
+  digest: sha256:abb750ac7b63116761c16dd481ae92496fbe04721686c0920f0fa4d0728cd4a6
 resources:
 - resources
 patches:

docs/how-to-make-a-release.md

@@ -13,7 +13,7 @@ or addon a link to the new CHANGELOG file must be added to the root one.
 
 ## Tags
 
-After the changelogs are updated the relevant tag can be created, the name of the tag dependes on what are you tagging:
+After the changelogs are updated the relevant tag can be created, the name of the tag depends on what are you tagging:
 
 - if the tag pertain to a module the tag must be `module-<category>-<name>-v<semver>`
 - if the tag pertain to an addon the tag must be `addon-<category>-<name>-v<semver>`

hack/cni/script.sh

@@ -3,35 +3,35 @@
 set -o nounset
 set -o errexit
 
-CILIUM_VERSION="${1:-1.18.4}"
+CILIUM_VERSION="${1:-1.18.5}"
 FOLDER_PATH=$(dirname -- "${0}")
 
 helm repo add cilium https://helm.cilium.io/
 
 helm repo update cilium
 
 helm template cilium cilium/cilium \
-	--kube-version "v1.33.0-0" \
+	--kube-version "v1.34.0-0" \
 	--version "${CILIUM_VERSION}" \
 	--namespace kube-system \
 	--values "${FOLDER_PATH}/values.yaml" > "${FOLDER_PATH}/kind-${CILIUM_VERSION}.yaml"
 
 helm template cilium cilium/cilium \
-	--kube-version "v1.33.0-0" \
+	--kube-version "v1.34.0-0" \
 	--version "${CILIUM_VERSION}" \
 	--namespace kube-system \
 	--values "${FOLDER_PATH}/values.yaml" \
 	--values "${FOLDER_PATH}/eks-values.yaml" > "${FOLDER_PATH}/eks-${CILIUM_VERSION}.yaml"
 
 helm template cilium cilium/cilium \
-	--kube-version "v1.33.0-0" \
+	--kube-version "v1.34.0-0" \
 	--version "${CILIUM_VERSION}" \
 	--namespace kube-system \
 	--values "${FOLDER_PATH}/values.yaml" \
 	--values "${FOLDER_PATH}/gke-values.yaml" > "${FOLDER_PATH}/gke-${CILIUM_VERSION}.yaml"
 
 helm template cilium cilium/cilium \
-	--kube-version "v1.33.0-0" \
+	--kube-version "v1.34.0-0" \
 	--version "${CILIUM_VERSION}" \
 	--namespace kube-system \
 	--values "${FOLDER_PATH}/values.yaml" \

hack/cni/values.yaml

@@ -1,9 +1,13 @@
-upgradeCompatibility: "1.14"
+upgradeCompatibility: "1.17"
 iptablesRandomFully: false
 
 cni:
   chainingMode: portmap
 
+envoyConfig:
+  secretsNamespace:
+    name: kube-system
+
 hubble:
   metrics:
     enabled:
@@ -32,25 +36,41 @@ hubble:
     podDisruptionBudget:
       enabled: true
 
+loadBalancer:
+  l7:
+    backend: envoy
+  protocolDifferentiation:
+    enabled: true
+
 prometheus:
   enabled: true
   serviceMonitor:
     enabled: true
     trustCRDsExist: true
 
+envoy:
+  enabled: true
+  log:
+    format: null
+    format_json:
+      time: "%Y-%m-%dT%T.%e"
+      level: "%l"
+      scope: "%n"
+      message: "%j"
+    defaultLevel: info
+  prometheus:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+
 sessionAffinity: true
+
 tls:
   readSecretsOnlyFromSecretsNamespace: true
   secretsNamespace:
     create: false
     name: kube-system
 
-loadBalancer:
-  # l7:
-  #   backend: envoy
-  protocolDifferentiation:
-    enabled: true
-
 operator:
   prometheus:
     enabled: true

modules/cni/cilium/CHANGELOG.md

@@ -7,27 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
-## v1.33.3
-
-### Changed
-
-- update cilium to v1.18.4
-
-## v1.33.2
-
 ### Changed
 
-- update cilium to v1.18.3
-
-## v1.33.1
+- update cilium to v1.18.5
 
-### Changed
-
-- update cilium to v1.18.2
-- update hubble UI to v0.13.3
-
-## v1.33.0
-
-### Changed
+### Added
 
-- update cilium to v1.18.1
+- add external envoy daemonset and enable l7 loadbalancer for grpc

modules/cni/cilium/README.md

@@ -26,6 +26,7 @@ the Cilium DaemonSet to run on them before everything else and setup the node pr
   - **[workloads](./base/resources/workloads):**
     - **[cilium-agent](./base/resources/workloads/cilium-agent):** resources for the DaemonSet agent that will handle the
 				eBPF module on the nodes
+    - **[cilium-envoy](./base/resources/workloads/cilium-envoy):** resources for the envoy L7 proxy DaemonSet
     - **[cilium-operator](./base/resources/workloads/cilium-operator):** resources for the operator that will handle the
 				correct configuration for cilium
     - **[hubble](./base/resources/workloads/hubble):** workloads for the Hubble observability platform
@@ -43,8 +44,6 @@ documentation for all the [system requirements].
 
 ### AKS
 
-- deploys the `node-init` DaemonSet
-
 The AKS flavor is indicated for setting up cilium to work inside an AKS cluster in BYOCNI plugin. You can follow
 the [official guide from Microsoft] for setting the cluster correctly.
 
@@ -84,19 +83,23 @@ update the nodes correctly to use Cilium as CNI plugin.
 
 | Module Version | Cilium           | Hubble UI   |
 |----------------|------------------|-------------|
-| 1.33.0         | 1.18.1           | v0.13.2     |
-| 1.33.1         | 1.18.2           | v0.13.3     |
-| 1.33.2         | 1.18.3           | v0.13.3     |
-| 1.33.3         | 1.18.4           | v0.13.3     |
+| 1.34.x         | 1.18.5           | v0.13.3     |
 
 ## User customization
 
-### Base, EKS
+### Base
 
-By default these flavor will set the `cluster-pool-ipv4-cidr` property inside the `cilium-config` ConfigMap to
+By default this flavor will set the `cluster-pool-ipv4-cidr` property inside the `cilium-config` ConfigMap to
 `10.10.0.0/16` and the `cluster-pool-ipv4-mask-size` to `24`. If you don’t want to use these values you can change them
 via a patch setting them to your desired values.
 
+### EKS
+
+For this flavor you **must** change the value of the `cluster-pool-ipv4-cidr` property inside the `cilium-config`
+ConfigMap with a patch and set it to a value that does not overlap with the default service CIDR of AKS. For
+avoiding the setup with a wrong value, the module will set the property to `CHANGE_TO_YOUR_CLUSTER_POD_IPV4_CIDR`
+value that will trigger an error inside Cilium workload and will not start.
+
 ### AKS
 
 For this flavor you **must** change the value of the `cluster-pool-ipv4-cidr`  property inside the `cilium-config`