Page MenuHomePhabricator

toolforge: review k8s API usage by custom components for 1.25 upgrade
Closed, ResolvedPublic

Description

With the Toolforge kubernetes 1.25 upgrade, some k8s API extension may have been deprecated, or changed names. We should review how we use them, or if changes are required for our custom components:

  • jobs-api
  • builds-api
  • builds-builder
  • envvars-api
  • custom admission controllers
  • tools-webservice

See also this useful dashboard: https://grafana.wmcloud.org/d/dVVFcEAVz/deprecated-kubernetes-api-calls?orgId=1&var-cluster=prometheus-tools&var-versions=1.25&from=now-2d&to=now

Details

Related Changes in GitLab:
TitleReferenceAuthorSource BranchDest Branch
envvars-admission: bump to 0.0.13-20240711114848-774571d5repos/cloud/toolforge/toolforge-deploy!409ghostbump_envvars-admissionmain
deployment: drop PSP referencesrepos/cloud/toolforge/envvars-admission!6aborreroarturo-326-deployment-drop-pspmain
builds-builder: bump to 0.0.109-20240708090642-a7a583cbrepos/cloud/toolforge/toolforge-deploy!398ghostbump_builds-buildermain
tekton: update apiVersion to autoscaling/v2repos/cloud/toolforge/builds-builder!50sstefanovaslavina/update-apiVersionmain
Customize query in GitLab

Event Timeline

Restricted Application removed a subscriber: taavi. · View Herald TranscriptJul 3 2024, 12:48 PM

builds-builder currently fails to deploy in lima-kilo with k8s 1.25.

deployment/chart/templates/tekton-pipelines.yaml.gotmpl:apiVersion: autoscaling/v2beta1 seems to be the deprecated api. autoscaling/v2 would to be the current one.

project_1317_bot_df3177307bed93c3f34e421e26c86e38 opened https://gitlab.wikimedia.org/repos/cloud/toolforge/toolforge-deploy/-/merge_requests/398

builds-builder: bump to 0.0.109-20240708090642-a7a583cb

Slst2020 changed the task status from Open to In Progress.Jul 8 2024, 3:15 PM
Slst2020 moved this task from Next Up to In Progress on the Toolforge (Toolforge iteration 12) board.

@aborrero should this be removed now that PSP is gone?

[~/repos/work/toolforge/envvars-admission (main)] % cat deployment/chart/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: envvars-admission-psp
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: privileged-psp
subjects:
  - kind: ServiceAccount
    name: default
    namespace: "{{ .Release.Namespace }}"

@aborrero should this be removed now that PSP is gone?

[~/repos/work/toolforge/envvars-admission (main)] % cat deployment/chart/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: envvars-admission-psp
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: privileged-psp
subjects:
  - kind: ServiceAccount
    name: default
    namespace: "{{ .Release.Namespace }}"

yes, I missed that one as part of T368142: Toolforge: drop PodSecurityPolicy

yes, I missed that one as part of T368142: Toolforge: drop PodSecurityPolicy

are you on it or should I go ahead and remove it?

project_1317_bot_df3177307bed93c3f34e421e26c86e38 opened https://gitlab.wikimedia.org/repos/cloud/toolforge/toolforge-deploy/-/merge_requests/409

envvars-admission: bump to 0.0.13-20240711114848-774571d5