fix(flux): vendor external-snapshotter manifests locally (stop remote-base build flake)
The kustomization pulled two REMOTE github bases (?ref=v8.2.0) that Flux's kustomize-controller git-fetched on every reconcile; those fetches intermittently exceeded the 27s timeout -> 'kustomize build failed' BuildFailed events -> the whole platform tier stalled whenever GitHub was slow. Vendored the exact v8.2.0 output to local crds.yaml + snapshot-controller.yaml (built with kubectl kustomize; images transformer still re-pins the controller to v8.2.0), so the build is now offline + deterministic. No change to what's deployed. platform/kubevirt has the same latent pattern. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
d1a547fd15
commit
7a79cea94a
3 files changed
+1992
-8
No files matched your search
File diff suppressed because it is too large.
Load diff
@@ -29,17 +29,24 @@
|
||||
# * The `client/config/crd` base also ships the beta VolumeGroupSnapshot CRDs; that feature is
|
||||
# gated OFF in the controller (no --enable-volume-group-snapshots arg), so they are inert.
|
||||
#
|
||||
# Kustomize loads these as REMOTE bases (github.com/...?ref=<tag>) — the same remote-manifest
|
||||
# pattern platform/kubevirt uses for the KubeVirt/CDI operators; Flux's kustomize-controller
|
||||
# fetches them identically at reconcile.
|
||||
# VENDORED (was remote github bases). The two upstream kustomize dirs are built to LOCAL files
|
||||
# (crds.yaml, snapshot-controller.yaml) at v8.2.0 and committed here. Previously these were REMOTE
|
||||
# bases (github.com/...?ref=v8.2.0) that Flux's kustomize-controller `git fetch`ed on EVERY reconcile;
|
||||
# those fetches intermittently hit the controller's 27s timeout -> "kustomize build failed" -> the
|
||||
# WHOLE `platform` tier flaked (a transient GitHub slowness stalled every downstream app). Local files
|
||||
# make the build OFFLINE + deterministic. NOTE: platform/kubevirt still uses the same remote-base
|
||||
# pattern and carries the same latent fragility (vendor it too if it flakes).
|
||||
# RE-VENDOR on a version bump:
|
||||
# kubectl kustomize "https://github.com/kubernetes-csi/external-snapshotter/client/config/crd?ref=vX.Y.Z" > crds.yaml
|
||||
# kubectl kustomize "https://github.com/kubernetes-csi/external-snapshotter/deploy/kubernetes/snapshot-controller?ref=vX.Y.Z" > snapshot-controller.yaml
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
# renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
|
||||
- https://github.com/kubernetes-csi/external-snapshotter/client/config/crd?ref=v8.2.0
|
||||
# renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
|
||||
- https://github.com/kubernetes-csi/external-snapshotter/deploy/kubernetes/snapshot-controller?ref=v8.2.0
|
||||
- crds.yaml
|
||||
- snapshot-controller.yaml
|
||||
images:
|
||||
# Re-pin the controller image to the base ref so controller == CRD version (see header note).
|
||||
# renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
|
||||
# Controller image == CRD version. A version bump = re-vendor crds.yaml + snapshot-controller.yaml
|
||||
# at the new tag (see header) AND bump this newTag.
|
||||
- name: registry.k8s.io/sig-storage/snapshot-controller
|
||||
newTag: v8.2.0
|
||||
@@ -0,0 +1,200 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: snapshot-controller
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: snapshot-controller-leaderelection
|
||||
namespace: kube-system
|
||||
rules:
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
- delete
|
||||
- update
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: snapshot-controller-runner
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumeclaims
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- snapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumesnapshotclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- snapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumesnapshotcontents
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- patch
|
||||
- apiGroups:
|
||||
- snapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumesnapshotcontents/status
|
||||
verbs:
|
||||
- patch
|
||||
- apiGroups:
|
||||
- snapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumesnapshots
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- snapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumesnapshots/status
|
||||
verbs:
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- groupsnapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumegroupsnapshotclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- groupsnapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumegroupsnapshotcontents
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- patch
|
||||
- apiGroups:
|
||||
- groupsnapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumegroupsnapshotcontents/status
|
||||
verbs:
|
||||
- patch
|
||||
- apiGroups:
|
||||
- groupsnapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumegroupsnapshots
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- groupsnapshot.storage.k8s.io
|
||||
resources:
|
||||
- volumegroupsnapshots/status
|
||||
verbs:
|
||||
- update
|
||||
- patch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: snapshot-controller-leaderelection
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: snapshot-controller-leaderelection
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: snapshot-controller
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: snapshot-controller-role
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: snapshot-controller-runner
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: snapshot-controller
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: snapshot-controller
|
||||
namespace: kube-system
|
||||
spec:
|
||||
minReadySeconds: 35
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: snapshot-controller
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 0
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: snapshot-controller
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --v=5
|
||||
- --leader-election=true
|
||||
image: registry.k8s.io/sig-storage/snapshot-controller:v8.0.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: snapshot-controller
|
||||
serviceAccountName: snapshot-controller
|
||||
Reference in new issue
Block a user