Skip to content

Commit 78de0c6

Browse files
RobertLuciandeliahu
RobertLucian
and
deliahu
authored
Update Cortex versions (eksctl, EKS, AWS IAM, Python, etc) (#2438)
* Update versions * Update resource metadata * eksctl fixes * Discard deprecated ubuntu images * Update k8s pkgs to match k8s version * Revert k8s.io pkg versions * Test commit * Upgrade k8s.io packages * Upgrade black and re-format * Revert black because of dependency conflict * Fix operator failing to create the Docker client * Fixes * Fix GPU examples * Increase the no output timeout * Lock click version Co-authored-by: David Eliahu <deliahu@users.noreply.github.com>
1 parent 231cbb6 commit 78de0c6

File tree

51 files changed

+1455
-783
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1455
-783
lines changed

‎.circleci/config.yml

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ commands:
2828
jobs:
2929
lint:
3030
docker:
31-
- image: cimg/python:3.6
31+
- image: cimg/python:3.7
3232
resource_class: medium
3333
steps:
3434
- checkout
@@ -42,18 +42,19 @@ jobs:
4242
command: |
4343
go get -u -v golang.org/x/lint/golint
4444
go get -u -v github.com/kyoh86/looppointer/cmd/looppointer
45-
pip3 install black aiohttp
45+
pip3 install aiohttp black==20.8b1 click==8.0.4
4646
- run:
4747
name: Lint
4848
command: make lint
49+
no_output_timeout: 20m
4950
- save_cache:
5051
key: go-mod-v1-{{ checksum "go.sum" }}
5152
paths:
5253
- "~/go/pkg/mod"
5354

5455
test:
5556
machine:
56-
image: ubuntu-1604:202104-01 # machine executor necessary to run go integration tests
57+
image: ubuntu-2004:202201-02 # machine executor necessary to run go integration tests
5758
resource_class: medium
5859
steps:
5960
- checkout
@@ -90,7 +91,7 @@ jobs:
9091

9192
build-and-upload-cli:
9293
docker:
93-
- image: cimg/python:3.6
94+
- image: cimg/python:3.7
9495
resource_class: medium
9596
steps:
9697
- checkout
@@ -117,7 +118,7 @@ jobs:
117118

118119
build-and-push-images-arm64:
119120
machine:
120-
image: ubuntu-2004:202101-01
121+
image: ubuntu-2004:202201-02
121122
resource_class: arm.medium
122123
steps:
123124
- checkout
@@ -133,7 +134,7 @@ jobs:
133134

134135
amend-images:
135136
docker:
136-
- image: cimg/python:3.6
137+
- image: cimg/python:3.7
137138
environment:
138139
DOCKER_CLI_EXPERIMENTAL: enabled
139140
resource_class: medium
@@ -148,7 +149,7 @@ jobs:
148149

149150
cluster-up:
150151
docker:
151-
- image: cimg/python:3.6
152+
- image: cimg/python:3.7
152153
steps:
153154
- setup_remote_docker
154155
- checkout
@@ -211,7 +212,7 @@ jobs:
211212

212213
e2e-tests:
213214
docker:
214-
- image: cimg/python:3.6
215+
- image: cimg/python:3.7
215216
steps:
216217
- checkout
217218
- run:
@@ -242,7 +243,7 @@ jobs:
242243

243244
cluster-down:
244245
docker:
245-
- image: cimg/python:3.6
246+
- image: cimg/python:3.7
246247
steps:
247248
- setup_remote_docker
248249
- checkout

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ tools:
171171
@go get -u -v github.com/kyoh86/looppointer/cmd/looppointer
172172
@go get -u -v github.com/VojtechVitek/rerun/cmd/rerun
173173
@go get -u -v github.com/go-delve/delve/cmd/dlv
174-
@python3 -m pip install aiohttp black 'pydoc-markdown>=3.0.0,<4.0.0' boto3 pyyaml
174+
@python3 -m pip install aiohttp boto3 pyyaml pydoc-markdown==3.* black==20.8b1 -U
175175
@python3 -m pip install -e test/e2e
176176

177177
format:

‎build/generate_ami_mapping.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ func main() {
222222
json.Unmarshal(jsonBytes, &k8sVersionMap)
223223
}
224224

225-
k8sVersion := "1.21"
225+
k8sVersion := "1.22"
226226

227227
if k8sVersionMap[k8sVersion] == nil {
228228
k8sVersionMap[k8sVersion] = map[string]map[string]string{}

‎dev/minimum_aws_policy.json

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,10 @@
5656
"logs:ListTagsLogGroup",
5757
"logs:DescribeLogStreams",
5858
"iam:TagRole",
59+
"iam:GetPolicy",
60+
"iam:CreatePolicy",
61+
"iam:DeletePolicy",
62+
"iam:ListPolicyVersions",
5963
"iam:RemoveRoleFromInstanceProfile",
6064
"iam:CreateRole",
6165
"iam:AttachRolePolicy",
@@ -69,6 +73,7 @@
6973
"iam:ListAttachedRolePolicies",
7074
"iam:DeleteRolePolicy",
7175
"iam:DeleteOpenIDConnectProvider",
76+
"iam:TagOpenIDConnectProvider",
7277
"iam:DeleteInstanceProfile",
7378
"iam:GetRole",
7479
"iam:GetInstanceProfile",
@@ -84,6 +89,7 @@
8489
"Resource": [
8590
"arn:*:iam::$CORTEX_ACCOUNT_ID:instance-profile/eksctl-*",
8691
"arn:*:iam::$CORTEX_ACCOUNT_ID:role/eksctl-*",
92+
"arn:*:iam::$CORTEX_ACCOUNT_ID:policy/eksctl-*",
8793
"arn:*:iam::$CORTEX_ACCOUNT_ID:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup",
8894
"arn:*:iam::$CORTEX_ACCOUNT_ID:role/eksctl-managed-*",
8995
"arn:*:iam::$CORTEX_ACCOUNT_ID:oidc-provider/*",
@@ -119,7 +125,8 @@
119125
"eks:*",
120126
"kms:CreateGrant",
121127
"acm:DescribeCertificate",
122-
"servicequotas:ListServiceQuotas"
128+
"servicequotas:ListServiceQuotas",
129+
"logs:PutRetentionPolicy"
123130
],
124131
"Resource": "*"
125132
},
@@ -139,4 +146,4 @@
139146
"Resource": "arn:*:s3:::$CORTEX_CLUSTER_NAME*/*"
140147
}
141148
]
142-
}
149+
}

‎dev/versions.md

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
1. Update `generate_eks.py` if necessary
88
1. Check that `eksctl utils write-kubeconfig` log filter still behaves as desired, and logs in `cortex cluster up` look good.
99
1. Update eksctl on your dev
10-
machine: `curl --location "https://github.com/weaveworks/eksctl/releases/download/v0.67.0/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp && sudo mv -f /tmp/eksctl /usr/local/bin`
11-
1. Check if eksctl iam polices changed by comparing the previous version of the eksctl policy docs to the new version's and update `./dev/minimum_aws_policy.json` and `docs/clusters/management/auth.md` accordingly. https://github.com/weaveworks/eksctl/blob/v0.67.0/userdocs/src/usage/minimum-iam-policies.md
10+
machine: `curl --location "https://github.com/weaveworks/eksctl/releases/download/v0.107.0/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp && sudo mv -f /tmp/eksctl /usr/local/bin`
11+
1. Check if eksctl iam polices changed by comparing the previous version of the eksctl policy docs to the new version's and update `./dev/minimum_aws_policy.json` and `docs/clusters/management/auth.md` accordingly. https://github.com/weaveworks/eksctl/blob/v0.107.0/userdocs/src/usage/minimum-iam-policies.md
1212

1313
## Kubernetes
1414

@@ -57,10 +57,10 @@
5757

5858
1. Find the latest [release](https://istio.io/latest/news/releases) and check the release notes (here are
5959
the [latest IstioOperator Options](https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/))
60-
1. Update the version in `images/manager/Dockerfile`
61-
1. Update the version in all `images/istio-*` Dockerfiles
62-
1. Update `istio.yaml.j2`, `apis.yaml.j2`, `operator.yaml.j2`, and `pkg/lib/k8s` as necessary
63-
1. Update `install.sh` as necessary
60+
1. Update the version in `images/manager/Dockerfile`.
61+
1. Update the version in all `images/istio-*` Dockerfiles.
62+
1. Update `istio.yaml.j2`, `apis.yaml.j2`, `operator.yaml.j2`, and `pkg/lib/k8s` as necessary.
63+
1. Update `install.sh` as necessary.
6464

6565
## AWS CNI
6666

@@ -71,7 +71,7 @@
7171
7272
```bash
7373
PREV_RELEASE=1.10.1
74-
NEW_RELEASE=1.10.1
74+
NEW_RELEASE=1.11.0
7575
wget -q -O cni_supported_instances_prev.txt https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v${PREV_RELEASE}/pkg/awsutils/vpc_ip_resource_limit.go; wget -q -O cni_supported_instances_new.txt https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v${NEW_RELEASE}/pkg/awsutils/vpc_ip_resource_limit.go; git diff --no-index cni_supported_instances_prev.txt cni_supported_instances_new.txt; rm -rf cni_supported_instances_prev.txt; rm -rf cni_supported_instances_new.txt
7676
```
7777
@@ -145,9 +145,9 @@ see https://github.com/moby/moby/issues/39302#issuecomment-639687466_
145145
### Non-versioned modules
146146
147147
1. `rm -rf go.mod go.sum && go mod init && go clean -modcache`
148-
1. `go get k8s.io/client-go@v0.21.6 && go get k8s.io/apimachinery@v0.21.6 && go get k8s.io/api@v0.21.6`
149-
1. `go get istio.io/client-go@v1.11.4 && go get istio.io/api@1.11.4`
150-
1. `go get github.com/aws/amazon-vpc-cni-k8s/pkg/awsutils@v1.9.3`
148+
1. `go get k8s.io/client-go@v0.20.15 && go get k8s.io/apimachinery@v0.20.15 && go get k8s.io/api@v0.20.15`
149+
1. `go get istio.io/client-go@v1.11.8 && go get istio.io/api@1.11.8`
150+
1. `go get github.com/aws/amazon-vpc-cni-k8s/pkg/awsutils@v1.11.0`
151151
1. `go get github.com/cortexlabs/yaml@31e52ba8433b683c471ef92cf1711fe67671dac5`
152152
1. `go get github.com/cortexlabs/go-input@8b67a7a7b28d1c45f5c588171b3b50148462b247`
153153
1. `go get github.com/xlab/treeprint@v1.0.0`
@@ -212,14 +212,14 @@ see https://github.com/moby/moby/issues/39302#issuecomment-639687466_
212212
1. `git stash`
213213
1. `git remote add upstream https://github.com/kubernetes/autoscaler.git`
214214
1. `git fetch upstream`
215-
1. Checkout the appropriate version tag, e.g. `git checkout cluster-autoscaler-1.21.1 -b cluster-autoscaler-1.21.1-cortex`
215+
1. Checkout the appropriate version tag, e.g. `git checkout cluster-autoscaler-1.22.2 -b cluster-autoscaler-1.22.2-cortex`
216216
1. `git stash pop`
217217
1. Resolve any merge conflicts
218218
1. Unstage and check the diff
219-
1. `git commit -am "Add rate limiter"`
220-
1. `git push origin cluster-autoscaler-1.21.1-cortex`
221-
1. Update `images/cluster-autoscaler/Dockerfile` to use the new branch name (e.g. "cluster-autoscaler-1.21.1") in the `-b` flag's value from `git clone`.
222-
1. Match the Go version of the builder in `images/cluster-autoscaler/Dockerfile` with that of the [cluster autoscaler](https://github.com/kubernetes/autoscaler)'s Dockerfile.
219+
1. `git add *; git commit -am "Add rate limiter"`
220+
1. `git push origin cluster-autoscaler-1.22.2-cortex`
221+
1. Update `images/cluster-autoscaler/Dockerfile` to use the new branch name (e.g. "cluster-autoscaler-1.22.2") in the `-b` flag's value from `git clone`.
222+
1. Match the Go version of the builder in `images/cluster-autoscaler/Dockerfile` with that of the [cluster autoscaler's Dockerfile](https://github.com/kubernetes/autoscaler/blob/master/builder/Dockerfile).
223223
224224
## FluentBit
225225

‎docs/clusters/management/auth.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,10 @@ Replace the following placeholders with their respective values in the policy te
121121
"logs:ListTagsLogGroup",
122122
"logs:DescribeLogStreams",
123123
"iam:TagRole",
124+
"iam:GetPolicy",
125+
"iam:CreatePolicy",
126+
"iam:DeletePolicy",
127+
"iam:ListPolicyVersions",
124128
"iam:RemoveRoleFromInstanceProfile",
125129
"iam:CreateRole",
126130
"iam:AttachRolePolicy",
@@ -134,6 +138,7 @@ Replace the following placeholders with their respective values in the policy te
134138
"iam:ListAttachedRolePolicies",
135139
"iam:DeleteRolePolicy",
136140
"iam:DeleteOpenIDConnectProvider",
141+
"iam:TagOpenIDConnectProvider",
137142
"iam:DeleteInstanceProfile",
138143
"iam:GetRole",
139144
"iam:GetInstanceProfile",
@@ -149,6 +154,7 @@ Replace the following placeholders with their respective values in the policy te
149154
"Resource": [
150155
"arn:*:iam::$CORTEX_ACCOUNT_ID:instance-profile/eksctl-*",
151156
"arn:*:iam::$CORTEX_ACCOUNT_ID:role/eksctl-*",
157+
"arn:*:iam::$CORTEX_ACCOUNT_ID:policy/eksctl-*",
152158
"arn:*:iam::$CORTEX_ACCOUNT_ID:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup",
153159
"arn:*:iam::$CORTEX_ACCOUNT_ID:role/eksctl-managed-*",
154160
"arn:*:iam::$CORTEX_ACCOUNT_ID:oidc-provider/*",
@@ -184,7 +190,8 @@ Replace the following placeholders with their respective values in the policy te
184190
"eks:*",
185191
"kms:CreateGrant",
186192
"acm:DescribeCertificate",
187-
"servicequotas:ListServiceQuotas"
193+
"servicequotas:ListServiceQuotas",
194+
"logs:PutRetentionPolicy"
188195
],
189196
"Resource": "*"
190197
},

0 commit comments

Comments
 (0)