🌱 Update Kustomize deprecated syntax

Makefile

@@ -104,10 +104,10 @@ get_go_version = $(shell go list -m $1 | awk '{print $$2}')
 # Binaries.
 #
 # Note: Need to use abspath so we can invoke these from subdirectories
-KUSTOMIZE_VER := v4.5.2
+KUSTOMIZE_VER := v5.3.0
 KUSTOMIZE_BIN := kustomize
 KUSTOMIZE := $(abspath $(TOOLS_BIN_DIR)/$(KUSTOMIZE_BIN)-$(KUSTOMIZE_VER))
-KUSTOMIZE_PKG := sigs.k8s.io/kustomize/kustomize/v4
+KUSTOMIZE_PKG := sigs.k8s.io/kustomize/kustomize/v5
 
 SETUP_ENVTEST_VER := v0.0.0-20240215143116-d0396a3d6f9f
 SETUP_ENVTEST_BIN := setup-envtest

bootstrap/kubeadm/config/certmanager/certificate.yaml

@@ -15,14 +15,14 @@ metadata:
   name: serving-cert  # this name should match the one appeared in kustomizeconfig.yaml
   namespace: system
 spec:
-  # $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize
+  # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
   dnsNames:
-  - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc
-  - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local
+  - SERVICE_NAME.SERVICE_NAMESPACE.svc
+  - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
   issuerRef:
     kind: Issuer
     name: selfsigned-issuer
-  secretName: $(SERVICE_NAME)-cert # this secret will not be prefixed, since it's not managed by kustomize
+  secretName: capi-kubeadm-bootstrap-webhook-service-cert # this secret will not be prefixed, since it's not managed by kustomize
   subject:
     organizations:
-      - k8s-sig-cluster-lifecycle
+      - k8s-sig-cluster-lifecycle

bootstrap/kubeadm/config/certmanager/kustomizeconfig.yaml

@@ -6,14 +6,3 @@ nameReference:
   - kind: Certificate
     group: cert-manager.io
     path: spec/issuerRef/name
-
-varReference:
-- kind: Certificate
-  group: cert-manager.io
-  path: spec/commonName
-- kind: Certificate
-  group: cert-manager.io
-  path: spec/dnsNames
-- kind: Certificate
-  group: cert-manager.io
-  path: spec/secretName

bootstrap/kubeadm/config/crd/kustomization.yaml

@@ -1,27 +1,29 @@
-commonLabels:
-  cluster.x-k8s.io/v1beta1: v1beta1
+labels:
+- includeSelectors: true
+  pairs:
+    cluster.x-k8s.io/v1beta1: v1beta1
 
 # This kustomization.yaml is not intended to be run by itself,
 # since it depends on service name and namespace that are out of this kustomize package.
 # It should be run by config/
 resources:
-  - bases/bootstrap.cluster.x-k8s.io_kubeadmconfigs.yaml
-  - bases/bootstrap.cluster.x-k8s.io_kubeadmconfigtemplates.yaml
+- bases/bootstrap.cluster.x-k8s.io_kubeadmconfigs.yaml
+- bases/bootstrap.cluster.x-k8s.io_kubeadmconfigtemplates.yaml
 # +kubebuilder:scaffold:crdkustomizeresource
 
-patchesStrategicMerge:
+patches:
   # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
   # patches here are for enabling the conversion webhook for each CRD
-- patches/webhook_in_kubeadmconfigs.yaml
-- patches/webhook_in_kubeadmconfigtemplates.yaml
+- path: patches/cainjection_in_kubeadmconfigs.yaml
+- path: patches/cainjection_in_kubeadmconfigtemplates.yaml
   # +kubebuilder:scaffold:crdkustomizewebhookpatch
 
   # [CERTMANAGER] To enable webhook, uncomment all the sections with [CERTMANAGER] prefix.
   # patches here are for enabling the CA injection for each CRD
-- patches/cainjection_in_kubeadmconfigs.yaml
-- patches/cainjection_in_kubeadmconfigtemplates.yaml
+- path: patches/webhook_in_kubeadmconfigs.yaml
+- path: patches/webhook_in_kubeadmconfigtemplates.yaml
 # +kubebuilder:scaffold:crdkustomizecainjectionpatch
 
 # the following config is for teaching kustomize how to do kustomization for CRDs.
 configurations:
-  - kustomizeconfig.yaml
+- kustomizeconfig.yaml

bootstrap/kubeadm/config/crd/kustomizeconfig.yaml

@@ -13,5 +13,3 @@ namespace:
     path: spec/conversion/webhook/clientConfig/service/namespace
     create: false
 
-varReference:
-  - path: metadata/annotations

bootstrap/kubeadm/config/crd/patches/cainjection_in_kubeadmconfigs.yaml

@@ -4,5 +4,5 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+    cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
   name: kubeadmconfigs.bootstrap.cluster.x-k8s.io

bootstrap/kubeadm/config/crd/patches/cainjection_in_kubeadmconfigtemplates.yaml

@@ -4,5 +4,5 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+    cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
   name: kubeadmconfigtemplates.bootstrap.cluster.x-k8s.io

bootstrap/kubeadm/config/crd/patches/webhook_in_kubeadmconfigs.yaml

@@ -15,5 +15,5 @@ spec:
         caBundle: Cg==
         service:
           namespace: system
-          name: webhook-service
+          name: capi-kubeadm-bootstrap-webhook-service
           path: /convert

bootstrap/kubeadm/config/default/kustomization.yaml

@@ -3,55 +3,122 @@ namespace: capi-kubeadm-bootstrap-system
 
 namePrefix: capi-kubeadm-bootstrap-
 
-commonLabels:
-  cluster.x-k8s.io/provider: "bootstrap-kubeadm"
+labels:
+- includeSelectors: true
+  pairs:
+    cluster.x-k8s.io/provider: bootstrap-kubeadm
 
 resources:
 - namespace.yaml
-
-bases:
 - ../crd
 - ../rbac
 - ../manager
 - ../webhook
 - ../certmanager
 
-patchesStrategicMerge:
-  # Provide customizable hook for make targets.
-  - manager_image_patch.yaml
-  - manager_pull_policy.yaml
-  # Enable webhook.
-  - manager_webhook_patch.yaml
-  # Inject certificate in the webhook definition.
-  - webhookcainjection_patch.yaml
-
-vars:
-  - name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
-    objref:
-      kind: Certificate
-      group: cert-manager.io
-      version: v1
-      name: serving-cert # this name should match the one in certificate.yaml
-    fieldref:
-      fieldpath: metadata.namespace
-  - name: CERTIFICATE_NAME
-    objref:
-      kind: Certificate
-      group: cert-manager.io
-      version: v1
-      name: serving-cert # this name should match the one in certificate.yaml
-  - name: SERVICE_NAMESPACE # namespace of the service
-    objref:
-      kind: Service
-      version: v1
-      name: webhook-service
-    fieldref:
-      fieldpath: metadata.namespace
-  - name: SERVICE_NAME
-    objref:
-      kind: Service
-      version: v1
-      name: webhook-service
+patches:
+# Provide customizable hook for make targets.
+- path: manager_image_patch.yaml
+- path: manager_pull_policy.yaml
+# Enable webhook.
+- path: manager_webhook_patch.yaml
+# Inject certificate in the webhook definition.
+- path: webhookcainjection_patch.yaml
 
-configurations:
-  - kustomizeconfig.yaml
+replacements:
+- source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
+    kind: Certificate
+    group: cert-manager.io
+    version: v1
+    name: serving-cert # this name should match the one in certificate.yaml
+    fieldPath: .metadata.namespace # namespace of the certificate CR
+  targets:
+    - select:
+        kind: ValidatingWebhookConfiguration
+      fieldPaths:
+        - .metadata.annotations.[cert-manager.io/inject-ca-from]
+      options:
+        delimiter: '/'
+        index: 0
+        create: true
+    - select:
+        kind: MutatingWebhookConfiguration
+      fieldPaths:
+        - .metadata.annotations.[cert-manager.io/inject-ca-from]
+      options:
+        delimiter: '/'
+        index: 0
+        create: true
+    - select:
+        kind: CustomResourceDefinition
+      fieldPaths:
+        - .metadata.annotations.[cert-manager.io/inject-ca-from]
+      options:
+        delimiter: '/'
+        index: 0
+        create: true
+- source:
+    kind: Certificate
+    group: cert-manager.io
+    version: v1
+    name: serving-cert # this name should match the one in certificate.yaml
+    fieldPath: .metadata.name
+  targets:
+    - select:
+        kind: ValidatingWebhookConfiguration
+      fieldPaths:
+        - .metadata.annotations.[cert-manager.io/inject-ca-from]
+      options:
+        delimiter: '/'
+        index: 1
+        create: true
+    - select:
+        kind: MutatingWebhookConfiguration
+      fieldPaths:
+        - .metadata.annotations.[cert-manager.io/inject-ca-from]
+      options:
+        delimiter: '/'
+        index: 1
+        create: true
+    - select:
+        kind: CustomResourceDefinition
+      fieldPaths:
+        - .metadata.annotations.[cert-manager.io/inject-ca-from]
+      options:
+        delimiter: '/'
+        index: 1
+        create: true
+- source: # Add cert-manager annotation to the webhook Service
+    kind: Service
+    version: v1
+    name: webhook-service
+    fieldPath: .metadata.name # namespace of the service
+  targets:
+    - select:
+        kind: Certificate
+        group: cert-manager.io
+        version: v1
+      fieldPaths:
+        - .spec.dnsNames.0
+        - .spec.dnsNames.1
+      options:
+        delimiter: '.'
+        index: 0
+        create: true
+- source:
+    kind: Service
+    version: v1
+    name: webhook-service
+    fieldPath: .metadata.namespace # namespace of the service
+  targets:
+    - select:
+        kind: Certificate
+        group: cert-manager.io
+        version: v1
+      fieldPaths:
+        - .spec.dnsNames.0
+        - .spec.dnsNames.1
+      options:
+        delimiter: '.'
+        index: 1
+        create: true

bootstrap/kubeadm/config/default/manager_webhook_patch.yaml

@@ -19,4 +19,4 @@ spec:
       volumes:
       - name: cert
         secret:
-          secretName: $(SERVICE_NAME)-cert
+          secretName: capi-kubeadm-bootstrap-webhook-service-cert

bootstrap/kubeadm/config/default/webhookcainjection_patch.yaml

@@ -4,11 +4,11 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: mutating-webhook-configuration
   annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+    cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name: validating-webhook-configuration
   annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+    cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME

bootstrap/kubeadm/config/webhook/kustomizeconfig.yaml

@@ -21,5 +21,3 @@ namespace:
   path: webhooks/clientConfig/service/namespace
   create: true
 
-varReference:
-- path: metadata/annotations

config/certmanager/certificate.yaml

@@ -14,14 +14,14 @@ metadata:
   name: serving-cert  # this name should match the one appeared in kustomizeconfig.yaml
   namespace: system
 spec:
-  # $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize
+  # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
   dnsNames:
-  - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc
-  - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local
+  - SERVICE_NAME.SERVICE_NAMESPACE.svc
+  - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
   issuerRef:
     kind: Issuer
     name: selfsigned-issuer
-  secretName: $(SERVICE_NAME)-cert # this secret will not be prefixed, since it's not managed by kustomize
+  secretName: capi-webhook-service-cert # this secret will not be prefixed, since it's not managed by kustomize
   subject:
     organizations:
-      - k8s-sig-cluster-lifecycle
+      - k8s-sig-cluster-lifecycle

config/certmanager/kustomizeconfig.yaml

@@ -7,13 +7,3 @@ nameReference:
     group: cert-manager.io
     path: spec/issuerRef/name
 
-varReference:
-- kind: Certificate
-  group: cert-manager.io
-  path: spec/commonName
-- kind: Certificate
-  group: cert-manager.io
-  path: spec/dnsNames
-- kind: Certificate
-  group: cert-manager.io
-  path: spec/secretName

config/crd/kustomization.yaml

@@ -16,31 +16,31 @@ resources:
 - bases/ipam.cluster.x-k8s.io_ipaddressclaims.yaml
 # +kubebuilder:scaffold:crdkustomizeresource
 
-patchesStrategicMerge:
+patches:
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
 # patches here are for enabling the conversion webhook for each CRD
-- patches/webhook_in_clusterclasses.yaml
-- patches/webhook_in_clusters.yaml
-- patches/webhook_in_machinepools.yaml
-- patches/webhook_in_machines.yaml
-- patches/webhook_in_machinesets.yaml
-- patches/webhook_in_machinedeployments.yaml
-- patches/webhook_in_machinehealthchecks.yaml
-- patches/webhook_in_clusterresourcesets.yaml
-- patches/webhook_in_clusterresourcesetbindings.yaml
+- path: patches/webhook_in_clusterclasses.yaml
+- path: patches/webhook_in_clusters.yaml
+- path: patches/webhook_in_machinepools.yaml
+- path: patches/webhook_in_machines.yaml
+- path: patches/webhook_in_machinesets.yaml
+- path: patches/webhook_in_machinedeployments.yaml
+- path: patches/webhook_in_machinehealthchecks.yaml
+- path: patches/webhook_in_clusterresourcesets.yaml
+- path: patches/webhook_in_clusterresourcesetbindings.yaml
 # +kubebuilder:scaffold:crdkustomizewebhookpatch
 
 # [CERTMANAGER] To enable webhook, uncomment all the sections with [CERTMANAGER] prefix.
 # patches here are for enabling the CA injection for each CRD
-- patches/cainjection_in_clusterclasses.yaml
-- patches/cainjection_in_clusters.yaml
-- patches/cainjection_in_machinepools.yaml
-- patches/cainjection_in_machines.yaml
-- patches/cainjection_in_machinesets.yaml
-- patches/cainjection_in_machinedeployments.yaml
-- patches/cainjection_in_machinehealthchecks.yaml
-- patches/cainjection_in_clusterresourcesets.yaml
-- patches/cainjection_in_clusterresourcesetbindings.yaml
+- path: patches/cainjection_in_clusterclasses.yaml
+- path: patches/cainjection_in_clusters.yaml
+- path: patches/cainjection_in_machinepools.yaml
+- path: patches/cainjection_in_machines.yaml
+- path: patches/cainjection_in_machinesets.yaml
+- path: patches/cainjection_in_machinedeployments.yaml
+- path: patches/cainjection_in_machinehealthchecks.yaml
+- path: patches/cainjection_in_clusterresourcesets.yaml
+- path: patches/cainjection_in_clusterresourcesetbindings.yaml
 # +kubebuilder:scaffold:crdkustomizecainjectionpatch
 
 # the following config is for teaching kustomize how to do kustomization for CRDs.