Drop caBundle from CRDs

Signed-off-by: Stefan Büringer buringerst@vmware.com
kubernetes-sigs · Jul 31, 2024 · 1320244 · 1320244
1 parent 64c0791
commit 1320244
Show file tree

Hide file tree

Showing 30 changed files with 62,393 additions and 69 deletions.
diff --git a/bootstrap/kubeadm/config/crd/patches/webhook_in_kubeadmconfigs.yaml b/bootstrap/kubeadm/config/crd/patches/webhook_in_kubeadmconfigs.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: capi-kubeadm-bootstrap-webhook-service

diff --git a/bootstrap/kubeadm/config/crd/patches/webhook_in_kubeadmconfigtemplates.yaml b/bootstrap/kubeadm/config/crd/patches/webhook_in_kubeadmconfigtemplates.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/config/crd/patches/webhook_in_clusterclasses.yaml b/config/crd/patches/webhook_in_clusterclasses.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/config/crd/patches/webhook_in_clusterresourcesetbindings.yaml b/config/crd/patches/webhook_in_clusterresourcesetbindings.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/config/crd/patches/webhook_in_clusterresourcesets.yaml b/config/crd/patches/webhook_in_clusterresourcesets.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/config/crd/patches/webhook_in_clusters.yaml b/config/crd/patches/webhook_in_clusters.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/config/crd/patches/webhook_in_machinedeployments.yaml b/config/crd/patches/webhook_in_machinedeployments.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/config/crd/patches/webhook_in_machinehealthchecks.yaml b/config/crd/patches/webhook_in_machinehealthchecks.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/config/crd/patches/webhook_in_machinepools.yaml b/config/crd/patches/webhook_in_machinepools.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/config/crd/patches/webhook_in_machines.yaml b/config/crd/patches/webhook_in_machines.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/config/crd/patches/webhook_in_machinesets.yaml b/config/crd/patches/webhook_in_machinesets.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/controlplane/kubeadm/config/crd/patches/webhook_in_kubeadmcontrolplanes.yaml b/controlplane/kubeadm/config/crd/patches/webhook_in_kubeadmcontrolplanes.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/controlplane/kubeadm/config/crd/patches/webhook_in_kubeadmcontrolplanetemplates.yaml b/controlplane/kubeadm/config/crd/patches/webhook_in_kubeadmcontrolplanetemplates.yaml
@@ -10,9 +10,6 @@ spec:
     webhook:
       conversionReviewVersions: ["v1", "v1beta1"]
       clientConfig:
-        # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
-        # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
-        caBundle: Cg==
         service:
           namespace: system
           name: webhook-service

diff --git a/docs/book/src/developer/providers/migrations/v1.7-to-v1.8.md b/docs/book/src/developer/providers/migrations/v1.7-to-v1.8.md
@@ -30,3 +30,6 @@ maintainers of providers and consumers of our Go API.
 - `remote.NewClusterCacheTracker` now has options to configure QPS & Burst. It's highly recommended to implement corresponding flags
   the same way as core Cluster API (see PR: https://github.com/kubernetes-sigs/cluster-api/pull/10880).
 - There were changes made to flags in core CAPI (https://github.com/kubernetes-sigs/cluster-api/pull/10883, https://github.com/kubernetes-sigs/cluster-api/pull/10880). It's recommended to adopt these changes in providers as well. 
+- To support Kubernetes 1.31, provider should stop setting caBundle to invalid values in there CRDs (see core CAPI PR: https://github.com/kubernetes-sigs/cluster-api/pull/10972)
+  Setting caBundle to `Cg==` is a pattern that is widely spread across the ecosystem but it will stop working with Kubernetes 1.31.
+  Please see the following Slack thread for details: https://kubernetes.slack.com/archives/C0EG7JC6T/p1722441161968339