release: update manifest and helm charts for v1.0.0-rc.0 (#807)

Signed-off-by: Anish Ramasekar <[email protected]>
Azure · Mar 21, 2023 · b0a9152 · b0a9152
1 parent 251b2b9
commit b0a9152
Show file tree

Hide file tree

Showing 19 changed files with 26 additions and 32 deletions.
diff --git a/Makefile b/Makefile
@@ -2,7 +2,7 @@ REGISTRY ?= mcr.microsoft.com/oss/azure/workload-identity
 PROXY_IMAGE_NAME := proxy
 INIT_IMAGE_NAME := proxy-init
 WEBHOOK_IMAGE_NAME := webhook
-IMAGE_VERSION ?= v1.0.0-beta.0
+IMAGE_VERSION ?= v1.0.0-rc.0
 
 ORG_PATH := github.com/Azure
 PROJECT_NAME := azure-workload-identity

diff --git a/charts/workload-identity-webhook/Chart.yaml b/charts/workload-identity-webhook/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: workload-identity-webhook
 description: A Helm chart to install the azure-workload-identity webhook
 type: application
-version: 1.0.0-beta.0
-appVersion: v1.0.0-beta.0
+version: 1.0.0-rc.0
+appVersion: v1.0.0-rc.0
 home: https://github.com/Azure/azure-workload-identity
 sources:
   - https://github.com/Azure/azure-workload-identity
diff --git a/charts/workload-identity-webhook/README.md b/charts/workload-identity-webhook/README.md
@@ -34,7 +34,7 @@ helm upgrade -n azure-workload-identity-system [RELEASE_NAME] azure-workload-ide
 | replicaCount                     | The number of azure-workload-identity replicas to deploy for the webhook                                                          | `2`                                                     |
 | image.repository                 | Image repository                                                                                                                  | `mcr.microsoft.com/oss/azure/workload-identity/webhook` |
 | image.pullPolicy                 | Image pullPolicy                                                                                                                  | `IfNotPresent`                                          |
-| image.release                    | The image release tag to use                                                                                                      | Current release version: `v1.0.0-beta.0`                      |
+| image.release                    | The image release tag to use                                                                                                      | Current release version: `v1.0.0-rc.0`                |
 | imagePullSecrets                 | Image pull secrets to use for retrieving images from private registries                                                           | `[]`                                                    |
 | nodeSelector                     | The node selector to use for pod scheduling                                                                                       | `kubernetes.io/os: linux`                               |
 | resources                        | The resource request/limits for the container image                                                                               | limits: 100m CPU, 30Mi, requests: 100m CPU, 20Mi        |
@@ -51,6 +51,7 @@ helm upgrade -n azure-workload-identity-system [RELEASE_NAME] azure-workload-ide
 | priorityClassName                | The priority class name for webhook manager                                                                                       | `system-cluster-critical`                               |
 | mutatingWebhookAnnotations       | The annotations to add to the MutatingWebhookConfiguration                                                                        | `{}`                                                    |
 | podLabels                        | The labels to add to the azure-workload-identity webhook pods                                                                     | `{}`                                                    |
+| podAnnotations                   | The annotations to add to the azure-workload-identity webhook pods                                                                | `{}`                                                    |
 | mutatingWebhookNamespaceSelector | The namespace selector to further refine which namespaces will be selected by the webhook.                                        | `{}`                                                    |
 
 ## Contributing Changes

diff --git a/...s/workload-identity-webhook/templates/azure-wi-webhook-controller-manager-deployment.yaml b/...s/workload-identity-webhook/templates/azure-wi-webhook-controller-manager-deployment.yaml
@@ -18,6 +18,8 @@ spec:
       release: '{{ .Release.Name }}'
   template:
     metadata:
+      annotations:
+        {{- toYaml .Values.podAnnotations | trim | nindent 8 }}
       labels:
 {{- include "workload-identity-webhook.podLabels" . }}
         app: '{{ template "workload-identity-webhook.name" . }}'

diff --git a/charts/workload-identity-webhook/templates/azure-wi-webhook-manager-role-clusterrole.yaml b/charts/workload-identity-webhook/templates/azure-wi-webhook-manager-role-clusterrole.yaml
@@ -14,21 +14,15 @@ rules:
   resources:
   - serviceaccounts
   verbs:
-  - create
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - mutatingwebhookconfigurations
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
   - update
   - watch
diff --git a/...mplates/azure-wi-webhook-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml b/...mplates/azure-wi-webhook-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml
@@ -25,6 +25,7 @@ webhooks:
   objectSelector:
     matchLabels:
       azure.workload.identity/use: "true"
+  reinvocationPolicy: IfNeeded
   rules:
   - apiGroups:
     - ""

diff --git a/charts/workload-identity-webhook/values.yaml b/charts/workload-identity-webhook/values.yaml
@@ -7,7 +7,7 @@ image:
   repository: mcr.microsoft.com/oss/azure/workload-identity/webhook
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  release: v1.0.0-beta.0
+  release: v1.0.0-rc.0
 imagePullSecrets: []
 nodeSelector:
   kubernetes.io/os: linux
@@ -32,4 +32,5 @@ metricsBackend: prometheus
 priorityClassName: system-cluster-critical
 mutatingWebhookAnnotations: {}
 podLabels: {}
+podAnnotations: {}
 mutatingWebhookNamespaceSelector: {}
diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml
@@ -5,7 +5,7 @@ kind: Kustomization
 images:
 - name: manager
   newName: mcr.microsoft.com/oss/azure/workload-identity/webhook
-  newTag: v1.0.0-beta.0
+  newTag: v1.0.0-rc.0
 configMapGenerator:
 - literals:
   - AZURE_TENANT_ID="${AZURE_TENANT_ID}"

diff --git a/deploy/azure-wi-webhook.yaml b/deploy/azure-wi-webhook.yaml
@@ -54,22 +54,16 @@ rules:
   resources:
   - serviceaccounts
   verbs:
-  - create
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - mutatingwebhookconfigurations
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
   - update
   - watch
 ---
@@ -168,7 +162,7 @@ spec:
         envFrom:
         - configMapRef:
             name: azure-wi-webhook-config
-        image: mcr.microsoft.com/oss/azure/workload-identity/webhook:v1.0.0-beta.0
+        image: mcr.microsoft.com/oss/azure/workload-identity/webhook:v1.0.0-rc.0
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 6
@@ -260,6 +254,7 @@ webhooks:
   objectSelector:
     matchLabels:
       azure.workload.identity/use: "true"
+  reinvocationPolicy: IfNeeded
   rules:
   - apiGroups:
     - ""

diff --git a/docs/book/src/installation/mutating-admission-webhook.md b/docs/book/src/installation/mutating-admission-webhook.md
@@ -73,7 +73,7 @@ The deployment YAML contains the environment variables we defined above and we r
 Install the webhook using the deployment YAML via `kubectl apply -f` and `envsubst`:
 
 ```bash
-curl -sL https://github.com/Azure/azure-workload-identity/releases/download/v1.0.0-beta.0/azure-wi-webhook.yaml | envsubst | kubectl apply -f -
+curl -sL https://github.com/Azure/azure-workload-identity/releases/download/v1.0.0-rc.0/azure-wi-webhook.yaml | envsubst | kubectl apply -f -
 ```
 
 <details>

diff --git a/examples/migration/pod-with-proxy-init-and-proxy-sidecar.yaml b/examples/migration/pod-with-proxy-init-and-proxy-sidecar.yaml
@@ -8,7 +8,7 @@ spec:
   serviceAccountName: workload-identity-sa
   initContainers:
   - name: init-networking
-    image: mcr.microsoft.com/oss/azure/workload-identity/proxy-init:v1.0.0-beta.0
+    image: mcr.microsoft.com/oss/azure/workload-identity/proxy-init:v1.0.0-rc.0
     securityContext:
       capabilities:
         add:
@@ -26,6 +26,6 @@ spec:
     ports:
     - containerPort: 80
   - name: proxy
-    image: mcr.microsoft.com/oss/azure/workload-identity/proxy:v1.0.0-beta.0
+    image: mcr.microsoft.com/oss/azure/workload-identity/proxy:v1.0.0-rc.0
     ports:
     - containerPort: 8000
diff --git a/manifest_staging/charts/workload-identity-webhook/Chart.yaml b/manifest_staging/charts/workload-identity-webhook/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: workload-identity-webhook
 description: A Helm chart to install the azure-workload-identity webhook
 type: application
-version: 1.0.0-beta.0
-appVersion: v1.0.0-beta.0
+version: 1.0.0-rc.0
+appVersion: v1.0.0-rc.0
 home: https://github.com/Azure/azure-workload-identity
 sources:
   - https://github.com/Azure/azure-workload-identity
diff --git a/manifest_staging/charts/workload-identity-webhook/README.md b/manifest_staging/charts/workload-identity-webhook/README.md
@@ -34,7 +34,7 @@ helm upgrade -n azure-workload-identity-system [RELEASE_NAME] azure-workload-ide
 | replicaCount                     | The number of azure-workload-identity replicas to deploy for the webhook                                                          | `2`                                                     |
 | image.repository                 | Image repository                                                                                                                  | `mcr.microsoft.com/oss/azure/workload-identity/webhook` |
 | image.pullPolicy                 | Image pullPolicy                                                                                                                  | `IfNotPresent`                                          |
-| image.release                    | The image release tag to use                                                                                                      | Current release version: `v1.0.0-beta.0`                |
+| image.release                    | The image release tag to use                                                                                                      | Current release version: `v1.0.0-rc.0`                |
 | imagePullSecrets                 | Image pull secrets to use for retrieving images from private registries                                                           | `[]`                                                    |
 | nodeSelector                     | The node selector to use for pod scheduling                                                                                       | `kubernetes.io/os: linux`                               |
 | resources                        | The resource request/limits for the container image                                                                               | limits: 100m CPU, 30Mi, requests: 100m CPU, 20Mi        |

diff --git a/manifest_staging/charts/workload-identity-webhook/values.yaml b/manifest_staging/charts/workload-identity-webhook/values.yaml
@@ -7,7 +7,7 @@ image:
   repository: mcr.microsoft.com/oss/azure/workload-identity/webhook
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  release: v1.0.0-beta.0
+  release: v1.0.0-rc.0
 imagePullSecrets: []
 nodeSelector:
   kubernetes.io/os: linux

diff --git a/manifest_staging/deploy/azure-wi-webhook.yaml b/manifest_staging/deploy/azure-wi-webhook.yaml
@@ -162,7 +162,7 @@ spec:
         envFrom:
         - configMapRef:
             name: azure-wi-webhook-config
-        image: mcr.microsoft.com/oss/azure/workload-identity/webhook:v1.0.0-beta.0
+        image: mcr.microsoft.com/oss/azure/workload-identity/webhook:v1.0.0-rc.0
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 6

diff --git a/pkg/cmd/podidentity/detect.go b/pkg/cmd/podidentity/detect.go
@@ -35,7 +35,7 @@ var (
 
 const (
 	imageRepository = "mcr.microsoft.com/oss/azure/workload-identity"
-	imageTag        = "v1.0.0-beta.0"
+	imageTag        = "v1.0.0-rc.0"
 
 	proxyInitImageName     = "proxy-init"
 	proxyImageName         = "proxy"

diff --git a/third_party/open-policy-agent/gatekeeper/helmify/static/Chart.yaml b/third_party/open-policy-agent/gatekeeper/helmify/static/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: workload-identity-webhook
 description: A Helm chart to install the azure-workload-identity webhook
 type: application
-version: 1.0.0-beta.0
-appVersion: v1.0.0-beta.0
+version: 1.0.0-rc.0
+appVersion: v1.0.0-rc.0
 home: https://github.com/Azure/azure-workload-identity
 sources:
   - https://github.com/Azure/azure-workload-identity
diff --git a/third_party/open-policy-agent/gatekeeper/helmify/static/README.md b/third_party/open-policy-agent/gatekeeper/helmify/static/README.md
@@ -34,7 +34,7 @@ helm upgrade -n azure-workload-identity-system [RELEASE_NAME] azure-workload-ide
 | replicaCount                     | The number of azure-workload-identity replicas to deploy for the webhook                                                          | `2`                                                     |
 | image.repository                 | Image repository                                                                                                                  | `mcr.microsoft.com/oss/azure/workload-identity/webhook` |
 | image.pullPolicy                 | Image pullPolicy                                                                                                                  | `IfNotPresent`                                          |
-| image.release                    | The image release tag to use                                                                                                      | Current release version: `v1.0.0-beta.0`                |
+| image.release                    | The image release tag to use                                                                                                      | Current release version: `v1.0.0-rc.0`                |
 | imagePullSecrets                 | Image pull secrets to use for retrieving images from private registries                                                           | `[]`                                                    |
 | nodeSelector                     | The node selector to use for pod scheduling                                                                                       | `kubernetes.io/os: linux`                               |
 | resources                        | The resource request/limits for the container image                                                                               | limits: 100m CPU, 30Mi, requests: 100m CPU, 20Mi        |

diff --git a/third_party/open-policy-agent/gatekeeper/helmify/static/values.yaml b/third_party/open-policy-agent/gatekeeper/helmify/static/values.yaml
@@ -7,7 +7,7 @@ image:
   repository: mcr.microsoft.com/oss/azure/workload-identity/webhook
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  release: v1.0.0-beta.0
+  release: v1.0.0-rc.0
 imagePullSecrets: []
 nodeSelector:
   kubernetes.io/os: linux