PSS app upgrades - Cabbage

[alex-dabija]

Towards epic.

Task

Upgrade all applications running on all AWS clusters to a version which supports PSS before the cluster is upgraded to AWS v19.3.x.

Why?

All apps running on a cluster need to be upgraded to a version which supports PSS before upgrading to cluster to AWS v19.3.x (see the release notes).

Links

• AWS v19.3.0 release notes;
• Scheduled cluster upgrades;
• App status;
• Managed apps upgrades;
• Long-term process app upgrades issue;

[mcharriere]

This refers to non-default apps; which in our case are:

• kong-app: deployments on 3.7.0 already ✅
• cloudflared: only installed in some kvm installation. so no more upgrades. The app will be deprecated in the future.
• linkerd: non-PSS version still used on viking. We need to talk to the customer.
• nginx-ingress-controller: this is the most problematic one. Customers need to upgrade to v3.

[ced0ps]

linkerd: non-PSS version still used on viking. We need to talk to the customer.

Shot a quick message to the customer. Consider it handled. EDIT: Decidedly handled.

[ced0ps]

nginx-ingress-controller: this is the most problematic one. Customers need to upgrade to v3

All affected customers are aware and in the process of updating. Some instances fall out of scope.

[mcharriere]

╭────┬─────────┬───────────────────────────────┬─────────┬───────╮
│  # │  team   │              app              │ version │ count │
├────┼─────────┼───────────────────────────────┼─────────┼───────┤
│  0 │ cabbage │ app-exporter                  │ 0.3.0   │     1 │
│  1 │ cabbage │ app-exporter                  │ 0.4.0   │     1 │
│  2 │ cabbage │ app-exporter                  │ 2.13.0  │     2 │
│  3 │ cabbage │ app-exporter                  │ 2.30.1  │     3 │
│  4 │ cabbage │ aws-load-balancer-controller  │ 1.2.0   │     4 │
│  5 │ cabbage │ aws-load-balancer-controller  │ 1.3.2   │     9 │
│  6 │ cabbage │ aws-load-balancer-controller  │ 1.4.3   │     2 │
│  7 │ cabbage │ aws-load-balancer-controller  │ 1.5.0   │    42 │
│  8 │ cabbage │ aws-load-balancer-controller  │ 1.6.1   │    20 │
│  9 │ cabbage │ cloudflared                   │ 0.3.0   │     1 │
│ 10 │ cabbage │ cloudflared                   │ 0.4.0   │     1 │
│ 11 │ cabbage │ coredns-app                   │ 1.20.0  │    18 │
│ 12 │ cabbage │ external-dns-app              │ 2.42.0  │    69 │
│ 13 │ cabbage │ external-dns-app              │ 3.0.0   │    25 │
│ 14 │ cabbage │ external-dns-app              │ 3.1.0   │     3 │
│ 15 │ cabbage │ ingress-nginx                 │ 3.5.1   │     3 │
│ 16 │ cabbage │ ingress-nginx                 │ 3.5.2   │     7 │
│ 17 │ cabbage │ ingress-nginx                 │ 3.6.0   │    21 │
│ 18 │ cabbage │ k8s-dns-node-cache-app        │ 2.5.0   │    13 │
│ 19 │ cabbage │ k8s-dns-node-cache-app        │ 2.6.1   │     8 │
│ 20 │ cabbage │ kong-app                      │ 3.7.0   │    50 │
│ 21 │ cabbage │ kong-app                      │ 3.8.0   │     1 │
│ 22 │ cabbage │ kyverno-policies-connectivity │ 0.5.4   │     4 │
│ 23 │ cabbage │ linkerd-control-plane         │ 1.1.0   │     1 │
│ 24 │ cabbage │ linkerd-control-plane         │ 1.2.0   │     6 │
│ 25 │ cabbage │ linkerd-control-plane         │ 1.4.0   │     3 │
│ 26 │ cabbage │ linkerd-viz                   │ 1.3.2   │     6 │
│ 27 │ cabbage │ linkerd-viz                   │ 1.5.0   │     3 │
│ 28 │ cabbage │ linkerd2-cni                  │ 1.3.0   │     6 │
│ 29 │ cabbage │ linkerd2-cni                  │ 1.4.1   │     3 │
│ 30 │ cabbage │ net-exporter                  │ 1.17.0  │    19 │
│ 31 │ cabbage │ net-exporter                  │ 1.18.0  │    37 │
│ 32 │ cabbage │ net-exporter                  │ 1.18.2  │    45 │
│ 33 │ cabbage │ nginx-ingress-controller-app  │ 2.30.1  │    23 │
│ 34 │ cabbage │ oauth2-proxy                  │ 2.12.0  │     1 │
│ 35 │ cabbage │ oauth2-proxy                  │ 2.13.0  │    21 │
│ 36 │ cabbage │ service-mesh-bundle           │ 0.5.0   │     1 │
├────┼─────────┼───────────────────────────────┼─────────┼───────┤
│  # │  team   │              app              │ version │ count │
╰────┴─────────┴───────────────────────────────┴─────────┴───────╯

• app-exporter 🚫 not ours
• aws-load-balancer-controller 🚫 not ours
• cloudflared deprecated. no more upgrades
• coredns-app default app. upgrade will happen with the cluster
• external-dns-app default app. upgrade will happen with the cluster
• ingress-nginx it's fine
• linkerd* it's fine
• net-exporter default app. upgrade will happen with the cluster
• nginx-ingress-controller-app it's v2. needs upgrade. As far as I remember we already got rid of all of them, but I'll check once more.
• oauth2-proxy MC only
• service-mesh-bundle it's fine

[mcharriere]

There is nothing else to do here, pending nginx upgrades are to be worked on https://github.com/giantswarm/giantswarm/issues/31059