Spike: Update Ambassador to the latest stable version

[suvajit-sarkar]

Description

As a developer I want to use the latest stable version of Ambassador to avoid any vulnerabilities and use the latest features.

How

1. Make a list of all the (breaking) changes that occurred from v0.52 until v1.9.1
2. Make changes to the code according to the created list and test Ambassador

Acceptance Criteria

1. Have that latest version of Ambassador supported (which is 1.9.1).
2. Test out of one component which uses Ambassador annotations.

[jagpreetsinghsasan]

https://github.com/hyperledger-labs/blockchain-automation-framework/issues/824 story status should be checked for, to confirm if UDP support is enabled in the latest ambassador version or not. If UDP support is there, we should upgrade ambassador to directly that version

[ghost]

For the complete changelog for Ambassador check: https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

Most impacting changes from 0.52 to latest are:

• (0.60.0) Ambassador 0.60 will listen on ports 8080/8443 by default.
• (0.80.0) Golang components now use Go 1.13.
• (0.80.0) Ambassador build now requires clean type hinting.
• (0.80.0) KAT client and server have been pulled back into the Ambassador repo.
• (0.81.0) Test services can now be built, deployed, and tested more easily (see BUILDING.md).
• (0.82.0) Switch back to the latest mypy (currently 0.730).
• (0.82.0) Environment variable KAT_IMAGE_PULL_POLICY can override the imagePullPolicy when running KAT tests.
• (0.82.0) Updated Generated Envoy Golang APIs.
• (0.82.0) Switch to Python 3.7 and Alpine 3.10.
• (0.83.0) Update Ambassador to address CVE-2019-15225 and CVE-2019-15226. This switches the default regex engine! See the documentation for the ambassador Module for more.
• (0.84.0) Many many things about the build system have changed under the hood! Start with 'make help'.
• (1.0.0) All of Ambassador's CRDs have been switched to apiVersion: getambassador.io/v2, and your resources will be upgraded when you apply the new CRDs. We recommend that you follow the migration instructions and check your installation's behavior before upgrading your CRDs.
• (1.0.0) ambassador-internal-access-control Filter and FilterPolicy are now created internally. Remove them from your cluster if upgrading from a previous version.
• (1.0.0) BREAKING CHANGE: When a resource specifies a service or secret name without a corresponding namespace, Ambassador will now look for the service or secret in the namespace of the resource that mentioned it. In the past, Ambassador would look in the namespace in which Ambassador was running.
• (1.0.0) BREAKING CHANGE: Rename Host CR status field 'reason' to 'errorReason'.
• (1.0.0) BREAKING CHANGE: APP_LOG_LEVEL is now AES_LOG_LEVEL.
• (1.0.0) Switched from quay.io back to DockerHub as our primary publication point. If you are using your own Kubernetes manifests, you will have to update them!
• (1.5.0) Datawire's Helm charts and published YAML have already been updated.
• (1.6.0) Ambassador will no longer attempt to update the Status of a Mapping unless you explicitly set AMBASSADOR_UPDATE_MAPPING_STATUS=true.
• (1.9.0) Upgrade Alpine 3.10→3.12, GNU libc 2.30→2.32, and Python 3.7→3.8.
• (1.9.0) The DevPortal no longer looks for documentation at /.ambassador-internal/openapi-docs. A new field in Mappings, docs, must be used for specifying the source for documentation.

[ghost]

During the upgrade from 0.52 to 1.9.1, we stumbled upon an issue where the secret could not be found. This happend due to the fact the the default namespace is not used for retrieving the secret, it looks in the service namespace.

[ghost]

824 story status should be checked for, to confirm if UDP support is enabled in the latest ambassador version or not.

If UDP support is there, we should upgrade ambassador to directly that version

I can't find any mention on UDP in the change log, we have decided to upgrade to the latest version.

[ghost]

Possible issue with searching for secret in namespace if ambassador version is higher then 1.8.

[suvajit-sarkar]

Spike outcome:

1. Ambassador v1.9.1 would be used as upgraded version for BAF
2. Ambassador v1.9.1 create CRDs which makes current BAF ambassador incompatible / not working until the CRDs are deleted, suggest approach is to use a separate cluster
3. Ambassador v1.9.1 uses v2 annotations which expects to secret to be in the same namespace of the service to be annotated. So the TLS cert secret should be created in the same namespace not in the default

Stories and Next Steps

1. Install Ambassador v1.9.1 using BAF shared code #1285
2. Update the annotations for BAF HL Besu ( includes changing secret namespace) #1286
3. Further DLT annotation upgrading issues needs to be create