Merge pull request #659 from aws-quickstart/task/1.7.0-release-prep

Task/1.7.0 release prep

lib/addons/adot/index.ts

@@ -1,10 +1,10 @@
-import { CoreAddOn, CoreAddOnProps } from "../core-addon";
-import { ClusterInfo } from "../../spi";
-import { getAdotCollectorPolicyDocument } from "./iam-policy";
-import { dependable, loadYaml, readYamlDocument } from "../../utils";
 import { KubernetesManifest } from "aws-cdk-lib/aws-eks";
 import { Construct } from 'constructs';
+import { ClusterInfo } from "../../spi";
+import { dependable, loadYaml, readYamlDocument } from "../../utils";
 import { CertManagerAddOn } from "../cert-manager";
+import { CoreAddOn, CoreAddOnProps } from "../core-addon";
+import { getAdotCollectorPolicyDocument } from "./iam-policy";
 
 /**
  * Configuration options for the Adot add-on.
@@ -13,7 +13,7 @@ type AdotCollectorAddOnProps = CoreAddOnProps;
 
 const defaultProps = {
     addOnName: 'adot',
-    version: 'v0.66.0-eksbuild.1',
+    version: 'v0.70.0-eksbuild.1',
     saName: 'adot-collector',
     policyDocumentProvider: getAdotCollectorPolicyDocument,
     namespace: 'default'

lib/addons/appmesh/index.ts

@@ -1,4 +1,5 @@
 import { ManagedPolicy } from "aws-cdk-lib/aws-iam";
+import { Construct } from "constructs";
 import merge from "ts-deepmerge";
 import { assertEC2NodeGroup } from "../../cluster-providers";
 import { ClusterInfo, Values } from "../../spi";
@@ -57,7 +58,7 @@ export class AppMeshAddOn extends HelmAddOn {
         this.options = this.props;
     }
 
-    override deploy(clusterInfo: ClusterInfo): void {
+    override deploy(clusterInfo: ClusterInfo): Promise<Construct> {
 
         const cluster = clusterInfo.cluster;
 
@@ -101,5 +102,6 @@ export class AppMeshAddOn extends HelmAddOn {
 
         const chart = this.addHelmChart(clusterInfo, values);
         chart.node.addDependency(sa);
+        return Promise.resolve(chart);
     }
 }

lib/addons/aws-loadbalancer-controller/index.ts

@@ -1,10 +1,10 @@
 import * as iam from "aws-cdk-lib/aws-iam";
 import { Construct } from "constructs";
+import "reflect-metadata";
 import { ClusterInfo, Values } from "../../spi";
 import { registries } from "../../utils/registry-utils";
 import { HelmAddOn, HelmAddOnUserProps } from "../helm-addon";
 import { AwsLoadbalancerControllerIamPolicy } from "./iam-policy";
-import { deployBeforeCapacity } from "../../utils";
 
 /**
  * Configuration options for the add-on.
@@ -35,7 +35,13 @@ export interface AwsLoadBalancerControllerProps extends HelmAddOnUserProps {
      * Name of ingressClass to the ALB controller will satisfy. If not provided
      * the value will be defaulted to "alb"
      */
-    ingressClass?: string
+    ingressClass?: string,
+
+    /**
+     * If false, disable the Service Mutator webhook which makes all new services of type LoadBalancer reconciled by the lb controller.
+     * @default false   
+     */
+    enableServiceMutatorWebhook?: boolean
 }
 
 
@@ -50,12 +56,13 @@ const defaultProps: AwsLoadBalancerControllerProps = {
     chart: AWS_LOAD_BALANCER_CONTROLLER,
     repository: 'https://aws.github.io/eks-charts',
     release: AWS_LOAD_BALANCER_CONTROLLER,
-    version: '1.4.8',
+    version: '1.5.2',
     enableShield: false,
     enableWaf: false,
     enableWafv2: false,
     createIngressClassResource: true,
-    ingressClass: "alb"
+    ingressClass: "alb",
+    enableServiceMutatorWebhook: false
 };
 
 
@@ -68,6 +75,7 @@ function lookupImage(registry?: string, region?: string): Values {
     return { image: { repository: registry + "amazon/aws-load-balancer-controller" } };
 }
 
+@Reflect.metadata("ordered", true)
 export class AwsLoadBalancerControllerAddOn extends HelmAddOn {
 
     readonly options: AwsLoadBalancerControllerProps;
@@ -104,13 +112,13 @@ export class AwsLoadBalancerControllerAddOn extends HelmAddOn {
             enableWafv2: this.options.enableWafv2,
             createIngressClassResource: this.options.createIngressClassResource,
             ingressClass: this.options.ingressClass,
+            enableServiceMutatorWebhook: this.options.enableServiceMutatorWebhook,
             region: clusterInfo.cluster.stack.region,
             ...image,
             vpcId: clusterInfo.cluster.vpc.vpcId,
         }, undefined, false);
 
         awsLoadBalancerControllerChart.node.addDependency(serviceAccount);
-        deployBeforeCapacity(awsLoadBalancerControllerChart, clusterInfo);
         // return the Promise Construct for any teams that may depend on this
         return Promise.resolve(awsLoadBalancerControllerChart);
     }

lib/addons/aws-privateca-issuer/index.ts

@@ -30,7 +30,7 @@ const defaultProps: HelmAddOnProps & AWSPrivateCAIssuerAddonProps = {
   name: "blueprints-aws-pca-issuer-addon",
   chart: "aws-privateca-issuer",
   namespace:"aws-pca-issuer",
-  version: "1.2.4",
+  version: "1.2.5",
   release: "aws-pca-issuer",
   repository:  "https://cert-manager.github.io/aws-privateca-issuer",
   values: {},

lib/addons/calico-operator/index.ts

@@ -31,7 +31,7 @@ export interface CalicoOperatorAddOnProps extends HelmAddOnUserProps {
 const defaultProps = {
     name: 'calico-operator',
     namespace: 'calico-operator',
-    version: 'v3.25.0',
+    version: 'v3.25.1',
     chart: "tigera-operator",
     release: "bp-addon-calico-operator",
     repository: "https://projectcalico.docs.tigera.io/charts"

lib/addons/cert-manager/index.ts

@@ -27,7 +27,7 @@ const defaultProps: HelmAddOnProps & CertManagerAddOnProps = {
   name: "blueprints-cert-manager-addon",
   namespace: "cert-manager",
   chart: "cert-manager",
-  version: "1.11.0",
+  version: "1.11.1",
   release: "cert-manager",
   repository:  "https://charts.jetstack.io",
   values: {},

lib/addons/external-dns/index.ts

@@ -24,7 +24,7 @@ const defaultProps = {
     namespace: 'external-dns',
     repository: 'https://charts.bitnami.com/bitnami',
     release: 'blueprints-addon-external-dns',
-    version: '6.15.0',
+    version: '6.18.0',
     values: {},
 };
 

lib/addons/istio-base/index.ts

@@ -55,7 +55,7 @@ const defaultProps = {
     release: "istio-base",
     namespace: "istio-system",
     chart: "base",
-    version: "1.17.1",
+    version: "1.17.2",
     repository: "https://istio-release.storage.googleapis.com/charts"
 };
 

lib/addons/istio-control-plane/index.ts

@@ -14,7 +14,7 @@ const defaultProps = {
     release: "istiod",
     namespace: "istio-system",
     chart: "istiod",
-    version: "1.17.1",
+    version: "1.17.2",
     repository: "https://istio-release.storage.googleapis.com/charts"
 };
 

lib/addons/karpenter/index.ts

@@ -117,7 +117,7 @@ const RELEASE = 'blueprints-addon-karpenter';
 const defaultProps: HelmAddOnProps = {
     name: KARPENTER,
     namespace: KARPENTER,
-    version: 'v0.25.0',
+    version: 'v0.27.3',
     chart: KARPENTER,
     release: KARPENTER,
     repository: 'oci://public.ecr.aws/karpenter/karpenter',

lib/addons/keda/index.ts

@@ -52,7 +52,7 @@ const defaultProps: HelmAddOnProps & KedaAddOnProps = {
   name: "blueprints-keda-addon",
   chart: "keda",
   namespace:"keda",
-  version: "2.10.1",
+  version: "2.10.2",
   release: "keda",
   repository:  "https://kedacore.github.io/charts",
   values: {},

lib/addons/kube-state-metrics/index.ts

@@ -21,7 +21,7 @@ const defaultProps: HelmAddOnProps & KubeStateMetricsAddOnProps = {
   name: "kube-state-metrics",
   namespace: "kube-system",
   chart: "kube-state-metrics",
-  version: "5.3.0",
+  version: "5.6.0",
   release: "kube-state-metrics",
   repository:  "https://prometheus-community.github.io/helm-charts",
   values: {},

lib/addons/metrics-server/index.ts

@@ -12,7 +12,7 @@ type MetricsServerAddOnProps = HelmAddOnUserProps;
 const defaultProps: HelmAddOnProps = {
     chart: "metrics-server",
     repository: "https://kubernetes-sigs.github.io/metrics-server",
-    version: "3.9.0",
+    version: "3.10.0",
     release: 'blueprints-addon-metrics-server',
     name: 'metrics-server',
     namespace: 'kube-system'

lib/addons/opa-gatekeeper/index.ts

@@ -4,7 +4,7 @@ import { HelmAddOn, HelmAddOnProps, HelmAddOnUserProps } from "../helm-addon";
 /**
  * Properties available to configure opa gatekeeper.
  * namespace default is gatekeeper-system
- * version default is 3.11.0
+ * version default is 3.12.0
  * values as per https://github.com/open-policy-agent/gatekeeper/tree/master/charts/gatekeeper
  */
 export type OpaGatekeeperAddOnProps = HelmAddOnUserProps;
@@ -19,7 +19,7 @@ const defaultProps: HelmAddOnProps = {
     namespace: 'gatekeeper-system',
     chart: 'gatekeeper',
     repository: "https://open-policy-agent.github.io/gatekeeper/charts",
-    version: '3.11.0'
+    version: '3.12.0'
 };
 
 export class OpaGatekeeperAddOn extends HelmAddOn implements ClusterPostDeploy {

lib/addons/prometheus-node-exporter/index.ts

@@ -21,7 +21,7 @@ const defaultProps: HelmAddOnProps & PrometheusNodeExporterAddOnProps = {
   name: "prometheus-node-exporter",
   namespace: "prometheus-node-exporter",
   chart: "prometheus-node-exporter",
-  version: "4.14.0",
+  version: "4.17.0",
   release: "prometheus-node-exporter",
   repository:  "https://prometheus-community.github.io/helm-charts",
   values: {},

lib/addons/secrets-store/index.ts

@@ -46,7 +46,7 @@ const defaultProps: SecretsStoreAddOnProps = {
     chart: 'secrets-store-csi-driver',
     name: 'secrets-store-csi-driver',
     namespace: 'kube-system',
-    version: '1.3.2',
+    version: '1.3.3',
     release: 'blueprints-addon-secret-store-csi-driver',
     repository: 'https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts',
     rotationPollInterval: undefined,

lib/addons/velero/index.ts

@@ -19,7 +19,7 @@ export interface VeleroAddOnProps extends HelmAddOnUserProps {
  */
 const defaultProps = {
     name: 'velero',
-    version: "3.1.5",
+    version: "3.2.0",
     namespace: "velero",
     createNamespace: true,
     chart: "velero",

lib/addons/vpc-cni/index.ts

@@ -192,7 +192,7 @@ export interface CustomNetworkingConfig {
 
 const defaultProps: CoreAddOnProps = {
   addOnName: 'vpc-cni',
-  version: 'v1.12.5-eksbuild.2',
+  version: 'v1.12.6-eksbuild.1',
   saName: 'aws-node',
   namespace: 'kube-system',
   controlPlaneAddOn: true,

lib/cluster-providers/generic-cluster-provider.ts

@@ -1,7 +1,7 @@
 
-import { KubectlV22Layer } from "@aws-cdk/lambda-layer-kubectl-v22";
 import { KubectlV23Layer } from "@aws-cdk/lambda-layer-kubectl-v23";
 import { KubectlV24Layer } from "@aws-cdk/lambda-layer-kubectl-v24";
+import { KubectlV25Layer } from "@aws-cdk/lambda-layer-kubectl-v25";
 import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
 import * as ec2 from "aws-cdk-lib/aws-ec2";
 import * as eks from "aws-cdk-lib/aws-eks";
@@ -269,12 +269,12 @@ export class GenericClusterProvider implements ClusterProvider {
      */
     protected getKubectlLayer(scope: Construct, version: eks.KubernetesVersion) : ILayerVersion | undefined {
         switch(version) {
-            case eks.KubernetesVersion.V1_24:
-                return new KubectlV24Layer(scope, "kubectllayer24");
             case eks.KubernetesVersion.V1_23:
                 return new KubectlV23Layer(scope, "kubectllayer23");
-            case eks.KubernetesVersion.V1_22:
-                return new KubectlV22Layer(scope, "kubectllayer22");
+            case eks.KubernetesVersion.V1_24:
+                return new KubectlV24Layer(scope, "kubectllayer24");
+            case eks.KubernetesVersion.V1_25:
+                return new KubectlV25Layer(scope, "kubectllayer25");
         }
 
         const minor = version.version.split('.')[1];

lib/spi/types.ts

@@ -160,12 +160,13 @@ export class ClusterInfo {
      * @param construct
      */
     public addProvisionedAddOn(addOn: string, construct: Construct) {
-        if (this.isOrderedAddOn(addOn) && this.provisionedAddOns.size > 0) {
-            const prev: Construct = Array.from(this.provisionedAddOns.values()).pop()!;
-            construct.node.addDependency(prev);
-            const prevAddOn = Array.from(this.provisionedAddOns.keys()).pop()!;
-            logger.debug(`Adding dependency from ${addOn} to ${prevAddOn}`);
-        }
+        this.orderedAddOns.forEach(e => {
+            const provisionedOrdered = this.provisionedAddOns.get(e);
+            if(provisionedOrdered) {
+                logger.debug(`Adding dependency from ${addOn} to ${e}`);
+                construct.node.addDependency(provisionedOrdered);
+            }
+        });
         this.provisionedAddOns.set(addOn, construct);
     }
 

lib/utils/secrets-manager-utils.ts

@@ -1,4 +1,4 @@
-import { SecretsManager } from "aws-sdk";
+import { SecretsManager } from "@aws-sdk/client-secrets-manager";
 /**
  * Gets secret value from AWS Secret Manager. Requires access rights to the secret, specified by the secretName parameter.
  * @param secretName name of the secret to retrieve
@@ -9,7 +9,7 @@ import { SecretsManager } from "aws-sdk";
     const secretManager = new SecretsManager({ region });
     let secretString = "";
     try {
-        let response = await secretManager.getSecretValue({ SecretId: secretName }).promise();
+        let response = await secretManager.getSecretValue({ SecretId: secretName });
         if (response) {
             if (response.SecretString) {
                 secretString = response.SecretString;
@@ -32,7 +32,7 @@ import { SecretsManager } from "aws-sdk";
 export async function validateSecret(secretName: string, region: string): Promise<string> {
     const secretManager = new SecretsManager({ region });
     try {
-        const response = await secretManager.describeSecret({ SecretId: secretName }).promise();
+        const response = await secretManager.describeSecret({ SecretId: secretName });
         return response.ARN!;
     }
     catch (error) {