Update Helm release aws-load-balancer-controller to v3

apps/aws-lb-controller/manifests/ClusterRole-aws-lb-controller-aws-load-balancer-controller-role.yml

@@ -9,72 +9,74 @@ metadata:
     app.kubernetes.io/name: aws-load-balancer-controller
     app.kubernetes.io/instance: aws-lb-controller
 rules:
-  - apiGroups: ["elbv2.k8s.aws"]
-    resources: [targetgroupbindings]
-    verbs: [create, delete, get, list, patch, update, watch]
-  - apiGroups: ["elbv2.k8s.aws"]
-    resources: [ingressclassparams]
+  # AUTO-GENERATED from config/rbac/role.yaml by hack/sync-rbac-to-helm.sh
+  # Do not edit these rules manually. Run 'make manifests' to update.
+  - apiGroups: [""]
+    resources: [configmaps]
+    verbs: [create, delete, get, update]
+  - apiGroups: [""]
+    resources: [endpoints, namespaces, nodes, pods]
     verbs: [get, list, watch]
   - apiGroups: [""]
     resources: [events]
     verbs: [create, patch]
   - apiGroups: [""]
-    resources: [pods]
-    verbs: [get, list, watch]
-  - apiGroups: ["networking.k8s.io"]
-    resources: [ingressclasses]
-    verbs: [get, list, watch]
-  - apiGroups: ["", "extensions", "networking.k8s.io"]
-    resources: [services, ingresses]
-    verbs: [get, list, patch, update, watch]
-  - apiGroups: [""]
-    resources: [nodes, namespaces, endpoints]
-    verbs: [get, list, watch]
+    resources: [pods/status, services/status]
+    verbs: [patch, update]
   - apiGroups: [""]
-    resources: [configmaps]
-    verbs: [get, delete, create, update]
-  - apiGroups: ["elbv2.k8s.aws", "", "extensions", "networking.k8s.io"]
-    resources: [targetgroupbindings/status, pods/status, services/status, ingresses/status]
-    verbs: [update, patch]
+    resources: [services]
+    verbs: [get, list, patch, update, watch]
+  - apiGroups: ["aga.k8s.aws"]
+    resources: [globalaccelerators]
+    verbs: [get, list, patch, watch]
+  - apiGroups: ["aga.k8s.aws"]
+    resources: [globalaccelerators/finalizers, globalaccelerators/status]
+    verbs: [patch, update]
   - apiGroups: ["discovery.k8s.io"]
     resources: [endpointslices]
     verbs: [get, list, watch]
+  - apiGroups: ["elbv2.k8s.aws"]
+    resources: [albtargetcontrolconfigs]
+    verbs: [get]
+  - apiGroups: ["elbv2.k8s.aws"]
+    resources: [ingressclassparams]
+    verbs: [get, list, watch]
+  - apiGroups: ["elbv2.k8s.aws"]
+    resources: [targetgroupbindings]
+    verbs: [create, delete, get, list, patch, update, watch]
+  - apiGroups: ["elbv2.k8s.aws"]
+    resources: [targetgroupbindings/status]
+    verbs: [patch, update]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: [ingresses]
+    verbs: [get, list, patch, update, watch]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: [ingresses/status]
+    verbs: [patch, update]
   - apiGroups: ["gateway.k8s.aws"]
-    resources: [loadbalancerconfigurations, targetgroupconfigurations, listenerruleconfigurations]
-    verbs: [get, list, watch, patch]
+    resources: [listenerruleconfigurations, loadbalancerconfigurations, targetgroupconfigurations]
+    verbs: [get, list, patch, watch]
   - apiGroups: ["gateway.k8s.aws"]
-    resources: [loadbalancerconfigurations/finalizers, targetgroupconfigurations/finalizers, listenerruleconfigurations/finalizers]
-    verbs: [update, patch]
+    resources: [listenerruleconfigurations/finalizers, loadbalancerconfigurations/finalizers, targetgroupconfigurations/finalizers]
+    verbs: [patch, update]
   - apiGroups: ["gateway.k8s.aws"]
-    resources: [loadbalancerconfigurations/status, targetgroupconfigurations/status, listenerruleconfigurations/status]
-    verbs: [get, patch, watch]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: [gatewayclasses, gateways]
-    verbs: [get, list, watch, patch]
+    resources: [listenerruleconfigurations/status, loadbalancerconfigurations/status, targetgroupconfigurations/status]
+    verbs: [get, patch, update]
   - apiGroups: ["gateway.networking.k8s.io"]
-    resources: [referencegrants]
-    verbs: [get, list, watch]
+    resources: [gatewayclasses, gateways, referencegrants]
+    verbs: [get, list, patch, watch]
   - apiGroups: ["gateway.networking.k8s.io"]
     resources: [gatewayclasses/finalizers, gateways/finalizers]
-    verbs: [update, patch]
+    verbs: [patch, update]
   - apiGroups: ["gateway.networking.k8s.io"]
-    resources: [gatewayclasses/status, gateways/status]
+    resources: [gatewayclasses/status, gateways/status, grpcroutes/status, httproutes/status, listenersets/status, tcproutes/status, tlsroutes/status, udproutes/status]
     verbs: [get, patch, update]
   - apiGroups: ["gateway.networking.k8s.io"]
-    resources: [grpcroutes, httproutes, tcproutes, tlsroutes, udproutes]
+    resources: [grpcroutes, httproutes, listenersets, tcproutes, tlsroutes, udproutes]
     verbs: [get, list, watch]
   - apiGroups: ["gateway.networking.k8s.io"]
-    resources: [grpcroutes/finalizers, httproutes/finalizers, tcproutes/finalizers, tlsroutes/finalizers, udproutes/finalizers]
+    resources: [grpcroutes/finalizers, httproutes/finalizers, listenersets/finalizers, tcproutes/finalizers, tlsroutes/finalizers, udproutes/finalizers]
     verbs: [update]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: [grpcroutes/status, httproutes/status, tcproutes/status, tlsroutes/status, udproutes/status]
-    verbs: [get, patch, update]
-  - apiGroups: ["aga.k8s.aws"]
-    resources: [globalaccelerators]
-    verbs: [get, list, patch, watch]
-  - apiGroups: ["aga.k8s.aws"]
-    resources: [globalaccelerators/finalizers]
-    verbs: [patch, update]
-  - apiGroups: ["aga.k8s.aws"]
-    resources: [globalaccelerators/status]
-    verbs: [patch, update]
+  - apiGroups: ["networking.k8s.io"]
+    resources: [ingressclasses]
+    verbs: [get, list, watch]

apps/aws-lb-controller/manifests/Deployment-aws-lb-controller-aws-load-balancer-controller.yml

@@ -44,7 +44,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: "public.ecr.aws/eks/aws-load-balancer-controller:v2.14.1"
+          image: "public.ecr.aws/eks/aws-load-balancer-controller:v3.5.0"
           imagePullPolicy: IfNotPresent
           volumeMounts:
             - mountPath: /tmp/k8s-webhook-server/serving-certs

apps/aws-lb-controller/manifests/MutatingWebhookConfiguration-aws-load-balancer-webhook.yml

@@ -18,7 +18,7 @@ webhooks:
     failurePolicy: Ignore
     name: mpod.elbv2.k8s.aws
     admissionReviewVersions:
-      - v1beta1
+      - v1
     namespaceSelector:
       matchExpressions:
         - key: elbv2.k8s.aws/pod-readiness-gate-inject
@@ -41,6 +41,38 @@ webhooks:
         resources:
           - pods
     sideEffects: None
+  - clientConfig:
+      caBundle: REPLACED
+      service:
+        name: aws-load-balancer-webhook-service
+        namespace: aws-lb-controller
+        path: /mutate-v1-pod-server-id
+    failurePolicy: Fail
+    name: quicid.elbv2.k8s.aws
+    admissionReviewVersions:
+      - v1
+    namespaceSelector:
+      matchExpressions:
+        - key: elbv2.k8s.aws/quic-server-id-inject
+          operator: In
+          values:
+            - enabled
+    objectSelector:
+      matchExpressions:
+        - key: app.kubernetes.io/name
+          operator: NotIn
+          values:
+            - aws-load-balancer-controller
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+        resources:
+          - pods
+    sideEffects: None
   - clientConfig:
       caBundle: REPLACED
       service:
@@ -50,7 +82,7 @@ webhooks:
     failurePolicy: Fail
     name: mservice.elbv2.k8s.aws
     admissionReviewVersions:
-      - v1beta1
+      - v1
     objectSelector:
       matchExpressions:
         - key: app.kubernetes.io/name
@@ -67,6 +99,76 @@ webhooks:
         resources:
           - services
     sideEffects: None
+  - clientConfig:
+      caBundle: REPLACED
+      service:
+        name: aws-load-balancer-webhook-service
+        namespace: aws-lb-controller
+        path: /mutate-alb-target-control-namespace-v1-pod
+    failurePolicy: Fail
+    name: alb-target-control.namespace.elbv2.k8s.aws
+    admissionReviewVersions:
+      - v1
+    namespaceSelector:
+      matchExpressions:
+        - key: elbv2.k8s.aws/alb-target-control-agent-injection
+          operator: In
+          values:
+            - enabled
+    objectSelector:
+      matchExpressions:
+        - key: app.kubernetes.io/name
+          operator: NotIn
+          values:
+            - aws-load-balancer-controller
+        - key: elbv2.k8s.aws/alb-target-control-agent-inject
+          operator: NotIn
+          values:
+            - "false"
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+        resources:
+          - pods
+    sideEffects: None
+  - clientConfig:
+      caBundle: REPLACED
+      service:
+        name: aws-load-balancer-webhook-service
+        namespace: aws-lb-controller
+        path: /mutate-alb-target-control-object-v1-pod
+    failurePolicy: Fail
+    name: alb-target-control.object.elbv2.k8s.aws
+    admissionReviewVersions:
+      - v1
+    namespaceSelector:
+      matchExpressions:
+        - key: elbv2.k8s.aws/alb-target-control-agent-injection
+          operator: DoesNotExist
+    objectSelector:
+      matchExpressions:
+        - key: app.kubernetes.io/name
+          operator: NotIn
+          values:
+            - aws-load-balancer-controller
+        - key: elbv2.k8s.aws/alb-target-control-agent-inject
+          operator: In
+          values:
+            - "true"
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+        resources:
+          - pods
+    sideEffects: None
   - clientConfig:
       caBundle: REPLACED
       service:
@@ -76,7 +178,7 @@ webhooks:
     failurePolicy: Fail
     name: mtargetgroupbinding.elbv2.k8s.aws
     admissionReviewVersions:
-      - v1beta1
+      - v1
     rules:
       - apiGroups:
           - elbv2.k8s.aws

apps/aws-lb-controller/manifests/ValidatingWebhookConfiguration-aws-load-balancer-webhook.yml

@@ -18,7 +18,7 @@ webhooks:
     failurePolicy: Fail
     name: vingressclassparams.elbv2.k8s.aws
     admissionReviewVersions:
-      - v1beta1
+      - v1
     objectSelector:
       matchExpressions:
         - key: app.kubernetes.io/name
@@ -45,7 +45,7 @@ webhooks:
     failurePolicy: Fail
     name: vtargetgroupbinding.elbv2.k8s.aws
     admissionReviewVersions:
-      - v1beta1
+      - v1
     rules:
       - apiGroups:
           - elbv2.k8s.aws
@@ -66,8 +66,10 @@ webhooks:
     failurePolicy: Fail
     matchPolicy: Equivalent
     name: vingress.elbv2.k8s.aws
+    objectSelector:
+    namespaceSelector:
     admissionReviewVersions:
-      - v1beta1
+      - v1
     rules:
       - apiGroups:
           - networking.k8s.io

apps/aws-lb-controller/release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: aws-load-balancer-controller
-      version: 1.14.1
+      version: 3.5.0
       sourceRef:
         kind: HelmRepository
         name: eks