zalando-incubator · demonCoder95 · Jul 3, 2024 · Jun 19, 2024 · Jul 1, 2024 · Jul 1, 2024
diff --git a/cluster/config-defaults.yaml b/cluster/config-defaults.yaml
@@ -112,6 +112,8 @@ skipper_validate_query: "true"
 skipper_validate_query_log: "false"
 
 skipper_default_filters: 'disableAccessLog(2,3,404,429) -> fifo(2000,20,"1s")'
+# skipper_default_filters_authentication defines filters that implement default request authentication
+skipper_default_filters_authentication: ''
 skipper_default_filters_append: 'stateBagToTag("auth-user", "client.uid")'
 skipper_disabled_filters: "static,bearerinjector"
 skipper_lua_sources: "file"

diff --git a/cluster/manifests/audittrail-adapter/daemonset.yaml b/cluster/manifests/audittrail-adapter/daemonset.yaml
@@ -33,7 +33,7 @@ spec:
       hostNetwork: true
       containers:
       - name: audittrail-adapter
-        image: container-registry.zalando.net/teapot/audittrail-adapter:master-64
+        image: container-registry.zalando.net/teapot/audittrail-adapter:master-65
         env:
           - name: AWS_REGION
             value: "{{ .Cluster.Region }}"

diff --git a/cluster/manifests/aws-cloud-controller-manager/daemonset.yaml b/cluster/manifests/aws-cloud-controller-manager/daemonset.yaml
@@ -27,7 +27,7 @@ spec:
         - --cloud-provider=aws
         - --use-service-account-credentials=true
         - --configure-cloud-routes=false
-        image: container-registry.zalando.net/teapot/aws-cloud-controller-manager-internal:v1.30.0-master-120
+        image: container-registry.zalando.net/teapot/aws-cloud-controller-manager-internal:v1.30.2-master-124
         name: aws-cloud-controller-manager
         resources:
           requests:

diff --git a/cluster/manifests/cronjob-fixer/deployment.yaml b/cluster/manifests/cronjob-fixer/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: cronjob-fixer
       containers:
         - name: cronjob-fixer
-          image: "container-registry.zalando.net/teapot/cronjob-fixer:master-15"
+          image: "container-registry.zalando.net/teapot/cronjob-fixer:master-16"
           resources:
             limits:
               cpu: 5m

diff --git a/cluster/manifests/event-logger/statefulset.yaml b/cluster/manifests/event-logger/statefulset.yaml
@@ -30,7 +30,7 @@ spec:
       serviceAccountName: kubernetes-event-logger
       containers:
       - name: logger
-        image: container-registry.zalando.net/teapot/event-logger:master-14
+        image: container-registry.zalando.net/teapot/event-logger:master-15
         args:
             - --snapshot-namespace=kube-system
             - --snapshot-name=kubernetes-event-logger

diff --git a/cluster/manifests/flannel/daemonset.yaml b/cluster/manifests/flannel/daemonset.yaml
@@ -37,7 +37,7 @@ spec:
             memory: 50Mi
       containers:
       - name: delayed-install-cni
-        image: container-registry.zalando.net/teapot/flannel-awaiter:master-12
+        image: container-registry.zalando.net/teapot/flannel-awaiter:master-13
         command:
         - /await
         stdin: true
@@ -57,7 +57,7 @@ spec:
           failureThreshold: 30
           periodSeconds: 10
       - name: kube-flannel
-        image: container-registry.zalando.net/teapot/flannel:v0.25.2-master-26
+        image: container-registry.zalando.net/teapot/flannel:v0.25.4-master-27
         command:
         - /opt/bin/flanneld
         args:

diff --git a/cluster/manifests/kube-state-metrics/deployment.yaml b/cluster/manifests/kube-state-metrics/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: kube-state-metrics
       containers:
       - name: kube-state-metrics
-        image: container-registry.zalando.net/teapot/kube-state-metrics:v2.10.1-master-24
+        image: container-registry.zalando.net/teapot/kube-state-metrics:v2.12.0-master-26
         args:
         - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
         - --metric-labels-allowlist=pods=[{{.Cluster.ConfigItems.observability_metrics_pods_labels}}],ingresses=[{{.Cluster.ConfigItems.observability_metrics_ingresses_labels}}],nodes=[topology.kubernetes.io/zone,node.kubernetes.io/instance-type,node.kubernetes.io/node-pool,node.kubernetes.io/role,node.kubernetes.io/profile,dedicated]

diff --git a/cluster/manifests/kubelet-summary-metrics/deployment.yaml b/cluster/manifests/kubelet-summary-metrics/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: kubelet-summary-metrics
       containers:
       - name: proxy
-        image: container-registry.zalando.net/teapot/kubelet-summary-metrics:main-5
+        image: container-registry.zalando.net/teapot/kubelet-summary-metrics:main-6
         resources:
           limits:
             cpu: "{{.Cluster.ConfigItems.kubelet_summary_metrics_cpu}}"

diff --git a/cluster/manifests/kubernetes-lifecycle-metrics/deployment.yaml b/cluster/manifests/kubernetes-lifecycle-metrics/deployment.yaml
@@ -31,7 +31,7 @@ spec:
       serviceAccountName: kubernetes-lifecycle-metrics
       containers:
         - name: kubernetes-lifecycle-metrics
-          image: "container-registry.zalando.net/teapot/kubernetes-lifecycle-metrics:master-21"
+          image: "container-registry.zalando.net/teapot/kubernetes-lifecycle-metrics:master-22"
           ports:
             - containerPort: 9090
               protocol: TCP

diff --git a/cluster/manifests/node-monitor/daemonset.yaml b/cluster/manifests/node-monitor/daemonset.yaml
@@ -79,7 +79,7 @@ spec:
               hostPort: 9101
               protocol: TCP
 {{- end }}
-        - image: container-registry.zalando.net/teapot/prometheus-node-exporter:v1.7.0-master-20
+        - image: container-registry.zalando.net/teapot/prometheus-node-exporter:v1.8.1-master-21
           args:
 {{- if eq .Cluster.ConfigItems.node_exporter_experimental_metrics "true" }}
             - --collector.ethtool

diff --git a/cluster/manifests/prometheus/statefulset.yaml b/cluster/manifests/prometheus/statefulset.yaml
@@ -35,9 +35,9 @@ spec:
           value: "1"
       initContainers:
       - name: generate-config
-        image: container-registry.zalando.net/library/alpine-3:3-20240325
+        image: container-registry.zalando.net/library/amazonlinux-2023-slim:main-810.1131-20240701
         command:
-        - /bin/sh
+        - /bin/bash
         args:
         - -c
         - sed s/'@@POD_NAME@@'/${POD_NAME}/g /etc/prometheus/prometheus.yml > /prometheus/prometheus.yaml ; cp /etc/prometheus/prometheus.rules.yml /prometheus/prometheus.rules.yaml
@@ -57,7 +57,7 @@ spec:
           mountPath: /prometheus
       containers:
       - name: prometheus
-        image: container-registry.zalando.net/teapot/prometheus:v2.51.0-master-54
+        image: container-registry.zalando.net/teapot/prometheus:v2.53.0-master-55
         args:
         - "--config.file=/prometheus/prometheus.yaml"
         - "--storage.tsdb.path=/prometheus/"

diff --git a/cluster/manifests/skipper/deployment.yaml b/cluster/manifests/skipper/deployment.yaml
@@ -1,5 +1,5 @@
 {{ $internal_version := "v0.21.124-947" }}
-{{ $canary_internal_version := "v0.21.133-957" }}
+{{ $canary_internal_version := "v0.21.139-963" }}
 
 {{/* Optional canary arguments separated by "[cf724afc]" to allow whitespaces, e.g. "-foo=has a whitespace[cf724afc]-baz=qux" */}}
 {{ $canary_args := "" }}
@@ -256,6 +256,7 @@ spec:
           - "-disabled-filters={{ .Cluster.ConfigItems.skipper_disabled_filters }}"
 {{ if ne .Cluster.ConfigItems.skipper_routesrv_enabled "exec" }}
           - '-default-filters-prepend={{ .Cluster.ConfigItems.skipper_default_filters }}'
+          - '-default-filters-append={{ .Cluster.ConfigItems.skipper_default_filters_authentication }}'
           - '-default-filters-append={{ .Cluster.ConfigItems.skipper_default_filters_append }}'
   {{ if .Cluster.ConfigItems.skipper_edit_route_placeholders }}
           {{ range $placeholder := split .Cluster.ConfigItems.skipper_edit_route_placeholders "[cf724afc]" }}
@@ -541,6 +542,7 @@ spec:
           - "-reverse-source-predicate"
           - "-default-filters-dir=/etc/config/default-filters"
           - '-default-filters-prepend={{ .Cluster.ConfigItems.skipper_default_filters }}'
+          - '-default-filters-append={{ .Cluster.ConfigItems.skipper_default_filters_authentication }}'
           - '-default-filters-append={{ .Cluster.ConfigItems.skipper_default_filters_append }}'
 {{ if eq .Cluster.ConfigItems.skipper_ingress_redis_swarm_enabled "true" }}
           - "-enable-swarm"

diff --git a/cluster/manifests/spot-node-rescheduler/cronjob.yaml b/cluster/manifests/spot-node-rescheduler/cronjob.yaml
@@ -24,7 +24,7 @@ spec:
           restartPolicy: Never
           containers:
           - name: spot-node-rescheduler
-            image: container-registry.zalando.net/teapot/spot-node-rescheduler:main-8
+            image: container-registry.zalando.net/teapot/spot-node-rescheduler:main-9
             resources:
               limits:
                 cpu: "{{ .Cluster.ConfigItems.spot_node_rescheduler_cpu }}"

diff --git a/cluster/node-pools/master-default/userdata.yaml b/cluster/node-pools/master-default/userdata.yaml
@@ -271,7 +271,7 @@ write_files:
             - mountPath: /etc/kubernetes/ssl
               name: ssl-certs-kubernetes
               readOnly: true
-        - image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/k8s-authnz-webhook:master-134
+        - image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/k8s-authnz-webhook:master-135
           name: webhook
           ports:
           - containerPort: 8081