beta to stable

cluster/config-defaults.yaml

@@ -84,12 +84,18 @@ skipper_ingress_max_replicas: "50"
 {{end}}
 skipper_ingress_cpu: "1000m"
 skipper_ingress_memory: "1500Mi"
+
+skipper_topology_spread_enabled: "true"
+skipper_topology_spread_timeout: "7m"
+
+# PHC
 skipper_ingress_health_check_options: "period=10s,min-requests=10,min-drop-probability=0.05,max-drop-probability=0.9,max-unhealthy-endpoints-ratio=0.9"
 
 # Enables deployment of canary version
 skipper_ingress_canary_enabled: "true"
 skipper_ingress_test_single_pod: "false"
 skipper_canary_controller_enabled: "false"
+
 # When set to true (and dedicated node pool for skipper is also true) the
 # daemonset overhead will be subtracted from the cpu settings such
 # that skipper will perfectly fit on the node.
@@ -98,9 +104,9 @@ skipper_ingress_binpack: "true"
 {{else}}
 skipper_ingress_binpack: "false"
 {{end}}
+
 # skipper node-pool
 enable_dedicate_nodepool_skipper: "true"
-skipper_topology_spread_enabled: "true"
 {{if eq .Cluster.Environment "e2e"}}
 skipper_attach_only_to_skipper_node_pool: "false"
 {{else}}
@@ -726,6 +732,9 @@ kuberuntu_distro_worker: "jammy"
 
 # Feature toggle for auditing events
 audit_pod_events: "true"
+# Whether to log audit event for node changes by kube-controller-manager. Useful
+# to see if kube-controller-manager is setting overlapping podCIDRs.
+audit_kube_controller_manager_node_changes: "false"
 {{if eq .Cluster.Environment "production"}}
 audittrail_url: "https://audittrail.cloud.zalando.com"
 {{else}}

cluster/manifests/roles/poweruser-role.yaml

@@ -246,3 +246,4 @@ rules:
   - create
   - update
   - patch
+  - delete

cluster/manifests/skipper/deployment.yaml

@@ -1,7 +1,7 @@
 {{/* image-updater-bot detects *image variables so use print to disable it for main image */}}
 
 {{ $main_image := print "container-registry.zalando.net/teapot/skipper-internal:" "v0.21.208-1027" }}
-{{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.21.208-1027" }}
+{{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.21.211-1033" }}
 
 
 {{/* Optional canary arguments separated by "[cf724afc]" to allow whitespaces, e.g. "-foo=has a whitespace[cf724afc]-baz=qux" */}}
@@ -68,8 +68,8 @@ spec:
         prometheus.io/path: /metrics
         prometheus.io/port: "9911"
         prometheus.io/scrape: "true"
-{{- if eq .Cluster.ConfigItems.skipper_topology_spread_enabled "true" }}
-        zalando.org/topology-spread-timeout: 7m
+{{- if and (eq .Cluster.ConfigItems.skipper_topology_spread_enabled "true") (ne .Cluster.ConfigItems.skipper_topology_spread_timeout "0")}}
+        zalando.org/topology-spread-timeout: {{ .Cluster.ConfigItems.skipper_topology_spread_timeout }}
 {{- end }}
     spec:
 {{- if eq .Cluster.ConfigItems.skipper_topology_spread_enabled "true" }}

cluster/node-pools/master-default/userdata.yaml

@@ -767,6 +767,14 @@ write_files:
             - group: "" # core
               resources: ["pods"]
         {{ end }}
+{{- if eq .Cluster.ConfigItems.audit_kube_controller_manager_node_changes "true"}}
+        - level: Request
+          users: ["system:kube-controller-manager"]
+          verbs: ["patch", "update"]
+          resources:
+            - group: "" # core
+              resources: ["nodes"]
+{{- end}}
         # don't audit any kube-controller-manager events
         - level: None
           users: ["system:kube-controller-manager"]