[2.2.2] release pr

.circleci/yq.d/go.mod

@@ -1,5 +1,21 @@
 module github.com/datawire/build-aux/bin-go/yq
 
-go 1.13
+go 1.17
 
 require github.com/mikefarah/yq/v3 v3.0.0-20200417222338-3f913afbb9ed
+
+require (
+	github.com/fatih/color v1.9.0 // indirect
+	github.com/goccy/go-yaml v1.4.3 // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.6 // indirect
+	github.com/mattn/go-isatty v0.0.12 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/spf13/cobra v1.0.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	golang.org/x/sys v0.0.0-20200413165638-669c56c373c4 // indirect
+	golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 // indirect
+	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
+)

.circleci/yq.d/go.sum

@@ -45,15 +45,18 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmg
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
@@ -68,12 +71,8 @@ github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOA
 github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mikefarah/yq v1.15.0 h1:ViMYNRG5UB7hzm8olxMFqPtkpMXXKO4g32/v9JUa62o=
-github.com/mikefarah/yq v2.4.0+incompatible h1:oBxbWy8R9hI3BIUUxEf0CzikWa2AgnGrGhvGQt5jgjk=
 github.com/mikefarah/yq/v3 v3.0.0-20200417222338-3f913afbb9ed h1:OPcaXkq4IrtwnP0leTxMFv9f6R9HVNmK9ryr80sWUEM=
 github.com/mikefarah/yq/v3 v3.0.0-20200417222338-3f913afbb9ed/go.mod h1:A6ElbOcozhGwjUdRx9kn1HtKJteuLrx76cnZYjSTJFw=
-github.com/mikefarah/yq/v3 v3.0.0-20200501003153-6fc3566acd3a h1:cC7JRs/VhffZg3JHuYqZOI8BIVI7r3ufx4xLRNgDuus=
-github.com/mikefarah/yq/v3 v3.0.0-20200501003153-6fc3566acd3a/go.mod h1:A6ElbOcozhGwjUdRx9kn1HtKJteuLrx76cnZYjSTJFw=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -161,6 +160,7 @@ google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZi
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
 gopkg.in/go-playground/validator.v9 v9.30.0/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWdVbfP1avr/N00E2vyQ=

.circleci/yq.d/pin.go

@@ -0,0 +1,6 @@
+//go:build pin
+// +build pin
+
+package ignore
+
+import "github.com/mikefarah/yq/v3"

CHANGELOG.md

@@ -77,6 +77,79 @@ Please see the [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest
 
 ## RELEASE NOTES
 
+## [2.2.2] TBD
+[2.2.2]: https://github.com/datawire/edge-stack/releases/v2.2.2
+
+## Ambassador Edge Stack
+
+- Change: You may now choose to enable TLS Secret validation by setting the
+  `AMBASSADOR_FORCE_SECRET_VALIDATION=true` environment variable. The default configuration does not
+  enforce secret validation.
+
+- Bugfix: Kubernetes Secrets that should contain an EC (Elliptic Curve) TLS Private Key are now properly
+  validated. ([4134])
+
+[4134]: https://github.com/emissary-ingress/emissary/issues/4134
+
+## [2.2.1] 2022-02-22
+[2.2.1]: https://github.com/datawire/edge-stack/releases/v2.2.1
+
+## Ambassador Edge Stack
+
+- Change: Support for the Envoy V2 API is deprecated as of Ambassador Edge Stack v2.1, and will be removed
+  in Ambassador Edge Stack v3.0. The `AMBASSADOR_ENVOY_API_VERSION` environment variable will be
+  removed at the same time. Only the Envoy V3 API will be supported (this has been the default since
+  Ambassador Edge Stack v1.14.0).
+
+- Security: Upgraded Envoy to address security vulnerabilities CVE-2021-43824, CVE-2021-43825, CVE-2021-43826,
+  CVE-2022-21654, and CVE-2022-21655.
+
+- Bugfix: The Ambassador Agent now correctly supports requests to cancel a rollout.
+
+## [2.2.0] 2022-02-10
+[2.2.0]: https://github.com/datawire/edge-stack/releases/v2.2.0
+
+## Ambassador Edge Stack
+
+- Change: Support for the Envoy V2 API is deprecated as of Ambassador Edge Stack v2.1, and will be removed
+  in Ambassador Edge Stack v3.0. The `AMBASSADOR_ENVOY_API_VERSION` environment variable will be
+  removed at the same time. Only the Envoy V3 API will be supported (this has been the default since
+  Ambassador Edge Stack v1.14.0).
+
+- Change: Ambassador Edge Stack will now watch for ConfigMap or Secret resources specified by the
+  `AGENT_CONFIG_RESOURCE_NAME` environment variable in order to allow all components (and not only
+  the Ambassador Agent) to authenticate requests to Ambassador Cloud.
+
+- Security: Ambassador Edge Stack has updated Alpine to 3.15, and Python and Go dependencies to their latest
+  compatible versions, to incorporate numerous security patches.
+
+- Feature: Ambassador Edge Stack now supports the metric `ambassador_log_level{label="debug"}` which will be
+  set to 1 if debug logging is enabled for the running Emissary instance, or to 0 if not. This can
+  help to be sure that a running production instance was not actually left doing debugging logging,
+  for example. (Thanks to <a href="https://github.com/jfrabaute">Fabrice</a>!) ([#3906])
+
+- Feature: Ambassador Edge Stack is now leveraging a new Envoy Proxy patch that allows Envoy to accept
+  escaped '%' characters in its configuration. This means that error_response_overrides and other
+  custom user content can now contain '%' symbols escaped as '%%'. ([DW Envoy: 74]) ([Upstream Envoy: 19383])
+
+- Feature: Support for streaming Envoy metrics about the clusters to Ambassador Cloud. ([#4053])
+
+- Feature: The Ambassador agent now receives commands to manipulate Rollouts (pause, continue, and abort are
+  currently supported) via directives and executes them in the cluster. A report is sent to
+  Ambassador Cloud including the command ID, whether it ran successfully, and an error message in
+  case there was any. ([#4040])
+
+- Bugfix: Kubernetes Secrets that should contain TLS certificates are now validated before being accepted
+  for configuration. A Secret that contains an invalid TLS certificate will be logged as an invalid
+  resource. ([#3821])
+
+[#3906]: https://github.com/emissary-ingress/emissary/issues/3906
+[DW Envoy: 74]: https://github.com/datawire/envoy/pull/74
+[Upstream Envoy: 19383]: https://github.com/envoyproxy/envoy/pull/19383
+[#4053]: https://github.com/emissary-ingress/emissary/pull/4053
+[#4040]: https://github.com/emissary-ingress/emissary/pull/4040
+[#3821]: https://github.com/emissary-ingress/emissary/issues/3821
+
 ## [2.1.2] 2022-01-25
 [2.1.2]: https://github.com/datawire/edge-stack/releases/v2.1.2
 

Makefile

@@ -4,37 +4,50 @@ SHELL := /bin/bash
 HELM_OUTPUT_DIR := $(EDGE_STACK_HOME)/build/helm/
 
 generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes.yaml
+generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes-ambassadorns.yaml
+generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes-ambassadorns-agent.yaml
+generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes-ambassadorns-migration.yaml
 generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes-defaultns.yaml
+generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes-defaultns-agent.yaml
 generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes-defaultns-migration.yaml
 generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes-emissaryns.yaml
+generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes-emissaryns-agent.yaml
 generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/aes-emissaryns-migration.yaml
 generate/files += $(EDGE_STACK_HOME)/manifests/edge-stack/resources-migration.yaml
 generate/files += $(EDGE_STACK_HOME)/CHANGELOG.md
 generate/files += $(EDGE_STACK_HOME)/.circleci/config.yml
 
 $(EDGE_STACK_HOME)/venv:
 	python3 -m venv $@
-	$@/bin/python -m pip install ruamel.yaml
+	$@/bin/pip3 install ruamel.yaml
 
 FORCE:
 .PHONY: FORCE
 .SECONDARY:
 
-$(EDGE_STACK_HOME)/charts/edge-stack/charts: %/charts: %/Chart.yaml
-	rm -rf $@
-	cd $* && helm dependency update
+$(EDGE_STACK_HOME)/charts/edge-stack/charts: FORCE
+	if test -f ../go.mod && test "$$(cd .. && go list -m)" == github.com/datawire/apro/v2; then \
+	  $(MAKE) -C .. $@; \
+	else \
+	  cd $(@D) && helm dependency update; \
+	fi
 
 $(HELM_OUTPUT_DIR): $(EDGE_STACK_HOME)/charts/edge-stack/charts FORCE
 	rm -rf $@
 	mkdir -p $@
 	helm template edge-stack --output-dir $@ -n ambassador $(EDGE_STACK_HOME)/charts/edge-stack
 
-helm-namespace.aes                      = ambassador
-helm-namespace.aes-defaultns            = default
-helm-namespace.aes-defaultms-migration  = default
-helm-namespace.aes-emissaryns           = emissary
-helm-namespace.aes-emissaryns-migration = emissary
-helm-namespace.resources-migration      = default
+helm-namespace.aes                         = ambassador
+helm-namespace.aes-ambassadorns            = ambassador
+helm-namespace.aes-ambassadorns-agent      = ambassador
+helm-namespace.aes-ambassadorns-migration  = ambassador
+helm-namespace.aes-defaultns               = default
+helm-namespace.aes-defaultns-agent         = default
+helm-namespace.aes-defaultns-migration     = default
+helm-namespace.aes-emissaryns              = emissary
+helm-namespace.aes-emissaryns-migration    = emissary
+helm-namespace.aes-emissaryns-agent        = emissary
+helm-namespace.resources-migration         = default
 $(EDGE_STACK_HOME)/k8s-config/%/helm-expanded.yaml: \
   $(EDGE_STACK_HOME)/charts/edge-stack/charts \
   $(EDGE_STACK_HOME)/k8s-config/%/values.yaml \

VERSION

@@ -1 +1 @@
-2.1.2
+2.2.2

charts/charts.mk

@@ -22,14 +22,14 @@ define _docgen
 	fi
 endef
 
+EMISSARY_CHART_REPO_GA  = https://s3.amazonaws.com/datawire-static-files/charts
+EMISSARY_CHART_REPO_PRE = https://s3.amazonaws.com/datawire-static-files/charts-dev
+EMISSARY_CHART_REPO     = $(if $(findstring -,$(EMISSARY_CHART_VERSION)),$(EMISSARY_CHART_REPO_PRE),$(EMISSARY_CHART_REPO_GA))
 chart/update-emissary: $(YQ)
-	[ -n "${EMISSARY_CHART_VERSION}" ] || (echo "EMISSARY_CHART_VERSION must be set for non-GA pushes" && exit 1)
+	[ -n '$(EMISSARY_CHART_VERSION)' ] || (echo "EMISSARY_CHART_VERSION must be set for non-GA pushes" && exit 1)
 	rm -f $(CHART_DIR)/charts/emissary-ingress*.tgz
-	$(YQ) w -i $(CHART_DIR)/Chart.yaml 'dependencies.(name==emissary-ingress).version' "${EMISSARY_CHART_VERSION}"
-	helm repo rm emissary-updater || true
-	helm repo add emissary-updater `$(YQ) r $(CHART_DIR)/Chart.yaml 'dependencies.(name==emissary-ingress).repository'`
-	helm dep update $(CHART_DIR)
-	git add $(CHART_DIR)/charts/emissary*.tgz $(CHART_DIR)/Chart.yaml $(CHART_DIR)/Chart.lock
+	$(YQ) w -i $(CHART_DIR)/Chart.yaml 'dependencies.(name==emissary-ingress).version' '$(patsubst v%,%,$(EMISSARY_CHART_VERSION))'
+	$(YQ) w -i $(CHART_DIR)/Chart.yaml 'dependencies.(name==emissary-ingress).repository' '$(EMISSARY_CHART_REPO)'
 .PHONY: chart/update-emissary
 
 chart/docgen:

charts/edge-stack/CHANGELOG.md

@@ -3,6 +3,18 @@
 This file documents all notable changes to Edge Stack Helm Chart. The release
 numbering uses [semantic versioning](http://semver.org).
 
+## v7.3.2
+
+- Update Edge Stack chart image to version v2.2.2: [CHANGELOG](https://github.com/datawire/edge-stack/blob/master/CHANGELOG.md)
+
+## v7.3.1
+
+- Update Edge Stack chart image to version v2.2.1: [CHANGELOG](https://github.com/datawire/edge-stack/blob/master/CHANGELOG.md)
+
+## v7.3.0
+
+- Update Edge Stack chart image to version v2.2.0: [CHANGELOG](https://github.com/datawire/edge-stack/blob/master/CHANGELOG.md)
+
 ## v7.2.2
 
 - Update Edge Stack chart image to version v2.1.2: [CHANGELOG](https://github.com/datawire/edge-stack/blob/master/CHANGELOG.md)

charts/edge-stack/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: emissary-ingress
   repository: https://s3.amazonaws.com/datawire-static-files/charts
-  version: 7.2.2
-digest: sha256:43fd13e494c74484656c6a811f8474b6a227c896c1b42e75f46f5fe2f23c09b8
-generated: "2022-01-25T18:57:51.910303-05:00"
+  version: 7.3.2
+digest: sha256:bd7cedbf03bcc3f255a08a818e9a34e0b2715e0f61c8645ac1c80ecf0ac3ef3e
+generated: "2022-02-25T13:00:54.216180784-08:00"

charts/edge-stack/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-appVersion: 2.1.2
+appVersion: 2.2.2
 description: A Helm chart for Ambassador Edge Stack
 name: edge-stack
-version: 7.2.2
+version: 7.3.2
 # TODO: change these to whatever the appropriate things are
 icon: https://www.getambassador.io/images/logo.png
 home: https://www.getambassador.io/
@@ -27,5 +27,5 @@ maintainers:
 engine: gotpl
 dependencies:
 - name: emissary-ingress
-  version: v7.2.2
-  repository: "https://s3.amazonaws.com/datawire-static-files/charts"
+  version: 7.3.2
+  repository: https://s3.amazonaws.com/datawire-static-files/charts

charts/edge-stack/values.yaml

@@ -70,7 +70,7 @@ emissary-ingress: # +doc-gen:break
 
   image:
     repository: docker.io/datawire/aes
-    tag: 2.1.2
+    tag: 2.2.2
     pullPolicy: IfNotPresent
 
 rbac: