Sync stackhpc/2023.1 with stackhpc/zed backports

doc/source/user/index.rst

@@ -413,13 +413,6 @@ the table are linked to more details elsewhere in the user guide.
 +---------------------------------------+--------------------+---------------+
 | `k8s_keystone_auth_tag`_              | see below          | see below     |
 +---------------------------------------+--------------------+---------------+
-| `tiller_enabled`_                     | - true             | false         |
-|                                       | - false            |               |
-+---------------------------------------+--------------------+---------------+
-| `tiller_tag`_                         | see below          | ""            |
-+---------------------------------------+--------------------+---------------+
-| `tiller_namespace`_                   | see below          | see below     |
-+---------------------------------------+--------------------+---------------+
 | `helm_client_url`_                    | see below          | see below     |
 +---------------------------------------+--------------------+---------------+
 | `helm_client_sha256`_                 | see below          | see below     |
@@ -484,6 +477,12 @@ the table are linked to more details elsewhere in the user guide.
 +---------------------------------------+--------------------+---------------+
 | `octavia_lb_healthcheck`_             | see bellow         | true          |
 +---------------------------------------+--------------------+---------------+
+| `extra_network`_                      | see below          | ""            |
++---------------------------------------+--------------------+---------------+
+| `extra_subnet`_                       | see below          | ""            |
++---------------------------------------+--------------------+---------------+
+| `extra_security_group`_               | see below          | see below     |
++---------------------------------------+--------------------+---------------+
 
 .. _cluster:
 
@@ -1224,13 +1223,14 @@ _`container_infra_prefix`
 
   Images that might be needed if 'monitoring_enabled' is 'true':
 
-  * quay.io/prometheus/alertmanager:v0.20.0
-  * docker.io/squareup/ghostunnel:v1.5.2
-  * docker.io/jettech/kube-webhook-certgen:v1.0.0
-  * quay.io/coreos/prometheus-operator:v0.37.0
-  * quay.io/coreos/configmap-reload:v0.0.1
-  * quay.io/coreos/prometheus-config-reloader:v0.37.0
-  * quay.io/prometheus/prometheus:v2.15.2
+  * quay.io/prometheus/alertmanager:v0.21.0
+  * docker.io/jettech/kube-webhook-certgen:v1.5.0
+  * quay.io/prometheus-operator/prometheus-operator:v0.44.0
+  * docker.io/jimmidyson/configmap-reload:v0.4.0
+  * quay.io/prometheus-operator/prometheus-config-reloader:v0.44.0
+  * quay.io/prometheus/prometheus:v2.22.1
+  * quay.io/prometheus/node-exporter:v1.0.1
+  * docker.io/directxman12/k8s-prometheus-adapter:v0.8.2
 
   Images that might be needed if 'cinder_csi_enabled' is 'true':
 
@@ -1449,22 +1449,6 @@ _`k8s_keystone_auth_tag`
   Train default: v1.14.0
   Ussuri default: v1.18.0
 
-_`tiller_enabled`
-  If set to true, tiller will be deployed in the kube-system namespace.
-  Ussuri default: false
-  Train default: false
-
-_`tiller_tag`
-  This label allows users to override the default container tag for Tiller.
-  For additional tags, `refer to Tiller page
-  <https://github.com/helm/helm/tags>`_ and look for tags<v3.0.0.
-  Train default: v2.12.3
-  Ussuri default: v2.16.7
-
-_`tiller_namespace`
-  The namespace in which Tiller and Helm v2 chart install jobs are installed.
-  Default: magnum-tiller
-
 _`helm_client_url`
   URL of the helm client binary.
   Default: ''
@@ -1476,8 +1460,7 @@ _`helm_client_sha256`
 _`helm_client_tag`
   This label allows users to override the default container tag for Helm
   client.  For additional tags, `refer to Helm client page
-  <https://github.com/helm/helm/tags>`_. You must use identical tiller_tag if
-  you wish to use Tiller (for helm_client_tag<v3.0.0).
+  <https://github.com/helm/helm/tags>`_.
   Ussuri default: v3.2.1
 
 _`master_lb_floating_ip_enabled`
@@ -1617,6 +1600,22 @@ _`octavia_lb_healthcheck`
   If true, enable Octavia load balancer healthcheck
   Default: true
 
+_`extra_network`
+  Optional additional network name or UUID to add to cluster nodes.
+  When not specified, additional networks are not added. Optionally specify
+  'extra_subnet' if you wish to use a specific subnet on the network.
+  Default: ""
+
+_`extra_subnet`
+  Optional additional subnet name or UUID to add to cluster nodes.
+  Only used when 'extra_network' is defined.
+  Default: ""
+
+_`extra_security_group`
+  Optional additional group name or UUID to add to network port.
+  Only used when 'extra_network' is defined.
+  Default: cluster node default security group.
+
 Supported versions
 ------------------
 
@@ -1692,8 +1691,6 @@ _`ingress_controller`
   Controller is configured. For more details about octavia-ingress-controller
   please refer to `cloud-provider-openstack document
   <https://github.com/kubernetes/cloud-provider-openstack/blob/master/docs/octavia-ingress-controller/using-octavia-ingress-controller.md>`_
-  To use 'nginx' ingress controller, tiller_enabled must be true when using
-  helm_client_tag<v3.0.0.
 
 _`ingress_controller_role`
   This label defines the role nodes should have to run an instance of the
@@ -2463,7 +2460,6 @@ _`calico_tag`
   Victoria default: v3.13.1
   Wallaby default: v3.13.1
 
-
 Besides, the Calico network driver needs kube_tag with v1.9.3 or later, because
 Calico needs extra mounts for the kubelet container. See `commit
 <https://github.com/projectatomic/atomic-system-containers/commit/54ab8abc7fa1bfb6fa674f55cd0c2fa0c812fd36>`_

doc/source/user/monitoring.rst

@@ -28,22 +28,20 @@ The installation of these services is controlled with the following labels:
 _`metrics_server_enabled`
   metrics_server_enabled is used to enable disable the installation of
   the metrics server.
-  To use this service tiller_enabled must be true when using
-  helm_client_tag<v3.0.0.
   Train default: true
   Stein default: true
 
 _`monitoring_enabled`
   Enable installation of cluster monitoring solution provided by the
-  stable/prometheus-operator helm chart.
+  prometheus-community/kube-prometheus-stack helm chart.
   To use this service tiller_enabled must be true when using
   helm_client_tag<v3.0.0.
   Default: false
 
 _`prometheus_adapter_enabled`
   Enable installation of cluster custom metrics provided by the
-  stable/prometheus-adapter helm chart. This service depends on
-  monitoring_enabled.
+  prometheus-community/prometheus-adapter helm chart.
+  This service depends on monitoring_enabled.
   Default: true
 
 To control deployed versions, extra labels are available:
@@ -56,14 +54,17 @@ _`metrics_server_chart_tag`
 
 _`prometheus_operator_chart_tag`
   Add prometheus_operator_chart_tag to select version of the
-  stable/prometheus-operator chart to install. When installing the chart,
-  helm will use the default values of the tag defined and overwrite them based
-  on the prometheus-operator-config ConfigMap currently defined. You must
-  certify that the versions are compatible.
+  prometheus-community/kube-prometheus-stack chart to install.
+  When installing the chart, helm will use the default values of the tag
+  defined and overwrite them based on the prometheus-operator-config
+  ConfigMap currently defined.
+  You must certify that the versions are compatible.
+  Wallaby-default: 17.2.0
 
 _`prometheus_adapter_chart_tag`
-  The stable/prometheus-adapter helm chart version to use.
+  The prometheus-community/prometheus-adapter helm chart version to use.
   Train-default: 1.4.0
+  Wallaby-default: 2.12.1
 
 Full fledged cluster monitoring
 +++++++++++++++++++++++++++++++

magnum/drivers/common/templates/kubernetes/fragments/calico-service.sh → magnum/drivers/common/templates/kubernetes/fragments/calico-service-v3-21-x.sh

@@ -1,4 +1,4 @@
-step="calico-service"
+step="calico-service-v3-21-x"
 printf "Starting to run ${step}\n"
 
 set -e
@@ -4441,7 +4441,7 @@ metadata:
 
 # This manifest creates a Pod Disruption Budget for Controller to allow K8s Cluster Autoscaler to evict
 
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: calico-kube-controllers