From 2d3840653a241353a427dc2b856004c70896bc7e Mon Sep 17 00:00:00 2001 From: eding Date: Mon, 31 Aug 2026 18:34:20 +0200 Subject: [PATCH] fix: read Cilium version from HelmRelease --- internal/bootstrap/bootstrap.go | 30 +++++++++++++++++++++++++++- internal/bootstrap/bootstrap_test.go | 11 ++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/internal/bootstrap/bootstrap.go b/internal/bootstrap/bootstrap.go index 981e65e..f77b374 100644 --- a/internal/bootstrap/bootstrap.go +++ b/internal/bootstrap/bootstrap.go @@ -1092,7 +1092,35 @@ func installCilium(dir string, cfg config.Config) error { if err := os.MkdirAll(helmDir, 0755); err != nil { return err } - return utils.RunCommandInDir(dir, "helm", "upgrade", "--install", "cilium", "cilium", "--repo=https://helm.cilium.io", "--version=1.19.6", "--repository-config="+filepath.Join(helmDir, "repositories.yaml"), "--repository-cache="+helmDir, "--namespace=kube-system", "--create-namespace", "--kubeconfig=kubeconfig", "--wait", "--timeout=5m", "--set=kubeProxyReplacement=true", "--set=ipam.mode=kubernetes", "--set=k8sServiceHost=localhost", "--set=k8sServicePort=7445", "--set=cgroup.autoMount.enabled=false", "--set=cgroup.hostRoot=/sys/fs/cgroup", "--set=bpf.hostLegacyRouting=true", "--set=securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}", "--set=securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}", "--set=envoy.enabled=true", "--set=gatewayAPI.enabled=true", "--set=hubble.enabled=true", "--set=hubble.relay.enabled=true", "--set=hubble.ui.enabled=true", "--set=l2announcements.enabled=true", "--set=rollOutCiliumPods=true", "--set=operator.replicas=1", "--set=operator.rollOutPods=true") + // The generated HelmRelease is the sole Cilium chart-version authority. + version, err := ciliumChartVersion(filepath.Join(dir, "base", "cilium", "release.yaml")) + if err != nil { + return err + } + return utils.RunCommandInDir(dir, "helm", "upgrade", "--install", "cilium", "cilium", "--repo=https://helm.cilium.io", "--version="+version, "--repository-config="+filepath.Join(helmDir, "repositories.yaml"), "--repository-cache="+helmDir, "--namespace=kube-system", "--create-namespace", "--kubeconfig=kubeconfig", "--wait", "--timeout=5m", "--set=kubeProxyReplacement=true", "--set=ipam.mode=kubernetes", "--set=k8sServiceHost=localhost", "--set=k8sServicePort=7445", "--set=cgroup.autoMount.enabled=false", "--set=cgroup.hostRoot=/sys/fs/cgroup", "--set=bpf.hostLegacyRouting=true", "--set=securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}", "--set=securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}", "--set=envoy.enabled=true", "--set=gatewayAPI.enabled=true", "--set=hubble.enabled=true", "--set=hubble.relay.enabled=true", "--set=hubble.ui.enabled=true", "--set=l2announcements.enabled=true", "--set=rollOutCiliumPods=true", "--set=operator.replicas=1", "--set=operator.rollOutPods=true") +} + +func ciliumChartVersion(path string) (string, error) { + content, err := os.ReadFile(path) + if err != nil { + return "", err + } + var release struct { + Spec struct { + Chart struct { + Spec struct { + Version string `yaml:"version"` + } `yaml:"spec"` + } `yaml:"chart"` + } `yaml:"spec"` + } + if err := yaml.Unmarshal(content, &release); err != nil { + return "", fmt.Errorf("parse Cilium HelmRelease: %w", err) + } + if release.Spec.Chart.Spec.Version == "" { + return "", errors.New("Cilium HelmRelease chart version is required") + } + return release.Spec.Chart.Spec.Version, nil } func copyDir(source, destination string, overwrite bool) error { diff --git a/internal/bootstrap/bootstrap_test.go b/internal/bootstrap/bootstrap_test.go index bcf17ff..7aa60eb 100644 --- a/internal/bootstrap/bootstrap_test.go +++ b/internal/bootstrap/bootstrap_test.go @@ -39,6 +39,17 @@ func TestRenderCiliumConfig(t *testing.T) { } } +func TestCiliumChartVersion(t *testing.T) { + path := filepath.Join(t.TempDir(), "release.yaml") + if err := os.WriteFile(path, []byte("spec:\n chart:\n spec:\n version: test-version\n"), 0644); err != nil { + t.Fatal(err) + } + version, err := ciliumChartVersion(path) + if err != nil || version != "test-version" { + t.Fatalf("ciliumChartVersion() = %q, %v", version, err) + } +} + func TestRenderDeliveryConfig(t *testing.T) { dir := t.TempDir() path := filepath.Join(dir, "webhook.yaml")