Migrate away from deprecated kustomize features #3091

james-callahan · 2023-03-06T04:14:53Z

Issue

Description

This PR cleans up various things in the kustomize manifests. See individual commits for descriptions of the modifications.

In particular:

we now don't have any deprecation warnings when you run kustomize build config/default with kustomize v5.0.0.
there's now only one place you need to go to enable/disable the webhook/cert-manager integration

Checklist

Added tests that cover your change (if possible)
Added/modified documentation as required (such as the README.md, or the docs directory)
Manually tested
Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Backfilled missing tests for code in same general area 🎉
Refactored something and made the world a better place 🌟

k8s-ci-robot · 2023-03-06T04:15:02Z

Welcome @james-callahan!

It looks like this is your first PR to kubernetes-sigs/aws-load-balancer-controller 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/aws-load-balancer-controller has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2023-03-06T04:15:03Z

Hi @james-callahan. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

james-callahan · 2023-04-17T01:31:04Z

Rebased on v2.5.0.

k8s-triage-robot · 2023-07-20T00:15:18Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

james-callahan · 2023-09-18T04:00:34Z

Rebased on top of main post-v2.6.1

james-callahan · 2023-09-18T04:01:34Z

@kishorj / @M00nF1sh could you have a look at this?

drGrove · 2023-10-05T03:53:37Z

This will solve warnings in our CI system. Can someone take a look?

k8s-triage-robot · 2024-01-19T07:01:50Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle rotten
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

drGrove · 2024-01-19T18:58:58Z

/remove-lifecycle rotten

james-callahan · 2024-02-20T04:44:14Z

rebased on v2.7.1

james-callahan · 2024-02-20T04:47:09Z

PR needs rebase.

And rebased again on main

james-callahan · 2024-12-23T13:44:26Z

rebased on v2.11.0.....

k8s-triage-robot · 2025-01-22T14:20:13Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen
Mark this PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot · 2025-01-22T14:20:18Z

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen

Mark this PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

james-callahan · 2025-01-30T16:31:23Z

/reopen

k8s-ci-robot · 2025-01-30T16:31:28Z

@james-callahan: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2025-01-30T16:31:33Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: james-callahan
Once this PR has been reviewed and has the lgtm label, please assign oliviassss for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

james-callahan · 2025-01-30T16:50:30Z

/remove-lifecycle rotten

james-callahan · 2025-03-11T01:50:23Z

Rebased on v2.12.0

zac-nixon · 2025-03-11T20:25:54Z

Hello, I apologize that we didn't attend to this PR sooner. I have some concerns that the proposed changes are not backwards compatible. Does kustomize define replacements for the functionality you're removing?

james-callahan · 2025-03-24T06:43:13Z

Does kustomize define replacements for the functionality you're removing?

Which functionality is being removed?

james-callahan · 2025-05-19T02:16:00Z

Rebased on v2.13.2...

james-callahan · 2025-06-18T02:21:36Z

Rebased on v2.13.3

r-n-o · 2025-06-19T14:34:45Z

This PR has now been opened for more than 2 years -- @zac-nixon @kishorj @M00nF1sh what can we do to unblock it?

zac-nixon

Sorry for not elaborating on these issues in my previous comment.

zac-nixon · 2025-06-21T01:52:34Z

config/certmanager/cainjection_in_ingressclassparams_patch.yaml

@@ -4,5 +4,6 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)


This is a behavior change

zac-nixon · 2025-06-21T01:52:44Z

config/certmanager/cainjection_in_targetgroupbindings_patch.yaml

  annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+    # `default` and `serving-cert` may be substituted by kustomize
+    cert-manager.io/inject-ca-from: default/serving-cert


Again, behavior change.

zac-nixon · 2025-06-21T01:53:00Z

config/certmanager/certificate.yaml

  dnsNames:
-    - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc
-    - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local
+    - webhook-service.default.svc


Behavior change, normally this webhook isn't in the default namespace

zac-nixon · 2025-06-21T01:53:28Z

config/controller/controller.yaml

 kind: ServiceAccount
 metadata:
  name: controller
-  labels:


Why is this removed?

zac-nixon · 2025-06-21T01:54:11Z

config/webhook/manifests.yaml

    clientConfig:
      service:
        name: webhook-service
-        namespace: system


Behavior change, why?

- Always include apiVersion+kind of kustomization files - `patchesStrategicMerge` was deprecated, use `patches` instead - `bases` was deprecated, use `resources` instead - Order `configurations` first

kustomize also requires that we specify a namespace here, or else it won't add one

And it causes the resource to show up in e.g. ArgoCD as Out-of-Sync

kustomize will fill these in for us

k8s-ci-robot requested review from M00nF1sh and kishorj March 6, 2023 04:14

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Mar 6, 2023

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Mar 6, 2023

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Mar 6, 2023

james-callahan force-pushed the kustomization-cleanup branch from 8b01cd3 to 89b1563 Compare March 16, 2023 03:23

james-callahan force-pushed the kustomization-cleanup branch from 4cb32d3 to cedf571 Compare March 23, 2023 23:37

james-callahan force-pushed the kustomization-cleanup branch from cedf571 to 1297391 Compare April 17, 2023 01:30

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 20, 2023

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 20, 2023

james-callahan force-pushed the kustomization-cleanup branch from 1297391 to 75c68d2 Compare August 11, 2023 03:07

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 11, 2023

james-callahan force-pushed the kustomization-cleanup branch from 75c68d2 to 8150880 Compare September 18, 2023 04:00

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jan 19, 2024

k8s-ci-robot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Jan 19, 2024

james-callahan force-pushed the kustomization-cleanup branch from 8150880 to cf0b99f Compare February 20, 2024 04:44

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 20, 2024

james-callahan force-pushed the kustomization-cleanup branch from cf0b99f to 00e7897 Compare February 20, 2024 04:47

k8s-ci-robot closed this Jan 22, 2025

k8s-ci-robot reopened this Jan 30, 2025

k8s-ci-robot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Jan 30, 2025

james-callahan force-pushed the kustomization-cleanup branch from 1e00392 to fff3714 Compare March 11, 2025 01:49

james-callahan force-pushed the kustomization-cleanup branch from fff3714 to 4c3f73a Compare May 19, 2025 02:15

james-callahan force-pushed the kustomization-cleanup branch from 4c3f73a to 448dd6c Compare June 18, 2025 02:21

zac-nixon reviewed Jun 21, 2025

View reviewed changes

james-callahan added 9 commits August 7, 2025 14:53

Clean up kustomizations

aab4929

- Always include apiVersion+kind of kustomization files - `patchesStrategicMerge` was deprecated, use `patches` instead - `bases` was deprecated, use `resources` instead - Order `configurations` first

Use commonLabels

685e74a

Add ports declaration to controller container

7dbb066

Consolidate cert-manager kustomize pieces into the one component

a06c692

Consolidate webhook kustomize pieces into the one component

d0e27b1

Kustomize deprecated vars, use replacements

dae4273

Use CRD v1 form

c158ef6

kustomize also requires that we specify a namespace here, or else it won't add one

caBundle doesn't need to be set

51ad0b2

And it causes the resource to show up in e.g. ArgoCD as Out-of-Sync

Remove hardcoded namespaces

6891bb9

kustomize will fill these in for us

james-callahan force-pushed the kustomization-cleanup branch from 448dd6c to 6891bb9 Compare August 7, 2025 04:53

Migrate away from deprecated kustomize features #3091

Are you sure you want to change the base?

Migrate away from deprecated kustomize features #3091

Uh oh!

Conversation

james-callahan commented Mar 6, 2023

Issue

Description

Checklist

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

Uh oh!

k8s-ci-robot commented Mar 6, 2023

Uh oh!

k8s-ci-robot commented Mar 6, 2023

Uh oh!

james-callahan commented Apr 17, 2023

Uh oh!

k8s-triage-robot commented Jul 20, 2023

Uh oh!

james-callahan commented Sep 18, 2023

Uh oh!

james-callahan commented Sep 18, 2023

Uh oh!

drGrove commented Oct 5, 2023

Uh oh!

k8s-triage-robot commented Jan 19, 2024

Uh oh!

drGrove commented Jan 19, 2024

Uh oh!

james-callahan commented Feb 20, 2024

Uh oh!

james-callahan commented Feb 20, 2024

Uh oh!

james-callahan commented Dec 23, 2024

Uh oh!

k8s-triage-robot commented Jan 22, 2025

Uh oh!

k8s-ci-robot commented Jan 22, 2025

Uh oh!

james-callahan commented Jan 30, 2025

Uh oh!

k8s-ci-robot commented Jan 30, 2025

Uh oh!

k8s-ci-robot commented Jan 30, 2025

Uh oh!

james-callahan commented Jan 30, 2025

Uh oh!

james-callahan commented Mar 11, 2025

Uh oh!

zac-nixon commented Mar 11, 2025

Uh oh!

james-callahan commented Mar 24, 2025

Uh oh!

james-callahan commented May 19, 2025

Uh oh!

james-callahan commented Jun 18, 2025

Uh oh!

r-n-o commented Jun 19, 2025

Uh oh!

zac-nixon left a comment

Choose a reason for hiding this comment

Uh oh!

zac-nixon Jun 21, 2025

Choose a reason for hiding this comment

Uh oh!

zac-nixon Jun 21, 2025

Choose a reason for hiding this comment

Uh oh!

zac-nixon Jun 21, 2025

Choose a reason for hiding this comment

Uh oh!

zac-nixon Jun 21, 2025

Choose a reason for hiding this comment

Uh oh!

zac-nixon Jun 21, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels