zalando-incubator · k8s-on-aws-manager-app · Apr 28, 2025 · Apr 30, 2025 · Apr 30, 2025 · Apr 30, 2025
diff --git a/cluster/config-defaults.yaml b/cluster/config-defaults.yaml
@@ -305,6 +305,12 @@ skipper_serve_method_metric: "false"
 # defines if the http response status code is included in the dimension
 # of the skipper_serve_host_duration_seconds_bucket metric.
 skipper_serve_status_code_metric: "false"
+# skipper_combined_response_metrics sets the flag -combined-response-metrics.
+# It enables reporting combined response time metrics
+skipper_combined_response_metrics: "false"
+# skipper_backend_host_metrics sets the flag -backend-host-metrics.
+# It enables reporting total serve time metrics for backend
+skipper_backend_host_metrics: "false"
 
 # disabled|provisioned|enabled routegroup validation via skipper webhook
 # can be one of disabled|provisioned|enabled

diff --git a/cluster/manifests/02-admission-control/deployment.yaml b/cluster/manifests/02-admission-control/deployment.yaml
@@ -33,7 +33,7 @@ spec:
       priorityClassName: system-cluster-critical
       containers:
       - name: admission-controller
-        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-254
+        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-257
         lifecycle:
           preStop:
             exec:

diff --git a/cluster/manifests/cluster-lifecycle-controller/deployment.yaml b/cluster/manifests/cluster-lifecycle-controller/deployment.yaml
@@ -29,7 +29,7 @@ spec:
       serviceAccountName: cluster-lifecycle-controller
       containers:
       - name: cluster-lifecycle-controller
-        image: container-registry.zalando.net/teapot/cluster-lifecycle-controller:master-44
+        image: container-registry.zalando.net/teapot/cluster-lifecycle-controller:master-47
         args:
             - --drain-grace-period={{.Cluster.ConfigItems.drain_grace_period}}
             - --drain-min-pod-lifetime={{.Cluster.ConfigItems.drain_min_pod_lifetime}}

diff --git a/cluster/manifests/cronjob-fixer/deployment.yaml b/cluster/manifests/cronjob-fixer/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: cronjob-fixer
       containers:
         - name: cronjob-fixer
-          image: "container-registry.zalando.net/teapot/cronjob-fixer:master-18"
+          image: "container-registry.zalando.net/teapot/cronjob-fixer:master-21"
           resources:
             limits:
               cpu: 5m

diff --git a/cluster/manifests/event-logger/statefulset.yaml b/cluster/manifests/event-logger/statefulset.yaml
@@ -30,7 +30,7 @@ spec:
       serviceAccountName: kubernetes-event-logger
       containers:
       - name: logger
-        image: container-registry.zalando.net/teapot/event-logger:master-17
+        image: container-registry.zalando.net/teapot/event-logger:master-20
         args:
             - --snapshot-namespace=kube-system
             - --snapshot-name=kubernetes-event-logger

diff --git a/cluster/manifests/kube-node-decommissioner/cronjob.yaml b/cluster/manifests/kube-node-decommissioner/cronjob.yaml
@@ -29,7 +29,7 @@ spec:
           restartPolicy: Never
           containers:
           - name: kube-node-decommissioner
-            image: container-registry.zalando.net/teapot/kube-node-decommissioner:main-2
+            image: container-registry.zalando.net/teapot/kube-node-decommissioner:main-3
             resources:
               limits:
                 cpu: "{{.Cluster.ConfigItems.kube_node_decommissioner_cpu}}"

diff --git a/cluster/manifests/kube-node-ready-controller/daemonset.yaml b/cluster/manifests/kube-node-ready-controller/daemonset.yaml
@@ -39,7 +39,7 @@ spec:
       dnsPolicy: Default
       containers:
       - name: controller
-        image: container-registry.zalando.net/teapot/kube-node-ready-controller:master-30
+        image: container-registry.zalando.net/teapot/kube-node-ready-controller:master-31
         resources:
           requests:
             cpu: {{.Cluster.ConfigItems.kube_node_ready_controller_cpu}}

diff --git a/cluster/manifests/kubelet-summary-metrics/deployment.yaml b/cluster/manifests/kubelet-summary-metrics/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: kubelet-summary-metrics
       containers:
       - name: proxy
-        image: container-registry.zalando.net/teapot/kubelet-summary-metrics:main-11
+        image: container-registry.zalando.net/teapot/kubelet-summary-metrics:main-12
         resources:
           limits:
             cpu: "{{.Cluster.ConfigItems.kubelet_summary_metrics_cpu}}"

diff --git a/cluster/manifests/kubernetes-lifecycle-metrics/deployment.yaml b/cluster/manifests/kubernetes-lifecycle-metrics/deployment.yaml
@@ -32,7 +32,7 @@ spec:
       serviceAccountName: kubernetes-lifecycle-metrics
       containers:
         - name: kubernetes-lifecycle-metrics
-          image: "container-registry.zalando.net/teapot/kubernetes-lifecycle-metrics:master-27"
+          image: "container-registry.zalando.net/teapot/kubernetes-lifecycle-metrics:master-28"
           ports:
             - containerPort: 9090
               protocol: TCP

diff --git a/cluster/manifests/skipper/deployment.yaml b/cluster/manifests/skipper/deployment.yaml
@@ -177,9 +177,6 @@ spec:
           - "-kubernetes-default-lb-algorithm={{ .Cluster.ConfigItems.skipper_ingress_default_lb_algorithm }}"
           - "-kubernetes-disable-catchall-routes={{ .Cluster.ConfigItems.skipper_ingress_disable_catchall_routes }}"
           - "-enable-kubernetes-endpointslices={{ .Cluster.ConfigItems.skipper_endpointslices_enabled }}"
-{{ if and (eq .Cluster.Provider "zalando-eks") (eq .Cluster.ConfigItems.eks_ip_family "ipv6")}}
-          - "-whitelisted-healthcheck-cidr={{ .Values.subnet_ipv6_cidrs }}"
-{{ end }}
 {{ end }}
           - "-address=:9999"
           - "-wait-first-route-load"
@@ -198,6 +195,8 @@ spec:
           - "-serve-method-metric={{ .Cluster.ConfigItems.skipper_serve_method_metric }}"
           - "-serve-status-code-metric={{ .Cluster.ConfigItems.skipper_serve_status_code_metric }}"
           - "-serve-host-counter"
+          - "-combined-response-metrics={{ .Cluster.ConfigItems.skipper_combined_response_metrics }}"
+          - "-backend-host-metrics={{ .Cluster.ConfigItems.skipper_backend_host_metrics }}"
           - "-disable-metrics-compat"
           - "-enable-profile"
           - "-memory-profile-rate={{ .Cluster.ConfigItems.skipper_memory_profile_rate }}"
@@ -323,21 +322,18 @@ spec:
           - "-forwarded-headers=X-Forwarded-For,X-Forwarded-Proto=https,X-Forwarded-Port=443"
           - '-forwarded-headers-exclude-cidrs={{ .cluster_internal_cidrs | join "," }}'
 {{ end }}
-          - >-
-            -inline-routes=
-            kube__healthz_down:
-            Path("/kube-system/healthz") &&
-            Shutdown() &&
-            SourceFromLast("10.0.0.0/8", "192.168.0.0/16", "172.16.0.0/12", "127.0.0.1/8", "::1/128"{{- if and (eq .Cluster.Provider "zalando-eks") (eq .Cluster.ConfigItems.eks_ip_family "ipv6")}}{{ range $ip := split .Values.subnet_ipv6_cidrs "," }},"{{ $ip }}"{{ end }}{{- else }}, "fd00::/8"{{- end }})
-            -> disableAccessLog()
-            -> status(503)
-            -> <shunt>;
-            kube__healthz_up:
-            Path("/kube-system/healthz") &&
-            SourceFromLast("10.0.0.0/8", "192.168.0.0/16", "172.16.0.0/12", "127.0.0.1/8", "::1/128"{{- if and (eq .Cluster.Provider "zalando-eks") (eq .Cluster.ConfigItems.eks_ip_family "ipv6")}}{{ range $ip := split .Values.subnet_ipv6_cidrs "," }},"{{ $ip }}"{{ end }}{{- else }}, "fd00::/8"{{- end }})
-            -> disableAccessLog()
-            -> status(200)
-            -> <shunt>;
+          - "-inline-routes"
+          - |
+            kube__healthz_down: Path("/kube-system/healthz") && Shutdown()
+              && SourceFromLast("{{ .cluster_internal_cidrs | join `","` }}", "10.0.0.0/8", "192.168.0.0/16", "172.16.0.0/12", "127.0.0.1/8", "fd00::/8", "::1/128")
+              -> disableAccessLog()
+              -> status(503)
+              -> <shunt>;
+            kube__healthz_up: Path("/kube-system/healthz")
+              && SourceFromLast("{{ .cluster_internal_cidrs | join `","` }}", "10.0.0.0/8", "192.168.0.0/16", "172.16.0.0/12", "127.0.0.1/8", "fd00::/8", "::1/128")
+              -> disableAccessLog()
+              -> status(200)
+              -> <shunt>;
             {{ .Cluster.ConfigItems.skipper_ingress_inline_routes }}
 
 {{ if .Cluster.ConfigItems.skipper_ingress_health_check_options }}

diff --git a/cluster/manifests/spot-node-rescheduler/cronjob.yaml b/cluster/manifests/spot-node-rescheduler/cronjob.yaml
@@ -24,7 +24,7 @@ spec:
           restartPolicy: Never
           containers:
           - name: spot-node-rescheduler
-            image: container-registry.zalando.net/teapot/spot-node-rescheduler:main-10
+            image: container-registry.zalando.net/teapot/spot-node-rescheduler:main-12
             resources:
               limits:
                 cpu: "{{ .Cluster.ConfigItems.spot_node_rescheduler_cpu }}"

diff --git a/cluster/manifests/zalando-iam-aws-proxy/deployment.yaml b/cluster/manifests/zalando-iam-aws-proxy/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: zalando-iam-aws-proxy
       containers:
       - name: proxy
-        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/zalando-iam-aws-proxy:main-2
+        image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/zalando-iam-aws-proxy:main-4
         args:
         - "--apiserver-url=https://kubernetes.default.svc.cluster.local"
         - "--ca-file-path=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"

diff --git a/cluster/node-pools/master-default/userdata.yaml b/cluster/node-pools/master-default/userdata.yaml
@@ -216,7 +216,7 @@ write_files:
             limits:
               memory: {{ .Values.InstanceInfo.MemoryFraction (parseInt64 .Cluster.ConfigItems.apiserver_memory_limit_percent)}}
 {{- end }}
-        - image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-254
+        - image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-257
           name: admission-controller
           lifecycle:
             preStop: