82 lines
2.8 KiB
Bash
Executable File
82 lines
2.8 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
set -eu
|
|
|
|
CILIUM_VERSION=v1.20.0
|
|
NAMESPACE=kube-system
|
|
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
|
|
|
|
for command in cilium-cli kubectl; do
|
|
if ! command -v "$command" >/dev/null 2>&1; then
|
|
echo "Required command not found: $command" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
kubectl apply --dry-run=server --validate=false \
|
|
--filename "$SCRIPT_DIR/hubble-pki.yaml"
|
|
kubectl apply --validate=false --filename "$SCRIPT_DIR/hubble-pki.yaml"
|
|
|
|
kubectl wait --for=condition=Ready issuer/hubble-selfsigned \
|
|
--namespace "$NAMESPACE" --timeout=2m
|
|
kubectl wait --for=condition=Ready certificate/hubble-ca \
|
|
--namespace "$NAMESPACE" --timeout=5m
|
|
kubectl wait --for=condition=Ready issuer/hubble-ca \
|
|
--namespace "$NAMESPACE" --timeout=2m
|
|
|
|
existing_installation=false
|
|
version_change=false
|
|
if kubectl get daemonset/cilium --namespace "$NAMESPACE" >/dev/null 2>&1; then
|
|
existing_installation=true
|
|
current_image=$(kubectl get daemonset/cilium --namespace "$NAMESPACE" \
|
|
--output=jsonpath='{.spec.template.spec.containers[0].image}')
|
|
case "$current_image" in
|
|
*":$CILIUM_VERSION"|*":$CILIUM_VERSION@"*) ;;
|
|
*) version_change=true ;;
|
|
esac
|
|
|
|
cilium-cli upgrade \
|
|
--version "$CILIUM_VERSION" \
|
|
--reset-values \
|
|
--values "$SCRIPT_DIR/values.yaml"
|
|
else
|
|
cilium-cli install \
|
|
--version "$CILIUM_VERSION" \
|
|
--values "$SCRIPT_DIR/values.yaml" \
|
|
--wait
|
|
fi
|
|
|
|
kubectl wait --for=condition=Ready certificate/hubble-server-certs \
|
|
--namespace "$NAMESPACE" --timeout=5m
|
|
kubectl wait --for=condition=Ready certificate/hubble-relay-client-certs \
|
|
--namespace "$NAMESPACE" --timeout=5m
|
|
|
|
# A version upgrade already changes the Pod templates. Wait for those rolling
|
|
# updates instead of forcing a second restart. A same-version reconcile still
|
|
# restarts the agents and Relay so renewed Hubble certificates are loaded.
|
|
if [ "$existing_installation" = true ]; then
|
|
if [ "$version_change" = false ]; then
|
|
kubectl rollout restart daemonset/cilium --namespace "$NAMESPACE"
|
|
fi
|
|
kubectl rollout status daemonset/cilium \
|
|
--namespace "$NAMESPACE" --timeout=10m
|
|
kubectl rollout status daemonset/cilium-envoy \
|
|
--namespace "$NAMESPACE" --timeout=10m
|
|
kubectl rollout status deployment/cilium-operator \
|
|
--namespace "$NAMESPACE" --timeout=10m
|
|
fi
|
|
|
|
if [ "$version_change" = false ]; then
|
|
kubectl rollout restart deployment/hubble-relay --namespace "$NAMESPACE"
|
|
fi
|
|
kubectl rollout status deployment/hubble-relay \
|
|
--namespace "$NAMESPACE" --timeout=5m
|
|
|
|
cilium-cli status --wait
|
|
|
|
# Install availability alerts when Prometheus Operator is present. This keeps
|
|
# a fresh Cilium-only bootstrap independent from the monitoring install order.
|
|
if kubectl get customresourcedefinition prometheusrules.monitoring.coreos.com >/dev/null 2>&1; then
|
|
kubectl apply --filename "$SCRIPT_DIR/cilium-alerts.yaml"
|
|
fi
|