Drop deprecated kube-rbac-proxy

[mythi]

See confidential-containers/trustee-operator#65

[bpradipt]

/lgtm

[mythi]

#466 needs to be merged first since my preference is to have that PR to update the dependencies (and then I'd drop 91656ed here)

[fidencio]

lgtm, thanks @mythi!

[mythi]

The remaining failure seems to be because of

Warning  Evicted    5m3s  kubelet            The node had condition: [DiskPressure].

[mythi]

I believe this hits #481 now. @ldoktor is there a way to recover from this corruption?

[ldoktor]

Hello @mythi, one way is to find out what stage the uninstall is in and recover the config based on that. Usually it suffices to just remove imports that are gone from /etc/containerd/config.yaml.d/XXX in config.yaml (imports=[]) and restart containerd (unless it manages to restart automatically :D) and it should proceed.

Anyway I'm playing with this issue, I have one little workaround that improves things (kata-deploy and pre-reqs in operator) but I'm trying to find out the root cause first (which is proving to be more complex than I thought). I can submit the workarounds if you think it's worth it but I'd rather spend more time on the actual fix first (basically the kata-deploy=cleanup is set immediately even when I use sleep 2m in kata-deploy before the labeling, trying to find out why as we rely on this label in operator cleanup to start post-cleanup).

[mythi]

Usually it suffices to just remove imports that are gone from /etc/containerd/config.yaml.d/XXX in `config.yaml

OK, I've not followed the work done in this space. It used to be so that imports=[] was not used and we "patched" the main config.yaml for the runtimeclass handlers.

My main open/concern is if the failure is related to my PR or flaky tests since it'd be important to have this change for the next release.

[wainersm]

IIUC this PR is depending on #483 to get CI passing.

[mythi]

IIUC this PR is depending on #483 to get CI passing.

Correct. I stopped restarting the failing jobs after @ldoktor started working on the improvements.

[ldoktor]

@mythi I'm using DISABLECVM="true" on v1.30.6 eks cluster and the usual way to deploy CAA failed to deploy the controller-manager, in logs it complains about this argument:

oc logs -n confidential-containers-system pods/cc-operator-controller-manager-78454cf6d8-qj9xg 
flag provided but not defined: -metrics-secure
Usage of /manager:
  -cc-runtime-namespace string
        The namespace where CcRuntime secondary resources are created (default "kube-system")
  -health-probe-bind-address string
        The address the probe endpoint binds to. (default ":8081")
  -kubeconfig string
        Paths to a kubeconfig. Only required if out-of-cluster.
  -leader-elect
        Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
  -metrics-bind-address string
        The address the metric endpoint binds to. (default ":8080")
  -peer-pods
        Enable Peerpod controllers.
  -zap-devel
        Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error) (default true)
  -zap-encoder value
        Zap log encoding (one of 'json' or 'console')
  -zap-log-level value
        Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', or any integer value > 0 which corresponds to custom debug levels of increasing verbosity
  -zap-stacktrace-level value
        Zap Level at and above which stacktraces are captured (one of 'info', 'error', 'panic').
  -zap-time-encoding value
        Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano'). Defaults to 'epoch'.

Removing it helps but my question is are there any new requirements tied to this change?

[ldoktor]

Note deploying it via: CLOUD_PROVIDER=aws make deploy from cloud-api-adapter...

[ldoktor]

I see, the problem is that it uses quay.io/confidential-containers/operator:v0.10.0 image by default, which doesn't supports this (and another problem is it uses different labels resulting in kata not being installed :-/) I'll have to figure-out why and if it's a default or something I set. Because if it's default it needs to be adjusted in order to work out of the box...

[ldoktor]

Well, looking at the history of https://github.com/confidential-containers/operator/blob/main/config/manager/kustomization.yaml I guess we forgot to update and re-bump to latest a couple of times... @wainersm @fitzthum @fidencio what do you think?

[mythi]

See #488

config/release looks to be the stable deployment with the pinned release versions

[ldoktor]

I see, so let's hope it'll be updated soon as currently the latest CAA fails to install due to change of labels and the support for --metrics-secure.