Merge pull request #11707 from linkerd/ver/stable-2.14.6

stable-2.14.6

* 0a72f1f Add imagePullSecrets to the multicluster chart. (#11287)
* 284d76b service-mirror: support gateway resolving to multiple addresses (#11499)
* 64bccd9 Improve klog (client-go logs) handling (#11632)
* 6a07e2c Add ability to configure client-go's `QPS` and `Burst` settings (#11644)
* e294c78 Bump prometheus to v2.48.0 (#11633)

CHANGES.md

@@ -1,5 +1,31 @@
 # Changes
 
+## stable-2.14.6
+
+This stable release back-ports bugfixes and improvements from recent edge
+releases.
+
+* multicluster: Added an `imagePullSecrets` configuration to
+  linkerd-multicluster Helm chart (thanks @lhaussknecht!). ([#11287])
+* multicluster: Updated the service mirror to support gateways exposed on
+  multiple IP addresses (thanks @MrFreezeex!) ([#11499])
+* Updated control plane logging so that client-go may emit error logs. This will
+  also ensures that all logs are emitted in JSON when the json log format is
+  enabled. ([#11632])
+* Added `kubeAPI.clientBurst` and `kubeAPI.clientQPS` configurations that allow
+  users to configure the burst and QPS rate limits for the Kubernetes API
+  clients used by the control plane. The default burst and qps values are now
+  set at 200 and 100, respectively. The prior defaults limited bursts 10 and QPS
+  to 5, which could cause throttling issues in clusters that schedule many pods
+  quickly. ([#11644])
+* viz: Update the default prometheus version to v2.48.0. ([#11633])
+
+[#11287]: https://github.com/linkerd/linkerd2/pull/11287
+[#11499]: https://github.com/linkerd/linkerd2/pull/11499
+[#11632]: https://github.com/linkerd/linkerd2/pull/11632
+[#11644]: https://github.com/linkerd/linkerd2/pull/11644
+[#11633]: https://github.com/linkerd/linkerd2/pull/11633
+
 ## stable-2.14.5
 
 This stable release fixes a proxy regression where bursts of TCP connections

charts/linkerd-control-plane/Chart.yaml

@@ -16,7 +16,7 @@ dependencies:
 - name: partials
   version: 0.1.0
   repository: file://../partials
-version: 1.16.6
+version: 1.16.7
 icon: https://linkerd.io/images/logo-only-200h.png
 maintainers:
   - name: Linkerd authors

charts/linkerd-control-plane/README.md

@@ -175,11 +175,15 @@ Kubernetes: `>=1.21.0-0`
 | identity.issuer.tls | object | `{"crtPEM":"","keyPEM":""}` | Which scheme is used for the identity issuer secret format |
 | identity.issuer.tls.crtPEM | string | `""` | Issuer certificate (ECDSA). It must be provided during install. |
 | identity.issuer.tls.keyPEM | string | `""` | Key for the issuer certificate (ECDSA). It must be provided during install |
+| identity.kubeAPI.clientBurst | int | `200` | Burst value over clientQPS |
+| identity.kubeAPI.clientQPS | int | `100` | Maximum QPS sent to the kube-apiserver before throttling. See [token bucket rate limiter implementation](https://github.com/kubernetes/client-go/blob/v12.0.0/util/flowcontrol/throttle.go) |
 | identity.serviceAccountTokenProjection | bool | `true` | Use [Service Account token Volume projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection) for pod validation instead of the default token |
 | identityTrustAnchorsPEM | string | `""` | Trust root certificate (ECDSA). It must be provided during install. |
 | identityTrustDomain | string | clusterDomain | Trust domain used for identity |
 | imagePullPolicy | string | `"IfNotPresent"` | Docker image pull policy |
 | imagePullSecrets | list | `[]` | For Private docker registries, authentication is needed.  Registry secrets are applied to the respective service accounts |
+| kubeAPI.clientBurst | int | `200` | Burst value over clientQPS |
+| kubeAPI.clientQPS | int | `100` | Maximum QPS sent to the kube-apiserver before throttling. See [token bucket rate limiter implementation](https://github.com/kubernetes/client-go/blob/v12.0.0/util/flowcontrol/throttle.go) |
 | linkerdVersion | string | `"linkerdVersionValue"` | control plane version. See Proxy section for proxy version |
 | networkValidator.connectAddr | string | `"1.1.1.1:20001"` | Address to which the network-validator will attempt to connect. we expect this to be rewritten |
 | networkValidator.enableSecurityContext | bool | `true` | Include a securityContext in the network-validator pod spec |

charts/linkerd-control-plane/templates/identity.yaml

@@ -159,6 +159,8 @@ spec:
         - -identity-clock-skew-allowance={{.Values.identity.issuer.clockSkewAllowance}}
         - -identity-scheme={{.Values.identity.issuer.scheme}}
         - -enable-pprof={{.Values.enablePprof | default false}}
+        - -kube-apiclient-qps={{.Values.identity.kubeAPI.clientQPS}}
+        - -kube-apiclient-burst={{.Values.identity.kubeAPI.clientBurst}}
         {{- include "partials.linkerd.trace" . | nindent 8 -}}
         env:
         - name: LINKERD_DISABLED

charts/linkerd-control-plane/values.yaml

@@ -48,6 +48,13 @@ identityTrustAnchorsPEM: |
 # -- Trust domain used for identity
 # @default -- clusterDomain
 identityTrustDomain: ""
+kubeAPI: &kubeapi
+  # -- Maximum QPS sent to the kube-apiserver before throttling.
+  # See [token bucket rate limiter
+  # implementation](https://github.com/kubernetes/client-go/blob/v12.0.0/util/flowcontrol/throttle.go)
+  clientQPS: 100
+  # -- Burst value over clientQPS
+  clientBurst: 200
 # -- Additional annotations to add to all pods
 podAnnotations: {}
 # -- Additional labels to add to all pods
@@ -327,6 +334,7 @@ identity:
 
   # -- Use [Service Account token Volume projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection) for pod validation instead of the default token
   serviceAccountTokenProjection: true
+
   issuer:
     scheme: linkerd.io/tls
 
@@ -345,6 +353,8 @@ identity:
       # install
       keyPEM: |
 
+  kubeAPI: *kubeapi
+
 # -|- CPU, Memory and Ephemeral Storage resources required by the identity controller (see `proxy.resources` for sub-fields)
 #identityResources:
 # -|- CPU, Memory and Ephemeral Storage resources required by proxy injected into identity pod (see `proxy.resources` for sub-fields)