Update cdk8s imports

[michelesr]

The external secrets CRD manifest has been vendored and modified to
remove fields that are preventing import due to JSII inability to handle
fields with name matching /get[A-Z].*/

The following fields have been removed:

1. getByTitleFallback, KeeperSecurity provider:

• Optional boolean field
• Controls whether to fall back to searching secrets by title when lookup by UID fails
• Not in required: it's optional
• Impact of removing: You simply can't set this behaviour from cdk8s.
  It defaults to false in the controller. Reasonable to omit unless you use KeeperSecurity.

2. getParameters, VaultDynamicSecret generator:

• Optional object (map of string arrays) for query-string parameters on Vault GET calls
• Not in required: optional, and the description says "Ignored for non-GET methods"
• Impact of removing: You can't pass query-string params to Vault GET
  calls from cdk8s. For POST/write flows you'd use parameters instead,
  which is still present.

[simonwgill]

Are all the changes inside the two imports folders down to the cdk8s import process?

[michelesr]

Are all the changes inside the two imports folders down to the cdk8s import process?

• the CRD for external secrets is now vendored, so it's now in a yaml file hosted in the repository: that yaml file has been modified to comment fields that cannot be imported, but aren't used by our constructs anyway, so it should be harmless (and the test confirms that the snapshots are unchanged)
• cdk8s.yaml has been modified to update the versions for the k8s api (to 1.35 -> 1.36), vpa (1.5.0 -> 1.5.1), and the vendored external secrets manifest (so 2.0.1 -> modified 2.8.0)

[simonwgill]

I'm trying to understand why there's a lot of seemingly unrelated changes, especially to all the __init__.py files under ca_cdk_constructs/eks/imports

[michelesr]

I'm trying to understand why there's a lot of seemingly unrelated changes, especially to all the __init__.py files under ca_cdk_constructs/eks/imports

Those are all the output of the import process, they are not manual changes.

[simonwgill]

ok, I see what's happening with all those changes now. Worth splitting out each command execution as a single commit in future and explicitly stating the command line used.

The update process needs recording in the documentation here so somebody else can do the update to all the CRDs next time. At the very least for this PR, it needs the how to for where to get the external secrets CRD and do the changes you've identified. If it's easier to automate, a script would also be acceptable.

[michelesr]

Worth splitting out each command execution

You usually just have to update cdk8s.yaml with the latest versions of everything and run the import command once.

explicitly stating the command line used

why? it's in the README

documentation here so somebody else can do the update to all the CRDs next time

how to update the imports is already in the readme

At the very least for this PR, it needs the how to for where to get the external secrets CRD

I forgot to put the URL of the upstream manifest for the external-secrets, that can be remediated.

and do the changes you've identified

you can identify the changes by looking at the current manifest and search for commented lines:

$ grep '# ' crds/external-secrets-crds.yaml
                        # getByTitleFallback:
                        #   type: boolean
                        # getByTitleFallback:
                        #   type: boolean
                        # getParameters:
                        #   additionalProperties:
                        #     items:
                        #       type: string
                        #     type: array
                        #   description: |-
                        #     GetParameters are query-string parameters passed to Vault on GET calls.
                        #     Each key may map to multiple values, matching HTTP query-string semantics.
                        #     Ignored for non-GET methods; use Parameters for write bodies.
                        #   type: object
                # getParameters:
                #   additionalProperties:
                #     items:
                #       type: string
                #     type: array
                #   description: |-
                #     GetParameters are query-string parameters passed to Vault on GET calls.
                #     Each key may map to multiple values, matching HTTP query-string semantics.
                #     Ignored for non-GET methods; use Parameters for write bodies.
                #   type: object

there's no point in describing in detailed what was commented as it might change in the future and depends on the JSII errors you're getting when running the import command; I can add a comment in cdk8s.yaml under the external-secret ref to specify the original URL as well as the type of change that you have to make, that is commenting fields that fields that match /get[A-Z]/ because they cannot be imported.

[MatthewCane]

This all makes sense to me, Michele's additional comments in cdk8s.yaml are sufficient to explain what is going on.

[michelesr]

I've realized the VPA CRD is not used anywhere, so I simply removed it from cdk8s.yaml and the imports.