[TSLA-9066] Change container security features to state disabled #1963
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify site configuration. |
| | Compliance Reports | `installer.components.compliance.enabled` | `true` (default), `false` | | ||
| | Compliance Reports | `installer.components.compliance.enabled` | `true`, `false` (default) | | ||
|
|
||
| :::note |
There was a problem hiding this comment.
We'll also need to add a note about deprecation here.
Something along the lines of:
"Legacy users - those who have signed up prior to April 2025 - are still able to install the components above by setting the state to be Enabled. If you use the kubectl installs, then you can use deploy-with-container-security.yaml instead."
@ctauchen Is this messaging okay?
cc: @ozdanborne
There was a problem hiding this comment.
@WilliamTigera Thanks, I'll dig into the implications of the deprecation schedule and add notes myself where necessary.
ctauchen
left a comment
ctauchen
left a comment
There was a problem hiding this comment.
Thanks, @WilliamTigera. Changing the defaults works just fine for me, only thing from me is that we should also include calico-cloud/get-started/install-private-registry.mdx.
I'll go ahead and clean out the old 20-2 version, so you can expect to do a fetch and rebase before we merge.
| | Compliance Reports | `installer.components.compliance.enabled` | `true` (default), `false` | | ||
| | Compliance Reports | `installer.components.compliance.enabled` | `true`, `false` (default) | | ||
|
|
||
| :::note |
There was a problem hiding this comment.
@WilliamTigera Thanks, I'll dig into the implications of the deprecation schedule and add notes myself where necessary.
| ``` | ||
| 1. Optional: To make changes to what features are enabled during installation, paste the command to a text editor and append the `--set` option any of the following key-value pairs. | ||
| You can change these options only by reinstalling or upgrading Calico Cloud and changing the values. | ||
|
|
There was a problem hiding this comment.
Above this, we'll also need to add:
For legacy users that want to install image assurance using kubectl: Replace deploy.yaml with deploy-with-container-security.yaml.
kubectl apply -f https://installer.calicocloud.io/manifests/cc-operator/latest/deploy-with-container-security.yaml && curl -H "Authorization: Bearer mprcnz04t:9dav6eoag:s8w7xjslez1x1xkf6ds0h23miz5b1fw6phh9897d0n76e4pjfdekijowjv5lw9dd" "https://www.calicocloud.io/api/managed-cluster/deploy-with-container-security.yaml?version=v19.1.0" | kubectl apply -f -There was a problem hiding this comment.
I'm guessing that you're talking about people who are doing upgrades and who have IA enabled. If they run the generated kubectl command for v21.1.0, it will disable IA and CTD. If they want to continue with these enabled, they need to:
- Generate and copy the kubectl command.
- s/deploy.yaml/deploy-with-container-security.yaml
- Apply, and see a successful upgrade with deprecated features working normally.
Is that right?
There was a problem hiding this comment.
That's correct.
| | Packet Capture | `installer.components.packetCaptureAPI.state` | `Enabled`, `Disabled` (default\*) <br/> * The default for new clusters is `Disabled`. For upgrades for previously connected clusters, the default will retain the previous state. | | ||
| | Compliance Reports | `installer.components.compliance.enabled` | `true` (default), `false` | | ||
| | Compliance Reports | `installer.components.compliance.enabled` | `true`, `false` (default) | | ||
|
|
There was a problem hiding this comment.
We also need to add a note that if you're not a legacy user, installing with container security enabled will cause an installation error.
@ctauchen If you're able to tell me the best location to place the messaging, I believe you might put them in a deprecated section?
WilliamTigera
force-pushed
the
TSLA-9066-Deprecation-Notice
branch
from
16e31eb to
8d28830
Compare
|
Closing here, reproduced in #1975 |
2 participants
Product Version(s):
Issue:
Link to docs preview:
SME review:
DOCS review:
Additional information:
Merge checklist: