Aad-pod-identity: helm charts patch version and breaking change

[glcx]

Dear,

The latest aad-pod-identity release (v1.7.0) got pushed into a patch version of the helm charts: 2.0.3

Is this expected as it contains minor release and a breaking change ?

Pod Identity is disabled by default for Clusters with Kubenet. Please review this doc before upgrade.

Using tools like flux & helm operator we can decide to always use the latest patch version of a charts like "2.0.x" which in this case would break aad-pod-identity features on clusters with kubenet.

Thanks

[chewong]

Thanks for opening this issue. We added nmi.allowNetworkPluginKubenet in the helm chart values.yaml so you can simply add helm install|upgrade ... --set nmi.allowNetworkPluginKubenet=true ... when performing helm operations.

Note that kubenet is vulnerable to a number of known issues, that's why we recommend using Azure CNI as the network plugin instead of kubenet.

Regarding the semantic versioning of the helm chart, we only bump the major/minor of it when there are API changes.

[bcorijn]

Changing the default behaviour, especially when it's as intrusive as completely disabling all functionality, in a patch version is just _very_ counter intuitive to how semver is supposed to work. The application versioning seems to follow that understanding, but it then got propagated into the chart as patch version, that just doesn't seem right?
I understand the API didn't change but there's a huge breaking change introduced here for people running kubenet in just a patch release, needing manual intervention/rollback.

[chewong]

That makes a ton of sense, thanks for all the input @glcx @bcorijn. We decided to re-publish aad-pod-identity v1.7.0 with helm chart version v2.1.0 to reflect the breaking change on kubenet.