From 13a89f22ae7e79a67ae2e0fa4ef4ece46278f74e Mon Sep 17 00:00:00 2001 From: David C Wang Date: Thu, 19 Jul 2018 19:13:01 +0000 Subject: [PATCH 001/163] Implemented Nvidia DevicePlugin GPU Support * Supports DevicePlugin GPU Mode AND Legacy Accelerators GPU Mode --- hooks/nvidia-device-plugin/Makefile | 31 +++ hooks/nvidia-device-plugin/README.md | 214 +++++++++++++++++ hooks/nvidia-device-plugin/image/Dockerfile | 27 +++ .../image/files/01-aws-nvidia-driver.sh | 218 ++++++++++++++++++ .../image/files/02-nvidia-docker.sh | 80 +++++++ .../image/files/nvidia-device-plugin.service | 10 + .../image/files/nvidia-device-plugin.sh | 52 +++++ hooks/nvidia-device-plugin/image/run.sh | 37 +++ 8 files changed, 669 insertions(+) create mode 100644 hooks/nvidia-device-plugin/Makefile create mode 100644 hooks/nvidia-device-plugin/README.md create mode 100644 hooks/nvidia-device-plugin/image/Dockerfile create mode 100755 hooks/nvidia-device-plugin/image/files/01-aws-nvidia-driver.sh create mode 100755 hooks/nvidia-device-plugin/image/files/02-nvidia-docker.sh create mode 100644 hooks/nvidia-device-plugin/image/files/nvidia-device-plugin.service create mode 100755 hooks/nvidia-device-plugin/image/files/nvidia-device-plugin.sh create mode 100755 hooks/nvidia-device-plugin/image/run.sh diff --git a/hooks/nvidia-device-plugin/Makefile b/hooks/nvidia-device-plugin/Makefile new file mode 100644 index 0000000000000..cb19c580e01a8 --- /dev/null +++ b/hooks/nvidia-device-plugin/Makefile @@ -0,0 +1,31 @@ +# Copyright 2017 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +.DEFAULT_GOAL=help + +all: image + +.PHONY: image push + +image: ## Build the image + docker build -t dcwangmit01/nvidia-device-plugin:0.1.0 -f image/Dockerfile image/ + +push: ## Push the image + docker push dcwangmit01/nvidia-device-plugin:0.1.0 + +help: ## Print list of Makefile targets + @# Taken from https://github.com/spf13/hugo/blob/master/Makefile + @grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \ + cut -d ":" -f1- | \ + awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' diff --git a/hooks/nvidia-device-plugin/README.md b/hooks/nvidia-device-plugin/README.md new file mode 100644 index 0000000000000..6cf68895cab16 --- /dev/null +++ b/hooks/nvidia-device-plugin/README.md @@ -0,0 +1,214 @@ +# NVIDIA GPU Driver and DevicePlugin Installation + +## Summary + +This kops hook container may be used to enable nodes with GPUs to work with +Kubernetes. It is targeted specifically for AWS GPU [instance +types](https://aws.amazon.com/ec2/instance-types/). + +It installs the following from web sources. + +1. [Nvidia Device Drivers](http://www.nvidia.com/Download/index.aspx) +2. [Cuda Libraries v9.1](https://developer.nvidia.com/cuda-downloads) +3. [nvidia-docker](https://github.com/NVIDIA/nvidia-docker) +4. [docker-ce](https://www.docker.com/community-edition) + +Using this hook indicates that you agree to the Nvidia +[licenses](http://www.nvidia.com/content/DriverDownload-March2009/licence.php?lang=us). + +## How it works + +* This kops hook container runs on a kubernetes node upon every boot. +* It installs onto the host system a systemd oneshot service unit + `nvidia-device-plugin.service` along with setup scripts. +* The systemd unit `nvidia-device-plugin.service` runs and executes the setup + scripts in the host directory `/nvidia-device-plugin`. +* The scripts install the Nvidia device drivers, Cuda libs, Nvidia docker along + with the matching version of docker-ce. +* The scheduling of work in a separate systemd unit outside of this kops hook + is required because it is not possible to upgrade docker-ce on the host from + within a docker container. + +## Prerequisites + +Although this hook *may* work among many combinatorial versions of software and +images, it has only been tested with the following: + +* kops: **1.9** +* kubernetes: 1.10, **1.11** +* OS Image: **`kope.io/k8s-1.10-debian-stretch-amd64-hvm-ebs-2018-05-27`** + * This is most certainly not the default image for kops. The OS image must + be explicitly overridden in the cluster or instancegroup spec. + * Debian stretch is needed because `nvidia-docker` requires a newer version + of `docker-ce >= 18.0`, which is not available in the Debian jessie package + repository. In addition, the Debian jessie kernel was compiled with gcc-7, + while the system packages install gcc-4, thus making the nvidia driver + compilation fail. +* cloud: **AWS** + * This hook will only work on AWS at this moment. + * This is due to the fact that it uses an AWS discovery mechanism to + determine node instancetype, and subsequently install the correct drivers and + configure the optimal settings for the GPU chipsets. + +### Test Matrix + +This kops hook was developed against the following version combinations. + +| Kops Version | Kubernetes Version | GPU Mode | OS Image | +| ------------- | ------------------ | ------------ | -------- | +| 1.10-beta.1 | 1.10 | deviceplugin | kope.io/k8s-1.10-debian-stretch-amd64-hvm-ebs-2018-05-27 +| 1.9.1 | 1.11 | deviceplugin | kope.io/k8s-1.10-debian-stretch-amd64-hvm-ebs-2018-05-27 +| 1.9.1 | 1.10 | legacy | kope.io/k8s-1.10-debian-stretch-amd64-hvm-ebs-2018-05-27 + +## Using this DevicePlugin + +### Create a Cluster with GPU Nodes + +```bash +kops create cluster gpu.example.com \ + --zones us-east-1c \ + --node-size p2.xlarge \ + --node-count 1 \ + --image kope.io/k8s-1.10-debian-stretch-amd64-hvm-ebs-2018-05-27 \ + --kubernetes-version 1.11.0 +``` + +### Enable the Kops Installation Hook and DevicePlugins + +This should be safe to do for all machines, because the hook auto-detects if +the machine is an AWS GPU instancetype and will NO-OP otherwise. Choose +between the DevicePlugin GPU Mode or Legacy Accelerators GPU Mode. + +#### (Preferred) DevicePlugin GPU Mode + +This mode is: + +* Required for kubernetes >= 1.11.0 +* Optional for 1.8.0 =< kubernetes <= 1.11.0 + +For Kubernetes >= 1.11.0 or clusters supporting DevicePlugins + +```yaml +# > kops edit instancegroup nodes + +spec: + image: kope.io/k8s-1.10-debian-stretch-amd64-hvm-ebs-2018-05-27 + hooks: + - execContainer: + image: dcwangmit01/nvidia-device-plugin:0.1.0 + +### The settings below are only necessary for kubernetes <= 1.11.0, where +### deviceplugins are not enabled by default. +# kubelet: +# featureGates: +# # Enable DevicePlugins +# DevicePlugins: "true" +# # Disable Accelerators (may interfere with DevicePlugins) +# Accelerators: "false" +``` + +#### (Deprecated) Legacy Accelerators GPU Mode + +The legacy `accelerator` +GPU mode is equivalent to the original [GPU hook](/docs/gpu.md). +Accelerators are deprecated in `Kubernetes >= 1.11.0`. + +```yaml +# > kops edit instancegroup nodes + +spec: + image: kope.io/k8s-1.10-debian-stretch-amd64-hvm-ebs-2018-05-27 + hooks: + - execContainer: + image: dcwangmit01/nvidia-device-plugin:0.1.0 + environment: + NVIDIA_DEVICE_PLUGIN_MODE: legacy + kubelet: + featureGates: + # Disable DevicePlugins (may interfere with DevicePlugins) + DevicePlugins: "false" + # Enable Accelerators + Accelerators: "true" +``` + +### Update the cluster + +```bash +kops update cluster gpu.example.com --yes +kops rolling-update cluster gpu.example.com --yes +``` + +### Deploy the Daemonset for the Nvidia DevicePlugin + +Only for DevicePlugin GPU Mode, load the deviceplugin daemonset for your +specific environment. This is not required for the Legacy Accelerators GPU +Mode. + +```bash +# For kubernetes 1.10 +kubectl create -f https://raw.githubusercontent.com/NVIDIA/k8s-device-plugin/v1.10/nvidia-device-plugin.yml + +# For kubernetes 1.11 +kubectl create -f https://raw.githubusercontent.com/NVIDIA/k8s-device-plugin/v1.11/nvidia-device-plugin.yml + +# (Optional) Set permissive toleration to allow daemonset to run anywhere. +# By default this is permissive in case you have tainted your GPU nodes. +kubectl patch daemonset nvidia-device-plugin-daemonset --namespace kube-system \ + -p '{ "spec": { "template": { "spec": { "tolerations": [ { "operator": "Exists" } ] } } } }' +``` + +### Validate that GPUs are Working + +#### Deploy a Test Pod + +```bash +cat << EOF | kubectl create -f - +apiVersion: v1 +kind: Pod +metadata: + name: tf-gpu +spec: + containers: + - name: gpu + image: tensorflow/tensorflow:1.9.0-gpu + imagePullPolicy: IfNotPresent + resources: + limits: + memory: 1024Mi + # ^ Set memory in case default limits are set low + nvidia.com/gpu: 1 # requesting 1 GPUs + # ^ For Legacy Accelerators mode this key must be renamed + # 'alpha.kubernetes.io/nvidia-gpu' + tolerations: + # This toleration will allow the gpu hook to run anywhere + # By default this is permissive in case you have tainted your GPU nodes. + - operator: "Exists" + # ^ If you have a specific taint to target, comment out the above and modify + # the example below + +### Example tolerations +# - key: "dedicated" +# operator: "Equal" +# value: "gpu" +# effect: "NoExecute" +EOF +``` + +#### Validate that GPUs are working + +```bash +# Check that nodes are detected to have GPUs +kubectl describe nodes|grep -E 'gpu:\s.*[1-9]' + +# Check the logs of the Tensorflow Container to ensure that it ran +kubectl logs tf-gpu + +# Show GPU info from within the pod +# Only works in DevicePlugin mode +kubectl exec -it tf-gpu nvidia-smi + +# Show Tensorflow detects GPUs from within the pod. +# Only works in DevicePlugin mode +kubectl exec -it tf-gpu -- \ + python -c 'from tensorflow.python.client import device_lib; print(device_lib.list_local_devices())' +``` diff --git a/hooks/nvidia-device-plugin/image/Dockerfile b/hooks/nvidia-device-plugin/image/Dockerfile new file mode 100644 index 0000000000000..5cfe7857db60f --- /dev/null +++ b/hooks/nvidia-device-plugin/image/Dockerfile @@ -0,0 +1,27 @@ +# Copyright 2017 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +FROM debian:stretch-slim +# ^ Cannot be Alpine since it does not support systemctl +# ^ Systemctl is used to control systemd resources of the host + +RUN apt-get update && \ + apt-get install -y -q --no-install-recommends systemd && \ + apt-get -y clean && \ + apt-get -y autoremove + +COPY run.sh /run.sh +COPY files/* /nvidia-device-plugin/ + +CMD [ "/bin/bash", "/run.sh" ] diff --git a/hooks/nvidia-device-plugin/image/files/01-aws-nvidia-driver.sh b/hooks/nvidia-device-plugin/image/files/01-aws-nvidia-driver.sh new file mode 100755 index 0000000000000..82b3c4b111234 --- /dev/null +++ b/hooks/nvidia-device-plugin/image/files/01-aws-nvidia-driver.sh @@ -0,0 +1,218 @@ +# Copyright 2017 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#!/bin/bash +set -euo pipefail +set -x + +################################################# +# Settings + +# A place on the host machine to cache 1.6GB+ downloads in-between reboots. + +CACHE_DIR=/nvidia-device-plugin + +# AWS Instance Types to Nvidia Card Mapping (cut and pasted from AWS docs) +# Load the correct driver for the correct instance type +# Instances Product Type Product Series Product +# G2 GRID GRID Series GRID K520 (deprecated) +# G3 Tesla M-Series M-60 +# P2 Tesla K-Series K-80 +# P3 Tesla V-Series V100 +# http://www.nvidia.com/Download/index.aspx +declare -A class_to_driver_file +class_to_driver_file=( \ + ["g2"]="http://us.download.nvidia.com/XFree86/Linux-x86_64/367.124/NVIDIA-Linux-x86_64-367.124.run" \ + ["g3"]="http://us.download.nvidia.com/tesla/390.46/NVIDIA-Linux-x86_64-390.46.run" \ + ["p2"]="http://us.download.nvidia.com/tesla/390.46/NVIDIA-Linux-x86_64-390.46.run" \ + ["p3"]="http://us.download.nvidia.com/tesla/390.46/NVIDIA-Linux-x86_64-390.46.run" \ +) +declare -A class_to_driver_checksum +class_to_driver_checksum=( \ + ["g2"]="77f37939efeea4b6505842bed50445971992e303" \ + ["g3"]="57569ecb6f6d839ecc77fa10a2c573cc069990cc" \ + ["p2"]="57569ecb6f6d839ecc77fa10a2c573cc069990cc" \ + ["p3"]="57569ecb6f6d839ecc77fa10a2c573cc069990cc" \ +) + +# CUDA Files that need to be installed ~1.4GB +# First one is main installation +# Subsequent files are patches which need to be applied in order +# Order in the arrays below matters +# https://developer.nvidia.com/cuda-downloads +cuda_files=( \ + "https://developer.nvidia.com/compute/cuda/9.1/Prod/local_installers/cuda_9.1.85_387.26_linux" \ + "https://developer.nvidia.com/compute/cuda/9.1/Prod/patches/1/cuda_9.1.85.1_linux" \ + "https://developer.nvidia.com/compute/cuda/9.1/Prod/patches/2/cuda_9.1.85.2_linux" \ + "https://developer.nvidia.com/compute/cuda/9.1/Prod/patches/3/cuda_9.1.85.3_linux" \ +) +cuda_files_checksums=( \ + "1540658f4fe657dddd8b0899555b7468727d4aa8" \ + "7ec6970ecd81163b0d02ef30d35599e7fd6e97d8" \ + "cfa3b029b58fc117d8ce510a70efc848924dd565" \ + "6269a2c5784b08997edb97ea0020fb4e6c8769ed" \ +) + +containsElement () { for e in "${@:2}"; do [[ "$e" = "$1" ]] && return 0; done; return 1; } + +################################################# +# Ensure that we are on a proper AWS GPU Instance + +apt-get -y update +apt-get -y --no-upgrade install curl jq + +AWS_INSTANCE_TYPE=$(curl -m 2 -fsSL http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r ".instanceType" || true) # eg: p2.micro +AWS_INSTANCE_CLASS=$(echo $AWS_INSTANCE_TYPE | cut -d . -f 1 || true) # e.g. p2 + +if [[ -z $AWS_INSTANCE_TYPE ]] || [[ -z $AWS_INSTANCE_CLASS ]]; then + echo "This machine is not an AWS instance" + echo " Exiting without installing GPU drivers" + exit 1 +fi + +classnames=${!class_to_driver_file[@]} # e.g. [ "g2", "g3", "p2", "p3" ] +if ! containsElement $AWS_INSTANCE_CLASS $classnames; then + echo "This machine is an AWS instance, but not a GPU instance" + echo " Exiting without installing GPU drivers" + exit 1 +fi + +echo "Identified machine as AWS_INSTANCE_TYPE[$AWS_INSTANCE_TYPE] AWS_INSTANCE_CLASS[$AWS_INSTANCE_CLASS]" + +################################################# +# Install dependencies + +# Install GCC and linux headers on the host machine +# The NVIDIA driver build must be compiled with the same version of GCC as +# the kernel. In addition, linux-headers are machine image specific. +# Install with --no-upgrade so that the c-libs are not upgraded, possibly +# breaking programs and requiring restart +apt-get -y update +apt-get -y --no-upgrade install gcc libc-dev linux-headers-$(uname -r) +apt-get -y clean +apt-get -y autoremove + +################################################# +# Unload open-source nouveau driver if it exists +# The nvidia drivers won't install otherwise +# "g3" instances in particular have this module auto-loaded +modprobe -r nouveau || true + +################################################# +# Download and install the Nvidia drivers and cuda libraries + +# Create list of URLs and Checksums by merging driver item with array of cuda files +downloads=(${class_to_driver_file[$AWS_INSTANCE_CLASS]} ${cuda_files[@]}) +checksums=(${class_to_driver_checksum[$AWS_INSTANCE_CLASS]} ${cuda_files_checksums[@]}) + +# Download, verify, and execute each file +length=${#downloads[@]} +for (( i=0; i<${length}; i++ )); do + download=${downloads[$i]} + checksum=${checksums[$i]} + filename=$(basename $download) + filepath="${CACHE_DIR}/${filename}" + filepath_installed="${CACHE_DIR}/${filename}.installed" + + echo "Checking for file at $filepath" + if [[ ! -f $filepath ]] || ! (echo "$checksum $filepath" | sha1sum -c - 2>&1 >/dev/null); then + echo "Downloading $download" + curl -L $download > $filepath + chmod a+x $filepath + fi + + echo "Verifying sha1sum of file at $filepath" + if ! (echo "$checksum $filepath" | sha1sum -c -); then + echo "Failed to verify sha1sum for file at $filepath" + exit 1 + fi + + # Install the Nvidia driver and cuda libs + if [[ -f $filepath_installed ]]; then + echo "Detected prior install of file $filename on host" + else + echo "Installing file $filename on host" + if [[ $download =~ .*NVIDIA.* ]]; then + # Install the nvidia package + $filepath --accept-license --silent + touch $filepath_installed # Mark successful installation + elif [[ $download =~ .*local_installers.*cuda.* ]]; then + # Install the primary cuda library + $filepath --toolkit --silent --verbose + touch $filepath_installed # Mark successful installation + elif [[ $download =~ .*patches.*cuda.* ]]; then + # Install an update to the primary cuda library + $filepath --accept-eula --silent + touch $filepath_installed # Mark successful installation + else + echo "Unable to handle file $filepath" + exit 1 + fi + fi +done + +################################################# +# Output GPU info for debugging +nvidia-smi --list-gpus + +################################################# +# Configure and Optimize Nvidia cards now that things are installed +# AWS Optimizization Doc +# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/optimize_gpu.html +# Nvidia Doc +# http://developer.download.nvidia.com/compute/DCGM/docs/nvidia-smi-367.38.pdf + +# Common configurations +nvidia-smi -pm 1 +nvidia-smi --auto-boost-default=0 +nvidia-smi --auto-boost-permission=0 + +# Custom configurations per class of nvidia video card +case "$AWS_INSTANCE_CLASS" in +"g2" | "g3") + nvidia-smi -ac 2505,1177 + ;; +"p2") + nvidia-smi -ac 2505,875 + nvidia-smi -acp 0 + ;; +"p3") + nvidia-smi -ac 877,1530 + nvidia-smi -acp 0 + ;; +*) + ;; +esac + +################################################# +# Load the Kernel Module + +if ! /sbin/modprobe nvidia-uvm; then + echo "Unable to modprobe nvidia-uvm" + exit 1 +fi + +# Ensure that the device node exists +if ! test -e /dev/nvidia-uvm; then + # Find out the major device number used by the nvidia-uvm driver + D=`grep nvidia-uvm /proc/devices | awk '{print $1}'` + mknod -m 666 /dev/nvidia-uvm c $D 0 +fi + +########################################################### +# Restart Kubelet +# Only necessary in the case of Accelerators (not Device Plugins) + +echo "Restarting Kubelet" +systemctl restart kubelet.service diff --git a/hooks/nvidia-device-plugin/image/files/02-nvidia-docker.sh b/hooks/nvidia-device-plugin/image/files/02-nvidia-docker.sh new file mode 100755 index 0000000000000..e5d13a5fe833b --- /dev/null +++ b/hooks/nvidia-device-plugin/image/files/02-nvidia-docker.sh @@ -0,0 +1,80 @@ +# Copyright 2017 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#!/bin/bash +set -euo pipefail +set -x + +################################################# +# Install nvidia-docker2 + +# This section is somewhat adapted from README at: +# https://github.com/NVIDIA/nvidia-docker + +####################################### +# Cleanup old nvidia-docker + +# If you have nvidia-docker 1.0 installed: we need to remove it and all existing GPU containers +docker volume ls -q -f driver=nvidia-docker | xargs -r -I{} -n1 docker ps -q -a -f volume={} | xargs -r docker rm -f + +# Remove the old nvidia-docker if it exists +apt-get purge -y nvidia-docker || true + +####################################### +# Add package repositories + +# Add the package repository for docker-ce +curl -fsSL https://download.docker.com/linux/debian/gpg | \ + apt-key add - +echo 'deb [arch=amd64] https://download.docker.com/linux/debian stretch stable' | \ + tee /etc/apt/sources.list.d/docker-ce.list + +# Add the package repository for nvidia-docker +curl -s -L https://nvidia.github.io/nvidia-docker/gpgkey | \ + apt-key add - +distribution=$(. /etc/os-release;echo $ID$VERSION_ID) +curl -s -L https://nvidia.github.io/nvidia-docker/$distribution/nvidia-docker.list | \ + tee /etc/apt/sources.list.d/nvidia-docker.list + +# Override the default runtime with the one from nvidia +# Also explicity set the storage-driver to the prior 'overlay' +cat << 'EOF' > /etc/docker/daemon.json +{ + "default-runtime": "nvidia", + "runtimes": { + "nvidia": { + "path": "/usr/bin/nvidia-container-runtime", + "runtimeArgs": [] + } + }, + "storage-driver": "overlay" +} +EOF + +# Install nvidia-docker2 and reload the Docker daemon configuration +# Note that the nvidia-docker version must match the docker-ce version +# --force-confold prevents prompt for replacement of daemon.json +apt-get -y update +apt-get install -y --allow-downgrades -o Dpkg::Options::="--force-confold" \ + nvidia-docker2 \ + nvidia-container-runtime \ + docker-ce + +# Disable a few things that break docker-ce/gpu support upon reboot: +# Upon boot, the kops-configuration.service systemd unit sets up and starts +# the cloud-init.service which runs nodeup which forces docker-ce to a +# specific version that is a downgrade and incompatible with nvidia-docker2. +# Permanently disable these systemd units via masking. +systemctl mask cloud-init.service +systemctl mask kops-configuration.service diff --git a/hooks/nvidia-device-plugin/image/files/nvidia-device-plugin.service b/hooks/nvidia-device-plugin/image/files/nvidia-device-plugin.service new file mode 100644 index 0000000000000..660d7e48c5ed4 --- /dev/null +++ b/hooks/nvidia-device-plugin/image/files/nvidia-device-plugin.service @@ -0,0 +1,10 @@ +[Unit] +Description=Prepare AWS GPU instances for Nvidia Kubernetes Device Plugin +After=cloud-config.target cloud-init.target kops-configuration.service apt-daily-upgrade.timer install-xfs.service + +[Service] +Type=oneshot +ExecStart=/bin/bash -c "/nvidia-device-plugin/nvidia-device-plugin.sh" + +[Install] +WantedBy=multi-user.target diff --git a/hooks/nvidia-device-plugin/image/files/nvidia-device-plugin.sh b/hooks/nvidia-device-plugin/image/files/nvidia-device-plugin.sh new file mode 100755 index 0000000000000..7590502dac058 --- /dev/null +++ b/hooks/nvidia-device-plugin/image/files/nvidia-device-plugin.sh @@ -0,0 +1,52 @@ +# Copyright 2017 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#!/bin/bash +set -euo pipefail +set -x + +CACHE_DIR=/nvidia-device-plugin + +# Load Passthrough enviroment variables from the original kops hook +source $CACHE_DIR/environment + +# Support both deviceplugin and legacy (accelerator) GPU modes. +# Default to 'deviceplugin' if env var is unset. +if [[ ! -v NVIDIA_DEVICE_PLUGIN_MODE ]]; then + NVIDIA_DEVICE_PLUGIN_MODE='deviceplugin' + echo "Defaulting to NVIDIA_DEVICE_PLUGIN_MODE='deviceplugin'" +fi + +# Figure out which scripts should run +scripts=() +case "$NVIDIA_DEVICE_PLUGIN_MODE" in + legacy) + scripts+=("$CACHE_DIR/01-aws-nvidia-driver.sh") + ;; + deviceplugin) + scripts+=("$CACHE_DIR/01-aws-nvidia-driver.sh") + scripts+=("$CACHE_DIR/02-nvidia-docker.sh") + ;; + *) + echo "Invalid NVIDIA_DEVICE_PLUGIN_MODE=$NVIDIA_DEVICE_PLUGIN_MODE" + echo " Valid values are 'deviceplugin' or 'legacy'" + exit 1 +esac + +# Run the scripts +for script in "${scripts[@]}"; do + echo "########## Starting $script ##########" + $script 2>&1 | tee -a $CACHE_DIR/install.log + echo "########## Finished $script ##########" +done diff --git a/hooks/nvidia-device-plugin/image/run.sh b/hooks/nvidia-device-plugin/image/run.sh new file mode 100755 index 0000000000000..ea997becf8ce4 --- /dev/null +++ b/hooks/nvidia-device-plugin/image/run.sh @@ -0,0 +1,37 @@ +# Copyright 2017 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#!/bin/bash +set -euo pipefail +set -x + +# Copy the setup scripts to the host +# The kops hook automatically mounts the host root filesystem into the +# container /rootfs +mkdir -p /rootfs/nvidia-device-plugin +cp -r /nvidia-device-plugin/* /rootfs/nvidia-device-plugin + +# Setup the host systemd to run the systemd unit that runs setup scripts +ln -sf /nvidia-device-plugin/nvidia-device-plugin.service /rootfs/etc/systemd/system/nvidia-device-plugin.service + +# Save the environment to be passed on to the systemd unit +(env | grep NVIDIA_DEVICE_PLUGIN > /rootfs/nvidia-device-plugin/environment) || true + +# Kickoff host systemd unit that runs the setup scripts +# 'systemctl' within this docker container uses the mounted /run/systemd/* +# volume from the host to control systemd on the host. +systemctl daemon-reload +systemctl start --no-block nvidia-device-plugin.service + +exit 0 From 00e6e5f9f6233f859a6b7473671fc973c7fc0c41 Mon Sep 17 00:00:00 2001 From: Tamas Tobi <3641118+tatobi@users.noreply.github.com> Date: Thu, 16 Aug 2018 14:42:21 +0200 Subject: [PATCH 002/163] increase respose timeout In case of increased I/O load, the 10sec timeout is not enough on small / heavily loaded systems thus I propose the 60sec. The kubelet timeout is 2m (120sec) by default to detect health problems. Secondly, the docker restart can load heavily the host OS even huge systems because of many pods initialization at the same time. Continuous dockerd restart loop - a deadlock of node - is observed. Thirdly, because of the forcibly closed sockets and the kernel TCP TIME_WAIT value, the TCP sockets are not usable immediately with a "restart", wait for FIN_TIMEOUT is necessary before start services. Workaround #1 for: https://github.com/kubernetes/kops/issues/5434 --- .../opt/kubernetes/helpers/docker-healthcheck | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/upup/models/nodeup/docker/_systemd/_debian_family/files/opt/kubernetes/helpers/docker-healthcheck b/upup/models/nodeup/docker/_systemd/_debian_family/files/opt/kubernetes/helpers/docker-healthcheck index c21bf3ee2c3fc..87ae0413b8943 100644 --- a/upup/models/nodeup/docker/_systemd/_debian_family/files/opt/kubernetes/helpers/docker-healthcheck +++ b/upup/models/nodeup/docker/_systemd/_debian_family/files/opt/kubernetes/helpers/docker-healthcheck @@ -17,7 +17,7 @@ # This script is intended to be run periodically, to check the health # of docker. If it detects a failure, it will restart docker using systemctl. -if timeout 10 docker ps > /dev/null; then +if timeout 60 docker ps > /dev/null; then echo "docker healthy" exit 0 fi @@ -26,20 +26,26 @@ echo "docker failed" echo "Giving docker 30 seconds grace before restarting" sleep 30 -if timeout 10 docker ps > /dev/null; then +if timeout 60 docker ps > /dev/null; then echo "docker recovered" exit 0 fi -echo "docker still down; triggering docker restart" -systemctl restart docker +echo "docker still unresposive; triggering docker restart" +systemctl stop docker -echo "Waiting 60 seconds to give docker time to start" +echo "wait all tcp sockets to close" +sleep `cat /proc/sys/net/ipv4/tcp_fin_timeout` + +sleep 10 +systemctl start docker + +echo "Waiting 120 seconds to give docker time to start" sleep 60 -if timeout 10 docker ps > /dev/null; then +if timeout 60 docker ps > /dev/null; then echo "docker recovered" exit 0 fi -echo "docker still failing" \ No newline at end of file +echo "docker still failing" From 1f6034995d6349c5aebd6114d98bfce12da2570e Mon Sep 17 00:00:00 2001 From: Eric Hole Date: Mon, 24 Sep 2018 05:34:04 -0700 Subject: [PATCH 003/163] Should have fixed test problems by fixing patch version of go 1.10 :/ --- ROADMAP.md | 118 ++++++++++++++++------------------------------------- 1 file changed, 35 insertions(+), 83 deletions(-) diff --git a/ROADMAP.md b/ROADMAP.md index 2cb6703e6df02..6189917c483eb 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -1,99 +1,51 @@ # ROADMAP -The kops 1.N.x version officially supports kubernetes 1.N.x and earlier. While kubernetes 1.99 will likely run with kops 1.98, -the configuration will probably not be correct (for example docker versions, CNI versions etc). +## VERSION SUPPORT +kops 1.N.x _officially_ supports Kubernetes 1.N.x and prior versions. We understand that those in the community run a wide selection of versions and we do our best to maintain backward compatibility as far as we can. -kops 1.N.0 is released when it is believed that kubernetes 1.N.x is stable, along with all the core addons (e.g. networking). -This can mean that kops can release months after the release of kubernetes. It's also not a deterministic release criteria, -particularly with some networking plugins that are supported by kops but themselves still under development. We discussed -this challenge in kops office hours in March 2018, and the consensus was that we want to keep this, but that we should release -alphas & betas much earlier so that users can try out new kubernetes versions on release day. +However, kops 1.N.x does NOT support Kubernetes 1.N+1.x. Sometimes you get lucky and kops 1.N will technically install a later version of Kubernetes, but we cannot guarantee or support this situation. As always, we recommend waiting for the official release of kops with minor version >= the version of Kubernetes you wish to install. Please see the [compatibility matrix](README.md#Compatibility_Matrix) for further questions. -For the next few releases this means that: +## RELEASE SCHEDULE +There is a natural lag between the release of Kubernetes and the corresponding version of kops that has full support for it. While the first patch versions of a minor Kubernetes release are burning in, the kops team races to incorporate all the updates needed to release. Once we have both some stability in the upstream version of Kubernetes AND full support in kops, we will cut a release that includes version specific configuration and a selection of add-ons to match. -* 1.9.0 release target April 7th -* 1.10 alpha.1 with release of kops 1.9.0 (April 7th) -* 1.10 release target April 28th -* 1.11 alpha.1 at release of kops 1.10 -* 1.11 beta.1 at release of k8s 1.11 -* 1.12 alpha.1 at release of kops 1.11 etc +In practice, sometimes this means that kops release lags the upstream release by 1 or more months. We sincerely try to avoid this scenario- we understand how important this project is and respect the need that teams have to maintain their clusters. +Our goal is to have an official kops release no later than a month after the corresponding Kubernetes version is released. Please help us achieve this timeline and meet our goals by jumping in and giving us a hand. We always need assistance closing issues, reviewing PRs, and contributing code! Stop by office hours if you're interested. -### _kops 1.10_ +A rough outline of the timeline/release cycle with respect to the Kubernetes release follows. We are revising the automation around the release process so that we can get alpha and beta releases out to the community and other developers much faster for testing and to get more eyes on open issues. -* Support for kubernetes 1.10 -* Full support for GCE -* Make the etcd-backup tool enabled-by-default, so everyone should have backups. -* Allow users to opt-in to the full etcd-manager. -* Make etcd3 the default for new clusters, now that we have an upgrade path. -* Beginning of separation of addon functionality -* Support for more clouds (Aliyun, DigitalOcean, OpenStack) +Example release timeline based on Kubernetes quarterly release cycle: +July 1: Kubernetes 1.W.0 is released. +July 7: kops 1.W.beta1 +July 21: kops 1.W.0 released +August 15: kops 1.W+1alpha1 +August 31: kops 1.W+1alpha2 +etc... +September 25: Kubernetes1.W+1.RC-X +Oct 1: Kubernetes 1.W+1.0 +Oct 7: kops 1.W+1beta1 +Oct 21: kops 1.W+1.0 -### _kops 1.11_ -* Make the etcd-manager the default, deprecate the protokube-integrated approach -* kops-server -* Machines API support (including bare-metal) +## UPCOMING RELEASES -# HISTORICAL +### kops 1.11 -# 1.9 +* Full support for Kubernetes 1.11 +* Alpha support for bundles (etcd-manager is the test case) +* etcd3 will be the default for newly created clusters. + - Existing clusters will continue to run etcd2 but will be prompted to upgrade to 3. The upgrade will become mandatory in 1.12. +* Default to Debian stretch images which increase support for newer instance types +* Improvements to the release process that will make it easier for community members to cut releases. -## Must-have features +### kops 1.12 +* Full support for Kubernetes 1.12 +* Improvements to etcd3 support -* Support for k8s 1.9 _done_ -* etcd backup support _done_ - -## Other features - -* Use NodeAuthorizer / bootstrap kubeconfigs [#3551](https://github.com/kubernetes/kops/issues/3551) _no progress; may be less important with machines API_ - -# 1.8 - -## Must-have features - -* Support for k8s 1.8 - -## Other features - -* Improved GCE support -* Support for API aggregation - -# 1.7 - -## Must-have features - -* Support for k8s 1.7 - -## Other features we are working on in the 1.7 timeframe - -* etcd controller to allow moving between versions -* kops server for better team scenarios -* support for bare-metal -* more gossip backends -* IAM integration -* more cloud providers -* promote GCE to stable -* RBAC policies for all components -* bringing rolling-update out of alpha - -## 1.6 - -### Must-have features - -* Support for k8s 1.6 _done_ -* RBAC enabled by default _yes, but we kept RBAC optional_ - -## Other features we are working on in the 1.6 timeframe - -* Support for GCE _alpha_ -* Support for Google's [Container Optimized OS](https://cloud.google.com/container-optimized-os) (formerly known as GCI) _alpha_ -* Some support for bare-metal _private branches, not merged_ -* Some support for more cloud providers _initial work on vsphere_ -* Some IAM integration _discussions, but no code_ -* Federation made easy _no progress_ -* Authentication made easy _no progress_ -* Integration with kubeadm _kops now uses kubeadm for some RBAC related functionality_ -* CloudFormation integration on AWS _beta_ +## UPCOMING FEATURES +NB: These are features that are in process and may be introduced behind flags or in alpha capacity but are not explicitly targeting specific releases. +* Documentation revamp that is closer to k8s.io: Stories and walkthroughs of common scenarios, restructure and update information +* Additional cloud provider support: spotinst, aliyun, azure...? +* Revisit recommended base cluster configurations to get them modernized. Update recommendations and defaults for instances, disks, etc, From b0551a23a55aeb435d158343b430b3259b279896 Mon Sep 17 00:00:00 2001 From: vivekgarg20 Date: Wed, 3 Oct 2018 23:31:16 +0530 Subject: [PATCH 004/163] Fixed missing closing bracket from MIN_NODES --- addons/cluster-autoscaler/v1.10.0.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/cluster-autoscaler/v1.10.0.yaml b/addons/cluster-autoscaler/v1.10.0.yaml index c0317a5200dda..1aba3610583ff 100644 --- a/addons/cluster-autoscaler/v1.10.0.yaml +++ b/addons/cluster-autoscaler/v1.10.0.yaml @@ -155,7 +155,7 @@ spec: - --stderrthreshold=info - --cloud-provider={{CLOUD_PROVIDER}} - --skip-nodes-with-local-storage=false - - --nodes={{MIN_NODES}:{{MAX_NODES}}:{{GROUP_NAME}} + - --nodes={{MIN_NODES}}:{{MAX_NODES}}:{{GROUP_NAME}} env: - name: AWS_REGION value: {{AWS_REGION}} From 20d774d66328ee8a1a56531e0cc3ba7a69d5d20c Mon Sep 17 00:00:00 2001 From: Cryptophobia Date: Wed, 3 Oct 2018 22:36:56 -0400 Subject: [PATCH 005/163] Updating image and docs for metrics-server add-on --- addons/metrics-server/README.md | 59 +++++++++++++++++++++++++++++++ addons/metrics-server/v1.8.x.yaml | 38 ++++++++++++-------- 2 files changed, 83 insertions(+), 14 deletions(-) diff --git a/addons/metrics-server/README.md b/addons/metrics-server/README.md index f7d3c841be5e4..ec5fceaa3799e 100644 --- a/addons/metrics-server/README.md +++ b/addons/metrics-server/README.md @@ -1,9 +1,27 @@ # Kubernetes Metrics Server +## User guide + +You can find the user guide in +[the official Kubernetes documentation](https://kubernetes.io/docs/tasks/debug-application-cluster/core-metrics-pipeline/). + +## Design + +The detailed design of the project can be found in the following docs: + +- [Metrics API](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/instrumentation/resource-metrics-api.md) +- [Metrics Server](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/instrumentation/metrics-server.md) + +For the broader view of monitoring in Kubernetes take a look into +[Monitoring architecture](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/instrumentation/monitoring_architecture.md) + +## Deployment + Compatibility matrix: Metrics Server | Metrics API group/version | Supported Kubernetes version ---------------|---------------------------|----------------------------- +0.3.x | `metrics.k8s.io/v1beta1` | 1.8+ 0.2.x | `metrics.k8s.io/v1beta1` | 1.8+ 0.1.x | `metrics/v1alpha1` | 1.7 @@ -18,3 +36,44 @@ $ kubectl apply -f https://raw.githubusercontent.com/kubernetes/kops/master/addo # Kubernetes 1.8+ $ kubectl apply -f https://raw.githubusercontent.com/kubernetes/kops/master/addons/metrics-server/v1.8.x.yaml ``` + +## Flags + +Metrics Server supports all the standard Kubernetes API server flags, as +well as the standard Kubernetes `glog` logging flags. The most +commonly-used ones are: + +- `--logtostderr`: log to standard error instead of files in the + container. You generally want this on. + +- `--v=`: set log verbosity. It's generally a good idea to run a log + level 1 or 2 unless you're encountering errors. At log level 10, large + amounts of diagnostic information will be reported, include API request + and response bodies, and raw metric results from Kubelet. + +- `--secure-port=`: set the secure port. If you're not running as + root, you'll want to set this to something other than the default (port + 443). + +- `--tls-cert-file`, `--tls-private-key-file`: the serving certificate and + key files. If not specified, self-signed certificates will be + generated, but it's recommended that you use non-self-signed + certificates in production. + +Additionally, Metrics Server defines a number of flags for configuring its +behavior: + +- `--metric-resolution=`: the interval at which metrics will be + scraped from Kubelets (defaults to 60s). + +- `--kubelet-insecure-tls`: skip verifying Kubelet CA certificates. Not + recommended for production usage, but can be useful in test clusters + with self-signed Kubelet serving certificates. + +- `--kubelet-port`: the port to use to connect to the Kubelet (defaults to + the default secure Kubelet port, 10250). + +- `--kubelet-preferred-address-types`: the order in which to consider + different Kubelet node address types when connecting to Kubelet. + Functions similarly to the flag of the same name on the API server. +s \ No newline at end of file diff --git a/addons/metrics-server/v1.8.x.yaml b/addons/metrics-server/v1.8.x.yaml index aef36387e7e5b..412de71c4915c 100644 --- a/addons/metrics-server/v1.8.x.yaml +++ b/addons/metrics-server/v1.8.x.yaml @@ -57,6 +57,19 @@ rules: - list - watch --- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: system:aggregated-metrics-reader + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: ["metrics.k8s.io"] + resources: ["pods"] + verbs: ["get", "list", "watch"] +--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: @@ -99,7 +112,7 @@ spec: protocol: TCP targetPort: 443 --- -apiVersion: apps/v1beta2 +apiVersion: extensions/v1beta1 kind: Deployment metadata: name: metrics-server @@ -117,17 +130,14 @@ spec: k8s-app: metrics-server spec: serviceAccountName: metrics-server + volumes: + # mount in tmp so we can safely use from-scratch images and/or read-only containers + - name: tmp-dir + emptyDir: {} containers: - - name: metrics-server - image: gcr.io/google_containers/metrics-server-amd64:v0.2.1 - imagePullPolicy: Always - command: - - /metrics-server - - --source=kubernetes.summary_api:'' - resources: - requests: - cpu: 20m - memory: 200Mi - limits: - cpu: 100m - memory: 500Mi + - name: metrics-server + image: gcr.io/google_containers/metrics-server-amd64:v0.3.1 + imagePullPolicy: Always + volumeMounts: + - name: tmp-dir + mountPath: /tmp From 737a7a2cb81b70b558095ba1261a0898cc2bd168 Mon Sep 17 00:00:00 2001 From: Sean Johnson Date: Thu, 4 Oct 2018 14:25:34 +1000 Subject: [PATCH 006/163] 5700: Add command line flag for disabling Subnet ELB tags --- cmd/kops/create_cluster.go | 4 +++ docs/cli/kops_create_cluster.md | 1 + docs/run_in_existing_vpc.md | 19 +++++++------- pkg/apis/kops/cluster.go | 2 ++ pkg/apis/kops/v1alpha1/cluster.go | 2 ++ .../kops/v1alpha1/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha2/cluster.go | 2 ++ .../kops/v1alpha2/zz_generated.conversion.go | 2 ++ pkg/model/network.go | 26 ++++++++++++------- 9 files changed, 40 insertions(+), 20 deletions(-) diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index dacbf20b390ba..7af9da5ba130f 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -80,6 +80,7 @@ type CreateClusterOptions struct { VPCID string SubnetIDs []string UtilitySubnetIDs []string + DisableSubnetTags bool NetworkCIDR string DNSZone string AdminAccess []string @@ -290,6 +291,7 @@ func NewCmdCreateCluster(f *util.Factory, out io.Writer) *cobra.Command { cmd.Flags().StringSliceVar(&options.SubnetIDs, "subnets", options.SubnetIDs, "Set to use shared subnets") cmd.Flags().StringSliceVar(&options.UtilitySubnetIDs, "utility-subnets", options.UtilitySubnetIDs, "Set to use shared utility subnets") cmd.Flags().StringVar(&options.NetworkCIDR, "network-cidr", options.NetworkCIDR, "Set to override the default network CIDR") + cmd.Flags().BoolVar(&options.DisableSubnetTags, "disable-subnet-tags", options.DisableSubnetTags, "Set to disable automatic subnet tagging") cmd.Flags().Int32Var(&options.MasterCount, "master-count", options.MasterCount, "Set the number of masters. Defaults to one master per master-zone") cmd.Flags().Int32Var(&options.NodeCount, "node-count", options.NodeCount, "Set the number of nodes") @@ -923,6 +925,8 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e c.Topology = api.TopologyPublic } + cluster.Spec.DisableSubnetTags = c.DisableSubnetTags + switch c.Topology { case api.TopologyPublic: cluster.Spec.Topology = &api.TopologySpec{ diff --git a/docs/cli/kops_create_cluster.md b/docs/cli/kops_create_cluster.md index d93793a5776a3..48d067bd2c36d 100644 --- a/docs/cli/kops_create_cluster.md +++ b/docs/cli/kops_create_cluster.md @@ -73,6 +73,7 @@ kops create cluster [flags] --channel string Channel for default versions and configuration to use (default "stable") --cloud string Cloud provider to use - gce, aws, vsphere --cloud-labels string A list of KV pairs used to tag all instance groups in AWS (eg "Owner=John Doe,Team=Some Team"). + --disable-subnet-tags Set to disable automatic subnet tagging --dns string DNS hosted zone to use: public|private. (default "Public") --dns-zone string DNS hosted zone to use (defaults to longest matching zone) --dry-run If true, only print the object that would be sent, without sending it. This flag can be used to create a cluster YAML or JSON manifest. diff --git a/docs/run_in_existing_vpc.md b/docs/run_in_existing_vpc.md index 4b2dcac3921c7..a4daacdc4ca76 100644 --- a/docs/run_in_existing_vpc.md +++ b/docs/run_in_existing_vpc.md @@ -142,17 +142,11 @@ spec: kops update cluster ${CLUSTER_NAME} --yes ``` - **If you run in AWS private topology with shared subnets, and you would like Kubernetes to provision resources in these shared subnets, you must create tags on them.** - - **This is important, for example, if your `utility` subnets are shared, you will not be able to launch any services that create Elastic Load Balancers (ELBs).** - - **Prior to kops 1.8 `KubernetesCluster` tag was used for this. This lead to several problems if there were more than one Kubernetes Cluster in a subnet.** - - **After you upgraded to kops 1.8 remove `KubernetesCluster` Tag from subnets otherwise `kubernetes.io/cluster/` won't have any effect!** +### Subnet Tags - **These are currently needed Tags on shared resources:** + By default, kops will tag your existing subnets with the standard tags: - Public Subnets: + Public/Utility Subnets: ``` "kubernetes.io/cluster/" = "shared" "kubernetes.io/role/elb" = "1" @@ -165,7 +159,12 @@ spec: "kubernetes.io/role/internal-elb" = "1" "SubnetType" = "Private" ``` - + + These tags are important, for example, your services will be unable to create public or private Elastic Load Balancers (ELBs) if the respective `elb` or `internal-elb` tags are missing. + + If you would like to manage these tags externally then specify `--disable-subnet-tags` during your cluster creation. This will prevent kops from tagging existing subnets and allow some custom control, such as separate subnets for internal ELBs. + + Prior to kops 1.8 `KubernetesCluster` tag was used instead of `kubernetes.io/cluster/`. This lead to several problems if there were more than one Kubernetes Cluster in a subnet. After you upgraded to kops 1.8 ensure the `KubernetesCluster` Tag is removed from subnets otherwise `kubernetes.io/cluster/` won't have any effect! ### Shared NAT Egress diff --git a/pkg/apis/kops/cluster.go b/pkg/apis/kops/cluster.go index 53e6334172bd3..1ebef7e7c3d77 100644 --- a/pkg/apis/kops/cluster.go +++ b/pkg/apis/kops/cluster.go @@ -164,6 +164,8 @@ type ClusterSpec struct { IAM *IAMSpec `json:"iam,omitempty"` // EncryptionConfig controls if encryption is enabled EncryptionConfig *bool `json:"encryptionConfig,omitempty"` + // DisableSubnetTags controls if subnets are tagged in AWS + DisableSubnetTags bool `json:"disableSubnetTags,omitempty"` // Target allows for us to nest extra config for targets such as terraform Target *TargetSpec `json:"target,omitempty"` } diff --git a/pkg/apis/kops/v1alpha1/cluster.go b/pkg/apis/kops/v1alpha1/cluster.go index a8914c0d81d0e..adabaa6eac9d7 100644 --- a/pkg/apis/kops/v1alpha1/cluster.go +++ b/pkg/apis/kops/v1alpha1/cluster.go @@ -163,6 +163,8 @@ type ClusterSpec struct { IAM *IAMSpec `json:"iam,omitempty"` // EncryptionConfig holds the encryption config EncryptionConfig *bool `json:"encryptionConfig,omitempty"` + // DisableSubnetTags controls if subnets are tagged in AWS + DisableSubnetTags bool `json:"DisableSubnetTags,omitempty"` // Target allows for us to nest extra config for targets such as terraform Target *TargetSpec `json:"target,omitempty"` } diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 342c17a3cd2a6..7204fb4b7c9b7 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -1062,6 +1062,7 @@ func autoConvert_v1alpha1_ClusterSpec_To_kops_ClusterSpec(in *ClusterSpec, out * out.IAM = nil } out.EncryptionConfig = in.EncryptionConfig + out.DisableSubnetTags = in.DisableSubnetTags if in.Target != nil { in, out := &in.Target, &out.Target *out = new(kops.TargetSpec) @@ -1328,6 +1329,7 @@ func autoConvert_kops_ClusterSpec_To_v1alpha1_ClusterSpec(in *kops.ClusterSpec, out.IAM = nil } out.EncryptionConfig = in.EncryptionConfig + out.DisableSubnetTags = in.DisableSubnetTags if in.Target != nil { in, out := &in.Target, &out.Target *out = new(TargetSpec) diff --git a/pkg/apis/kops/v1alpha2/cluster.go b/pkg/apis/kops/v1alpha2/cluster.go index 3bf6d9d537e49..e185e8bc2fbfd 100644 --- a/pkg/apis/kops/v1alpha2/cluster.go +++ b/pkg/apis/kops/v1alpha2/cluster.go @@ -164,6 +164,8 @@ type ClusterSpec struct { IAM *IAMSpec `json:"iam,omitempty"` // EncryptionConfig holds the encryption config EncryptionConfig *bool `json:"encryptionConfig,omitempty"` + // DisableSubnetTags controls if subnets are tagged in AWS + DisableSubnetTags bool `json:"DisableSubnetTags,omitempty"` // Target allows for us to nest extra config for targets such as terraform Target *TargetSpec `json:"target,omitempty"` } diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 7bcd1d1504a35..5bf488587bbe2 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -1109,6 +1109,7 @@ func autoConvert_v1alpha2_ClusterSpec_To_kops_ClusterSpec(in *ClusterSpec, out * out.IAM = nil } out.EncryptionConfig = in.EncryptionConfig + out.DisableSubnetTags = in.DisableSubnetTags if in.Target != nil { in, out := &in.Target, &out.Target *out = new(kops.TargetSpec) @@ -1390,6 +1391,7 @@ func autoConvert_kops_ClusterSpec_To_v1alpha2_ClusterSpec(in *kops.ClusterSpec, out.IAM = nil } out.EncryptionConfig = in.EncryptionConfig + out.DisableSubnetTags = in.DisableSubnetTags if in.Target != nil { in, out := &in.Target, &out.Target *out = new(TargetSpec) diff --git a/pkg/model/network.go b/pkg/model/network.go index 4acdfe6a104f1..b605fa63a7762 100644 --- a/pkg/model/network.go +++ b/pkg/model/network.go @@ -184,21 +184,27 @@ func (b *NetworkModelBuilder) Build(c *fi.ModelBuilderContext) error { subnetSpec := &b.Cluster.Spec.Subnets[i] sharedSubnet := subnetSpec.ProviderID != "" subnetName := subnetSpec.Name + "." + b.ClusterName() - tags := b.CloudTags(subnetName, sharedSubnet) + tags := map[string]string{} // Apply tags so that Kubernetes knows which subnets should be used for internal/external ELBs - switch subnetSpec.Type { - case kops.SubnetTypePublic, kops.SubnetTypeUtility: - tags[aws.TagNameSubnetPublicELB] = "1" + if b.Cluster.Spec.DisableSubnetTags { + glog.V(2).Infof("skipping subnet tags. Ensure these are maintained externally.") + } else { + glog.V(2).Infof("applying subnet tags") + tags = b.CloudTags(subnetName, sharedSubnet) + tags["SubnetType"] = string(subnetSpec.Type) - case kops.SubnetTypePrivate: - tags[aws.TagNameSubnetInternalELB] = "1" + switch subnetSpec.Type { + case kops.SubnetTypePublic, kops.SubnetTypeUtility: + tags[aws.TagNameSubnetPublicELB] = "1" - default: - glog.V(2).Infof("unable to properly tag subnet %q because it has unknown type %q. Load balancers may be created in incorrect subnets", subnetSpec.Name, subnetSpec.Type) - } + case kops.SubnetTypePrivate: + tags[aws.TagNameSubnetInternalELB] = "1" - tags["SubnetType"] = string(subnetSpec.Type) + default: + glog.V(2).Infof("unable to properly tag subnet %q because it has unknown type %q. Load balancers may be created in incorrect subnets", subnetSpec.Name, subnetSpec.Type) + } + } subnet := &awstasks.Subnet{ Name: s(subnetName), From f234b3a0c0ea6493bde52682214bbd5c5e218a19 Mon Sep 17 00:00:00 2001 From: Bill Hegazy Date: Thu, 11 Oct 2018 10:19:32 +0700 Subject: [PATCH 007/163] coredns should not be running on master by default --- .../addons/coredns.addons.k8s.io/k8s-1.6.yaml.template | 2 -- 1 file changed, 2 deletions(-) diff --git a/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template b/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template index c3a7fea17efeb..dd6f4634c87f5 100644 --- a/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template +++ b/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template @@ -95,8 +95,6 @@ spec: spec: serviceAccountName: coredns tolerations: - - key: node-role.kubernetes.io/master - effect: NoSchedule - key: "CriticalAddonsOnly" operator: "Exists" containers: From 9f1836b49468cf04d90eb170fee07aec0142ae9a Mon Sep 17 00:00:00 2001 From: Bryan Rosander Date: Fri, 12 Oct 2018 09:30:01 -0400 Subject: [PATCH 008/163] Adding describe launch config to autoscaler permissions --- addons/cluster-autoscaler/cluster-autoscaler.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/addons/cluster-autoscaler/cluster-autoscaler.sh b/addons/cluster-autoscaler/cluster-autoscaler.sh index 9b021bb6df66d..ba983762021fa 100755 --- a/addons/cluster-autoscaler/cluster-autoscaler.sh +++ b/addons/cluster-autoscaler/cluster-autoscaler.sh @@ -61,6 +61,7 @@ cat > asg-policy.json << EOF "Action": [ "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", + "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeTags", "autoscaling:SetDesiredCapacity", "autoscaling:TerminateInstanceInAutoScalingGroup" From fbad6a98dfddaeebbf4f045e8494a681001e05a2 Mon Sep 17 00:00:00 2001 From: Shri Javadekar Date: Mon, 15 Oct 2018 11:39:02 -0700 Subject: [PATCH 009/163] Mount etc-hosts in calico-kube-controller Testing done: 1. Verfied that when a new cluster is created, the `calico-kube-controllers` deployment bind mounts /etc/hosts from the host. Refs #5934 --- .../networking.projectcalico.org/k8s-1.7.yaml.template | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7.yaml.template b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7.yaml.template index 9af6738bf0b43..61cfc73e623a9 100644 --- a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7.yaml.template @@ -360,7 +360,13 @@ spec: value: /certs/calico-client-key.pem - name: ETCD_CA_CERT_FILE value: /certs/ca.pem + {{- end }} volumeMounts: + # Necessary for gossip based DNS + - mountPath: /etc/hosts + name: etc-hosts + readOnly: true + {{- if eq $etcd_scheme "https" }} - mountPath: /certs name: calico readOnly: true From a737a1be095472249b7598cff3fb31c548562e93 Mon Sep 17 00:00:00 2001 From: Adam Malcontenti-Wilson Date: Tue, 9 Oct 2018 16:38:48 -0700 Subject: [PATCH 010/163] Update amazon-vpc-routed-eni to v1.2.1 --- .../k8s-1.10.yaml.template | 33 ++++++++++++++++-- .../k8s-1.7.yaml.template | 34 +++++++++++++++++-- .../k8s-1.8.yaml.template | 34 +++++++++++++++++-- 3 files changed, 95 insertions(+), 6 deletions(-) diff --git a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template index b20e32377c327..cfb651dbe2dcd 100644 --- a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template @@ -1,13 +1,21 @@ -# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/release-1.0/config/v1.0/aws-k8s-cni.yaml +# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.2.0/config/v1.2/aws-k8s-cni.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: aws-node rules: +- apiGroups: + - crd.k8s.amazonaws.com + resources: + - "*" + - namespaces + verbs: + - "*" - apiGroups: [""] resources: - pods + - nodes - namespaces verbs: ["list", "watch", "get"] - apiGroups: ["extensions"] @@ -67,7 +75,10 @@ spec: - key: CriticalAddonsOnly operator: Exists containers: - - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.0.0" }}" + - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.2.1" }}" + ports: + - containerPort: 60000 + name: metrics name: aws-node env: - name: AWS_VPC_K8S_CNI_LOGLEVEL @@ -76,6 +87,10 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName + - name: WATCH_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace resources: requests: cpu: 10m @@ -104,3 +119,17 @@ spec: hostPath: path: /var/run/docker.sock +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: eniconfigs.crd.k8s.amazonaws.com +spec: + scope: Cluster + group: crd.k8s.amazonaws.com + version: v1alpha1 + names: + scope: Cluster + plural: eniconfigs + singuar: eniconfig + kind: ENIConfig diff --git a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template index 6bd26b71561de..422832539a65c 100644 --- a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template @@ -1,13 +1,21 @@ -# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/release-1.0/config/v1.0/aws-k8s-cni.yaml +# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.2.0/config/v1.2/aws-k8s-cni.yaml apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRole metadata: name: aws-node rules: +- apiGroups: + - crd.k8s.amazonaws.com + resources: + - "*" + - namespaces + verbs: + - "*" - apiGroups: [""] resources: - pods + - nodes - namespaces verbs: ["list", "watch", "get"] - apiGroups: ["extensions"] @@ -69,7 +77,10 @@ spec: - key: CriticalAddonsOnly operator: Exists containers: - - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.0.0" }}" + - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.2.1" }}" + ports: + - containerPort: 60000 + name: metrics name: aws-node env: - name: AWS_VPC_K8S_CNI_LOGLEVEL @@ -78,6 +89,10 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName + - name: WATCH_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace resources: requests: cpu: 10m @@ -106,6 +121,21 @@ spec: hostPath: path: /var/run/docker.sock +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: eniconfigs.crd.k8s.amazonaws.com +spec: + scope: Cluster + group: crd.k8s.amazonaws.com + version: v1alpha1 + names: + scope: Cluster + plural: eniconfigs + singuar: eniconfig + kind: ENIConfig + --- kind: ClusterRole diff --git a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template index e6ca53e7c5a40..bfecc229fbc29 100644 --- a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template @@ -1,13 +1,21 @@ -# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/release-1.0/config/v1.0/aws-k8s-cni.yaml +# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.2.0/config/v1.2/aws-k8s-cni.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: aws-node rules: +- apiGroups: + - crd.k8s.amazonaws.com + resources: + - "*" + - namespaces + verbs: + - "*" - apiGroups: [""] resources: - pods + - nodes - namespaces verbs: ["list", "watch", "get"] - apiGroups: ["extensions"] @@ -67,7 +75,10 @@ spec: - key: CriticalAddonsOnly operator: Exists containers: - - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.0.0" }}" + - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.2.1" }}" + ports: + - containerPort: 60000 + name: metrics name: aws-node env: - name: AWS_VPC_K8S_CNI_LOGLEVEL @@ -76,6 +87,10 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName + - name: WATCH_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace resources: requests: cpu: 10m @@ -104,6 +119,21 @@ spec: hostPath: path: /var/run/docker.sock +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: eniconfigs.crd.k8s.amazonaws.com +spec: + scope: Cluster + group: crd.k8s.amazonaws.com + version: v1alpha1 + names: + scope: Cluster + plural: eniconfigs + singuar: eniconfig + kind: ENIConfig + --- kind: ClusterRole From 4b27e6c8ee3495f4bd7118459f1d6fb9c0dece6c Mon Sep 17 00:00:00 2001 From: "fernando.carletti" Date: Wed, 8 Aug 2018 19:59:46 -0400 Subject: [PATCH 011/163] Add flag to disable Basic Auth. --- docs/cluster_spec.md | 10 ++++++++++ nodeup/pkg/model/kube_apiserver.go | 5 ++++- pkg/apis/kops/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha1/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha1/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha2/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha2/zz_generated.conversion.go | 2 ++ 7 files changed, 24 insertions(+), 1 deletion(-) diff --git a/docs/cluster_spec.md b/docs/cluster_spec.md index 0175b4c1b0712..a6e7b20032bb6 100644 --- a/docs/cluster_spec.md +++ b/docs/cluster_spec.md @@ -264,6 +264,16 @@ spec: serviceNodePortRange: 30000-33000 ``` +#### Disable Basic Auth + +This will disable the passing of the `--basic-auth-file` flag. + +```yaml +spec: + kubeAPIServer: + disableBasicAuth: true +``` + #### targetRamMb Memory limit for apiserver in MB (used to configure sizes of caches, etc.) diff --git a/nodeup/pkg/model/kube_apiserver.go b/nodeup/pkg/model/kube_apiserver.go index 42806ca438d29..422cb8c891c46 100644 --- a/nodeup/pkg/model/kube_apiserver.go +++ b/nodeup/pkg/model/kube_apiserver.go @@ -283,9 +283,12 @@ func (b *KubeAPIServerBuilder) buildPod() (*v1.Pod, error) { kubeAPIServer.ClientCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt") kubeAPIServer.TLSCertFile = filepath.Join(b.PathSrvKubernetes(), "server.cert") kubeAPIServer.TLSPrivateKeyFile = filepath.Join(b.PathSrvKubernetes(), "server.key") - kubeAPIServer.BasicAuthFile = filepath.Join(b.PathSrvKubernetes(), "basic_auth.csv") kubeAPIServer.TokenAuthFile = filepath.Join(b.PathSrvKubernetes(), "known_tokens.csv") + if !kubeAPIServer.DisableBasicAuth { + kubeAPIServer.BasicAuthFile = filepath.Join(b.PathSrvKubernetes(), "basic_auth.csv") + } + if b.UseEtcdTLS() { kubeAPIServer.EtcdCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt") kubeAPIServer.EtcdCertFile = filepath.Join(b.PathSrvKubernetes(), "etcd-client.pem") diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index 94718d3546c96..494b47eb758fa 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -224,6 +224,8 @@ type KubeProxyConfig struct { type KubeAPIServerConfig struct { // Image is the docker container used Image string `json:"image,omitempty"` + // DisableBasicAuth removes the --basic-auth-file flag + DisableBasicAuth bool `json:"disableBasicAuth,omitempty"` // LogLevel is the logging level of the api LogLevel int32 `json:"logLevel,omitempty" flag:"v" flag-empty:"0"` // CloudProvider is the name of the cloudProvider we are using, aws, gce etcd diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index 8669377ff8d52..eb1691bfbd247 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -224,6 +224,8 @@ type KubeProxyConfig struct { type KubeAPIServerConfig struct { // Image is the docker container used Image string `json:"image,omitempty"` + // DisableBasicAuth removes the --basic-auth-file flag + DisableBasicAuth bool `json:"disableBasicAuth,omitempty"` // LogLevel is the logging level of the api LogLevel int32 `json:"logLevel,omitempty" flag:"v" flag-empty:"0"` // CloudProvider is the name of the cloudProvider we are using, aws, gce etcd diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 97f005eadabda..b0cd843d335ed 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -2163,6 +2163,7 @@ func Convert_kops_KopeioNetworkingSpec_To_v1alpha1_KopeioNetworkingSpec(in *kops func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAPIServerConfig, out *kops.KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image + out.DisableBasicAuth = in.DisableBasicAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort @@ -2236,6 +2237,7 @@ func Convert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAP func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *kops.KubeAPIServerConfig, out *KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image + out.DisableBasicAuth = in.DisableBasicAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 3d50d3a39f96e..097f0001abbfc 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -224,6 +224,8 @@ type KubeProxyConfig struct { type KubeAPIServerConfig struct { // Image is the docker container used Image string `json:"image,omitempty"` + // DisableBasicAuth removes the --basic-auth-file flag + DisableBasicAuth bool `json:"disableBasicAuth,omitempty"` // LogLevel is the logging level of the api LogLevel int32 `json:"logLevel,omitempty" flag:"v" flag-empty:"0"` // CloudProvider is the name of the cloudProvider we are using, aws, gce etcd diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 1afc069620d4b..89e62e3dc7b0e 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -2427,6 +2427,7 @@ func Convert_kops_KopeioNetworkingSpec_To_v1alpha2_KopeioNetworkingSpec(in *kops func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAPIServerConfig, out *kops.KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image + out.DisableBasicAuth = in.DisableBasicAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort @@ -2500,6 +2501,7 @@ func Convert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAP func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *kops.KubeAPIServerConfig, out *KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image + out.DisableBasicAuth = in.DisableBasicAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort From b6b6c6661c776a23ece157c2a1198a48aa23755a Mon Sep 17 00:00:00 2001 From: Sandeep Rajan Date: Mon, 22 Oct 2018 10:41:18 -0400 Subject: [PATCH 012/163] bump version to 1.2.4 and update manifest --- .../coredns.addons.k8s.io/k8s-1.6.yaml.template | 11 +++++++++-- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template b/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template index c3a7fea17efeb..3c914ad45eb8c 100644 --- a/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template +++ b/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template @@ -25,6 +25,12 @@ rules: verbs: - list - watch +- apiGroups: + - "" + resources: + - nodes + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding @@ -55,7 +61,6 @@ data: Corefile: | .:53 { errors - log health kubernetes {{ KubeDNS.Domain }}. in-addr.arpa ip6.arpa { pods insecure @@ -99,9 +104,11 @@ spec: effect: NoSchedule - key: "CriticalAddonsOnly" operator: "Exists" + nodeSelector: + beta.kubernetes.io/os: linux containers: - name: coredns - image: k8s.gcr.io/coredns:1.2.2 + image: k8s.gcr.io/coredns:1.2.4 imagePullPolicy: IfNotPresent resources: limits: diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index 1711a5c35e0c2..8152fe24b8c35 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -211,7 +211,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri if kubeDNS.Provider == "CoreDNS" { { key := "coredns.addons.k8s.io" - version := "1.2.2-kops.1" + version := "1.2.4-kops.1" { location := key + "/k8s-1.6.yaml" From dc2b6bef07d2ba6f50070313483b2fe093cc6e25 Mon Sep 17 00:00:00 2001 From: Rodrigo Chacon Date: Mon, 22 Oct 2018 23:58:12 -0300 Subject: [PATCH 013/163] cilium: Fix Prometheus serve addr flag --- .../resources/addons/networking.cilium.io/k8s-1.7.yaml.template | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.7.yaml.template b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.7.yaml.template index 6a10414e7830b..43e4d7c69dcec 100644 --- a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.7.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.7.yaml.template @@ -243,7 +243,7 @@ spec: - "{{ .PrefilterDevice }}" {{ end }} {{ if ne .PrometheusServeAddr "" }} - - "--prefilter-device" + - "--prometheus-serve-addr" - "{{ .PrometheusServeAddr }}" {{ end }} {{ if .Restore}} From 312813e4c54aeb3e1e987ade03c007e80282c335 Mon Sep 17 00:00:00 2001 From: Ian Hoegen Date: Tue, 23 Oct 2018 11:38:45 -0700 Subject: [PATCH 014/163] Add stdin input for secrets --- cmd/kops/create.go | 13 ------------ cmd/kops/create_secret_dockerconfig.go | 18 +++++++++++++---- cmd/kops/create_secret_encryptionconfig.go | 18 +++++++++++++---- .../create_secret_weave_encryptionconfig.go | 18 ++++++++++++++--- cmd/kops/delete.go | 20 +++++++++++++++---- cmd/kops/root.go | 12 +++++++++++ docs/apireference/openapi-spec/swagger.json | 1 + docs/cli/kops_create_secret_dockerconfig.md | 3 +++ .../kops_create_secret_encryptionconfig.md | 3 +++ docs/cli/kops_create_secret_weavepassword.md | 3 +++ docs/cli/kops_delete.md | 3 +++ 11 files changed, 84 insertions(+), 28 deletions(-) diff --git a/cmd/kops/create.go b/cmd/kops/create.go index 901abd931144a..e76afec41c9b4 100644 --- a/cmd/kops/create.go +++ b/cmd/kops/create.go @@ -20,7 +20,6 @@ import ( "bytes" "fmt" "io" - "os" "github.com/golang/glog" "github.com/spf13/cobra" @@ -245,15 +244,3 @@ func RunCreate(f *util.Factory, out io.Writer, c *CreateOptions) error { } return nil } - -// ConsumeStdin reads all the bytes available from stdin -func ConsumeStdin() ([]byte, error) { - file := os.Stdin - buf := new(bytes.Buffer) - _, err := buf.ReadFrom(file) - if err != nil { - return nil, fmt.Errorf("error reading stdin: %v", err) - } - - return buf.Bytes(), nil -} diff --git a/cmd/kops/create_secret_dockerconfig.go b/cmd/kops/create_secret_dockerconfig.go index bb80029b1017d..da51dc0ffc00e 100644 --- a/cmd/kops/create_secret_dockerconfig.go +++ b/cmd/kops/create_secret_dockerconfig.go @@ -40,6 +40,9 @@ var ( # Create a new docker config. kops create secret dockerconfig -f /path/to/docker/config.json \ --name k8s-cluster.example.com --state s3://example.com + # Create a docker config via stdin. + generate-docker-config.sh | kops create secret dockerconfig -f - \ + --name k8s-cluster.example.com --state s3://example.com # Replace an existing docker config secret. kops create secret dockerconfig -f /path/to/docker/config.json --force \ --name k8s-cluster.example.com --state s3://example.com @@ -110,10 +113,17 @@ func RunCreateSecretDockerConfig(f *util.Factory, out io.Writer, options *Create if err != nil { return err } - - data, err := ioutil.ReadFile(options.DockerConfigPath) - if err != nil { - return fmt.Errorf("error reading docker config %v: %v", options.DockerConfigPath, err) + var data []byte + if options.DockerConfigPath == "-" { + data, err = ConsumeStdin() + if err != nil { + return fmt.Errorf("error reading docker config from stdin: %v", err) + } + } else { + data, err = ioutil.ReadFile(options.DockerConfigPath) + if err != nil { + return fmt.Errorf("error reading docker config %v: %v", options.DockerConfigPath, err) + } } var parsedData map[string]interface{} diff --git a/cmd/kops/create_secret_encryptionconfig.go b/cmd/kops/create_secret_encryptionconfig.go index 0c4794e88167e..420889ce74550 100644 --- a/cmd/kops/create_secret_encryptionconfig.go +++ b/cmd/kops/create_secret_encryptionconfig.go @@ -40,6 +40,9 @@ var ( # Create a new encryption config. kops create secret encryptionconfig -f config.yaml \ --name k8s-cluster.example.com --state s3://example.com + # Create a new encryption config via stdin. + generate-encryption-config.sh | kops create secret encryptionconfig -f - \ + --name k8s-cluster.example.com --state s3://example.com # Replace an existing encryption config secret. kops create secret encryptionconfig -f config.yaml --force \ --name k8s-cluster.example.com --state s3://example.com @@ -111,10 +114,17 @@ func RunCreateSecretEncryptionConfig(f *util.Factory, out io.Writer, options *Cr if err != nil { return err } - - data, err := ioutil.ReadFile(options.EncryptionConfigPath) - if err != nil { - return fmt.Errorf("error reading encryption config %v: %v", options.EncryptionConfigPath, err) + var data []byte + if options.EncryptionConfigPath == "-" { + data, err = ConsumeStdin() + if err != nil { + return fmt.Errorf("error reading encryption config from stdin: %v", err) + } + } else { + data, err = ioutil.ReadFile(options.EncryptionConfigPath) + if err != nil { + return fmt.Errorf("error reading encryption config %v: %v", options.EncryptionConfigPath, err) + } } var parsedData map[string]interface{} diff --git a/cmd/kops/create_secret_weave_encryptionconfig.go b/cmd/kops/create_secret_weave_encryptionconfig.go index 2e6a27d8ae0f8..499cd645da93e 100644 --- a/cmd/kops/create_secret_weave_encryptionconfig.go +++ b/cmd/kops/create_secret_weave_encryptionconfig.go @@ -45,6 +45,9 @@ var ( # Install a specific weave password. kops create secret weavepassword -f /path/to/weavepassword \ --name k8s-cluster.example.com --state s3://example.com + # Install a specific weave password via stdin. + kops create secret weavepassword -f - \ + --name k8s-cluster.example.com --state s3://example.com # Replace an existing weavepassword secret. kops create secret weavepassword -f /path/to/weavepassword --force \ --name k8s-cluster.example.com --state s3://example.com @@ -112,9 +115,18 @@ func RunCreateSecretWeaveEncryptionConfig(f *util.Factory, options *CreateSecret } if options.WeavePasswordFilePath != "" { - data, err := ioutil.ReadFile(options.WeavePasswordFilePath) - if err != nil { - return fmt.Errorf("error reading weave password file %v: %v", options.WeavePasswordFilePath, err) + var data []byte + if options.WeavePasswordFilePath == "-" { + data, err = ConsumeStdin() + if err != nil { + return fmt.Errorf("error reading weave password file from stdin: %v", err) + } + } else { + data, err = ioutil.ReadFile(options.WeavePasswordFilePath) + if err != nil { + return fmt.Errorf("error reading weave password file %v: %v", options.WeavePasswordFilePath, err) + } + } secret.Data = data diff --git a/cmd/kops/delete.go b/cmd/kops/delete.go index 264532c068b63..940e02e1385ec 100644 --- a/cmd/kops/delete.go +++ b/cmd/kops/delete.go @@ -51,7 +51,10 @@ var ( deleteExample = templates.Examples(i18n.T(` # Delete a cluster using a manifest file kops delete -f my-cluster.yaml - + + # Delete a cluster using a pasted manifest file from stdin. + pbpaste | kops delete -f - + # Delete a cluster in AWS. kops delete cluster --name=k8s.example.com --state=s3://kops-state-1234 @@ -101,9 +104,18 @@ func RunDelete(factory *util.Factory, out io.Writer, d *DeleteOptions) error { deletedClusters := sets.NewString() for _, f := range d.Filenames { - contents, err := vfs.Context.ReadFile(f) - if err != nil { - return fmt.Errorf("error reading file %q: %v", f, err) + var contents []byte + var err error + if f == "-" { + contents, err = ConsumeStdin() + if err != nil { + return fmt.Errorf("error reading from stdin: %v", err) + } + } else { + contents, err = vfs.Context.ReadFile(f) + if err != nil { + return fmt.Errorf("error reading file %q: %v", f, err) + } } sections := bytes.Split(contents, []byte("\n---\n")) diff --git a/cmd/kops/root.go b/cmd/kops/root.go index b9fc48526c082..399a6acc0a314 100644 --- a/cmd/kops/root.go +++ b/cmd/kops/root.go @@ -17,6 +17,7 @@ limitations under the License. package main import ( + "bytes" goflag "flag" "fmt" "io" @@ -326,3 +327,14 @@ func GetCluster(factory Factory, clusterName string) (*kopsapi.Cluster, error) { } return cluster, nil } + +// ConsumeStdin reads all the bytes available from stdin +func ConsumeStdin() ([]byte, error) { + file := os.Stdin + buf := new(bytes.Buffer) + _, err := buf.ReadFrom(file) + if err != nil { + return nil, fmt.Errorf("error reading stdin: %v", err) + } + return buf.Bytes(), nil +} diff --git a/docs/apireference/openapi-spec/swagger.json b/docs/apireference/openapi-spec/swagger.json index d0bff1397fd22..4cb6a2ee95010 100644 --- a/docs/apireference/openapi-spec/swagger.json +++ b/docs/apireference/openapi-spec/swagger.json @@ -3,6 +3,7 @@ "/apis", "/apis/kops", "/apis/kops/v1alpha2", + "/metrics", "/version" ] } \ No newline at end of file diff --git a/docs/cli/kops_create_secret_dockerconfig.md b/docs/cli/kops_create_secret_dockerconfig.md index 7a3212379c14b..3f0d0d8a3b074 100644 --- a/docs/cli/kops_create_secret_dockerconfig.md +++ b/docs/cli/kops_create_secret_dockerconfig.md @@ -19,6 +19,9 @@ kops create secret dockerconfig [flags] # Create a new docker config. kops create secret dockerconfig -f /path/to/docker/config.json \ --name k8s-cluster.example.com --state s3://example.com + # Create a docker config via stdin. + generate-docker-config.sh | kops create secret dockerconfig -f - \ + --name k8s-cluster.example.com --state s3://example.com # Replace an existing docker config secret. kops create secret dockerconfig -f /path/to/docker/config.json --force \ --name k8s-cluster.example.com --state s3://example.com diff --git a/docs/cli/kops_create_secret_encryptionconfig.md b/docs/cli/kops_create_secret_encryptionconfig.md index 2cdbebf7f584c..d77dce56eb17a 100644 --- a/docs/cli/kops_create_secret_encryptionconfig.md +++ b/docs/cli/kops_create_secret_encryptionconfig.md @@ -19,6 +19,9 @@ kops create secret encryptionconfig [flags] # Create a new encryption config. kops create secret encryptionconfig -f config.yaml \ --name k8s-cluster.example.com --state s3://example.com + # Create a new encryption config via stdin. + generate-encryption-config.sh | kops create secret encryptionconfig -f - \ + --name k8s-cluster.example.com --state s3://example.com # Replace an existing encryption config secret. kops create secret encryptionconfig -f config.yaml --force \ --name k8s-cluster.example.com --state s3://example.com diff --git a/docs/cli/kops_create_secret_weavepassword.md b/docs/cli/kops_create_secret_weavepassword.md index 9a4923e1c8e05..c85df46c5a7a6 100644 --- a/docs/cli/kops_create_secret_weavepassword.md +++ b/docs/cli/kops_create_secret_weavepassword.md @@ -26,6 +26,9 @@ kops create secret weavepassword [flags] # Install a specific weave password. kops create secret weavepassword -f /path/to/weavepassword \ --name k8s-cluster.example.com --state s3://example.com + # Install a specific weave password via stdin. + kops create secret weavepassword -f - \ + --name k8s-cluster.example.com --state s3://example.com # Replace an existing weavepassword secret. kops create secret weavepassword -f /path/to/weavepassword --force \ --name k8s-cluster.example.com --state s3://example.com diff --git a/docs/cli/kops_delete.md b/docs/cli/kops_delete.md index 4a084e525083c..e6ab52868a27a 100644 --- a/docs/cli/kops_delete.md +++ b/docs/cli/kops_delete.md @@ -19,6 +19,9 @@ kops delete -f FILENAME [--yes] [flags] # Delete a cluster using a manifest file kops delete -f my-cluster.yaml + # Delete a cluster using a pasted manifest file from stdin. + pbpaste | kops delete -f - + # Delete a cluster in AWS. kops delete cluster --name=k8s.example.com --state=s3://kops-state-1234 From 15f3011f241ab0273e5d488bbdb43fc097b256de Mon Sep 17 00:00:00 2001 From: Victor Trac Date: Tue, 23 Oct 2018 20:57:11 -0500 Subject: [PATCH 015/163] fixed MIN_NODES missing closing bracket --- addons/cluster-autoscaler/v1.10.0.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/cluster-autoscaler/v1.10.0.yaml b/addons/cluster-autoscaler/v1.10.0.yaml index c0317a5200dda..1aba3610583ff 100644 --- a/addons/cluster-autoscaler/v1.10.0.yaml +++ b/addons/cluster-autoscaler/v1.10.0.yaml @@ -155,7 +155,7 @@ spec: - --stderrthreshold=info - --cloud-provider={{CLOUD_PROVIDER}} - --skip-nodes-with-local-storage=false - - --nodes={{MIN_NODES}:{{MAX_NODES}}:{{GROUP_NAME}} + - --nodes={{MIN_NODES}}:{{MAX_NODES}}:{{GROUP_NAME}} env: - name: AWS_REGION value: {{AWS_REGION}} From 701cf08d27ba60f45f248964728e01c81996c074 Mon Sep 17 00:00:00 2001 From: wangxy518 <40482095+wangxy518@users.noreply.github.com> Date: Wed, 24 Oct 2018 10:00:49 +0800 Subject: [PATCH 016/163] Update v0.19.0.yaml --- addons/prometheus-operator/v0.19.0.yaml | 64 ++++++++++++------------- 1 file changed, 32 insertions(+), 32 deletions(-) diff --git a/addons/prometheus-operator/v0.19.0.yaml b/addons/prometheus-operator/v0.19.0.yaml index 8fec572a48086..b6dfb1290a53a 100644 --- a/addons/prometheus-operator/v0.19.0.yaml +++ b/addons/prometheus-operator/v0.19.0.yaml @@ -1378,7 +1378,7 @@ spec: imagePullSecrets: description: An optional list of references to secrets in the same namespace to use for pulling prometheus and alertmanager images from registries - see http://kubernetes.io/docs/user-guide/images#specifying-imagepullsecrets-on-a-pod + see https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. @@ -1410,7 +1410,7 @@ spec: description: 'Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should - be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations' + be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/' type: object clusterName: description: The name of the cluster which the object belongs to. @@ -1550,7 +1550,7 @@ spec: uid: description: 'UID of the resource. (when there is a single resource which can be described). More info: - http://kubernetes.io/docs/user-guide/identifiers#uids' + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' type: string kind: description: 'Kind is a string value representing the REST @@ -1608,20 +1608,20 @@ spec: description: 'Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: - http://kubernetes.io/docs/user-guide/labels' + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/' type: object name: description: 'Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration - definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names' + definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string namespace: description: |- Namespace defines the space within each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. - Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces + Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string ownerReferences: description: List of objects depended by this object. If ALL objects @@ -1652,10 +1652,10 @@ spec: description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds' type: string name: - description: 'Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names' + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string uid: - description: 'UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids' + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' type: string required: - apiVersion @@ -1877,7 +1877,7 @@ spec: stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. - More info: http://kubernetes.io/docs/user-guide/annotations' + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/' type: object clusterName: description: The name of the cluster which the object belongs @@ -2087,7 +2087,7 @@ spec: description: 'Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. - More info: http://kubernetes.io/docs/user-guide/labels' + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/' type: object name: description: 'Name must be unique within a namespace. Is @@ -2095,13 +2095,13 @@ spec: may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. - More info: http://kubernetes.io/docs/user-guide/identifiers#names' + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string namespace: description: |- Namespace defines the space within each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. - Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces + Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string ownerReferences: description: List of objects depended by this object. If @@ -2135,10 +2135,10 @@ spec: description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds' type: string name: - description: 'Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names' + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string uid: - description: 'UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids' + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' type: string required: - apiVersion @@ -2160,7 +2160,7 @@ spec: description: |- UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. - Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids + Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids type: string spec: description: PersistentVolumeClaimSpec describes the common @@ -3724,7 +3724,7 @@ spec: imagePullSecrets: description: An optional list of references to secrets in the same namespace to use for pulling prometheus and alertmanager images from registries - see http://kubernetes.io/docs/user-guide/images#specifying-imagepullsecrets-on-a-pod + see https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod items: description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. @@ -3755,7 +3755,7 @@ spec: description: 'Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should - be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations' + be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/' type: object clusterName: description: The name of the cluster which the object belongs to. @@ -3895,7 +3895,7 @@ spec: uid: description: 'UID of the resource. (when there is a single resource which can be described). More info: - http://kubernetes.io/docs/user-guide/identifiers#uids' + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' type: string kind: description: 'Kind is a string value representing the REST @@ -3953,20 +3953,20 @@ spec: description: 'Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: - http://kubernetes.io/docs/user-guide/labels' + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/' type: object name: description: 'Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration - definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names' + definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string namespace: description: |- Namespace defines the space within each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. - Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces + Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string ownerReferences: description: List of objects depended by this object. If ALL objects @@ -3997,10 +3997,10 @@ spec: description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds' type: string name: - description: 'Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names' + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string uid: - description: 'UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids' + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' type: string required: - apiVersion @@ -4022,7 +4022,7 @@ spec: description: |- UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. - Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids + Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids type: string remoteRead: description: If specified, the remote_read spec. This is an experimental @@ -4566,7 +4566,7 @@ spec: stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. - More info: http://kubernetes.io/docs/user-guide/annotations' + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/' type: object clusterName: description: The name of the cluster which the object belongs @@ -4713,7 +4713,7 @@ spec: uid: description: 'UID of the resource. (when there is a single resource which can be described). - More info: http://kubernetes.io/docs/user-guide/identifiers#uids' + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' type: string kind: description: 'Kind is a string value representing @@ -4776,7 +4776,7 @@ spec: description: 'Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. - More info: http://kubernetes.io/docs/user-guide/labels' + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/' type: object name: description: 'Name must be unique within a namespace. Is @@ -4784,13 +4784,13 @@ spec: may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. - More info: http://kubernetes.io/docs/user-guide/identifiers#names' + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string namespace: description: |- Namespace defines the space within each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. - Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces + Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string ownerReferences: description: List of objects depended by this object. If @@ -4824,10 +4824,10 @@ spec: description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds' type: string name: - description: 'Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names' + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string uid: - description: 'UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids' + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' type: string required: - apiVersion @@ -4849,7 +4849,7 @@ spec: description: |- UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. - Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids + Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids type: string spec: description: PersistentVolumeClaimSpec describes the common From 04b6817627ceed1b1af506d7a6cfb3f06671ecb9 Mon Sep 17 00:00:00 2001 From: Rongxiang Song Date: Wed, 24 Oct 2018 15:45:13 +0800 Subject: [PATCH 017/163] fix typo in comments --- pkg/apis/kops/cluster.go | 2 +- pkg/apis/kops/instancegroup.go | 2 +- pkg/apis/kops/v1alpha1/cluster.go | 2 +- pkg/apis/kops/v1alpha1/instancegroup.go | 2 +- pkg/apis/kops/v1alpha2/cluster.go | 2 +- pkg/apis/kops/v1alpha2/instancegroup.go | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pkg/apis/kops/cluster.go b/pkg/apis/kops/cluster.go index 53e6334172bd3..b4e8b5e5b32b3 100644 --- a/pkg/apis/kops/cluster.go +++ b/pkg/apis/kops/cluster.go @@ -323,7 +323,7 @@ type LoadBalancerAccessSpec struct { SecurityGroupOverride *string `json:"securityGroupOverride,omitempty"` // AdditionalSecurityGroups attaches additional security groups (e.g. sg-123456). AdditionalSecurityGroups []string `json:"additionalSecurityGroups,omitempty"` - // UseForInternalApi indicates wether the LB should be used by the kubelet + // UseForInternalApi indicates whether the LB should be used by the kubelet UseForInternalApi bool `json:"useForInternalApi,omitempty"` // SSLCertificate allows you to specify the ACM cert to be used the LB SSLCertificate string `json:"sslCertificate,omitempty"` diff --git a/pkg/apis/kops/instancegroup.go b/pkg/apis/kops/instancegroup.go index 52274bf224c03..2e4840cc95ad6 100644 --- a/pkg/apis/kops/instancegroup.go +++ b/pkg/apis/kops/instancegroup.go @@ -123,7 +123,7 @@ type InstanceGroupSpec struct { DetailedInstanceMonitoring *bool `json:"detailedInstanceMonitoring,omitempty"` // IAMProfileSpec defines the identity of the cloud group iam profile (AWS only). IAM *IAMProfileSpec `json:"iam,omitempty"` - // SecurityGroupOverride overrides the defaut security group created by Kops for this IG (AWS only). + // SecurityGroupOverride overrides the default security group created by Kops for this IG (AWS only). SecurityGroupOverride *string `json:"securityGroupOverride,omitempty"` } diff --git a/pkg/apis/kops/v1alpha1/cluster.go b/pkg/apis/kops/v1alpha1/cluster.go index 78df8b0a535a3..213ddf73460b7 100644 --- a/pkg/apis/kops/v1alpha1/cluster.go +++ b/pkg/apis/kops/v1alpha1/cluster.go @@ -322,7 +322,7 @@ type LoadBalancerAccessSpec struct { SecurityGroupOverride *string `json:"securityGroupOverride,omitempty"` // AdditionalSecurityGroups attaches additional security groups (e.g. sg-123456). AdditionalSecurityGroups []string `json:"additionalSecurityGroups,omitempty"` - // UseForInternalApi indicates wether the LB should be used by the kubelet + // UseForInternalApi indicates whether the LB should be used by the kubelet UseForInternalApi bool `json:"useForInternalApi,omitempty"` // SSLCertificate allows you to specify the ACM cert to be used the LB SSLCertificate string `json:"sslCertificate,omitempty"` diff --git a/pkg/apis/kops/v1alpha1/instancegroup.go b/pkg/apis/kops/v1alpha1/instancegroup.go index 3465f076766fa..73edc196156a3 100644 --- a/pkg/apis/kops/v1alpha1/instancegroup.go +++ b/pkg/apis/kops/v1alpha1/instancegroup.go @@ -102,7 +102,7 @@ type InstanceGroupSpec struct { DetailedInstanceMonitoring *bool `json:"detailedInstanceMonitoring,omitempty"` // IAMProfileSpec defines the identity of the cloud group iam profile (AWS only). IAM *IAMProfileSpec `json:"iam,omitempty"` - // SecurityGroupOverride overrides the defaut security group created by Kops for this IG (AWS only). + // SecurityGroupOverride overrides the default security group created by Kops for this IG (AWS only). SecurityGroupOverride *string `json:"securityGroupOverride,omitempty"` } diff --git a/pkg/apis/kops/v1alpha2/cluster.go b/pkg/apis/kops/v1alpha2/cluster.go index 4884d8751d618..16ba5e3177ca6 100644 --- a/pkg/apis/kops/v1alpha2/cluster.go +++ b/pkg/apis/kops/v1alpha2/cluster.go @@ -323,7 +323,7 @@ type LoadBalancerAccessSpec struct { SecurityGroupOverride *string `json:"securityGroupOverride,omitempty"` // AdditionalSecurityGroups attaches additional security groups (e.g. sg-123456). AdditionalSecurityGroups []string `json:"additionalSecurityGroups,omitempty"` - // UseForInternalApi indicates wether the LB should be used by the kubelet + // UseForInternalApi indicates whether the LB should be used by the kubelet UseForInternalApi bool `json:"useForInternalApi,omitempty"` // SSLCertificate allows you to specify the ACM cert to be used the LB SSLCertificate string `json:"sslCertificate,omitempty"` diff --git a/pkg/apis/kops/v1alpha2/instancegroup.go b/pkg/apis/kops/v1alpha2/instancegroup.go index d6c351713671c..773196b3d7a10 100644 --- a/pkg/apis/kops/v1alpha2/instancegroup.go +++ b/pkg/apis/kops/v1alpha2/instancegroup.go @@ -111,7 +111,7 @@ type InstanceGroupSpec struct { DetailedInstanceMonitoring *bool `json:"detailedInstanceMonitoring,omitempty"` // IAMProfileSpec defines the identity of the cloud group iam profile (AWS only). IAM *IAMProfileSpec `json:"iam,omitempty"` - // SecurityGroupOverride overrides the defaut security group created by Kops for this IG (AWS only). + // SecurityGroupOverride overrides the default security group created by Kops for this IG (AWS only). SecurityGroupOverride *string `json:"securityGroupOverride,omitempty"` } From 3847082704961d536752a0b3b32ff930441089eb Mon Sep 17 00:00:00 2001 From: Rongxiang Song Date: Wed, 24 Oct 2018 16:24:56 +0800 Subject: [PATCH 018/163] fix typo in log --- upup/pkg/fi/cloudup/alitasks/disk.go | 2 +- upup/pkg/fi/cloudup/alitasks/launchconfiguration.go | 4 ++-- upup/pkg/fi/cloudup/alitasks/loadbalancer.go | 2 +- upup/pkg/fi/cloudup/alitasks/scalinggroup.go | 4 ++-- upup/pkg/fi/cloudup/alitasks/securitygroup.go | 2 +- upup/pkg/fi/cloudup/awstasks/vpccidrblock.go | 2 +- upup/pkg/fi/secrets/clientset_secretstore.go | 4 ++-- upup/pkg/fi/secrets/vfs_secretstore.go | 4 ++-- 8 files changed, 12 insertions(+), 12 deletions(-) diff --git a/upup/pkg/fi/cloudup/alitasks/disk.go b/upup/pkg/fi/cloudup/alitasks/disk.go index 399d73dfee63e..d4b2b54b0306f 100644 --- a/upup/pkg/fi/cloudup/alitasks/disk.go +++ b/upup/pkg/fi/cloudup/alitasks/disk.go @@ -143,7 +143,7 @@ func (_ *Disk) RenderALI(t *aliup.ALIAPITarget, a, e, changes *Disk) error { } if changes != nil && changes.Tags != nil { - glog.V(2).Infof("Modifing tags of disk with Name:%q", fi.StringValue(e.Name)) + glog.V(2).Infof("Modifying tags of disk with Name:%q", fi.StringValue(e.Name)) if err := t.Cloud.CreateTags(*e.DiskId, DiskResource, e.Tags); err != nil { return fmt.Errorf("error adding Tags to ALI YunPan: %v", err) } diff --git a/upup/pkg/fi/cloudup/alitasks/launchconfiguration.go b/upup/pkg/fi/cloudup/alitasks/launchconfiguration.go index aef675a8c90aa..234068d872b01 100644 --- a/upup/pkg/fi/cloudup/alitasks/launchconfiguration.go +++ b/upup/pkg/fi/cloudup/alitasks/launchconfiguration.go @@ -201,8 +201,8 @@ func (_ *LaunchConfiguration) RenderALI(t *aliup.ALIAPITarget, a, e, changes *La } e.ConfigurationId = fi.String(createScalingConfigurationResponse.ScalingConfigurationId) - // Disable ScalingGroup, used to bind scalingConfig, we should excute EnableScalingGroup in the task LaunchConfiguration - // If the ScalingGroup is active, we can not excute EnableScalingGroup. + // Disable ScalingGroup, used to bind scalingConfig, we should execute EnableScalingGroup in the task LaunchConfiguration + // If the ScalingGroup is active, we can not execute EnableScalingGroup. if e.ScalingGroup.Active != nil && fi.BoolValue(e.ScalingGroup.Active) { glog.V(2).Infof("Disabling LoadBalancer with id:%q", fi.StringValue(e.ScalingGroup.ScalingGroupId)) diff --git a/upup/pkg/fi/cloudup/alitasks/loadbalancer.go b/upup/pkg/fi/cloudup/alitasks/loadbalancer.go index b3ac7fe5e6b37..be397b911e1b5 100644 --- a/upup/pkg/fi/cloudup/alitasks/loadbalancer.go +++ b/upup/pkg/fi/cloudup/alitasks/loadbalancer.go @@ -188,7 +188,7 @@ func (_ *LoadBalancer) RenderALI(t *aliup.ALIAPITarget, a, e, changes *LoadBalan } if a != nil && (len(a.Tags) > 0) { - glog.V(2).Infof("Modifing LoadBalancer with Name:%q, update LoadBalancer tags", fi.StringValue(e.Name)) + glog.V(2).Infof("Modifying LoadBalancer with Name:%q, update LoadBalancer tags", fi.StringValue(e.Name)) tagsToDelete := e.getLoadBalancerTagsToDelete(a.Tags) if len(tagsToDelete) > 0 { diff --git a/upup/pkg/fi/cloudup/alitasks/scalinggroup.go b/upup/pkg/fi/cloudup/alitasks/scalinggroup.go index 828c9f933b49d..4773bfd8b283c 100644 --- a/upup/pkg/fi/cloudup/alitasks/scalinggroup.go +++ b/upup/pkg/fi/cloudup/alitasks/scalinggroup.go @@ -157,7 +157,7 @@ func (_ *ScalingGroup) RenderALI(t *aliup.ALIAPITarget, a, e, changes *ScalingGr } else { //only support to update size if changes.MinSize != nil || changes.MaxSize != nil { - glog.V(2).Infof("Modifing AutoscalingGroup with Name:%q", fi.StringValue(e.Name)) + glog.V(2).Infof("Modifying AutoscalingGroup with Name:%q", fi.StringValue(e.Name)) modifyScalingGroupArgs := &ess.ModifyScalingGroupArgs{ ScalingGroupId: fi.StringValue(a.ScalingGroupId), @@ -166,7 +166,7 @@ func (_ *ScalingGroup) RenderALI(t *aliup.ALIAPITarget, a, e, changes *ScalingGr } _, err := t.Cloud.EssClient().ModifyScalingGroup(modifyScalingGroupArgs) if err != nil { - return fmt.Errorf("error modifing autoscalingGroup: %v", err) + return fmt.Errorf("error modifying autoscalingGroup: %v", err) } } } diff --git a/upup/pkg/fi/cloudup/alitasks/securitygroup.go b/upup/pkg/fi/cloudup/alitasks/securitygroup.go index 940408fbaedd2..1f76572a1d9d2 100644 --- a/upup/pkg/fi/cloudup/alitasks/securitygroup.go +++ b/upup/pkg/fi/cloudup/alitasks/securitygroup.go @@ -159,7 +159,7 @@ func (_ *SecurityGroup) RenderALI(t *aliup.ALIAPITarget, a, e, changes *Security } if a != nil && (len(a.Tags) > 0) { - glog.V(2).Infof("Modifing SecurityGroup with Name:%q", fi.StringValue(e.Name)) + glog.V(2).Infof("Modifying SecurityGroup with Name:%q", fi.StringValue(e.Name)) tagsToDelete := e.getGroupTagsToDelete(a.Tags) if len(tagsToDelete) > 0 { diff --git a/upup/pkg/fi/cloudup/awstasks/vpccidrblock.go b/upup/pkg/fi/cloudup/awstasks/vpccidrblock.go index 60a40e9312497..a6226bd923124 100644 --- a/upup/pkg/fi/cloudup/awstasks/vpccidrblock.go +++ b/upup/pkg/fi/cloudup/awstasks/vpccidrblock.go @@ -122,7 +122,7 @@ func (_ *VPCCIDRBlock) RenderTerraform(t *terraform.TerraformTarget, a, e, chang return fmt.Errorf("terraform does not support AdditionalCIDRs on VPCs") // The code below is based on https://github.com/terraform-providers/terraform-provider-aws/pull/1568 - // and can be un-comented once it is landed. + // and can be un-commented once it is landed. // When this has been enabled please fix test TestAdditionalCIDR in integration_test.go to run runTestAWS. // tf := &terraformVPCCIDRBlock{ // VPCID: e.VPC.TerraformLink(), diff --git a/upup/pkg/fi/secrets/clientset_secretstore.go b/upup/pkg/fi/secrets/clientset_secretstore.go index 59fb11d4abd1d..67f3841cd5594 100644 --- a/upup/pkg/fi/secrets/clientset_secretstore.go +++ b/upup/pkg/fi/secrets/clientset_secretstore.go @@ -194,7 +194,7 @@ func (c *ClientsetSecretStore) GetOrCreateSecret(name string, secret *fi.Secret) // Make double-sure it round-trips s, err := c.loadSecret(name) if err != nil { - glog.Fatalf("unable to load secret immmediately after creation %v: %v", name, err) + glog.Fatalf("unable to load secret immediately after creation %v: %v", name, err) return nil, false, err } return s, true, nil @@ -210,7 +210,7 @@ func (c *ClientsetSecretStore) ReplaceSecret(name string, secret *fi.Secret) (*f // Confirm the secret exists s, err := c.loadSecret(name) if err != nil { - return nil, fmt.Errorf("unable to load secret immmediately after creation: %v", err) + return nil, fmt.Errorf("unable to load secret immediately after creation: %v", err) } return s, nil } diff --git a/upup/pkg/fi/secrets/vfs_secretstore.go b/upup/pkg/fi/secrets/vfs_secretstore.go index f2c7b02cd8333..918b0a783d9e8 100644 --- a/upup/pkg/fi/secrets/vfs_secretstore.go +++ b/upup/pkg/fi/secrets/vfs_secretstore.go @@ -171,7 +171,7 @@ func (c *VFSSecretStore) GetOrCreateSecret(id string, secret *fi.Secret) (*fi.Se // Make double-sure it round-trips s, err := c.loadSecret(p) if err != nil { - glog.Fatalf("unable to load secret immmediately after creation %v: %v", p, err) + glog.Fatalf("unable to load secret immediately after creation %v: %v", p, err) return nil, false, err } return s, true, nil @@ -193,7 +193,7 @@ func (c *VFSSecretStore) ReplaceSecret(id string, secret *fi.Secret) (*fi.Secret // Confirm the secret exists s, err := c.loadSecret(p) if err != nil { - return nil, fmt.Errorf("unable to load secret immmediately after creation %v: %v", p, err) + return nil, fmt.Errorf("unable to load secret immediately after creation %v: %v", p, err) } return s, nil } From 4f99988e2a76c822a5d9f47b41902325a3ed728f Mon Sep 17 00:00:00 2001 From: Steve Winslow Date: Thu, 25 Oct 2018 15:08:13 -0400 Subject: [PATCH 019/163] Clarify license statement for nvidia-bootstrap hook Signed-off-by: Steve Winslow --- hooks/nvidia-bootstrap/README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hooks/nvidia-bootstrap/README.md b/hooks/nvidia-bootstrap/README.md index 04c73afa8aa23..7d3df1a49f156 100644 --- a/hooks/nvidia-bootstrap/README.md +++ b/hooks/nvidia-bootstrap/README.md @@ -1,6 +1,8 @@ ## NVIDIA Driver Installation -Using this hook indicates that you agree to the [license](http://www.nvidia.com/content/DriverDownload-March2009/licence.php?lang=us) +The source code within this directory is provided under the [Apache License, version 2.0](https://www.apache.org/licenses/LICENSE-2.0). + +Note that the NVIDIA software installed by this hook's container may be subject to [NVIDIA's own license terms](http://www.nvidia.com/content/DriverDownload-March2009/licence.php?lang=us). This is an experimental hook for installing the nvidia drivers as part of the kops boot process. From 17a2c474956b3aa8513124efe6f5f431212e5216 Mon Sep 17 00:00:00 2001 From: Ilya Dmitrichenko Date: Thu, 25 Oct 2018 13:07:20 +0100 Subject: [PATCH 020/163] Separate subnet utils into a standalone package --- hack/.packages | 1 + pkg/apis/kops/validation/BUILD.bazel | 2 +- pkg/apis/kops/validation/helpers.go | 21 ----- pkg/apis/kops/validation/helpers_test.go | 75 --------------- pkg/apis/kops/validation/legacy.go | 11 ++- pkg/util/subnet/BUILD.bazel | 14 +++ pkg/util/subnet/subnet.go | 69 ++++++++++++++ pkg/util/subnet/subnet_test.go | 111 +++++++++++++++++++++++ upup/pkg/fi/cloudup/BUILD.bazel | 1 + upup/pkg/fi/cloudup/subnets.go | 39 +------- upup/pkg/fi/cloudup/subnets_test.go | 36 -------- 11 files changed, 207 insertions(+), 173 deletions(-) delete mode 100644 pkg/apis/kops/validation/helpers_test.go create mode 100644 pkg/util/subnet/BUILD.bazel create mode 100644 pkg/util/subnet/subnet.go create mode 100644 pkg/util/subnet/subnet_test.go diff --git a/hack/.packages b/hack/.packages index 7f5367ee6f373..2c78c321c9a53 100644 --- a/hack/.packages +++ b/hack/.packages @@ -130,6 +130,7 @@ k8s.io/kops/pkg/tokens k8s.io/kops/pkg/try k8s.io/kops/pkg/urls k8s.io/kops/pkg/util/stringorslice +k8s.io/kops/pkg/util/subnet k8s.io/kops/pkg/util/templater k8s.io/kops/pkg/validation k8s.io/kops/pkg/values diff --git a/pkg/apis/kops/validation/BUILD.bazel b/pkg/apis/kops/validation/BUILD.bazel index 4f5ca4939314f..f7b2f54d2c00b 100644 --- a/pkg/apis/kops/validation/BUILD.bazel +++ b/pkg/apis/kops/validation/BUILD.bazel @@ -19,6 +19,7 @@ go_library( "//pkg/featureflag:go_default_library", "//pkg/model/components:go_default_library", "//pkg/model/iam:go_default_library", + "//pkg/util/subnet:go_default_library", "//upup/pkg/fi:go_default_library", "//upup/pkg/fi/cloudup/awsup:go_default_library", "//vendor/github.com/blang/semver:go_default_library", @@ -35,7 +36,6 @@ go_test( name = "go_default_test", srcs = [ "aws_test.go", - "helpers_test.go", "instancegroup_test.go", "validation_test.go", ], diff --git a/pkg/apis/kops/validation/helpers.go b/pkg/apis/kops/validation/helpers.go index 20da4d726a3c5..5931228b8690d 100644 --- a/pkg/apis/kops/validation/helpers.go +++ b/pkg/apis/kops/validation/helpers.go @@ -17,32 +17,11 @@ limitations under the License. package validation import ( - "net" "net/url" "k8s.io/apimachinery/pkg/util/validation/field" ) -// isSubnet checks if child is a subnet of parent -func isSubnet(parent *net.IPNet, child *net.IPNet) bool { - parentOnes, parentBits := parent.Mask.Size() - childOnes, childBits := child.Mask.Size() - if childBits != parentBits { - return false - } - if parentOnes > childOnes { - return false - } - childMasked := child.IP.Mask(parent.Mask) - parentMasked := parent.IP.Mask(parent.Mask) - return childMasked.Equal(parentMasked) -} - -// subnetsOverlap checks if two subnets overlap -func subnetsOverlap(l *net.IPNet, r *net.IPNet) bool { - return l.Contains(r.IP) || r.Contains(l.IP) -} - func isValidAPIServersURL(s string) bool { u, err := url.Parse(s) if err != nil { diff --git a/pkg/apis/kops/validation/helpers_test.go b/pkg/apis/kops/validation/helpers_test.go deleted file mode 100644 index c1a9130ebb3ce..0000000000000 --- a/pkg/apis/kops/validation/helpers_test.go +++ /dev/null @@ -1,75 +0,0 @@ -/* -Copyright 2016 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package validation - -import ( - "net" - "testing" -) - -func Test_isSubnet(t *testing.T) { - grid := []struct { - L string - R string - IsSubnet bool - }{ - { - L: "192.168.1.0/24", - R: "192.168.0.0/24", - IsSubnet: false, - }, - { - L: "192.168.0.0/16", - R: "192.168.0.0/24", - IsSubnet: true, - }, - { - L: "192.168.0.0/24", - R: "192.168.0.0/16", - IsSubnet: false, - }, - { - L: "192.168.0.0/16", - R: "192.168.0.0/16", - IsSubnet: true, // Not a strict subnet - }, - { - L: "192.168.0.1/16", - R: "192.168.0.0/24", - IsSubnet: true, - }, - { - L: "0.0.0.0/0", - R: "101.0.1.0/32", - IsSubnet: true, - }, - } - for _, g := range grid { - _, l, err := net.ParseCIDR(g.L) - if err != nil { - t.Fatalf("error parsing %q: %v", g.L, err) - } - _, r, err := net.ParseCIDR(g.R) - if err != nil { - t.Fatalf("error parsing %q: %v", g.R, err) - } - actual := isSubnet(l, r) - if actual != g.IsSubnet { - t.Errorf("isSubnet(%q, %q) = %v, expected %v", g.L, g.R, actual, g.IsSubnet) - } - } -} diff --git a/pkg/apis/kops/validation/legacy.go b/pkg/apis/kops/validation/legacy.go index 72195c5ff52f7..ce59692f93758 100644 --- a/pkg/apis/kops/validation/legacy.go +++ b/pkg/apis/kops/validation/legacy.go @@ -27,6 +27,7 @@ import ( "k8s.io/kops/pkg/apis/kops/util" "k8s.io/kops/pkg/featureflag" "k8s.io/kops/pkg/model/components" + "k8s.io/kops/pkg/util/subnet" "k8s.io/kops/upup/pkg/fi" "github.com/blang/semver" @@ -190,7 +191,7 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { return field.Invalid(fieldSpec.Child("NonMasqueradeCIDR"), nonMasqueradeCIDRString, "Cluster had an invalid NonMasqueradeCIDR") } - if networkCIDR != nil && subnetsOverlap(nonMasqueradeCIDR, networkCIDR) && c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC == nil { + if networkCIDR != nil && subnet.Overlap(nonMasqueradeCIDR, networkCIDR) && c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC == nil { return field.Invalid(fieldSpec.Child("NonMasqueradeCIDR"), nonMasqueradeCIDRString, fmt.Sprintf("NonMasqueradeCIDR %q cannot overlap with NetworkCIDR %q", nonMasqueradeCIDRString, c.Spec.NetworkCIDR)) } @@ -220,7 +221,7 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { return field.Invalid(fieldSpec.Child("ServiceClusterIPRange"), serviceClusterIPRangeString, "Cluster had an invalid ServiceClusterIPRange") } - if !isSubnet(nonMasqueradeCIDR, serviceClusterIPRange) { + if !subnet.BelongsTo(nonMasqueradeCIDR, serviceClusterIPRange) { return field.Invalid(fieldSpec.Child("ServiceClusterIPRange"), serviceClusterIPRangeString, fmt.Sprintf("ServiceClusterIPRange %q must be a subnet of NonMasqueradeCIDR %q", serviceClusterIPRangeString, c.Spec.NonMasqueradeCIDR)) } @@ -266,7 +267,7 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { return field.Invalid(fieldSpec.Child("KubeControllerManager", "ClusterCIDR"), clusterCIDRString, "Cluster had an invalid KubeControllerManager.ClusterCIDR") } - if !isSubnet(nonMasqueradeCIDR, clusterCIDR) { + if !subnet.BelongsTo(nonMasqueradeCIDR, clusterCIDR) { return field.Invalid(fieldSpec.Child("KubeControllerManager", "ClusterCIDR"), clusterCIDRString, fmt.Sprintf("KubeControllerManager.ClusterCIDR %q must be a subnet of NonMasqueradeCIDR %q", clusterCIDRString, c.Spec.NonMasqueradeCIDR)) } } @@ -625,12 +626,12 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { // validateSubnetCIDR is responsible for validating subnets are part of the CIRDs assigned to the cluster. func validateSubnetCIDR(networkCIDR *net.IPNet, additionalNetworkCIDRs []*net.IPNet, subnetCIDR *net.IPNet) bool { - if isSubnet(networkCIDR, subnetCIDR) { + if subnet.BelongsTo(networkCIDR, subnetCIDR) { return true } for _, additionalNetworkCIDR := range additionalNetworkCIDRs { - if isSubnet(additionalNetworkCIDR, subnetCIDR) { + if subnet.BelongsTo(additionalNetworkCIDR, subnetCIDR) { return true } } diff --git a/pkg/util/subnet/BUILD.bazel b/pkg/util/subnet/BUILD.bazel new file mode 100644 index 0000000000000..a34f27752eaa1 --- /dev/null +++ b/pkg/util/subnet/BUILD.bazel @@ -0,0 +1,14 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test") + +go_library( + name = "go_default_library", + srcs = ["subnet.go"], + importpath = "k8s.io/kops/pkg/util/subnet", + visibility = ["//visibility:public"], +) + +go_test( + name = "go_default_test", + srcs = ["subnet_test.go"], + embed = [":go_default_library"], +) diff --git a/pkg/util/subnet/subnet.go b/pkg/util/subnet/subnet.go new file mode 100644 index 0000000000000..b15651ceacbd5 --- /dev/null +++ b/pkg/util/subnet/subnet.go @@ -0,0 +1,69 @@ +/* +Copyright 2016 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package subnet + +import ( + "encoding/binary" + "fmt" + "net" +) + +// Overlap checks if two subnets overlap +func Overlap(l, r *net.IPNet) bool { + return l.Contains(r.IP) || r.Contains(l.IP) +} + +// BelongsTo checks if child is a subnet of parent +func BelongsTo(parent *net.IPNet, child *net.IPNet) bool { + parentOnes, parentBits := parent.Mask.Size() + childOnes, childBits := child.Mask.Size() + if childBits != parentBits { + return false + } + if parentOnes > childOnes { + return false + } + childMasked := child.IP.Mask(parent.Mask) + parentMasked := parent.IP.Mask(parent.Mask) + return childMasked.Equal(parentMasked) +} + +// SplitInto8 splits the parent IPNet into 8 subnets +func SplitInto8(parent *net.IPNet) ([]*net.IPNet, error) { + networkLength, _ := parent.Mask.Size() + networkLength += 3 + + var subnets []*net.IPNet + for i := 0; i < 8; i++ { + ip4 := parent.IP.To4() + if ip4 != nil { + n := binary.BigEndian.Uint32(ip4) + n += uint32(i) << uint(32-networkLength) + subnetIP := make(net.IP, len(ip4)) + binary.BigEndian.PutUint32(subnetIP, n) + + subnets = append(subnets, &net.IPNet{ + IP: subnetIP, + Mask: net.CIDRMask(networkLength, 32), + }) + } else { + return nil, fmt.Errorf("Unexpected IP address type: %s", parent) + } + } + + return subnets, nil +} diff --git a/pkg/util/subnet/subnet_test.go b/pkg/util/subnet/subnet_test.go new file mode 100644 index 0000000000000..1b3e58b8b6cfa --- /dev/null +++ b/pkg/util/subnet/subnet_test.go @@ -0,0 +1,111 @@ +/* +Copyright 2016 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package subnet + +import ( + "net" + "reflect" + "testing" +) + +func Test_BelongsTo(t *testing.T) { + grid := []struct { + L string + R string + Belongs bool + }{ + { + L: "192.168.1.0/24", + R: "192.168.0.0/24", + Belongs: false, + }, + { + L: "192.168.0.0/16", + R: "192.168.0.0/24", + Belongs: true, + }, + { + L: "192.168.0.0/24", + R: "192.168.0.0/16", + Belongs: false, + }, + { + L: "192.168.0.0/16", + R: "192.168.0.0/16", + Belongs: true, // Not a strict subnet + }, + { + L: "192.168.0.1/16", + R: "192.168.0.0/24", + Belongs: true, + }, + { + L: "0.0.0.0/0", + R: "101.0.1.0/32", + Belongs: true, + }, + } + for _, g := range grid { + _, l, err := net.ParseCIDR(g.L) + if err != nil { + t.Fatalf("error parsing %q: %v", g.L, err) + } + _, r, err := net.ParseCIDR(g.R) + if err != nil { + t.Fatalf("error parsing %q: %v", g.R, err) + } + actual := BelongsTo(l, r) + if actual != g.Belongs { + t.Errorf("isSubnet(%q, %q) = %v, expected %v", g.L, g.R, actual, g.Belongs) + } + } +} + +func Test_SplitInto8(t *testing.T) { + tests := []struct { + parent string + expected []string + }{ + { + parent: "1.2.3.0/24", + expected: []string{"1.2.3.0/27", "1.2.3.32/27", "1.2.3.64/27", "1.2.3.96/27", "1.2.3.128/27", "1.2.3.160/27", "1.2.3.192/27", "1.2.3.224/27"}, + }, + { + parent: "1.2.3.0/27", + expected: []string{"1.2.3.0/30", "1.2.3.4/30", "1.2.3.8/30", "1.2.3.12/30", "1.2.3.16/30", "1.2.3.20/30", "1.2.3.24/30", "1.2.3.28/30"}, + }, + } + for _, test := range tests { + _, parent, err := net.ParseCIDR(test.parent) + if err != nil { + t.Fatalf("error parsing parent cidr %q: %v", test.parent, err) + } + + subnets, err := SplitInto8(parent) + if err != nil { + t.Fatalf("error splitting parent cidr %q: %v", parent, err) + } + + var actual []string + for _, subnet := range subnets { + actual = append(actual, subnet.String()) + } + if !reflect.DeepEqual(actual, test.expected) { + t.Fatalf("unexpected result of split: actual=%v, expected=%v", actual, test.expected) + } + } +} diff --git a/upup/pkg/fi/cloudup/BUILD.bazel b/upup/pkg/fi/cloudup/BUILD.bazel index 8d70ce10b60d9..9219a3244b38e 100644 --- a/upup/pkg/fi/cloudup/BUILD.bazel +++ b/upup/pkg/fi/cloudup/BUILD.bazel @@ -53,6 +53,7 @@ go_library( "//pkg/resources/digitalocean:go_default_library", "//pkg/resources/spotinst:go_default_library", "//pkg/templates:go_default_library", + "//pkg/util/subnet:go_default_library", "//upup/models:go_default_library", "//upup/pkg/fi:go_default_library", "//upup/pkg/fi/assettasks:go_default_library", diff --git a/upup/pkg/fi/cloudup/subnets.go b/upup/pkg/fi/cloudup/subnets.go index 36278bb563db5..4ca4f01eed68e 100644 --- a/upup/pkg/fi/cloudup/subnets.go +++ b/upup/pkg/fi/cloudup/subnets.go @@ -17,13 +17,13 @@ limitations under the License. package cloudup import ( - "encoding/binary" "fmt" "net" "sort" "github.com/golang/glog" "k8s.io/kops/pkg/apis/kops" + "k8s.io/kops/pkg/util/subnet" "k8s.io/kops/upup/pkg/fi" ) @@ -109,7 +109,7 @@ func assignCIDRsToSubnets(c *kops.Cluster) error { // TODO: Does this make sense on GCE? // TODO: Should we limit this to say 1000 IPs per subnet? (any reason to?) - bigCIDRs, err := splitInto8Subnets(cidr) + bigCIDRs, err := subnet.SplitInto8(cidr) if err != nil { return err } @@ -147,7 +147,7 @@ func assignCIDRsToSubnets(c *kops.Cluster) error { for _, c := range bigCIDRs { overlapped := false for _, r := range reserved { - if cidrsOverlap(r, c) { + if subnet.Overlap(r, c) { overlapped = true } } @@ -162,7 +162,7 @@ func assignCIDRsToSubnets(c *kops.Cluster) error { return fmt.Errorf("could not find any non-overlapping CIDRs in parent NetworkCIDR; cannot automatically assign CIDR to subnet") } - littleCIDRs, err := splitInto8Subnets(bigCIDRs[0]) + littleCIDRs, err := subnet.SplitInto8(bigCIDRs[0]) if err != nil { return err } @@ -203,32 +203,6 @@ func assignCIDRsToSubnets(c *kops.Cluster) error { return nil } -// splitInto8Subnets splits the parent IPNet into 8 subnets -func splitInto8Subnets(parent *net.IPNet) ([]*net.IPNet, error) { - networkLength, _ := parent.Mask.Size() - networkLength += 3 - - var subnets []*net.IPNet - for i := 0; i < 8; i++ { - ip4 := parent.IP.To4() - if ip4 != nil { - n := binary.BigEndian.Uint32(ip4) - n += uint32(i) << uint(32-networkLength) - subnetIP := make(net.IP, len(ip4)) - binary.BigEndian.PutUint32(subnetIP, n) - - subnets = append(subnets, &net.IPNet{ - IP: subnetIP, - Mask: net.CIDRMask(networkLength, 32), - }) - } else { - return nil, fmt.Errorf("Unexpected IP address type: %s", parent) - } - } - - return subnets, nil -} - // allSubnetsHaveCIDRs returns true iff each subnet in the cluster has a non-empty CIDR func allSubnetsHaveCIDRs(c *kops.Cluster) bool { for i := range c.Spec.Subnets { @@ -240,8 +214,3 @@ func allSubnetsHaveCIDRs(c *kops.Cluster) bool { return true } - -// cidrsOverlap returns true iff the two CIDRs are non-disjoint -func cidrsOverlap(l, r *net.IPNet) bool { - return l.Contains(r.IP) || r.Contains(l.IP) -} diff --git a/upup/pkg/fi/cloudup/subnets_test.go b/upup/pkg/fi/cloudup/subnets_test.go index c41e1ce08138c..27e496de0ba6d 100644 --- a/upup/pkg/fi/cloudup/subnets_test.go +++ b/upup/pkg/fi/cloudup/subnets_test.go @@ -17,48 +17,12 @@ limitations under the License. package cloudup import ( - "net" "reflect" "testing" "k8s.io/kops/pkg/apis/kops" ) -func Test_Split_Subnet(t *testing.T) { - tests := []struct { - parent string - expected []string - }{ - { - parent: "1.2.3.0/24", - expected: []string{"1.2.3.0/27", "1.2.3.32/27", "1.2.3.64/27", "1.2.3.96/27", "1.2.3.128/27", "1.2.3.160/27", "1.2.3.192/27", "1.2.3.224/27"}, - }, - { - parent: "1.2.3.0/27", - expected: []string{"1.2.3.0/30", "1.2.3.4/30", "1.2.3.8/30", "1.2.3.12/30", "1.2.3.16/30", "1.2.3.20/30", "1.2.3.24/30", "1.2.3.28/30"}, - }, - } - for _, test := range tests { - _, parent, err := net.ParseCIDR(test.parent) - if err != nil { - t.Fatalf("error parsing parent cidr %q: %v", test.parent, err) - } - - subnets, err := splitInto8Subnets(parent) - if err != nil { - t.Fatalf("error splitting parent cidr %q: %v", parent, err) - } - - var actual []string - for _, subnet := range subnets { - actual = append(actual, subnet.String()) - } - if !reflect.DeepEqual(actual, test.expected) { - t.Fatalf("unexpected result of split: actual=%v, expected=%v", actual, test.expected) - } - } -} - func Test_AssignSubnets(t *testing.T) { tests := []struct { subnets []kops.ClusterSubnetSpec From 77d42267a68a534939f47afb143c2d7df732084e Mon Sep 17 00:00:00 2001 From: SataQiu Date: Mon, 29 Oct 2018 18:17:45 +0800 Subject: [PATCH 021/163] fix some typos --- README.md | 2 +- node-authorizer/pkg/utils/logger.go | 2 +- pkg/client/simple/api/clientset.go | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c9abc90a13281..2c6f73b498153 100644 --- a/README.md +++ b/README.md @@ -197,7 +197,7 @@ Our office hours call is recorded, but the tone tends to be casual. First-timers Office hours are designed for ALL of those contributing to kops or the community. Contributions are not limited to those who commit source code. There are so many important ways to be involved- - helping in the slack channels - triaging/writing issues - - thinking about the topics raised at office hours and forming and advocating for your good ideas forming opinions + - thinking about the topics raised at office hours and forming and advocating for your good ideas forming opinions - testing pre-(and official) releases Although not exhaustive, the above activities are extremely important to our continued success and are all worth contributions. If you want to talk about kops and you have doubt, just come. diff --git a/node-authorizer/pkg/utils/logger.go b/node-authorizer/pkg/utils/logger.go index 97f025d3b7e65..2c18fc0b0f13f 100644 --- a/node-authorizer/pkg/utils/logger.go +++ b/node-authorizer/pkg/utils/logger.go @@ -21,7 +21,7 @@ import ( ) var ( - // Logger is the defaut logger + // Logger is the default logger Logger *zap.Logger ) diff --git a/pkg/client/simple/api/clientset.go b/pkg/client/simple/api/clientset.go index 6ee5994134231..bc783c5bf89ad 100644 --- a/pkg/client/simple/api/clientset.go +++ b/pkg/client/simple/api/clientset.go @@ -72,7 +72,7 @@ func (c *RESTClientset) ConfigBaseFor(cluster *kops.Cluster) (vfs.Path, error) { if cluster.Spec.ConfigBase != "" { return vfs.Context.BuildVfsPath(cluster.Spec.ConfigBase) } - // URL for clusters looks like https:///apis/kops/v1alpha2/namespaces//clusters/ + // URL for clusters looks like https:///apis/kops/v1alpha2/namespaces//clusters/ // We probably want to add a subresource for full resources return vfs.Context.BuildVfsPath(c.BaseURL.String()) } From 9db3567cac9fb8e40306be4d5402ccfde79affc5 Mon Sep 17 00:00:00 2001 From: Liran Polak Date: Mon, 29 Oct 2018 22:28:15 +0200 Subject: [PATCH 022/163] fix: skip the load balancer attachment --- pkg/model/awsmodel/BUILD.bazel | 1 + pkg/model/awsmodel/api_loadbalancer.go | 22 ++++++++++++++-------- pkg/model/bastion.go | 24 +++++++++++++++--------- 3 files changed, 30 insertions(+), 17 deletions(-) diff --git a/pkg/model/awsmodel/BUILD.bazel b/pkg/model/awsmodel/BUILD.bazel index b5efd0e979d82..b7d97f18cdef2 100644 --- a/pkg/model/awsmodel/BUILD.bazel +++ b/pkg/model/awsmodel/BUILD.bazel @@ -13,6 +13,7 @@ go_library( deps = [ "//pkg/apis/kops:go_default_library", "//pkg/dns:go_default_library", + "//pkg/featureflag:go_default_library", "//pkg/model:go_default_library", "//pkg/model/defaults:go_default_library", "//upup/pkg/fi:go_default_library", diff --git a/pkg/model/awsmodel/api_loadbalancer.go b/pkg/model/awsmodel/api_loadbalancer.go index af7ece83791bc..5a7ca79d9933b 100644 --- a/pkg/model/awsmodel/api_loadbalancer.go +++ b/pkg/model/awsmodel/api_loadbalancer.go @@ -25,6 +25,7 @@ import ( "k8s.io/apimachinery/pkg/util/sets" "k8s.io/kops/pkg/apis/kops" "k8s.io/kops/pkg/dns" + "k8s.io/kops/pkg/featureflag" "k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi/cloudup/awstasks" "k8s.io/kops/upup/pkg/fi/fitasks" @@ -254,16 +255,21 @@ func (b *APILoadBalancerBuilder) Build(c *fi.ModelBuilderContext) error { masterKeypair.AlternateNameTasks = append(masterKeypair.AlternateNameTasks, elb) } - for _, ig := range b.MasterInstanceGroups() { - t := &awstasks.LoadBalancerAttachment{ - Name: s("api-" + ig.ObjectMeta.Name), - Lifecycle: b.Lifecycle, + // When Spotinst Elastigroups are used, there is no need to create + // a separate task for the attachment of the load balancer since this + // is already done as part of the Elastigroup's creation, if needed. + if !featureflag.Spotinst.Enabled() { + for _, ig := range b.MasterInstanceGroups() { + t := &awstasks.LoadBalancerAttachment{ + Name: s("api-" + ig.ObjectMeta.Name), + Lifecycle: b.Lifecycle, + + LoadBalancer: b.LinkToELB("api"), + AutoscalingGroup: b.LinkToAutoscalingGroup(ig), + } - LoadBalancer: b.LinkToELB("api"), - AutoscalingGroup: b.LinkToAutoscalingGroup(ig), + c.AddTask(t) } - - c.AddTask(t) } return nil diff --git a/pkg/model/bastion.go b/pkg/model/bastion.go index 47f75305b3f84..54aa9511ebeb6 100644 --- a/pkg/model/bastion.go +++ b/pkg/model/bastion.go @@ -21,6 +21,7 @@ import ( "k8s.io/apimachinery/pkg/util/sets" "k8s.io/kops/pkg/apis/kops" + "k8s.io/kops/pkg/featureflag" "k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi/cloudup/awstasks" ) @@ -236,18 +237,23 @@ func (b *BastionModelBuilder) Build(c *fi.ModelBuilderContext) error { c.AddTask(elb) } - for _, ig := range bastionInstanceGroups { - // We build the ASG when we iterate over the instance groups + // When Spotinst Elastigroups are used, there is no need to create + // a separate task for the attachment of the load balancer since this + // is already done as part of the Elastigroup's creation, if needed. + if !featureflag.Spotinst.Enabled() { + for _, ig := range bastionInstanceGroups { + // We build the ASG when we iterate over the instance groups - // Attach the ELB to the ASG - t := &awstasks.LoadBalancerAttachment{ - Name: s("bastion-elb-attachment"), - Lifecycle: b.Lifecycle, + // Attach the ELB to the ASG + t := &awstasks.LoadBalancerAttachment{ + Name: s("bastion-elb-attachment"), + Lifecycle: b.Lifecycle, - LoadBalancer: elb, - AutoscalingGroup: b.LinkToAutoscalingGroup(ig), + LoadBalancer: elb, + AutoscalingGroup: b.LinkToAutoscalingGroup(ig), + } + c.AddTask(t) } - c.AddTask(t) } bastionPublicName := "" From 5d9f3891ca6f166a87564434ee223363ca94b4b0 Mon Sep 17 00:00:00 2001 From: xichengliudui Date: Tue, 30 Oct 2018 10:10:28 -0400 Subject: [PATCH 023/163] Change the wrong function name and wrong word --- docs/apireference/build/tabvisibility.js | 6 +++--- pkg/apis/kops/instancegroup.go | 2 +- pkg/apis/kops/v1alpha1/instancegroup.go | 2 +- pkg/apis/kops/v1alpha2/instancegroup.go | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/apireference/build/tabvisibility.js b/docs/apireference/build/tabvisibility.js index 48c0df7fe2684..9589fac92c5af 100644 --- a/docs/apireference/build/tabvisibility.js +++ b/docs/apireference/build/tabvisibility.js @@ -18,10 +18,10 @@ $(document).ready(function() { }); } - function setDefautTab() { + function setDefaultTab() { $(codeTabs[0]).addClass('tab-selected'); $('.' + codeTabs[0].id).addClass('active'); } - setDefautTab(); -}); \ No newline at end of file + setDefaultTab(); +}); diff --git a/pkg/apis/kops/instancegroup.go b/pkg/apis/kops/instancegroup.go index 52274bf224c03..2e4840cc95ad6 100644 --- a/pkg/apis/kops/instancegroup.go +++ b/pkg/apis/kops/instancegroup.go @@ -123,7 +123,7 @@ type InstanceGroupSpec struct { DetailedInstanceMonitoring *bool `json:"detailedInstanceMonitoring,omitempty"` // IAMProfileSpec defines the identity of the cloud group iam profile (AWS only). IAM *IAMProfileSpec `json:"iam,omitempty"` - // SecurityGroupOverride overrides the defaut security group created by Kops for this IG (AWS only). + // SecurityGroupOverride overrides the default security group created by Kops for this IG (AWS only). SecurityGroupOverride *string `json:"securityGroupOverride,omitempty"` } diff --git a/pkg/apis/kops/v1alpha1/instancegroup.go b/pkg/apis/kops/v1alpha1/instancegroup.go index 3465f076766fa..73edc196156a3 100644 --- a/pkg/apis/kops/v1alpha1/instancegroup.go +++ b/pkg/apis/kops/v1alpha1/instancegroup.go @@ -102,7 +102,7 @@ type InstanceGroupSpec struct { DetailedInstanceMonitoring *bool `json:"detailedInstanceMonitoring,omitempty"` // IAMProfileSpec defines the identity of the cloud group iam profile (AWS only). IAM *IAMProfileSpec `json:"iam,omitempty"` - // SecurityGroupOverride overrides the defaut security group created by Kops for this IG (AWS only). + // SecurityGroupOverride overrides the default security group created by Kops for this IG (AWS only). SecurityGroupOverride *string `json:"securityGroupOverride,omitempty"` } diff --git a/pkg/apis/kops/v1alpha2/instancegroup.go b/pkg/apis/kops/v1alpha2/instancegroup.go index d6c351713671c..773196b3d7a10 100644 --- a/pkg/apis/kops/v1alpha2/instancegroup.go +++ b/pkg/apis/kops/v1alpha2/instancegroup.go @@ -111,7 +111,7 @@ type InstanceGroupSpec struct { DetailedInstanceMonitoring *bool `json:"detailedInstanceMonitoring,omitempty"` // IAMProfileSpec defines the identity of the cloud group iam profile (AWS only). IAM *IAMProfileSpec `json:"iam,omitempty"` - // SecurityGroupOverride overrides the defaut security group created by Kops for this IG (AWS only). + // SecurityGroupOverride overrides the default security group created by Kops for this IG (AWS only). SecurityGroupOverride *string `json:"securityGroupOverride,omitempty"` } From 52d3449c23a8cdd8b1e2c41f3ef42bf66273d614 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Tue, 30 Oct 2018 13:13:43 -0400 Subject: [PATCH 024/163] Prune some license files that dep added Dep apparently decided to add some license files for packages that we aren't using, which is particularly irksome because the license is GPL. Remove those packages so that there's no confusion. Issue https://github.com/kubernetes/sig-release/issues/223 --- Makefile | 1 + .../docker-engine-selinux/LICENSE | 339 ----------------- .../docker-engine-selinux/LICENSE | 340 ------------------ .../docker/docker/contrib/syntax/vim/LICENSE | 22 -- 4 files changed, 1 insertion(+), 701 deletions(-) delete mode 100644 vendor/github.com/docker/docker/contrib/selinux-fedora-24/docker-engine-selinux/LICENSE delete mode 100644 vendor/github.com/docker/docker/contrib/selinux-oraclelinux-7/docker-engine-selinux/LICENSE delete mode 100644 vendor/github.com/docker/docker/contrib/syntax/vim/LICENSE diff --git a/Makefile b/Makefile index 5eff1eaf3792a..ca2ecaa58ac14 100644 --- a/Makefile +++ b/Makefile @@ -486,6 +486,7 @@ dep-ensure: dep-prereqs rm -rf vendor/k8s.io/code-generator/cmd/set-gen/ rm -rf vendor/k8s.io/code-generator/cmd/go-to-protobuf/ rm -rf vendor/k8s.io/code-generator/cmd/import-boss/ + rm -rf vendor/github.com/docker/docker/contrib/ make bazel-gazelle diff --git a/vendor/github.com/docker/docker/contrib/selinux-fedora-24/docker-engine-selinux/LICENSE b/vendor/github.com/docker/docker/contrib/selinux-fedora-24/docker-engine-selinux/LICENSE deleted file mode 100644 index d511905c1647a..0000000000000 --- a/vendor/github.com/docker/docker/contrib/selinux-fedora-24/docker-engine-selinux/LICENSE +++ /dev/null @@ -1,339 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Lesser General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - -Also add information on how to contact you by electronic and paper mail. - -If the program is interactive, make it output a short notice like this -when it starts in an interactive mode: - - Gnomovision version 69, Copyright (C) year name of author - Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. - -You should also get your employer (if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: - - Yoyodyne, Inc., hereby disclaims all copyright interest in the program - `Gnomovision' (which makes passes at compilers) written by James Hacker. - - , 1 April 1989 - Ty Coon, President of Vice - -This General Public License does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. diff --git a/vendor/github.com/docker/docker/contrib/selinux-oraclelinux-7/docker-engine-selinux/LICENSE b/vendor/github.com/docker/docker/contrib/selinux-oraclelinux-7/docker-engine-selinux/LICENSE deleted file mode 100644 index 5b6e7c66c276e..0000000000000 --- a/vendor/github.com/docker/docker/contrib/selinux-oraclelinux-7/docker-engine-selinux/LICENSE +++ /dev/null @@ -1,340 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc. - 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Library General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - - -Also add information on how to contact you by electronic and paper mail. - -If the program is interactive, make it output a short notice like this -when it starts in an interactive mode: - - Gnomovision version 69, Copyright (C) year name of author - Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. - -You should also get your employer (if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: - - Yoyodyne, Inc., hereby disclaims all copyright interest in the program - `Gnomovision' (which makes passes at compilers) written by James Hacker. - - , 1 April 1989 - Ty Coon, President of Vice - -This General Public License does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Library General -Public License instead of this License. diff --git a/vendor/github.com/docker/docker/contrib/syntax/vim/LICENSE b/vendor/github.com/docker/docker/contrib/syntax/vim/LICENSE deleted file mode 100644 index e67cdabd22e5f..0000000000000 --- a/vendor/github.com/docker/docker/contrib/syntax/vim/LICENSE +++ /dev/null @@ -1,22 +0,0 @@ -Copyright (c) 2013 Honza Pokorny -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are met: - -1. Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. -2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR -ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. From b1c8c0eed32d1bfd62120baf05435bbe9fa6cb52 Mon Sep 17 00:00:00 2001 From: hintss Date: Tue, 30 Oct 2018 23:03:06 -0700 Subject: [PATCH 025/163] Fix blog link --- docs/node_resource_handling.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/node_resource_handling.md b/docs/node_resource_handling.md index 3d0769a2079c2..0e55ebadc3f5d 100644 --- a/docs/node_resource_handling.md +++ b/docs/node_resource_handling.md @@ -128,4 +128,4 @@ But, it seems fitting to recommend the following: [5]: https://cloud.google.com/container-engine/ [6]: https://github.com/kubernetes/kops [7]: http://node-perf-dash.k8s.io/#/builds -[8]: http://blog.kubernetes.io/2016/11/visualize-kubelet-performance-with-node-dashboard.html +[8]: http://kubernetes.io/blog/2016/11/visualize-kubelet-performance-with-node-dashboard.html From 97aafc61dee7de6f19761f5d700f5877e3dd34dc Mon Sep 17 00:00:00 2001 From: AdamDang Date: Wed, 31 Oct 2018 17:16:22 +0800 Subject: [PATCH 026/163] Correct the table format in upgrade_from_kubeup.md Correct the table format in upgrade_from_kubeup.md --- docs/upgrade_from_kubeup.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/upgrade_from_kubeup.md b/docs/upgrade_from_kubeup.md index 71c9abf24273f..3038fc2c0fa29 100644 --- a/docs/upgrade_from_kubeup.md +++ b/docs/upgrade_from_kubeup.md @@ -185,7 +185,8 @@ kubectl delete deployment -lk8s-app=heapster --namespace=kube-system ## Delete remaining resources of the old cluster `kops delete cluster ${OLD_NAME}` -> ``` +> +``` TYPE NAME ID autoscaling-config kubernetes-minion-group-us-west-2a kubernetes-minion-group-us-west-2a autoscaling-group kubernetes-minion kubernetes-minion-group-us-west-2a From 9ccbe5b39a79c8c59d911b21ad6db21442d54eb2 Mon Sep 17 00:00:00 2001 From: Liran Polak Date: Wed, 31 Oct 2018 16:50:46 +0200 Subject: [PATCH 027/163] fix: do not log unmatched groups as warnings --- pkg/resources/spotinst/resources.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/resources/spotinst/resources.go b/pkg/resources/spotinst/resources.go index f5ad6011e53f5..d35d8f75a90c8 100644 --- a/pkg/resources/spotinst/resources.go +++ b/pkg/resources/spotinst/resources.go @@ -106,7 +106,7 @@ func GetCloudGroups(svc Service, cluster *kops.Cluster, instancegroups []*kops.I if instancegroup == nil { if warnUnmatched { - glog.Warningf("Found group with no corresponding instance group %q", group.Name()) + glog.V(2).Infof("Found group with no corresponding instance group %q", group.Name()) } continue } From 9b37ddff12df53deb2f2ec2c1cb116506fca79f3 Mon Sep 17 00:00:00 2001 From: Liran Polak Date: Thu, 1 Nov 2018 01:43:00 +0200 Subject: [PATCH 028/163] fix: find security group without vpc id --- upup/pkg/fi/cloudup/awstasks/securitygroup.go | 22 ++++++++----------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/upup/pkg/fi/cloudup/awstasks/securitygroup.go b/upup/pkg/fi/cloudup/awstasks/securitygroup.go index 739067eb697c8..e2a3d4d9dc457 100644 --- a/upup/pkg/fi/cloudup/awstasks/securitygroup.go +++ b/upup/pkg/fi/cloudup/awstasks/securitygroup.go @@ -96,26 +96,22 @@ func (e *SecurityGroup) Find(c *fi.Context) (*SecurityGroup, error) { func (e *SecurityGroup) findEc2(c *fi.Context) (*ec2.SecurityGroup, error) { cloud := c.Cloud.(awsup.AWSCloud) - - var vpcID *string - if e.VPC != nil { - vpcID = e.VPC.ID - } - - if vpcID == nil { - return nil, nil - } - request := &ec2.DescribeSecurityGroupsInput{} if fi.StringValue(e.ID) != "" { + // Find by ID. request.GroupIds = []*string{e.ID} - } else { + + } else if fi.StringValue(e.Name) != "" && e.VPC != nil { + // Find by filters (name and VPC ID). filters := cloud.BuildFilters(e.Name) - filters = append(filters, awsup.NewEC2Filter("vpc-id", *vpcID)) + filters = append(filters, awsup.NewEC2Filter("vpc-id", *e.VPC.ID)) filters = append(filters, awsup.NewEC2Filter("group-name", *e.Name)) - request.Filters = filters + + } else { + // No reason to try. + return nil, nil } response, err := cloud.EC2().DescribeSecurityGroups(request) From 63e4096107d044f9a964d1190b1f48c4480baa68 Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Thu, 1 Nov 2018 08:43:00 +0000 Subject: [PATCH 029/163] Fix indentation for monitoring-standalone addon --- addons/monitoring-standalone/addon.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/monitoring-standalone/addon.yaml b/addons/monitoring-standalone/addon.yaml index f5ce000ded8ee..1f5d82c889ba7 100644 --- a/addons/monitoring-standalone/addon.yaml +++ b/addons/monitoring-standalone/addon.yaml @@ -20,7 +20,7 @@ spec: k8s-addon: monitoring-standalone.addons.k8s.io manifest: v1.6.0.yaml kubernetesVersion: ">=1.6.0" -- version: 1.11.0 + - version: 1.11.0 selector: k8s-addon: monitoring-standalone.addons.k8s.io manifest: v1.11.0.yaml From b2b07cf045e163b96b9f53a2c69f4647423b18e4 Mon Sep 17 00:00:00 2001 From: Vlad Ionescu Date: Fri, 2 Nov 2018 16:01:30 +0200 Subject: [PATCH 030/163] Document etcd volume options This commit adds documentation around the options for the etcd volumes: volumeType and volumeIops, in addition to the already existing documentation for volumeSize Fixes https://github.com/kubernetes/kops/issues/4557 --- docs/cluster_spec.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/cluster_spec.md b/docs/cluster_spec.md index 0175b4c1b0712..21259264f83b0 100644 --- a/docs/cluster_spec.md +++ b/docs/cluster_spec.md @@ -85,19 +85,23 @@ etcdClusters: > __Note:__ The images for etcd that kops uses are from the Google Cloud Repository. Google doesn't release every version of etcd to the gcr. Check that the version of etcd you want to use is available [at the gcr](https://console.cloud.google.com/gcr/images/google-containers/GLOBAL/etcd?gcrImageListsize=50) before using it in your cluster spec. -By default, the Volumes created for the etcd clusters are 20GB each. They can be adjusted via the `volumeSize` parameter. +By default, the Volumes created for the etcd clusters are `gp2` and 20GB each. The volume size, type and Iops( for `io1`) can be configured via their parameters. Conversion between `gp2` and `io1` is not supported, nor are size changes. ```yaml etcdClusters: - etcdMembers: - instanceGroup: master-us-east-1a name: a - volumeSize: 5 + volumeType: gp2 + volumeSize: 20 name: main - etcdMembers: - instanceGroup: master-us-east-1a name: a - volumeSize: 5 + volumeType: io1 + # WARNING: bear in mind that the Iops to volume size ratio has a maximum of 50 on AWS! + volumeIops: 100 + volumeSize: 21 name: events ``` From 1ada8a98e5282de6179b01fae69245a78c4c5050 Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Fri, 2 Nov 2018 15:47:37 +0000 Subject: [PATCH 031/163] Canal v3.3.0 for Kubernetes v1.12+ --- .../k8s-1.12.yaml.template | 548 ++++++++++++++++++ .../pkg/fi/cloudup/bootstrapchannelbuilder.go | 15 + 2 files changed, 563 insertions(+) create mode 100644 upup/models/cloudup/resources/addons/networking.projectcalico.org.canal/k8s-1.12.yaml.template diff --git a/upup/models/cloudup/resources/addons/networking.projectcalico.org.canal/k8s-1.12.yaml.template b/upup/models/cloudup/resources/addons/networking.projectcalico.org.canal/k8s-1.12.yaml.template new file mode 100644 index 0000000000000..b9249de19d18a --- /dev/null +++ b/upup/models/cloudup/resources/addons/networking.projectcalico.org.canal/k8s-1.12.yaml.template @@ -0,0 +1,548 @@ +# Canal Version v3.3.0 +# https://docs.projectcalico.org/v3.3/releases#v3.3.0 +# This manifest includes the following component versions: +# calico/node:v3.3.0 +# calico/cni:v3.3.0 +# coreos/flannel:v0.9.0 + +# This ConfigMap is used to configure a self-hosted Canal installation. +kind: ConfigMap +apiVersion: v1 +metadata: + name: canal-config + namespace: kube-system +data: + # The interface used by canal for host <-> host communication. + # If left blank, then the interface is chosen using the node's + # default route. + canal_iface: "" + + # Whether or not to masquerade traffic to destinations not within + # the pod network. + masquerade: "true" + + # The CNI network configuration to install on each node. The special + # values in this config will be automatically populated. + cni_network_config: |- + { + "name": "k8s-pod-network", + "cniVersion": "0.3.0", + "plugins": [ + { + "type": "calico", + "log_level": "info", + "datastore_type": "kubernetes", + "nodename": "__KUBERNETES_NODE_NAME__", + "ipam": { + "type": "host-local", + "subnet": "usePodCidr" + }, + "policy": { + "type": "k8s" + }, + "kubernetes": { + "kubeconfig": "__KUBECONFIG_FILEPATH__" + } + }, + { + "type": "portmap", + "snat": true, + "capabilities": {"portMappings": true} + } + ] + } + + # Flannel network configuration. Mounted into the flannel container. + net-conf.json: | + { + "Network": "{{ .NonMasqueradeCIDR }}", + "Backend": { + "Type": "vxlan" + } + } + +--- + + + +# This manifest installs the calico/node container, as well +# as the Calico CNI plugins and network config on +# each master and worker node in a Kubernetes cluster. +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: canal + namespace: kube-system + labels: + k8s-app: canal +spec: + selector: + matchLabels: + k8s-app: canal + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + labels: + k8s-app: canal + annotations: + # This, along with the CriticalAddonsOnly toleration below, + # marks the pod as a critical add-on, ensuring it gets + # priority scheduling and that its resources are reserved + # if it ever gets evicted. + scheduler.alpha.kubernetes.io/critical-pod: '' + spec: + priorityClassName: system-node-critical + nodeSelector: + beta.kubernetes.io/os: linux + hostNetwork: true + tolerations: + # Make sure canal gets scheduled on all nodes. + - effect: NoSchedule + operator: Exists + # Mark the pod as a critical add-on for rescheduling. + - key: CriticalAddonsOnly + operator: Exists + - effect: NoExecute + operator: Exists + serviceAccountName: canal + # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force + # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. + terminationGracePeriodSeconds: 0 + containers: + # Runs calico/node container on each Kubernetes node. This + # container programs network policy and routes on each + # host. + - name: calico-node + image: quay.io/calico/node:v3.3.0 + env: + # Use Kubernetes API as the backing datastore. + - name: DATASTORE_TYPE + value: "kubernetes" + # Wait for the datastore. + - name: WAIT_FOR_DATASTORE + value: "true" + # Set based on the k8s node name. + - name: NODENAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # Don't enable BGP. + - name: CALICO_NETWORKING_BACKEND + value: "none" + # Cluster type to identify the deployment type + - name: CLUSTER_TYPE + value: "k8s,canal" + # Period, in seconds, at which felix re-applies all iptables state + - name: FELIX_IPTABLESREFRESHINTERVAL + value: "60" + # No IP address needed. + - name: IP + value: "" + # Disable file logging so `kubectl logs` works. + - name: CALICO_DISABLE_FILE_LOGGING + value: "true" + # Disable IPv6 on Kubernetes. + - name: FELIX_IPV6SUPPORT + value: "false" + # Set Felix logging to "info" + - name: FELIX_LOGSEVERITYSCREEN + value: "{{- or .Networking.Canal.LogSeveritySys "INFO" }}" + # Set Felix endpoint to host default action to ACCEPT. + - name: FELIX_DEFAULTENDPOINTTOHOSTACTION + value: "{{- or .Networking.Canal.DefaultEndpointToHostAction "ACCEPT" }}" + # Controls whether Felix inserts rules to the top of iptables chains, or appends to the bottom + - name: FELIX_CHAININSERTMODE + value: "{{- or .Networking.Canal.ChainInsertMode "insert" }}" + # Set to enable the experimental Prometheus metrics server + - name: FELIX_PROMETHEUSMETRICSENABLED + value: "{{- or .Networking.Canal.PrometheusMetricsEnabled "false" }}" + # TCP port that the Prometheus metrics server should bind to + - name: FELIX_PROMETHEUSMETRICSPORT + value: "{{- or .Networking.Canal.PrometheusMetricsPort "9091" }}" + # Enable Prometheus Go runtime metrics collection + - name: FELIX_PROMETHEUSGOMETRICSENABLED + value: "{{- or .Networking.Canal.PrometheusGoMetricsEnabled "true" }}" + # Enable Prometheus process metrics collection + - name: FELIX_PROMETHEUSPROCESSMETRICSENABLED + value: "{{- or .Networking.Canal.PrometheusProcessMetricsEnabled "true" }}" + - name: FELIX_HEALTHENABLED + value: "true" + securityContext: + privileged: true + resources: + requests: + cpu: 250m + livenessProbe: + httpGet: + path: /liveness + port: 9099 + host: localhost + periodSeconds: 10 + initialDelaySeconds: 10 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: 9099 + host: localhost + periodSeconds: 10 + volumeMounts: + - mountPath: /lib/modules + name: lib-modules + readOnly: true + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - mountPath: /var/run/calico + name: var-run-calico + readOnly: false + - mountPath: /var/lib/calico + name: var-lib-calico + readOnly: false + # This container installs the Calico CNI binaries + # and CNI network config file on each node. + - name: install-cni + image: quay.io/calico/cni:v3.3.0 + command: ["/install-cni.sh"] + env: + # Name of the CNI config file to create. + - name: CNI_CONF_NAME + value: "10-canal.conflist" + # Set the hostname based on the k8s node name. + - name: KUBERNETES_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # The CNI network config to install on each node. + - name: CNI_NETWORK_CONFIG + valueFrom: + configMapKeyRef: + name: canal-config + key: cni_network_config + volumeMounts: + - mountPath: /host/opt/cni/bin + name: cni-bin-dir + - mountPath: /host/etc/cni/net.d + name: cni-net-dir + # This container runs flannel using the kube-subnet-mgr backend + # for allocating subnets. + - name: kube-flannel + image: quay.io/coreos/flannel:v0.9.0 + command: [ "/opt/bin/flanneld", "--ip-masq", "--kube-subnet-mgr" ] + securityContext: + privileged: true + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: FLANNELD_IFACE + valueFrom: + configMapKeyRef: + name: canal-config + key: canal_iface + - name: FLANNELD_IP_MASQ + valueFrom: + configMapKeyRef: + name: canal-config + key: masquerade + volumeMounts: + - mountPath: /run/xtables.lock + name: xtables-lock + readOnly: false + - name: flannel-cfg + mountPath: /etc/kube-flannel/ + volumes: + # Used by calico/node. + - name: lib-modules + hostPath: + path: /lib/modules + - name: var-run-calico + hostPath: + path: /var/run/calico + - name: var-lib-calico + hostPath: + path: /var/lib/calico + - name: xtables-lock + hostPath: + path: /run/xtables.lock + type: FileOrCreate + # Used by flannel. + - name: flannel-cfg + configMap: + name: canal-config + # Used to install CNI. + - name: cni-bin-dir + hostPath: + path: /opt/cni/bin + - name: cni-net-dir + hostPath: + path: /etc/cni/net.d +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: canal + namespace: kube-system + +--- + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: calico +rules: + - apiGroups: [""] + resources: + - namespaces + - serviceaccounts + verbs: + - get + - list + - watch + - apiGroups: [""] + resources: + - pods/status + verbs: + - patch + - apiGroups: [""] + resources: + - pods + verbs: + - get + - list + - watch + - apiGroups: [""] + resources: + - services + verbs: + - get + - apiGroups: [""] + resources: + - endpoints + verbs: + - get + - apiGroups: [""] + resources: + - nodes + verbs: + - get + - list + - update + - watch + - apiGroups: ["networking.k8s.io"] + resources: + - networkpolicies + verbs: + - get + - list + - watch + - apiGroups: ["crd.projectcalico.org"] + resources: + - globalfelixconfigs + - felixconfigurations + - bgppeers + - globalbgpconfigs + - globalnetworksets + - hostendpoints + - bgpconfigurations + - ippools + - globalnetworkpolicies + - networkpolicies + - clusterinformations + verbs: + - create + - get + - list + - update + - watch + +--- + +# Flannel roles +# Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: flannel +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - nodes/status + verbs: + - patch +--- + +# Bind the flannel ClusterRole to the canal ServiceAccount. +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: canal-flannel +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flannel +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system + +--- + +# Bind the ClusterRole to the canal ServiceAccount. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: canal-calico +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico +subjects: +- kind: ServiceAccount + name: canal + namespace: kube-system + +--- + +# Create all the CustomResourceDefinitions needed for +# Calico policy and networking mode. + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: felixconfigurations.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: FelixConfiguration + plural: felixconfigurations + singular: felixconfiguration +--- + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: bgpconfigurations.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: BGPConfiguration + plural: bgpconfigurations + singular: bgpconfiguration + +--- + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: ippools.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: IPPool + plural: ippools + singular: ippool + +--- + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: hostendpoints.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: HostEndpoint + plural: hostendpoints + singular: hostendpoint + +--- + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: clusterinformations.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: ClusterInformation + plural: clusterinformations + singular: clusterinformation + +--- + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: globalnetworkpolicies.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: GlobalNetworkPolicy + plural: globalnetworkpolicies + singular: globalnetworkpolicy + +--- + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: globalnetworksets.crd.projectcalico.org +spec: + scope: Cluster + group: crd.projectcalico.org + version: v1 + names: + kind: GlobalNetworkSet + plural: globalnetworksets + singular: globalnetworkset + +--- + +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: networkpolicies.crd.projectcalico.org +spec: + scope: Namespaced + group: crd.projectcalico.org + version: v1 + names: + kind: NetworkPolicy + plural: networkpolicies + singular: networkpolicy diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index 2b75a5c6ef03b..49644c3912035 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -701,6 +701,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri "k8s-1.6": "2.4.2-kops.2", "k8s-1.8": "2.6.7-kops.3", "k8s-1.9": "3.2.3-kops.1", + "k8s-1.12": "3.3.0-kops.1", } { id := "pre-k8s-1.6" @@ -760,6 +761,20 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri }) manifests[key+"-"+id] = "addons/" + location } + { + id := "k8s-1.12" + location := key + "/" + id + ".yaml" + + addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{ + Name: fi.String(key), + Version: fi.String(versions[id]), + Selector: networkingSelector, + Manifest: fi.String(location), + KubernetesVersion: ">=1.12.0", + Id: id, + }) + manifests[key+"-"+id] = "addons/" + location + } } if b.cluster.Spec.Networking.Kuberouter != nil { From 72287214399c8b202e74f2ecf5f7626553c22f22 Mon Sep 17 00:00:00 2001 From: Jay Eno Date: Fri, 2 Nov 2018 23:46:02 -0600 Subject: [PATCH 032/163] Update test for new role --- pkg/model/iam/tests/iam_builder_master_strict.json | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/model/iam/tests/iam_builder_master_strict.json b/pkg/model/iam/tests/iam_builder_master_strict.json index f5f595b4bfa6f..fbd0b74ca1016 100644 --- a/pkg/model/iam/tests/iam_builder_master_strict.json +++ b/pkg/model/iam/tests/iam_builder_master_strict.json @@ -138,6 +138,7 @@ "Effect": "Allow", "Action": [ "s3:GetBucketLocation", + "s3:GetEncryptionConfiguration", "s3:ListBucket" ], "Resource": [ From 107b079cf6b31aa53588ef130978258d72a01ed5 Mon Sep 17 00:00:00 2001 From: Jay Eno Date: Fri, 2 Nov 2018 23:50:30 -0600 Subject: [PATCH 033/163] Add permission to check encryption policy on root bucket. --- pkg/model/iam/iam_builder.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/model/iam/iam_builder.go b/pkg/model/iam/iam_builder.go index 5c5c4407e32ae..707962929efe5 100644 --- a/pkg/model/iam/iam_builder.go +++ b/pkg/model/iam/iam_builder.go @@ -314,7 +314,7 @@ func (b *PolicyBuilder) AddS3Permissions(p *Policy) (*Policy, error) { p.Statement = append(p.Statement, &Statement{ Effect: StatementEffectAllow, - Action: stringorslice.Of("s3:GetBucketLocation", "s3:ListBucket"), + Action: stringorslice.Of("s3:GetBucketLocation", "s3:GetEncryptionConfiguration", "s3:ListBucket"), Resource: stringorslice.Slice([]string{ strings.Join([]string{b.IAMPrefix(), ":s3:::", s3Path.Bucket()}, ""), }), From d7dab870c940d7aeefd33b558b5652299e259598 Mon Sep 17 00:00:00 2001 From: Jay Eno Date: Sat, 3 Nov 2018 01:01:08 -0600 Subject: [PATCH 034/163] Update iam_builder_master_legacy.json --- pkg/model/iam/tests/iam_builder_master_legacy.json | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/model/iam/tests/iam_builder_master_legacy.json b/pkg/model/iam/tests/iam_builder_master_legacy.json index c5d9728b38993..640fce7d63f88 100644 --- a/pkg/model/iam/tests/iam_builder_master_legacy.json +++ b/pkg/model/iam/tests/iam_builder_master_legacy.json @@ -48,6 +48,7 @@ "Effect": "Allow", "Action": [ "s3:GetBucketLocation", + "s3:GetEncryptionConfiguration", "s3:ListBucket" ], "Resource": [ From ccfee27165b3041c1ed382706aa62872c98e0f22 Mon Sep 17 00:00:00 2001 From: Jay Eno Date: Sat, 3 Nov 2018 01:01:47 -0600 Subject: [PATCH 035/163] Update iam_builder_master_strict_ecr.json --- pkg/model/iam/tests/iam_builder_master_strict_ecr.json | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/model/iam/tests/iam_builder_master_strict_ecr.json b/pkg/model/iam/tests/iam_builder_master_strict_ecr.json index 0ebd4459010b1..a21d001eb9501 100644 --- a/pkg/model/iam/tests/iam_builder_master_strict_ecr.json +++ b/pkg/model/iam/tests/iam_builder_master_strict_ecr.json @@ -138,6 +138,7 @@ "Effect": "Allow", "Action": [ "s3:GetBucketLocation", + "s3:GetEncryptionConfiguration", "s3:ListBucket" ], "Resource": [ From b0201c5922b07a3391b46e88353cd4fe9370f871 Mon Sep 17 00:00:00 2001 From: Jay Eno Date: Sat, 3 Nov 2018 01:02:24 -0600 Subject: [PATCH 036/163] Update iam_builder_node_legacy.json --- pkg/model/iam/tests/iam_builder_node_legacy.json | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/model/iam/tests/iam_builder_node_legacy.json b/pkg/model/iam/tests/iam_builder_node_legacy.json index 1c330cbf37094..5926662e64082 100644 --- a/pkg/model/iam/tests/iam_builder_node_legacy.json +++ b/pkg/model/iam/tests/iam_builder_node_legacy.json @@ -15,6 +15,7 @@ "Effect": "Allow", "Action": [ "s3:GetBucketLocation", + "s3:GetEncryptionConfiguration", "s3:ListBucket" ], "Resource": [ From e5c12bdbef5beef61fc52842524aeb008c83ef9b Mon Sep 17 00:00:00 2001 From: Jay Eno Date: Sat, 3 Nov 2018 01:02:42 -0600 Subject: [PATCH 037/163] Update iam_builder_node_strict.json --- pkg/model/iam/tests/iam_builder_node_strict.json | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/model/iam/tests/iam_builder_node_strict.json b/pkg/model/iam/tests/iam_builder_node_strict.json index 1d28f2718a119..aa7b32f2471f7 100644 --- a/pkg/model/iam/tests/iam_builder_node_strict.json +++ b/pkg/model/iam/tests/iam_builder_node_strict.json @@ -15,6 +15,7 @@ "Effect": "Allow", "Action": [ "s3:GetBucketLocation", + "s3:GetEncryptionConfiguration", "s3:ListBucket" ], "Resource": [ From e0948842f380a155dd076c63790a4d1809047d8e Mon Sep 17 00:00:00 2001 From: Jay Eno Date: Sat, 3 Nov 2018 01:03:01 -0600 Subject: [PATCH 038/163] Update iam_builder_node_strict_ecr.json --- pkg/model/iam/tests/iam_builder_node_strict_ecr.json | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/model/iam/tests/iam_builder_node_strict_ecr.json b/pkg/model/iam/tests/iam_builder_node_strict_ecr.json index 10053f1c0d519..61df952ce32bb 100644 --- a/pkg/model/iam/tests/iam_builder_node_strict_ecr.json +++ b/pkg/model/iam/tests/iam_builder_node_strict_ecr.json @@ -15,6 +15,7 @@ "Effect": "Allow", "Action": [ "s3:GetBucketLocation", + "s3:GetEncryptionConfiguration", "s3:ListBucket" ], "Resource": [ From 6ba9f22ab8e8c14598d037e37aaa30576c517632 Mon Sep 17 00:00:00 2001 From: mooncake Date: Sun, 4 Nov 2018 16:59:45 +0800 Subject: [PATCH 039/163] Fix typos: iff -> if Signed-off-by: mooncake --- channels/pkg/channels/addons_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/channels/pkg/channels/addons_test.go b/channels/pkg/channels/addons_test.go index 6c03ed9b119aa..1a4ae6458576a 100644 --- a/channels/pkg/channels/addons_test.go +++ b/channels/pkg/channels/addons_test.go @@ -83,7 +83,7 @@ func Test_Replacement(t *testing.T) { New *ChannelVersion Replaces bool }{ - // With no id, update iff newer semver + // With no id, update if newer semver { Old: &ChannelVersion{Version: s("1.0.0"), Id: ""}, New: &ChannelVersion{Version: s("1.0.0"), Id: ""}, From f1aae1d2687b25c45fcdce9953e1ce4c3bc083de Mon Sep 17 00:00:00 2001 From: Bily Zhang Date: Mon, 5 Nov 2018 21:21:16 +0800 Subject: [PATCH 040/163] Update addons_test.go --- channels/pkg/channels/addons_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/channels/pkg/channels/addons_test.go b/channels/pkg/channels/addons_test.go index 1a4ae6458576a..5b6ea934dc585 100644 --- a/channels/pkg/channels/addons_test.go +++ b/channels/pkg/channels/addons_test.go @@ -83,7 +83,7 @@ func Test_Replacement(t *testing.T) { New *ChannelVersion Replaces bool }{ - // With no id, update if newer semver + // With no id, update if and only if newer semver { Old: &ChannelVersion{Version: s("1.0.0"), Id: ""}, New: &ChannelVersion{Version: s("1.0.0"), Id: ""}, From c649312a4a5d3415422e88819ab2b2b243e55c1b Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 5 Nov 2018 17:29:03 +0000 Subject: [PATCH 041/163] Update Weave Net to version 2.5.0 This release adds support for Kubernetes `hostPort` mapping and the `ipBlock` NetworkPolicy feature, plus many other improvements. Release notes https://github.com/weaveworks/weave/releases/tag/v2.5.0 Signed-off-by: Bryan Boreham --- .../resources/addons/networking.weave/k8s-1.7.yaml.template | 4 ++-- .../resources/addons/networking.weave/k8s-1.8.yaml.template | 4 ++-- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 4 ++-- .../cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/upup/models/cloudup/resources/addons/networking.weave/k8s-1.7.yaml.template b/upup/models/cloudup/resources/addons/networking.weave/k8s-1.7.yaml.template index e1a0fe384bda1..9fe75e06bda1c 100644 --- a/upup/models/cloudup/resources/addons/networking.weave/k8s-1.7.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.weave/k8s-1.7.yaml.template @@ -155,7 +155,7 @@ spec: name: weave-net key: network-password {{- end }} - image: 'weaveworks/weave-kube:2.4.1' + image: 'weaveworks/weave-kube:2.5.0' livenessProbe: httpGet: host: 127.0.0.1 @@ -193,7 +193,7 @@ spec: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - image: 'weaveworks/weave-npc:2.4.1' + image: 'weaveworks/weave-npc:2.5.0' resources: requests: cpu: 50m diff --git a/upup/models/cloudup/resources/addons/networking.weave/k8s-1.8.yaml.template b/upup/models/cloudup/resources/addons/networking.weave/k8s-1.8.yaml.template index e52c78e2b7140..8a94036650306 100644 --- a/upup/models/cloudup/resources/addons/networking.weave/k8s-1.8.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.weave/k8s-1.8.yaml.template @@ -159,7 +159,7 @@ spec: name: weave-net key: network-password {{- end }} - image: 'weaveworks/weave-kube:2.4.1' + image: 'weaveworks/weave-kube:2.5.0' livenessProbe: httpGet: host: 127.0.0.1 @@ -197,7 +197,7 @@ spec: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - image: 'weaveworks/weave-npc:2.4.1' + image: 'weaveworks/weave-npc:2.5.0' resources: requests: cpu: 50m diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index 2b75a5c6ef03b..44bb5d19a5577 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -539,8 +539,8 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri versions := map[string]string{ "pre-k8s-1.6": "2.3.0-kops.2", "k8s-1.6": "2.3.0-kops.2", - "k8s-1.7": "2.4.1-kops.1", - "k8s-1.8": "2.4.1-kops.1", + "k8s-1.7": "2.5.0-kops.1", + "k8s-1.8": "2.5.0-kops.1", } { diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml index 18f88d3286ccc..4d02e19993837 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml @@ -83,11 +83,11 @@ spec: name: networking.weave selector: role.kubernetes.io/networking: "1" - version: 2.4.1-kops.1 + version: 2.5.0-kops.1 - id: k8s-1.8 kubernetesVersion: '>=1.8.0' manifest: networking.weave/k8s-1.8.yaml name: networking.weave selector: role.kubernetes.io/networking: "1" - version: 2.4.1-kops.1 + version: 2.5.0-kops.1 From fdd8a3084142f2700c4454f5cd60b6fa027c7123 Mon Sep 17 00:00:00 2001 From: Liran Polak Date: Mon, 5 Nov 2018 21:46:32 +0200 Subject: [PATCH 042/163] fix: vpc.id null check --- upup/pkg/fi/cloudup/awstasks/securitygroup.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/upup/pkg/fi/cloudup/awstasks/securitygroup.go b/upup/pkg/fi/cloudup/awstasks/securitygroup.go index e2a3d4d9dc457..dbc92401d2dd3 100644 --- a/upup/pkg/fi/cloudup/awstasks/securitygroup.go +++ b/upup/pkg/fi/cloudup/awstasks/securitygroup.go @@ -102,7 +102,7 @@ func (e *SecurityGroup) findEc2(c *fi.Context) (*ec2.SecurityGroup, error) { // Find by ID. request.GroupIds = []*string{e.ID} - } else if fi.StringValue(e.Name) != "" && e.VPC != nil { + } else if fi.StringValue(e.Name) != "" && e.VPC != nil && e.VPC.ID != nil { // Find by filters (name and VPC ID). filters := cloud.BuildFilters(e.Name) filters = append(filters, awsup.NewEC2Filter("vpc-id", *e.VPC.ID)) From 098266e8751e0712db652f1f999dbe61e52de317 Mon Sep 17 00:00:00 2001 From: Vlad Ionescu Date: Tue, 6 Nov 2018 13:08:40 +0200 Subject: [PATCH 043/163] Fail fast if io2 iops to size ratio is too high In AWS the ratio between volume IOPS and volume size must be at most 50, otherwise volume will fail creating. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html, specifically "_The maximum ratio of provisioned IOPS to requested volume size (in GiB) is 50:1. For example, a 100 GiB volume can be provisioned with up to 5,000 IOPS._" This commit adds the option of failing fast when creating a new cluster if the ratio is higher than 50. Previously kops would send the API request to AWS, fail and repeat until the timeout was reached. --- pkg/model/master_volumes.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/pkg/model/master_volumes.go b/pkg/model/master_volumes.go index 0fed42efe7f96..72ced7f2b184f 100644 --- a/pkg/model/master_volumes.go +++ b/pkg/model/master_volumes.go @@ -92,7 +92,10 @@ func (b *MasterVolumeBuilder) Build(c *fi.ModelBuilderContext) error { switch kops.CloudProviderID(b.Cluster.Spec.CloudProvider) { case kops.CloudProviderAWS: - b.addAWSVolume(c, name, volumeSize, zone, etcd, m, allMembers) + err = b.addAWSVolume(c, name, volumeSize, zone, etcd, m, allMembers) + if err != nil { + return err + } case kops.CloudProviderDO: b.addDOVolume(c, name, volumeSize, zone, etcd, m, allMembers) case kops.CloudProviderGCE: @@ -116,7 +119,7 @@ func (b *MasterVolumeBuilder) Build(c *fi.ModelBuilderContext) error { return nil } -func (b *MasterVolumeBuilder) addAWSVolume(c *fi.ModelBuilderContext, name string, volumeSize int32, zone string, etcd *kops.EtcdClusterSpec, m *kops.EtcdMemberSpec, allMembers []string) { +func (b *MasterVolumeBuilder) addAWSVolume(c *fi.ModelBuilderContext, name string, volumeSize int32, zone string, etcd *kops.EtcdClusterSpec, m *kops.EtcdMemberSpec, allMembers []string) error { volumeType := fi.StringValue(m.VolumeType) volumeIops := fi.Int32Value(m.VolumeIops) switch volumeType { @@ -160,9 +163,16 @@ func (b *MasterVolumeBuilder) addAWSVolume(c *fi.ModelBuilderContext, name strin } if volumeType == "io1" { t.VolumeIops = i64(int64(volumeIops)) + + // https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html + if float64(*t.VolumeIops)/float64(*t.SizeGB) > 50.0 { + return fmt.Errorf("volumeIops to volumeSize ratio must be lower than 50. For %s ratio is %f", *t.Name, float64(*t.VolumeIops)/float64(*t.SizeGB)) + } } c.AddTask(t) + + return nil } func (b *MasterVolumeBuilder) addDOVolume(c *fi.ModelBuilderContext, name string, volumeSize int32, zone string, etcd *kops.EtcdClusterSpec, m *kops.EtcdMemberSpec, allMembers []string) { From ab28795faa12bfe18e84aa90c217404fd30fec1a Mon Sep 17 00:00:00 2001 From: Vlad Ionescu Date: Tue, 6 Nov 2018 13:23:08 +0200 Subject: [PATCH 044/163] Detail Calico BGP route reflector requirements As per Lance Robson's message in Slack, https://kubernetes.slack.com/archives/C3QUFP0QM/p1537959279000100?thread_ts=1537951563.000100&cid=C3QUFP0QM above 50-100 nodes Calico recommends usage of BGP route reflectors: > Clearly I'm not impartial here, but I can tell you that we test Calico to 5K > nodes. > We recommend BGP route reflectors once you go above ~50-100 nodes (we test up > to 100 nodes without RRs). The reason for RRs is that by default calico sets up > BGP connections in a full mesh - clearly the number of connections will scale as > the number of nodes squared. With RRs, the number of BGP connections scales > linearly with nodes - but then you have to manage the RRs too. > The next version of Calico (v3.3 - code is in master already, but not heavily > tested yet) will bring a feature to make RRs much easier to deploy - just > annotate a few nodes and they become RRs. Adding this detail to documentation as I recently got a cluster with such issues. --- docs/networking.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/networking.md b/docs/networking.md index 3c53fc9c5c111..948e8994451db 100644 --- a/docs/networking.md +++ b/docs/networking.md @@ -122,7 +122,7 @@ $ kops create secret weavepassword -f password $ kops update cluster ``` -Since unencrypted nodes will not be able to connect to nodes configured with encryption enabled, this configuration cannot be changed easily without downtime. +Since unencrypted nodes will not be able to connect to nodes configured with encryption enabled, this configuration cannot be changed easily without downtime. ### Calico Example for CNI and Network Policy @@ -158,7 +158,7 @@ Reference: [Calico 2.1 Release Notes](https://www.projectcalico.org/project-cali Note that Calico by default, routes between nodes within a subnet are distributed using a full node-to-node BGP mesh. Each node automatically sets up a BGP peering with every other node within the same L2 network. This full node-to-node mesh per L2 network has its scaling challenges for larger scale deployments. -BGP route reflectors can be used as a replacement to a full mesh, and is useful for scaling up a cluster. +BGP route reflectors can be used as a replacement to a full mesh, and is useful for scaling up a cluster. BGP route reflectors are recommended once the number of nodes goes above ~50-100. The setup of BGP route reflectors is currently out of the scope of kops. Read more here: [BGP route reflectors](http://docs.projectcalico.org/latest/usage/routereflector/calico-routereflector) From a918768991631af17d24d8e390cd37e8e8880469 Mon Sep 17 00:00:00 2001 From: Vlad Ionescu Date: Tue, 6 Nov 2018 14:44:13 +0200 Subject: [PATCH 045/163] Fix broken link --- docs/networking.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/networking.md b/docs/networking.md index 948e8994451db..777ca390d5da0 100644 --- a/docs/networking.md +++ b/docs/networking.md @@ -161,7 +161,7 @@ This full node-to-node mesh per L2 network has its scaling challenges for larger BGP route reflectors can be used as a replacement to a full mesh, and is useful for scaling up a cluster. BGP route reflectors are recommended once the number of nodes goes above ~50-100. The setup of BGP route reflectors is currently out of the scope of kops. -Read more here: [BGP route reflectors](http://docs.projectcalico.org/latest/usage/routereflector/calico-routereflector) +Read more here: [BGP route reflectors](https://docs.projectcalico.org/latest/usage/routereflector) To enable this mode in a cluster, with Calico as the CNI and Network Policy provider, you must edit the cluster after the previous `kops create ...` command. From 364834107ea54201707c3b676ad6f6f9524024b9 Mon Sep 17 00:00:00 2001 From: mooncake Date: Tue, 6 Nov 2018 23:43:29 +0800 Subject: [PATCH 046/163] Fix some typos Signed-off-by: mooncake --- cmd/kops/toolbox_template.go | 2 +- node-authorizer/pkg/server/types.go | 4 ++-- node-authorizer/pkg/utils/logger.go | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/cmd/kops/toolbox_template.go b/cmd/kops/toolbox_template.go index bcc493daf0151..e6a9ece790235 100644 --- a/cmd/kops/toolbox_template.go +++ b/cmd/kops/toolbox_template.go @@ -210,7 +210,7 @@ func runToolBoxTemplate(f *util.Factory, out io.Writer, options *toolboxTemplate return nil } -// newTemplateContext is responsible for loadding the --values and build a context for the template +// newTemplateContext is responsible for loading the --values and build a context for the template func newTemplateContext(files []string, values []string, stringValues []string) (map[string]interface{}, error) { context := make(map[string]interface{}, 0) diff --git a/node-authorizer/pkg/server/types.go b/node-authorizer/pkg/server/types.go index f31b70929a34b..fd012801dcac1 100644 --- a/node-authorizer/pkg/server/types.go +++ b/node-authorizer/pkg/server/types.go @@ -68,7 +68,7 @@ type Config struct { Features []string // EnableVerbose indicate verbose logging EnableVerbose bool - // ClientCommonName is the common name on the client certiicate if mutual tls is enabled + // ClientCommonName is the common name on the client certificate if mutual tls is enabled ClientCommonName string // ClusterName is the name of the kubernetes cluster ClusterName string @@ -168,7 +168,7 @@ type Authorizer interface { // Verifier is the client side of authorizer type Verifier interface { - // VerifyIdentity is responisible for constructing the parameters for a request + // VerifyIdentity is responsible for constructing the parameters for a request VerifyIdentity(context.Context) ([]byte, error) } diff --git a/node-authorizer/pkg/utils/logger.go b/node-authorizer/pkg/utils/logger.go index 97f025d3b7e65..2c18fc0b0f13f 100644 --- a/node-authorizer/pkg/utils/logger.go +++ b/node-authorizer/pkg/utils/logger.go @@ -21,7 +21,7 @@ import ( ) var ( - // Logger is the defaut logger + // Logger is the default logger Logger *zap.Logger ) From 5826e4f361f767431de00e0a5c1ce42a259b3bd9 Mon Sep 17 00:00:00 2001 From: xichengliudui Date: Wed, 7 Nov 2018 00:57:10 -0500 Subject: [PATCH 047/163] Remove unnecessary code --- cmd/kops/create_cluster.go | 9 +++------ cmd/kops/create_cluster_test.go | 5 ++--- cmd/kops/replace.go | 5 ++--- cmd/kops/root.go | 5 ++--- 4 files changed, 9 insertions(+), 15 deletions(-) diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index 66184b1ac27e6..c8f69dd3946a3 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -496,9 +496,8 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e if cluster.Spec.CloudProvider == "" { if allZones.Len() == 0 { return fmt.Errorf("must specify --zones or --cloud") - } else { - return fmt.Errorf("unable to infer CloudProvider from Zones (is there a typo in --zones?)") } + return fmt.Errorf("unable to infer CloudProvider from Zones (is there a typo in --zones?)") } } @@ -1368,11 +1367,9 @@ func loadSSHPublicKeys(sshPublicKey string) (map[string][]byte, error) { authorized, err := ioutil.ReadFile(sshPublicKey) if err != nil { return nil, err - } else { - sshPublicKeys[fi.SecretNameSSHPrimary] = authorized - - glog.Infof("Using SSH public key: %v\n", sshPublicKey) } + sshPublicKeys[fi.SecretNameSSHPrimary] = authorized + glog.Infof("Using SSH public key: %v\n", sshPublicKey) } return sshPublicKeys, nil } diff --git a/cmd/kops/create_cluster_test.go b/cmd/kops/create_cluster_test.go index d94eb1e7119f9..17f4b69eaedf6 100644 --- a/cmd/kops/create_cluster_test.go +++ b/cmd/kops/create_cluster_test.go @@ -36,9 +36,8 @@ func checkParse(t *testing.T, s string, expect map[string]string, shouldErr bool if err != nil { if shouldErr { return - } else { - t.Errorf(err.Error()) - } + } + t.Errorf(err.Error()) } for k, v := range expect { diff --git a/cmd/kops/replace.go b/cmd/kops/replace.go index 86375e34428ed..38688946928b5 100644 --- a/cmd/kops/replace.go +++ b/cmd/kops/replace.go @@ -165,9 +165,8 @@ func RunReplace(f *util.Factory, cmd *cobra.Command, out io.Writer, c *replaceOp if err != nil { if errors.IsNotFound(err) { return fmt.Errorf("cluster %q not found", clusterName) - } else { - return fmt.Errorf("error fetching cluster %q: %v", clusterName, err) - } + } + return fmt.Errorf("error fetching cluster %q: %v", clusterName, err) } // check if the instancegroup exists already igName := v.ObjectMeta.Name diff --git a/cmd/kops/root.go b/cmd/kops/root.go index 399a6acc0a314..9c483f567f41b 100644 --- a/cmd/kops/root.go +++ b/cmd/kops/root.go @@ -221,9 +221,8 @@ func (c *RootCmd) ProcessArgs(args []string) error { if len(args) == 1 { return fmt.Errorf("Cannot specify cluster via --name and positional argument") - } else { - return fmt.Errorf("expected a single to be passed as an argument") - } + } + return fmt.Errorf("expected a single to be passed as an argument") } func (c *RootCmd) ClusterName() string { From 3a8078763aed744f986dde20b6253695502823f9 Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Thu, 22 Mar 2018 11:59:56 -0700 Subject: [PATCH 048/163] Adds support for Lyft's cni-ipvlan-vpc-k8s https://github.com/lyft/cni-ipvlan-vpc-k8s This cni solution is slightly different in that it doesn't require running a daemonset It requires: * a config file in /etc/cni/net.d * the binaries in /opt/cni/bin * adding the --node-ip param to the kubelet This code is modeled after the AmazonVPC cni bits. I've left the setup of the required subnets as an exercise to the reader. --- cmd/kops/create_cluster.go | 2 + nodeup/pkg/model/context.go | 2 +- nodeup/pkg/model/network.go | 14 +++- pkg/apis/kops/cluster.go | 4 + pkg/apis/kops/networking.go | 38 ++++++---- pkg/apis/kops/v1alpha1/networking.go | 38 ++++++---- pkg/apis/kops/v1alpha2/networking.go | 38 ++++++---- pkg/apis/kops/validation/legacy.go | 12 ++- pkg/model/components/context.go | 2 +- pkg/model/components/kubecontrollermanager.go | 2 +- pkg/model/components/networking.go | 3 +- pkg/model/iam/iam_builder.go | 36 +++++++++ .../10-cni-ipvlan-vpc-k8s.conflist.template | 33 ++++++++ upup/pkg/fi/cloudup/networking.go | 5 ++ upup/pkg/fi/cloudup/tagbuilder.go | 10 +++ upup/pkg/fi/nodeup/command.go | 75 ++++++++++++++++++- upup/pkg/fi/nodeup/nodetasks/archive.go | 10 ++- 17 files changed, 275 insertions(+), 49 deletions(-) create mode 100644 upup/models/nodeup/resources/_amazon_vpc_ipvlan/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index 66184b1ac27e6..0b07c2b43aad6 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -929,6 +929,8 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e cluster.Spec.Networking.AmazonVPC = &api.AmazonVPCNetworkingSpec{} case "cilium": cluster.Spec.Networking.Cilium = &api.CiliumNetworkingSpec{} + case "amazonvpcipvlan": + cluster.Spec.Networking.AmazonVPCIPVlan = &api.AmazonVPCIPVlanNetworkingSpec{} default: return fmt.Errorf("unknown networking mode %q", c.Networking) } diff --git a/nodeup/pkg/model/context.go b/nodeup/pkg/model/context.go index 2d80c0cabf586..1112629ddd4fa 100644 --- a/nodeup/pkg/model/context.go +++ b/nodeup/pkg/model/context.go @@ -288,7 +288,7 @@ func (c *NodeupModelContext) UseNodeAuthorizer() bool { // UsesSecondaryIP checks if the CNI in use attaches secondary interfaces to the host. func (c *NodeupModelContext) UsesSecondaryIP() bool { - if (c.Cluster.Spec.Networking.CNI != nil && c.Cluster.Spec.Networking.CNI.UsesSecondaryIP) || c.Cluster.Spec.Networking.AmazonVPC != nil { + if (c.Cluster.Spec.Networking.CNI != nil && c.Cluster.Spec.Networking.CNI.UsesSecondaryIP) || c.Cluster.Spec.Networking.AmazonVPC != nil || c.Cluster.Spec.Networking.AmazonVPCIPVlan != nil { return true } diff --git a/nodeup/pkg/model/network.go b/nodeup/pkg/model/network.go index 65550e9eba586..56173d5fbc20c 100644 --- a/nodeup/pkg/model/network.go +++ b/nodeup/pkg/model/network.go @@ -43,7 +43,8 @@ func (b *NetworkBuilder) Build(c *fi.ModelBuilderContext) error { } else if networking.External != nil { // external is based on kubenet assetNames = append(assetNames, "bridge", "host-local", "loopback") - } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil { + + } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.AmazonVPCIPVlan != nil { assetNames = append(assetNames, "bridge", "host-local", "loopback", "ptp") // Do we need tuning? @@ -67,6 +68,17 @@ func (b *NetworkBuilder) Build(c *fi.ModelBuilderContext) error { } } + if networking.AmazonVPCIPVlan != nil { + binDownloadTask := &nodetasks.Archive{ + Source: networking.AmazonVPCIPVlan.BinariesDownloadURL, + TargetDir: "/opt/cni/bin", + Name: "cni-ipvlan-vpc-k8s-binaries", + Gzip: true, + } + + c.AddTask(binDownloadTask) + } + return nil } diff --git a/pkg/apis/kops/cluster.go b/pkg/apis/kops/cluster.go index b4e8b5e5b32b3..005ee38ad0d4a 100644 --- a/pkg/apis/kops/cluster.go +++ b/pkg/apis/kops/cluster.go @@ -536,6 +536,10 @@ func (c *Cluster) FillDefaults() error { c.Spec.Networking.Cilium.Version = CiliumDefaultVersion } // OK + } else if c.Spec.Networking.AmazonVPCIPVlan != nil { + if c.Spec.Networking.AmazonVPCIPVlan.BinariesDownloadURL == "" { + c.Spec.Networking.AmazonVPCIPVlan.BinariesDownloadURL = "https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.3.1/cni-ipvlan-vpc-k8s-v0.3.1.tar.gz" + } } else { // No networking model selected; choose Kubenet c.Spec.Networking.Kubenet = &KubenetNetworkingSpec{} diff --git a/pkg/apis/kops/networking.go b/pkg/apis/kops/networking.go index 33ba74d5dab86..785b91e73194a 100644 --- a/pkg/apis/kops/networking.go +++ b/pkg/apis/kops/networking.go @@ -18,19 +18,20 @@ package kops // NetworkingSpec allows selection and configuration of a networking plugin type NetworkingSpec struct { - Classic *ClassicNetworkingSpec `json:"classic,omitempty"` - Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` - External *ExternalNetworkingSpec `json:"external,omitempty"` - CNI *CNINetworkingSpec `json:"cni,omitempty"` - Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` - Weave *WeaveNetworkingSpec `json:"weave,omitempty"` - Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` - Calico *CalicoNetworkingSpec `json:"calico,omitempty"` - Canal *CanalNetworkingSpec `json:"canal,omitempty"` - Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` - Romana *RomanaNetworkingSpec `json:"romana,omitempty"` - AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` - Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` + Classic *ClassicNetworkingSpec `json:"classic,omitempty"` + Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` + External *ExternalNetworkingSpec `json:"external,omitempty"` + CNI *CNINetworkingSpec `json:"cni,omitempty"` + Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` + Weave *WeaveNetworkingSpec `json:"weave,omitempty"` + Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` + Calico *CalicoNetworkingSpec `json:"calico,omitempty"` + Canal *CanalNetworkingSpec `json:"canal,omitempty"` + Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` + Romana *RomanaNetworkingSpec `json:"romana,omitempty"` + AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` + Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` + AmazonVPCIPVlan *AmazonVPCIPVlanNetworkingSpec `json:"amazonvpcipvlan,omitempty"` } // ClassicNetworkingSpec is the specification of classic networking mode, integrated into kubernetes @@ -188,3 +189,14 @@ type CiliumNetworkingSpec struct { TracePayloadLen int `json:"tracePayloadlen,omitempty"` Tunnel string `json:"tunnel,omitempty"` } + +// LyftIpVlanNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking +type AmazonVPCIPVlanNetworkingSpec struct { + // Tags that subnets must have to be used for pod IPs + SubnetTags map[string]string `json:"subnetTags,omitempty"` + InterfaceIndex int `json:"interfaceIndex,omitempty"` + RouteToVPCPeers bool `json:"routeToVPCPeers,omitempty"` + // list of security groups to assign to the ENIs for pods + SecurityGroupIds []string `json:"securityGroupIds,omitempty"` + BinariesDownloadURL string `json:"binariesDownloadURL,omitempty"` +} diff --git a/pkg/apis/kops/v1alpha1/networking.go b/pkg/apis/kops/v1alpha1/networking.go index d30ce6c6081a4..48541948f9642 100644 --- a/pkg/apis/kops/v1alpha1/networking.go +++ b/pkg/apis/kops/v1alpha1/networking.go @@ -18,19 +18,20 @@ package v1alpha1 // NetworkingSpec allows selection and configuration of a networking plugin type NetworkingSpec struct { - Classic *ClassicNetworkingSpec `json:"classic,omitempty"` - Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` - External *ExternalNetworkingSpec `json:"external,omitempty"` - CNI *CNINetworkingSpec `json:"cni,omitempty"` - Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` - Weave *WeaveNetworkingSpec `json:"weave,omitempty"` - Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` - Calico *CalicoNetworkingSpec `json:"calico,omitempty"` - Canal *CanalNetworkingSpec `json:"canal,omitempty"` - Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` - Romana *RomanaNetworkingSpec `json:"romana,omitempty"` - AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` - Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` + Classic *ClassicNetworkingSpec `json:"classic,omitempty"` + Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` + External *ExternalNetworkingSpec `json:"external,omitempty"` + CNI *CNINetworkingSpec `json:"cni,omitempty"` + Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` + Weave *WeaveNetworkingSpec `json:"weave,omitempty"` + Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` + Calico *CalicoNetworkingSpec `json:"calico,omitempty"` + Canal *CanalNetworkingSpec `json:"canal,omitempty"` + Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` + Romana *RomanaNetworkingSpec `json:"romana,omitempty"` + AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` + Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` + AmazonVPCIPVlan *AmazonVPCIPVlanNetworkingSpec `json:"amazonvpcipvlan,omitempty"` } // ClassicNetworkingSpec is the specification of classic networking mode, integrated into kubernetes @@ -185,3 +186,14 @@ type CiliumNetworkingSpec struct { TracePayloadLen int `json:"tracePayloadlen,omitempty"` Tunnel string `json:"tunnel,omitempty"` } + +// LyftIpVlanNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking +type AmazonVPCIPVlanNetworkingSpec struct { + // Tags that subnets must have to be used for pod IPs + SubnetTags map[string]string `json:"subnetTags,omitempty"` + InterfaceIndex int `json:"interfaceIndex,omitempty"` + RouteToVPCPeers bool `json:"routeToVPCPeers,omitempty"` + // list of security groups to assign to the ENIs for pods + SecurityGroupIds []string `json:"securityGroupIds,omitempty"` + BinariesDownloadURL string `json:"binariesDownloadURL,omitempty"` +} diff --git a/pkg/apis/kops/v1alpha2/networking.go b/pkg/apis/kops/v1alpha2/networking.go index b6c60ffe25588..5f9ddd8111b60 100644 --- a/pkg/apis/kops/v1alpha2/networking.go +++ b/pkg/apis/kops/v1alpha2/networking.go @@ -18,19 +18,20 @@ package v1alpha2 // NetworkingSpec allows selection and configuration of a networking plugin type NetworkingSpec struct { - Classic *ClassicNetworkingSpec `json:"classic,omitempty"` - Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` - External *ExternalNetworkingSpec `json:"external,omitempty"` - CNI *CNINetworkingSpec `json:"cni,omitempty"` - Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` - Weave *WeaveNetworkingSpec `json:"weave,omitempty"` - Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` - Calico *CalicoNetworkingSpec `json:"calico,omitempty"` - Canal *CanalNetworkingSpec `json:"canal,omitempty"` - Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` - Romana *RomanaNetworkingSpec `json:"romana,omitempty"` - AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` - Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` + Classic *ClassicNetworkingSpec `json:"classic,omitempty"` + Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` + External *ExternalNetworkingSpec `json:"external,omitempty"` + CNI *CNINetworkingSpec `json:"cni,omitempty"` + Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` + Weave *WeaveNetworkingSpec `json:"weave,omitempty"` + Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` + Calico *CalicoNetworkingSpec `json:"calico,omitempty"` + Canal *CanalNetworkingSpec `json:"canal,omitempty"` + Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` + Romana *RomanaNetworkingSpec `json:"romana,omitempty"` + AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` + Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` + AmazonVPCIPVlan *AmazonVPCIPVlanNetworkingSpec `json:"amazonvpcipvlan,omitempty"` } // ClassicNetworkingSpec is the specification of classic networking mode, integrated into kubernetes @@ -186,3 +187,14 @@ type CiliumNetworkingSpec struct { TracePayloadLen int `json:"tracePayloadlen,omitempty"` Tunnel string `json:"tunnel,omitempty"` } + +// LyftIpVlanNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking +type AmazonVPCIPVlanNetworkingSpec struct { + // Tags that subnets must have to be used for pod IPs + SubnetTags map[string]string `json:"subnetTags,omitempty"` + InterfaceIndex int `json:"interfaceIndex,omitempty"` + RouteToVPCPeers bool `json:"routeToVPCPeers,omitempty"` + // list of security groups to assign to the ENIs for pods + SecurityGroupIds []string `json:"securityGroupIds,omitempty"` + BinariesDownloadURL string `json:"binariesDownloadURL,omitempty"` +} diff --git a/pkg/apis/kops/validation/legacy.go b/pkg/apis/kops/validation/legacy.go index ce59692f93758..ea5d253bbabae 100644 --- a/pkg/apis/kops/validation/legacy.go +++ b/pkg/apis/kops/validation/legacy.go @@ -191,7 +191,8 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { return field.Invalid(fieldSpec.Child("NonMasqueradeCIDR"), nonMasqueradeCIDRString, "Cluster had an invalid NonMasqueradeCIDR") } - if networkCIDR != nil && subnet.Overlap(nonMasqueradeCIDR, networkCIDR) && c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC == nil { + + if networkCIDR != nil && subnet.Overlap(nonMasqueradeCIDR, networkCIDR) && c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC == nil && c.Spec.Networking.AmazonVPCIPVlan == nil { return field.Invalid(fieldSpec.Child("NonMasqueradeCIDR"), nonMasqueradeCIDRString, fmt.Sprintf("NonMasqueradeCIDR %q cannot overlap with NetworkCIDR %q", nonMasqueradeCIDRString, c.Spec.NetworkCIDR)) } @@ -597,8 +598,9 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { } } - if c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC != nil && - (c.Spec.CloudProvider != "aws") { + + if c.Spec.Networking != nil && (c.Spec.Networking.AmazonVPC != nil || c.Spec.Networking.AmazonVPCIPVlan != nil) && + c.Spec.CloudProvider != "aws" { return field.Invalid(fieldSpec.Child("Networking"), "amazon-vpc-routed-eni", "amazon-vpc-routed-eni networking is supported only in AWS") } @@ -610,6 +612,10 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { if c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC != nil { return field.Invalid(fieldSpec.Child("Networking"), "amazon-vpc-routed-eni", "amazon-vpc-routed-eni networking is not supported with kubernetes versions 1.6 or lower") } + + if c.Spec.Networking != nil && c.Spec.Networking.AmazonVPCIPVlan != nil { + return field.Invalid(fieldSpec.Child("Networking"), "cni-ipvlan-vpc-k8s", "cni-ipvlan-vpc-k8s networking is not supported with kubernetes versions 1.6 or lower") + } } // Cilium specific validation rules diff --git a/pkg/model/components/context.go b/pkg/model/components/context.go index 0bce1cb49598e..062907723fbaf 100644 --- a/pkg/model/components/context.go +++ b/pkg/model/components/context.go @@ -78,7 +78,7 @@ func UsesKubenet(clusterSpec *kops.ClusterSpec) (bool, error) { } else if networking.External != nil { // external is based on kubenet return true, nil - } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil { + } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.AmazonVPCIPVlan != nil { return false, nil } else if networking.Kopeio != nil { // Kopeio is based on kubenet / external diff --git a/pkg/model/components/kubecontrollermanager.go b/pkg/model/components/kubecontrollermanager.go index d5116f58a42ae..468c24b77898f 100644 --- a/pkg/model/components/kubecontrollermanager.go +++ b/pkg/model/components/kubecontrollermanager.go @@ -152,7 +152,7 @@ func (b *KubeControllerManagerOptionsBuilder) BuildOptions(o interface{}) error kcm.ConfigureCloudRoutes = fi.Bool(true) } else if networking.External != nil { kcm.ConfigureCloudRoutes = fi.Bool(false) - } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil { + } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.AmazonVPCIPVlan != nil { kcm.ConfigureCloudRoutes = fi.Bool(false) } else if networking.Kopeio != nil { // Kopeio is based on kubenet / external diff --git a/pkg/model/components/networking.go b/pkg/model/components/networking.go index 6a86273a9a7d4..e36154f2ef73a 100644 --- a/pkg/model/components/networking.go +++ b/pkg/model/components/networking.go @@ -48,7 +48,8 @@ func (b *NetworkingOptionsBuilder) BuildOptions(o interface{}) error { if networking == nil { return fmt.Errorf("networking not set") } - if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil { + + if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.AmazonVPCIPVlan != nil { options.Kubelet.NetworkPluginName = "cni" if k8sVersion.Major == 1 && k8sVersion.Minor <= 4 { diff --git a/pkg/model/iam/iam_builder.go b/pkg/model/iam/iam_builder.go index 707962929efe5..8684e34ccffb0 100644 --- a/pkg/model/iam/iam_builder.go +++ b/pkg/model/iam/iam_builder.go @@ -188,6 +188,10 @@ func (b *PolicyBuilder) BuildAWSPolicyMaster() (*Policy, error) { addAmazonVPCCNIPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) } + if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.AmazonVPCIPVlan != nil { + addAmazonVPCIPVlanPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) + } + return p, nil } @@ -221,6 +225,10 @@ func (b *PolicyBuilder) BuildAWSPolicyNode() (*Policy, error) { addAmazonVPCCNIPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) } + if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.AmazonVPCIPVlan != nil { + addAmazonVPCIPVlanPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) + } + return p, nil } @@ -820,6 +828,34 @@ func addRomanaCNIPermissions(p *Policy, resource stringorslice.StringOrSlice, le ) } +func addAmazonVPCIPVlanPermissions(p *Policy, resource stringorslice.StringOrSlice, legacyIAM bool, clusterName string) { + if legacyIAM { + // Legacy IAM provides ec2:*, so no additional permissions required + return + } + + p.Statement = append(p.Statement, + &Statement{ + Sid: "cniIpvlanVpcK8s", + Effect: StatementEffectAllow, + Action: stringorslice.Slice([]string{ + "ec2:DescribeSubnets", + "ec2:AttachNetworkInterface", + "ec2:AssignPrivateIpAddresses", + "ec2:UnassignPrivateIpAddresses", + "ec2:CreateNetworkInterface", + "ec2:DescribeNetworkInterfaces", + "ec2:DescribeVpcPeeringConnections", + "ec2:DescribeSecurityGroups", + "ec2:DetachNetworkInterface", + "ec2:DeleteNetworkInterface", + "ec2:ModifyNetworkInterfaceAttribute", + }), + Resource: resource, + }, + ) +} + func addAmazonVPCCNIPermissions(p *Policy, resource stringorslice.StringOrSlice, legacyIAM bool, clusterName string) { if legacyIAM { // Legacy IAM provides ec2:*, so no additional permissions required diff --git a/upup/models/nodeup/resources/_amazon_vpc_ipvlan/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template b/upup/models/nodeup/resources/_amazon_vpc_ipvlan/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template new file mode 100644 index 0000000000000..246f8353bfdef --- /dev/null +++ b/upup/models/nodeup/resources/_amazon_vpc_ipvlan/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template @@ -0,0 +1,33 @@ +{ + "cniVersion": "0.3.1", + "name": "cni-ipvlan-vpc-k8s", + "plugins": [ + { + "cniVersion": "0.3.1", + "type": "cni-ipvlan-vpc-k8s-ipvlan", + "mode": "l2", + "master": "ipam", + "ipam": { + "type": "cni-ipvlan-vpc-k8s-ipam", + "interfaceIndex": {{ .Networking.AmazonVPCIPVlan.InterfaceIndex }}, + {{- if .Networking.AmazonVPCIPVlan.SubnetTags }} + "subnetTags": {{ MapJson .Networking.AmazonVPCIPVlan.SubnetTags}}, + {{- end }} + "routeToVpcPeers": {{ .Networking.AmazonVPCIPVlan.RouteToVPCPeers }}, + "secGroupIds": [ + {{ range $index, $element := .Networking.AmazonVPCIPVlan.SecurityGroupIds}} + {{if $index}},{{end}} "{{$element}}" + {{end}} + + ] + } + }, + { + "cniVersion": "0.3.1", + "type": "cni-ipvlan-vpc-k8s-unnumbered-ptp", + "hostInterface": "eth0", + "containerInterface": "veth0", + "ipMasq": true + } + ] +} diff --git a/upup/pkg/fi/cloudup/networking.go b/upup/pkg/fi/cloudup/networking.go index a158b59c92038..64e0ed4f3a0f3 100644 --- a/upup/pkg/fi/cloudup/networking.go +++ b/upup/pkg/fi/cloudup/networking.go @@ -95,6 +95,11 @@ func usesCNI(c *api.Cluster) bool { return true } + if networkConfig.AmazonVPCIPVlan != nil { + // AmazonVPCIPVlan uses CNI + return true + } + // Assume other modes also use CNI glog.Warningf("Unknown networking mode configured") return true diff --git a/upup/pkg/fi/cloudup/tagbuilder.go b/upup/pkg/fi/cloudup/tagbuilder.go index d5b745801a514..54b96e25a2769 100644 --- a/upup/pkg/fi/cloudup/tagbuilder.go +++ b/upup/pkg/fi/cloudup/tagbuilder.go @@ -96,6 +96,16 @@ func buildCloudupTags(cluster *api.Cluster) (sets.String, error) { func buildNodeupTags(role api.InstanceGroupRole, cluster *api.Cluster, clusterTags sets.String) (sets.String, error) { tags := sets.NewString() + networking := cluster.Spec.Networking + + if networking == nil { + return nil, fmt.Errorf("Networking is not set, and should not be nil here") + } + + if networking.AmazonVPCIPVlan != nil { + tags.Insert("_amazon_vpc_ipvlan") + } + switch fi.StringValue(cluster.Spec.UpdatePolicy) { case "": // default tags.Insert("_automatic_upgrades") diff --git a/upup/pkg/fi/nodeup/command.go b/upup/pkg/fi/nodeup/command.go index d3ecc2ab26ba9..399405c60b952 100644 --- a/upup/pkg/fi/nodeup/command.go +++ b/upup/pkg/fi/nodeup/command.go @@ -18,6 +18,7 @@ package nodeup import ( "errors" + "encoding/json" "fmt" "io" "io/ioutil" @@ -27,8 +28,12 @@ import ( "strings" "time" + "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/aws/ec2metadata" + "github.com/aws/aws-sdk-go/aws/request" + "github.com/aws/aws-sdk-go/aws/session" + "github.com/aws/aws-sdk-go/service/ec2" "github.com/golang/glog" - "k8s.io/apimachinery/pkg/util/sets" "k8s.io/kops/nodeup/pkg/distros" "k8s.io/kops/nodeup/pkg/model" @@ -247,6 +252,14 @@ func (c *NodeUpCommand) Run(out io.Writer) error { loader.Builders = append(loader.Builders, &model.EtcdTLSBuilder{NodeupModelContext: modelContext}) } + loader.TemplateFunctions["MapJson"] = func(m map[string]string) (string, error) { + bytes, err := json.Marshal(m) + if err != nil { + return "", err + } + return string(bytes), nil + } + taskMap, err := loader.Build(c.ModelDir) if err != nil { return fmt.Errorf("error building loader: %v", err) @@ -340,9 +353,69 @@ func evaluateSpec(c *api.Cluster) error { } } + if c.Spec.Networking.AmazonVPCIPVlan != nil && len(c.Spec.Networking.AmazonVPCIPVlan.SecurityGroupIds) == 0 { + // use the same security groups as the node when no alternative has been provided + ids, err := evaluateSecurityGroups(c.Spec.NetworkID) + if err != nil { + return err + } + c.Spec.Networking.AmazonVPCIPVlan.SecurityGroupIds = ids + } + return nil } +func evaluateSecurityGroups(vpcId string) ([]string, error) { + config := aws.NewConfig() + config = config.WithCredentialsChainVerboseErrors(true) + + s, err := session.NewSession(config) + if err != nil { + return nil, fmt.Errorf("error starting new AWS session: %v", err) + } + s.Handlers.Send.PushFront(func(r *request.Request) { + // Log requests + glog.V(4).Infof("AWS API Request: %s/%s", r.ClientInfo.ServiceName, r.Operation.Name) + }) + + metadata := ec2metadata.New(s, config) + + region, err := metadata.Region() + if err != nil { + return nil, fmt.Errorf("error querying ec2 metadata service (for az/region): %v", err) + } + + sgNames, err := metadata.GetMetadata("security-groups") + if err != nil { + return nil, fmt.Errorf("error querying ec2 metadata service (for security-groups): %v", err) + } + svc := ec2.New(s, config.WithRegion(region)) + + result, err := svc.DescribeSecurityGroups(&ec2.DescribeSecurityGroupsInput{ + Filters: []*ec2.Filter{ + { + Name: aws.String("group-name"), + Values: aws.StringSlice(strings.Fields(sgNames)), + }, + { + Name: aws.String("vpc-id"), + Values: []*string{aws.String(vpcId)}, + }, + }, + }) + + if err != nil { + return nil, fmt.Errorf("error looking up instance security group ids: %v", err) + } + var sgIds []string + for _, group := range result.SecurityGroups { + sgIds = append(sgIds, *group.GroupId) + } + + return sgIds, nil + +} + func evaluateHostnameOverride(hostnameOverride string) (string, error) { if hostnameOverride == "" || hostnameOverride == "@hostname" { return "", nil diff --git a/upup/pkg/fi/nodeup/nodetasks/archive.go b/upup/pkg/fi/nodeup/nodetasks/archive.go index e722d93015ab7..01d8302d437e4 100644 --- a/upup/pkg/fi/nodeup/nodetasks/archive.go +++ b/upup/pkg/fi/nodeup/nodetasks/archive.go @@ -42,6 +42,8 @@ type Archive struct { // Hash is the source tar Hash string `json:"hash,omitempty"` + Gzip bool `json:"gzip,omitempty"` + // TargetDir is the directory for extraction TargetDir string `json:"target,omitempty"` @@ -162,7 +164,13 @@ func (_ *Archive) RenderLocal(t *local.LocalTarget, a, e, changes *Archive) erro return fmt.Errorf("error creating directories %q: %v", targetDir, err) } - args := []string{"tar", "xf", localFile, "-C", targetDir} + var extractArgs = "xf" + + if e.Gzip { + extractArgs = "xzf" + } + + args := []string{"tar", extractArgs, localFile, "-C", targetDir} if e.StripComponents != 0 { args = append(args, "--strip-components="+strconv.Itoa(e.StripComponents)) } From 3ec470b240de1c3880367c550457b1cc7044f98d Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Thu, 22 Mar 2018 12:06:26 -0700 Subject: [PATCH 049/163] apimachinery and updated BUILD.bazel for cni-ipvlan-vpc-k8s --- nodeup/pkg/model/network.go | 15 ++---- .../kops/v1alpha1/zz_generated.conversion.go | 48 +++++++++++++++++++ .../kops/v1alpha1/zz_generated.deepcopy.go | 37 ++++++++++++++ .../kops/v1alpha2/zz_generated.conversion.go | 48 +++++++++++++++++++ .../kops/v1alpha2/zz_generated.deepcopy.go | 37 ++++++++++++++ pkg/apis/kops/zz_generated.deepcopy.go | 37 ++++++++++++++ upup/pkg/fi/cloudup/apply_cluster.go | 4 ++ upup/pkg/fi/nodeup/BUILD.bazel | 5 ++ upup/pkg/fi/nodeup/nodetasks/archive.go | 10 +--- 9 files changed, 220 insertions(+), 21 deletions(-) diff --git a/nodeup/pkg/model/network.go b/nodeup/pkg/model/network.go index 56173d5fbc20c..9becf7e7dedec 100644 --- a/nodeup/pkg/model/network.go +++ b/nodeup/pkg/model/network.go @@ -44,7 +44,7 @@ func (b *NetworkBuilder) Build(c *fi.ModelBuilderContext) error { // external is based on kubenet assetNames = append(assetNames, "bridge", "host-local", "loopback") - } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.AmazonVPCIPVlan != nil { + } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil { assetNames = append(assetNames, "bridge", "host-local", "loopback", "ptp") // Do we need tuning? @@ -58,6 +58,8 @@ func (b *NetworkBuilder) Build(c *fi.ModelBuilderContext) error { // TODO combine with External // Kopeio is based on kubenet / external assetNames = append(assetNames, "bridge", "host-local", "loopback") + } else if networking.AmazonVPCIPVlan != nil { + assetNames = append(assetNames, "cni-ipvlan-vpc-k8s-ipam", "cni-ipvlan-vpc-k8s-ipvlan", "cni-ipvlan-vpc-k8s-tool", "cni-ipvlan-vpc-k8s-unnumbered-ptp") } else { return fmt.Errorf("no networking mode set") } @@ -68,17 +70,6 @@ func (b *NetworkBuilder) Build(c *fi.ModelBuilderContext) error { } } - if networking.AmazonVPCIPVlan != nil { - binDownloadTask := &nodetasks.Archive{ - Source: networking.AmazonVPCIPVlan.BinariesDownloadURL, - TargetDir: "/opt/cni/bin", - Name: "cni-ipvlan-vpc-k8s-binaries", - Gzip: true, - } - - c.AddTask(binDownloadTask) - } - return nil } diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 97f005eadabda..289b0a240cdb9 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -40,6 +40,8 @@ func RegisterConversions(scheme *runtime.Scheme) error { Convert_kops_AddonSpec_To_v1alpha1_AddonSpec, Convert_v1alpha1_AlwaysAllowAuthorizationSpec_To_kops_AlwaysAllowAuthorizationSpec, Convert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha1_AlwaysAllowAuthorizationSpec, + Convert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec, + Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec, Convert_v1alpha1_AmazonVPCNetworkingSpec_To_kops_AmazonVPCNetworkingSpec, Convert_kops_AmazonVPCNetworkingSpec_To_v1alpha1_AmazonVPCNetworkingSpec, Convert_v1alpha1_Assets_To_kops_Assets, @@ -255,6 +257,34 @@ func Convert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha1_AlwaysAllowAuthorizat return autoConvert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha1_AlwaysAllowAuthorizationSpec(in, out, s) } +func autoConvert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in *AmazonVPCIPVlanNetworkingSpec, out *kops.AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { + out.SubnetTags = in.SubnetTags + out.InterfaceIndex = in.InterfaceIndex + out.RouteToVPCPeers = in.RouteToVPCPeers + out.SecurityGroupIds = in.SecurityGroupIds + out.BinariesDownloadURL = in.BinariesDownloadURL + return nil +} + +// Convert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec is an autogenerated conversion function. +func Convert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in *AmazonVPCIPVlanNetworkingSpec, out *kops.AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { + return autoConvert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in, out, s) +} + +func autoConvert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec(in *kops.AmazonVPCIPVlanNetworkingSpec, out *AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { + out.SubnetTags = in.SubnetTags + out.InterfaceIndex = in.InterfaceIndex + out.RouteToVPCPeers = in.RouteToVPCPeers + out.SecurityGroupIds = in.SecurityGroupIds + out.BinariesDownloadURL = in.BinariesDownloadURL + return nil +} + +// Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec is an autogenerated conversion function. +func Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec(in *kops.AmazonVPCIPVlanNetworkingSpec, out *AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { + return autoConvert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec(in, out, s) +} + func autoConvert_v1alpha1_AmazonVPCNetworkingSpec_To_kops_AmazonVPCNetworkingSpec(in *AmazonVPCNetworkingSpec, out *kops.AmazonVPCNetworkingSpec, s conversion.Scope) error { out.ImageName = in.ImageName return nil @@ -2907,6 +2937,15 @@ func autoConvert_v1alpha1_NetworkingSpec_To_kops_NetworkingSpec(in *NetworkingSp } else { out.Cilium = nil } + if in.AmazonVPCIPVlan != nil { + in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + *out = new(kops.AmazonVPCIPVlanNetworkingSpec) + if err := Convert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(*in, *out, s); err != nil { + return err + } + } else { + out.AmazonVPCIPVlan = nil + } return nil } @@ -3033,6 +3072,15 @@ func autoConvert_kops_NetworkingSpec_To_v1alpha1_NetworkingSpec(in *kops.Network } else { out.Cilium = nil } + if in.AmazonVPCIPVlan != nil { + in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + *out = new(AmazonVPCIPVlanNetworkingSpec) + if err := Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec(*in, *out, s); err != nil { + return err + } + } else { + out.AmazonVPCIPVlan = nil + } return nil } diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index 0288a34d4e2cc..a4746f5a34d3a 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -91,6 +91,34 @@ func (in *AlwaysAllowAuthorizationSpec) DeepCopy() *AlwaysAllowAuthorizationSpec return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopyInto(out *AmazonVPCIPVlanNetworkingSpec) { + *out = *in + if in.SubnetTags != nil { + in, out := &in.SubnetTags, &out.SubnetTags + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } + if in.SecurityGroupIds != nil { + in, out := &in.SecurityGroupIds, &out.SecurityGroupIds + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AmazonVPCIPVlanNetworkingSpec. +func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopy() *AmazonVPCIPVlanNetworkingSpec { + if in == nil { + return nil + } + out := new(AmazonVPCIPVlanNetworkingSpec) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AmazonVPCNetworkingSpec) DeepCopyInto(out *AmazonVPCNetworkingSpec) { *out = *in @@ -3087,6 +3115,15 @@ func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { (*in).DeepCopyInto(*out) } } + if in.AmazonVPCIPVlan != nil { + in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + if *in == nil { + *out = nil + } else { + *out = new(AmazonVPCIPVlanNetworkingSpec) + (*in).DeepCopyInto(*out) + } + } return } diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 1afc069620d4b..8bc4b25cfcacb 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -40,6 +40,8 @@ func RegisterConversions(scheme *runtime.Scheme) error { Convert_kops_AddonSpec_To_v1alpha2_AddonSpec, Convert_v1alpha2_AlwaysAllowAuthorizationSpec_To_kops_AlwaysAllowAuthorizationSpec, Convert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha2_AlwaysAllowAuthorizationSpec, + Convert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec, + Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec, Convert_v1alpha2_AmazonVPCNetworkingSpec_To_kops_AmazonVPCNetworkingSpec, Convert_kops_AmazonVPCNetworkingSpec_To_v1alpha2_AmazonVPCNetworkingSpec, Convert_v1alpha2_Assets_To_kops_Assets, @@ -269,6 +271,34 @@ func Convert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha2_AlwaysAllowAuthorizat return autoConvert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha2_AlwaysAllowAuthorizationSpec(in, out, s) } +func autoConvert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in *AmazonVPCIPVlanNetworkingSpec, out *kops.AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { + out.SubnetTags = in.SubnetTags + out.InterfaceIndex = in.InterfaceIndex + out.RouteToVPCPeers = in.RouteToVPCPeers + out.SecurityGroupIds = in.SecurityGroupIds + out.BinariesDownloadURL = in.BinariesDownloadURL + return nil +} + +// Convert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec is an autogenerated conversion function. +func Convert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in *AmazonVPCIPVlanNetworkingSpec, out *kops.AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { + return autoConvert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in, out, s) +} + +func autoConvert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec(in *kops.AmazonVPCIPVlanNetworkingSpec, out *AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { + out.SubnetTags = in.SubnetTags + out.InterfaceIndex = in.InterfaceIndex + out.RouteToVPCPeers = in.RouteToVPCPeers + out.SecurityGroupIds = in.SecurityGroupIds + out.BinariesDownloadURL = in.BinariesDownloadURL + return nil +} + +// Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec is an autogenerated conversion function. +func Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec(in *kops.AmazonVPCIPVlanNetworkingSpec, out *AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { + return autoConvert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec(in, out, s) +} + func autoConvert_v1alpha2_AmazonVPCNetworkingSpec_To_kops_AmazonVPCNetworkingSpec(in *AmazonVPCNetworkingSpec, out *kops.AmazonVPCNetworkingSpec, s conversion.Scope) error { out.ImageName = in.ImageName return nil @@ -3171,6 +3201,15 @@ func autoConvert_v1alpha2_NetworkingSpec_To_kops_NetworkingSpec(in *NetworkingSp } else { out.Cilium = nil } + if in.AmazonVPCIPVlan != nil { + in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + *out = new(kops.AmazonVPCIPVlanNetworkingSpec) + if err := Convert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(*in, *out, s); err != nil { + return err + } + } else { + out.AmazonVPCIPVlan = nil + } return nil } @@ -3297,6 +3336,15 @@ func autoConvert_kops_NetworkingSpec_To_v1alpha2_NetworkingSpec(in *kops.Network } else { out.Cilium = nil } + if in.AmazonVPCIPVlan != nil { + in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + *out = new(AmazonVPCIPVlanNetworkingSpec) + if err := Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec(*in, *out, s); err != nil { + return err + } + } else { + out.AmazonVPCIPVlan = nil + } return nil } diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index cc992a4278fac..c1ad235f646b1 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -91,6 +91,34 @@ func (in *AlwaysAllowAuthorizationSpec) DeepCopy() *AlwaysAllowAuthorizationSpec return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopyInto(out *AmazonVPCIPVlanNetworkingSpec) { + *out = *in + if in.SubnetTags != nil { + in, out := &in.SubnetTags, &out.SubnetTags + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } + if in.SecurityGroupIds != nil { + in, out := &in.SecurityGroupIds, &out.SecurityGroupIds + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AmazonVPCIPVlanNetworkingSpec. +func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopy() *AmazonVPCIPVlanNetworkingSpec { + if in == nil { + return nil + } + out := new(AmazonVPCIPVlanNetworkingSpec) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AmazonVPCNetworkingSpec) DeepCopyInto(out *AmazonVPCNetworkingSpec) { *out = *in @@ -3168,6 +3196,15 @@ func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { (*in).DeepCopyInto(*out) } } + if in.AmazonVPCIPVlan != nil { + in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + if *in == nil { + *out = nil + } else { + *out = new(AmazonVPCIPVlanNetworkingSpec) + (*in).DeepCopyInto(*out) + } + } return } diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index f35bd86fd2d3f..cc972f3f294fa 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -91,6 +91,34 @@ func (in *AlwaysAllowAuthorizationSpec) DeepCopy() *AlwaysAllowAuthorizationSpec return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopyInto(out *AmazonVPCIPVlanNetworkingSpec) { + *out = *in + if in.SubnetTags != nil { + in, out := &in.SubnetTags, &out.SubnetTags + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } + if in.SecurityGroupIds != nil { + in, out := &in.SecurityGroupIds, &out.SecurityGroupIds + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AmazonVPCIPVlanNetworkingSpec. +func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopy() *AmazonVPCIPVlanNetworkingSpec { + if in == nil { + return nil + } + out := new(AmazonVPCIPVlanNetworkingSpec) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AmazonVPCNetworkingSpec) DeepCopyInto(out *AmazonVPCNetworkingSpec) { *out = *in @@ -3372,6 +3400,15 @@ func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { (*in).DeepCopyInto(*out) } } + if in.AmazonVPCIPVlan != nil { + in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + if *in == nil { + *out = nil + } else { + *out = new(AmazonVPCIPVlanNetworkingSpec) + (*in).DeepCopyInto(*out) + } + } return } diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go index c0ffffc8687a6..032369e9c6bb5 100644 --- a/upup/pkg/fi/cloudup/apply_cluster.go +++ b/upup/pkg/fi/cloudup/apply_cluster.go @@ -1092,6 +1092,10 @@ func (c *ApplyClusterCmd) AddFileAssets(assetBuilder *assets.AssetBuilder) error c.Assets = append(c.Assets, cniAssetHashString+"@"+cniAsset.String()) } + if c.Cluster.Spec.Networking.AmazonVPCIPVlan != nil { + c.Assets = append(c.Assets, "818c50109eb6fb5bf2206426c4ceb1d48bab9ca52e1447335a9ce0788810d78c@https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.3.1/cni-ipvlan-vpc-k8s-v0.3.1.tar.gz") + } + // TODO figure out if we can only do this for CoreOS only and GCE Container OS // TODO It is very difficult to pre-determine what OS an ami is, and if that OS needs socat // At this time we just copy the socat and conntrack binaries to all distros. diff --git a/upup/pkg/fi/nodeup/BUILD.bazel b/upup/pkg/fi/nodeup/BUILD.bazel index 5fc32601304bd..ec9cbaa7eaa7e 100644 --- a/upup/pkg/fi/nodeup/BUILD.bazel +++ b/upup/pkg/fi/nodeup/BUILD.bazel @@ -23,6 +23,11 @@ go_library( "//upup/pkg/fi/secrets:go_default_library", "//upup/pkg/fi/utils:go_default_library", "//util/pkg/vfs:go_default_library", + "//vendor/github.com/aws/aws-sdk-go/aws:go_default_library", + "//vendor/github.com/aws/aws-sdk-go/aws/ec2metadata:go_default_library", + "//vendor/github.com/aws/aws-sdk-go/aws/request:go_default_library", + "//vendor/github.com/aws/aws-sdk-go/aws/session:go_default_library", + "//vendor/github.com/aws/aws-sdk-go/service/ec2:go_default_library", "//vendor/github.com/golang/glog:go_default_library", "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library", ], diff --git a/upup/pkg/fi/nodeup/nodetasks/archive.go b/upup/pkg/fi/nodeup/nodetasks/archive.go index 01d8302d437e4..e722d93015ab7 100644 --- a/upup/pkg/fi/nodeup/nodetasks/archive.go +++ b/upup/pkg/fi/nodeup/nodetasks/archive.go @@ -42,8 +42,6 @@ type Archive struct { // Hash is the source tar Hash string `json:"hash,omitempty"` - Gzip bool `json:"gzip,omitempty"` - // TargetDir is the directory for extraction TargetDir string `json:"target,omitempty"` @@ -164,13 +162,7 @@ func (_ *Archive) RenderLocal(t *local.LocalTarget, a, e, changes *Archive) erro return fmt.Errorf("error creating directories %q: %v", targetDir, err) } - var extractArgs = "xf" - - if e.Gzip { - extractArgs = "xzf" - } - - args := []string{"tar", extractArgs, localFile, "-C", targetDir} + args := []string{"tar", "xf", localFile, "-C", targetDir} if e.StripComponents != 0 { args = append(args, "--strip-components="+strconv.Itoa(e.StripComponents)) } From 4d40090c0c409b6b43f4874571bbf6c90e661bd2 Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Mon, 9 Apr 2018 12:28:25 -0700 Subject: [PATCH 050/163] adds loopback to list of cni assets. fix gofmt --- nodeup/pkg/model/network.go | 2 +- upup/pkg/fi/nodeup/command.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nodeup/pkg/model/network.go b/nodeup/pkg/model/network.go index 9becf7e7dedec..3d9abaa0a34d7 100644 --- a/nodeup/pkg/model/network.go +++ b/nodeup/pkg/model/network.go @@ -59,7 +59,7 @@ func (b *NetworkBuilder) Build(c *fi.ModelBuilderContext) error { // Kopeio is based on kubenet / external assetNames = append(assetNames, "bridge", "host-local", "loopback") } else if networking.AmazonVPCIPVlan != nil { - assetNames = append(assetNames, "cni-ipvlan-vpc-k8s-ipam", "cni-ipvlan-vpc-k8s-ipvlan", "cni-ipvlan-vpc-k8s-tool", "cni-ipvlan-vpc-k8s-unnumbered-ptp") + assetNames = append(assetNames, "cni-ipvlan-vpc-k8s-ipam", "cni-ipvlan-vpc-k8s-ipvlan", "cni-ipvlan-vpc-k8s-tool", "cni-ipvlan-vpc-k8s-unnumbered-ptp", "loopback") } else { return fmt.Errorf("no networking mode set") } diff --git a/upup/pkg/fi/nodeup/command.go b/upup/pkg/fi/nodeup/command.go index 399405c60b952..0df6c57d32981 100644 --- a/upup/pkg/fi/nodeup/command.go +++ b/upup/pkg/fi/nodeup/command.go @@ -17,8 +17,8 @@ limitations under the License. package nodeup import ( - "errors" "encoding/json" + "errors" "fmt" "io" "io/ioutil" From 2b9a56f8e6580a03f088005627c1cdad6720ed5e Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Mon, 9 Apr 2018 20:58:11 -0700 Subject: [PATCH 051/163] rename to LyftVPC. Removes all the settings from the NetworkingSpec --- cmd/kops/create_cluster.go | 4 +- nodeup/pkg/model/context.go | 2 +- nodeup/pkg/model/network.go | 2 +- pkg/apis/kops/cluster.go | 6 +- pkg/apis/kops/networking.go | 38 ++++------ pkg/apis/kops/v1alpha1/networking.go | 38 ++++------ .../kops/v1alpha1/zz_generated.conversion.go | 70 ++++++++----------- .../kops/v1alpha1/zz_generated.deepcopy.go | 52 ++++++-------- pkg/apis/kops/v1alpha2/networking.go | 38 ++++------ .../kops/v1alpha2/zz_generated.conversion.go | 70 ++++++++----------- .../kops/v1alpha2/zz_generated.deepcopy.go | 52 ++++++-------- pkg/apis/kops/validation/legacy.go | 7 +- pkg/apis/kops/zz_generated.deepcopy.go | 52 ++++++-------- pkg/model/components/context.go | 2 +- pkg/model/components/kubecontrollermanager.go | 2 +- pkg/model/components/networking.go | 2 +- pkg/model/iam/iam_builder.go | 10 +-- .../10-cni-ipvlan-vpc-k8s.conflist.template | 33 --------- .../10-cni-ipvlan-vpc-k8s.conflist.template | 28 ++++++++ upup/pkg/fi/cloudup/apply_cluster.go | 2 +- upup/pkg/fi/cloudup/networking.go | 4 +- upup/pkg/fi/cloudup/tagbuilder.go | 4 +- upup/pkg/fi/nodeup/command.go | 26 ++++--- 23 files changed, 228 insertions(+), 316 deletions(-) delete mode 100644 upup/models/nodeup/resources/_amazon_vpc_ipvlan/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template create mode 100644 upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index 0b07c2b43aad6..ba4b13050763c 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -929,8 +929,8 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e cluster.Spec.Networking.AmazonVPC = &api.AmazonVPCNetworkingSpec{} case "cilium": cluster.Spec.Networking.Cilium = &api.CiliumNetworkingSpec{} - case "amazonvpcipvlan": - cluster.Spec.Networking.AmazonVPCIPVlan = &api.AmazonVPCIPVlanNetworkingSpec{} + case "lyftvpc": + cluster.Spec.Networking.LyftVPC = &api.LyftVPCNetworkingSpec{} default: return fmt.Errorf("unknown networking mode %q", c.Networking) } diff --git a/nodeup/pkg/model/context.go b/nodeup/pkg/model/context.go index 1112629ddd4fa..326e626f5a783 100644 --- a/nodeup/pkg/model/context.go +++ b/nodeup/pkg/model/context.go @@ -288,7 +288,7 @@ func (c *NodeupModelContext) UseNodeAuthorizer() bool { // UsesSecondaryIP checks if the CNI in use attaches secondary interfaces to the host. func (c *NodeupModelContext) UsesSecondaryIP() bool { - if (c.Cluster.Spec.Networking.CNI != nil && c.Cluster.Spec.Networking.CNI.UsesSecondaryIP) || c.Cluster.Spec.Networking.AmazonVPC != nil || c.Cluster.Spec.Networking.AmazonVPCIPVlan != nil { + if (c.Cluster.Spec.Networking.CNI != nil && c.Cluster.Spec.Networking.CNI.UsesSecondaryIP) || c.Cluster.Spec.Networking.AmazonVPC != nil || c.Cluster.Spec.Networking.LyftVPC != nil { return true } diff --git a/nodeup/pkg/model/network.go b/nodeup/pkg/model/network.go index 3d9abaa0a34d7..d661ea704bd35 100644 --- a/nodeup/pkg/model/network.go +++ b/nodeup/pkg/model/network.go @@ -58,7 +58,7 @@ func (b *NetworkBuilder) Build(c *fi.ModelBuilderContext) error { // TODO combine with External // Kopeio is based on kubenet / external assetNames = append(assetNames, "bridge", "host-local", "loopback") - } else if networking.AmazonVPCIPVlan != nil { + } else if networking.LyftVPC != nil { assetNames = append(assetNames, "cni-ipvlan-vpc-k8s-ipam", "cni-ipvlan-vpc-k8s-ipvlan", "cni-ipvlan-vpc-k8s-tool", "cni-ipvlan-vpc-k8s-unnumbered-ptp", "loopback") } else { return fmt.Errorf("no networking mode set") diff --git a/pkg/apis/kops/cluster.go b/pkg/apis/kops/cluster.go index 005ee38ad0d4a..a23ed6e1a3695 100644 --- a/pkg/apis/kops/cluster.go +++ b/pkg/apis/kops/cluster.go @@ -536,10 +536,8 @@ func (c *Cluster) FillDefaults() error { c.Spec.Networking.Cilium.Version = CiliumDefaultVersion } // OK - } else if c.Spec.Networking.AmazonVPCIPVlan != nil { - if c.Spec.Networking.AmazonVPCIPVlan.BinariesDownloadURL == "" { - c.Spec.Networking.AmazonVPCIPVlan.BinariesDownloadURL = "https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.3.1/cni-ipvlan-vpc-k8s-v0.3.1.tar.gz" - } + } else if c.Spec.Networking.LyftVPC != nil { + // OK } else { // No networking model selected; choose Kubenet c.Spec.Networking.Kubenet = &KubenetNetworkingSpec{} diff --git a/pkg/apis/kops/networking.go b/pkg/apis/kops/networking.go index 785b91e73194a..f7817c360114a 100644 --- a/pkg/apis/kops/networking.go +++ b/pkg/apis/kops/networking.go @@ -18,20 +18,20 @@ package kops // NetworkingSpec allows selection and configuration of a networking plugin type NetworkingSpec struct { - Classic *ClassicNetworkingSpec `json:"classic,omitempty"` - Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` - External *ExternalNetworkingSpec `json:"external,omitempty"` - CNI *CNINetworkingSpec `json:"cni,omitempty"` - Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` - Weave *WeaveNetworkingSpec `json:"weave,omitempty"` - Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` - Calico *CalicoNetworkingSpec `json:"calico,omitempty"` - Canal *CanalNetworkingSpec `json:"canal,omitempty"` - Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` - Romana *RomanaNetworkingSpec `json:"romana,omitempty"` - AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` - Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` - AmazonVPCIPVlan *AmazonVPCIPVlanNetworkingSpec `json:"amazonvpcipvlan,omitempty"` + Classic *ClassicNetworkingSpec `json:"classic,omitempty"` + Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` + External *ExternalNetworkingSpec `json:"external,omitempty"` + CNI *CNINetworkingSpec `json:"cni,omitempty"` + Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` + Weave *WeaveNetworkingSpec `json:"weave,omitempty"` + Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` + Calico *CalicoNetworkingSpec `json:"calico,omitempty"` + Canal *CanalNetworkingSpec `json:"canal,omitempty"` + Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` + Romana *RomanaNetworkingSpec `json:"romana,omitempty"` + AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` + Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` + LyftVPC *LyftVPCNetworkingSpec `json:"lyftvpc,omitempty"` } // ClassicNetworkingSpec is the specification of classic networking mode, integrated into kubernetes @@ -191,12 +191,4 @@ type CiliumNetworkingSpec struct { } // LyftIpVlanNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking -type AmazonVPCIPVlanNetworkingSpec struct { - // Tags that subnets must have to be used for pod IPs - SubnetTags map[string]string `json:"subnetTags,omitempty"` - InterfaceIndex int `json:"interfaceIndex,omitempty"` - RouteToVPCPeers bool `json:"routeToVPCPeers,omitempty"` - // list of security groups to assign to the ENIs for pods - SecurityGroupIds []string `json:"securityGroupIds,omitempty"` - BinariesDownloadURL string `json:"binariesDownloadURL,omitempty"` -} +type LyftVPCNetworkingSpec struct{} diff --git a/pkg/apis/kops/v1alpha1/networking.go b/pkg/apis/kops/v1alpha1/networking.go index 48541948f9642..07e4186fcd5c9 100644 --- a/pkg/apis/kops/v1alpha1/networking.go +++ b/pkg/apis/kops/v1alpha1/networking.go @@ -18,20 +18,20 @@ package v1alpha1 // NetworkingSpec allows selection and configuration of a networking plugin type NetworkingSpec struct { - Classic *ClassicNetworkingSpec `json:"classic,omitempty"` - Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` - External *ExternalNetworkingSpec `json:"external,omitempty"` - CNI *CNINetworkingSpec `json:"cni,omitempty"` - Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` - Weave *WeaveNetworkingSpec `json:"weave,omitempty"` - Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` - Calico *CalicoNetworkingSpec `json:"calico,omitempty"` - Canal *CanalNetworkingSpec `json:"canal,omitempty"` - Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` - Romana *RomanaNetworkingSpec `json:"romana,omitempty"` - AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` - Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` - AmazonVPCIPVlan *AmazonVPCIPVlanNetworkingSpec `json:"amazonvpcipvlan,omitempty"` + Classic *ClassicNetworkingSpec `json:"classic,omitempty"` + Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` + External *ExternalNetworkingSpec `json:"external,omitempty"` + CNI *CNINetworkingSpec `json:"cni,omitempty"` + Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` + Weave *WeaveNetworkingSpec `json:"weave,omitempty"` + Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` + Calico *CalicoNetworkingSpec `json:"calico,omitempty"` + Canal *CanalNetworkingSpec `json:"canal,omitempty"` + Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` + Romana *RomanaNetworkingSpec `json:"romana,omitempty"` + AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` + Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` + LyftVPC *LyftVPCNetworkingSpec `json:"lyftvpc,omitempty"` } // ClassicNetworkingSpec is the specification of classic networking mode, integrated into kubernetes @@ -188,12 +188,4 @@ type CiliumNetworkingSpec struct { } // LyftIpVlanNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking -type AmazonVPCIPVlanNetworkingSpec struct { - // Tags that subnets must have to be used for pod IPs - SubnetTags map[string]string `json:"subnetTags,omitempty"` - InterfaceIndex int `json:"interfaceIndex,omitempty"` - RouteToVPCPeers bool `json:"routeToVPCPeers,omitempty"` - // list of security groups to assign to the ENIs for pods - SecurityGroupIds []string `json:"securityGroupIds,omitempty"` - BinariesDownloadURL string `json:"binariesDownloadURL,omitempty"` -} +type LyftVPCNetworkingSpec struct{} diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 289b0a240cdb9..a0a8fdda879f9 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -40,8 +40,6 @@ func RegisterConversions(scheme *runtime.Scheme) error { Convert_kops_AddonSpec_To_v1alpha1_AddonSpec, Convert_v1alpha1_AlwaysAllowAuthorizationSpec_To_kops_AlwaysAllowAuthorizationSpec, Convert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha1_AlwaysAllowAuthorizationSpec, - Convert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec, - Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec, Convert_v1alpha1_AmazonVPCNetworkingSpec_To_kops_AmazonVPCNetworkingSpec, Convert_kops_AmazonVPCNetworkingSpec_To_v1alpha1_AmazonVPCNetworkingSpec, Convert_v1alpha1_Assets_To_kops_Assets, @@ -138,6 +136,8 @@ func RegisterConversions(scheme *runtime.Scheme) error { Convert_kops_LoadBalancer_To_v1alpha1_LoadBalancer, Convert_v1alpha1_LoadBalancerAccessSpec_To_kops_LoadBalancerAccessSpec, Convert_kops_LoadBalancerAccessSpec_To_v1alpha1_LoadBalancerAccessSpec, + Convert_v1alpha1_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec, + Convert_kops_LyftVPCNetworkingSpec_To_v1alpha1_LyftVPCNetworkingSpec, Convert_v1alpha1_NetworkingSpec_To_kops_NetworkingSpec, Convert_kops_NetworkingSpec_To_v1alpha1_NetworkingSpec, Convert_v1alpha1_NodeAuthorizationSpec_To_kops_NodeAuthorizationSpec, @@ -257,34 +257,6 @@ func Convert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha1_AlwaysAllowAuthorizat return autoConvert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha1_AlwaysAllowAuthorizationSpec(in, out, s) } -func autoConvert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in *AmazonVPCIPVlanNetworkingSpec, out *kops.AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { - out.SubnetTags = in.SubnetTags - out.InterfaceIndex = in.InterfaceIndex - out.RouteToVPCPeers = in.RouteToVPCPeers - out.SecurityGroupIds = in.SecurityGroupIds - out.BinariesDownloadURL = in.BinariesDownloadURL - return nil -} - -// Convert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec is an autogenerated conversion function. -func Convert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in *AmazonVPCIPVlanNetworkingSpec, out *kops.AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { - return autoConvert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in, out, s) -} - -func autoConvert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec(in *kops.AmazonVPCIPVlanNetworkingSpec, out *AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { - out.SubnetTags = in.SubnetTags - out.InterfaceIndex = in.InterfaceIndex - out.RouteToVPCPeers = in.RouteToVPCPeers - out.SecurityGroupIds = in.SecurityGroupIds - out.BinariesDownloadURL = in.BinariesDownloadURL - return nil -} - -// Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec is an autogenerated conversion function. -func Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec(in *kops.AmazonVPCIPVlanNetworkingSpec, out *AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { - return autoConvert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec(in, out, s) -} - func autoConvert_v1alpha1_AmazonVPCNetworkingSpec_To_kops_AmazonVPCNetworkingSpec(in *AmazonVPCNetworkingSpec, out *kops.AmazonVPCNetworkingSpec, s conversion.Scope) error { out.ImageName = in.ImageName return nil @@ -2819,6 +2791,24 @@ func Convert_kops_LoadBalancerAccessSpec_To_v1alpha1_LoadBalancerAccessSpec(in * return autoConvert_kops_LoadBalancerAccessSpec_To_v1alpha1_LoadBalancerAccessSpec(in, out, s) } +func autoConvert_v1alpha1_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in *LyftVPCNetworkingSpec, out *kops.LyftVPCNetworkingSpec, s conversion.Scope) error { + return nil +} + +// Convert_v1alpha1_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec is an autogenerated conversion function. +func Convert_v1alpha1_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in *LyftVPCNetworkingSpec, out *kops.LyftVPCNetworkingSpec, s conversion.Scope) error { + return autoConvert_v1alpha1_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in, out, s) +} + +func autoConvert_kops_LyftVPCNetworkingSpec_To_v1alpha1_LyftVPCNetworkingSpec(in *kops.LyftVPCNetworkingSpec, out *LyftVPCNetworkingSpec, s conversion.Scope) error { + return nil +} + +// Convert_kops_LyftVPCNetworkingSpec_To_v1alpha1_LyftVPCNetworkingSpec is an autogenerated conversion function. +func Convert_kops_LyftVPCNetworkingSpec_To_v1alpha1_LyftVPCNetworkingSpec(in *kops.LyftVPCNetworkingSpec, out *LyftVPCNetworkingSpec, s conversion.Scope) error { + return autoConvert_kops_LyftVPCNetworkingSpec_To_v1alpha1_LyftVPCNetworkingSpec(in, out, s) +} + func autoConvert_v1alpha1_NetworkingSpec_To_kops_NetworkingSpec(in *NetworkingSpec, out *kops.NetworkingSpec, s conversion.Scope) error { if in.Classic != nil { in, out := &in.Classic, &out.Classic @@ -2937,14 +2927,14 @@ func autoConvert_v1alpha1_NetworkingSpec_To_kops_NetworkingSpec(in *NetworkingSp } else { out.Cilium = nil } - if in.AmazonVPCIPVlan != nil { - in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan - *out = new(kops.AmazonVPCIPVlanNetworkingSpec) - if err := Convert_v1alpha1_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(*in, *out, s); err != nil { + if in.LyftVPC != nil { + in, out := &in.LyftVPC, &out.LyftVPC + *out = new(kops.LyftVPCNetworkingSpec) + if err := Convert_v1alpha1_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(*in, *out, s); err != nil { return err } } else { - out.AmazonVPCIPVlan = nil + out.LyftVPC = nil } return nil } @@ -3072,14 +3062,14 @@ func autoConvert_kops_NetworkingSpec_To_v1alpha1_NetworkingSpec(in *kops.Network } else { out.Cilium = nil } - if in.AmazonVPCIPVlan != nil { - in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan - *out = new(AmazonVPCIPVlanNetworkingSpec) - if err := Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha1_AmazonVPCIPVlanNetworkingSpec(*in, *out, s); err != nil { + if in.LyftVPC != nil { + in, out := &in.LyftVPC, &out.LyftVPC + *out = new(LyftVPCNetworkingSpec) + if err := Convert_kops_LyftVPCNetworkingSpec_To_v1alpha1_LyftVPCNetworkingSpec(*in, *out, s); err != nil { return err } } else { - out.AmazonVPCIPVlan = nil + out.LyftVPC = nil } return nil } diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index a4746f5a34d3a..ed101c6ffc518 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -91,34 +91,6 @@ func (in *AlwaysAllowAuthorizationSpec) DeepCopy() *AlwaysAllowAuthorizationSpec return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopyInto(out *AmazonVPCIPVlanNetworkingSpec) { - *out = *in - if in.SubnetTags != nil { - in, out := &in.SubnetTags, &out.SubnetTags - *out = make(map[string]string, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - if in.SecurityGroupIds != nil { - in, out := &in.SecurityGroupIds, &out.SecurityGroupIds - *out = make([]string, len(*in)) - copy(*out, *in) - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AmazonVPCIPVlanNetworkingSpec. -func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopy() *AmazonVPCIPVlanNetworkingSpec { - if in == nil { - return nil - } - out := new(AmazonVPCIPVlanNetworkingSpec) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AmazonVPCNetworkingSpec) DeepCopyInto(out *AmazonVPCNetworkingSpec) { *out = *in @@ -2995,6 +2967,22 @@ func (in *LoadBalancerAccessSpec) DeepCopy() *LoadBalancerAccessSpec { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *LyftVPCNetworkingSpec) DeepCopyInto(out *LyftVPCNetworkingSpec) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LyftVPCNetworkingSpec. +func (in *LyftVPCNetworkingSpec) DeepCopy() *LyftVPCNetworkingSpec { + if in == nil { + return nil + } + out := new(LyftVPCNetworkingSpec) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { *out = *in @@ -3115,13 +3103,13 @@ func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { (*in).DeepCopyInto(*out) } } - if in.AmazonVPCIPVlan != nil { - in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + if in.LyftVPC != nil { + in, out := &in.LyftVPC, &out.LyftVPC if *in == nil { *out = nil } else { - *out = new(AmazonVPCIPVlanNetworkingSpec) - (*in).DeepCopyInto(*out) + *out = new(LyftVPCNetworkingSpec) + **out = **in } } return diff --git a/pkg/apis/kops/v1alpha2/networking.go b/pkg/apis/kops/v1alpha2/networking.go index 5f9ddd8111b60..d0aaea509aaa7 100644 --- a/pkg/apis/kops/v1alpha2/networking.go +++ b/pkg/apis/kops/v1alpha2/networking.go @@ -18,20 +18,20 @@ package v1alpha2 // NetworkingSpec allows selection and configuration of a networking plugin type NetworkingSpec struct { - Classic *ClassicNetworkingSpec `json:"classic,omitempty"` - Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` - External *ExternalNetworkingSpec `json:"external,omitempty"` - CNI *CNINetworkingSpec `json:"cni,omitempty"` - Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` - Weave *WeaveNetworkingSpec `json:"weave,omitempty"` - Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` - Calico *CalicoNetworkingSpec `json:"calico,omitempty"` - Canal *CanalNetworkingSpec `json:"canal,omitempty"` - Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` - Romana *RomanaNetworkingSpec `json:"romana,omitempty"` - AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` - Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` - AmazonVPCIPVlan *AmazonVPCIPVlanNetworkingSpec `json:"amazonvpcipvlan,omitempty"` + Classic *ClassicNetworkingSpec `json:"classic,omitempty"` + Kubenet *KubenetNetworkingSpec `json:"kubenet,omitempty"` + External *ExternalNetworkingSpec `json:"external,omitempty"` + CNI *CNINetworkingSpec `json:"cni,omitempty"` + Kopeio *KopeioNetworkingSpec `json:"kopeio,omitempty"` + Weave *WeaveNetworkingSpec `json:"weave,omitempty"` + Flannel *FlannelNetworkingSpec `json:"flannel,omitempty"` + Calico *CalicoNetworkingSpec `json:"calico,omitempty"` + Canal *CanalNetworkingSpec `json:"canal,omitempty"` + Kuberouter *KuberouterNetworkingSpec `json:"kuberouter,omitempty"` + Romana *RomanaNetworkingSpec `json:"romana,omitempty"` + AmazonVPC *AmazonVPCNetworkingSpec `json:"amazonvpc,omitempty"` + Cilium *CiliumNetworkingSpec `json:"cilium,omitempty"` + LyftVPC *LyftVPCNetworkingSpec `json:"lyftvpc,omitempty"` } // ClassicNetworkingSpec is the specification of classic networking mode, integrated into kubernetes @@ -189,12 +189,4 @@ type CiliumNetworkingSpec struct { } // LyftIpVlanNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking -type AmazonVPCIPVlanNetworkingSpec struct { - // Tags that subnets must have to be used for pod IPs - SubnetTags map[string]string `json:"subnetTags,omitempty"` - InterfaceIndex int `json:"interfaceIndex,omitempty"` - RouteToVPCPeers bool `json:"routeToVPCPeers,omitempty"` - // list of security groups to assign to the ENIs for pods - SecurityGroupIds []string `json:"securityGroupIds,omitempty"` - BinariesDownloadURL string `json:"binariesDownloadURL,omitempty"` -} +type LyftVPCNetworkingSpec struct{} diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 8bc4b25cfcacb..28e5c2638f818 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -40,8 +40,6 @@ func RegisterConversions(scheme *runtime.Scheme) error { Convert_kops_AddonSpec_To_v1alpha2_AddonSpec, Convert_v1alpha2_AlwaysAllowAuthorizationSpec_To_kops_AlwaysAllowAuthorizationSpec, Convert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha2_AlwaysAllowAuthorizationSpec, - Convert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec, - Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec, Convert_v1alpha2_AmazonVPCNetworkingSpec_To_kops_AmazonVPCNetworkingSpec, Convert_kops_AmazonVPCNetworkingSpec_To_v1alpha2_AmazonVPCNetworkingSpec, Convert_v1alpha2_Assets_To_kops_Assets, @@ -150,6 +148,8 @@ func RegisterConversions(scheme *runtime.Scheme) error { Convert_kops_LoadBalancer_To_v1alpha2_LoadBalancer, Convert_v1alpha2_LoadBalancerAccessSpec_To_kops_LoadBalancerAccessSpec, Convert_kops_LoadBalancerAccessSpec_To_v1alpha2_LoadBalancerAccessSpec, + Convert_v1alpha2_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec, + Convert_kops_LyftVPCNetworkingSpec_To_v1alpha2_LyftVPCNetworkingSpec, Convert_v1alpha2_NetworkingSpec_To_kops_NetworkingSpec, Convert_kops_NetworkingSpec_To_v1alpha2_NetworkingSpec, Convert_v1alpha2_NodeAuthorizationSpec_To_kops_NodeAuthorizationSpec, @@ -271,34 +271,6 @@ func Convert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha2_AlwaysAllowAuthorizat return autoConvert_kops_AlwaysAllowAuthorizationSpec_To_v1alpha2_AlwaysAllowAuthorizationSpec(in, out, s) } -func autoConvert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in *AmazonVPCIPVlanNetworkingSpec, out *kops.AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { - out.SubnetTags = in.SubnetTags - out.InterfaceIndex = in.InterfaceIndex - out.RouteToVPCPeers = in.RouteToVPCPeers - out.SecurityGroupIds = in.SecurityGroupIds - out.BinariesDownloadURL = in.BinariesDownloadURL - return nil -} - -// Convert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec is an autogenerated conversion function. -func Convert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in *AmazonVPCIPVlanNetworkingSpec, out *kops.AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { - return autoConvert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(in, out, s) -} - -func autoConvert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec(in *kops.AmazonVPCIPVlanNetworkingSpec, out *AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { - out.SubnetTags = in.SubnetTags - out.InterfaceIndex = in.InterfaceIndex - out.RouteToVPCPeers = in.RouteToVPCPeers - out.SecurityGroupIds = in.SecurityGroupIds - out.BinariesDownloadURL = in.BinariesDownloadURL - return nil -} - -// Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec is an autogenerated conversion function. -func Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec(in *kops.AmazonVPCIPVlanNetworkingSpec, out *AmazonVPCIPVlanNetworkingSpec, s conversion.Scope) error { - return autoConvert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec(in, out, s) -} - func autoConvert_v1alpha2_AmazonVPCNetworkingSpec_To_kops_AmazonVPCNetworkingSpec(in *AmazonVPCNetworkingSpec, out *kops.AmazonVPCNetworkingSpec, s conversion.Scope) error { out.ImageName = in.ImageName return nil @@ -3083,6 +3055,24 @@ func Convert_kops_LoadBalancerAccessSpec_To_v1alpha2_LoadBalancerAccessSpec(in * return autoConvert_kops_LoadBalancerAccessSpec_To_v1alpha2_LoadBalancerAccessSpec(in, out, s) } +func autoConvert_v1alpha2_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in *LyftVPCNetworkingSpec, out *kops.LyftVPCNetworkingSpec, s conversion.Scope) error { + return nil +} + +// Convert_v1alpha2_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec is an autogenerated conversion function. +func Convert_v1alpha2_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in *LyftVPCNetworkingSpec, out *kops.LyftVPCNetworkingSpec, s conversion.Scope) error { + return autoConvert_v1alpha2_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in, out, s) +} + +func autoConvert_kops_LyftVPCNetworkingSpec_To_v1alpha2_LyftVPCNetworkingSpec(in *kops.LyftVPCNetworkingSpec, out *LyftVPCNetworkingSpec, s conversion.Scope) error { + return nil +} + +// Convert_kops_LyftVPCNetworkingSpec_To_v1alpha2_LyftVPCNetworkingSpec is an autogenerated conversion function. +func Convert_kops_LyftVPCNetworkingSpec_To_v1alpha2_LyftVPCNetworkingSpec(in *kops.LyftVPCNetworkingSpec, out *LyftVPCNetworkingSpec, s conversion.Scope) error { + return autoConvert_kops_LyftVPCNetworkingSpec_To_v1alpha2_LyftVPCNetworkingSpec(in, out, s) +} + func autoConvert_v1alpha2_NetworkingSpec_To_kops_NetworkingSpec(in *NetworkingSpec, out *kops.NetworkingSpec, s conversion.Scope) error { if in.Classic != nil { in, out := &in.Classic, &out.Classic @@ -3201,14 +3191,14 @@ func autoConvert_v1alpha2_NetworkingSpec_To_kops_NetworkingSpec(in *NetworkingSp } else { out.Cilium = nil } - if in.AmazonVPCIPVlan != nil { - in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan - *out = new(kops.AmazonVPCIPVlanNetworkingSpec) - if err := Convert_v1alpha2_AmazonVPCIPVlanNetworkingSpec_To_kops_AmazonVPCIPVlanNetworkingSpec(*in, *out, s); err != nil { + if in.LyftVPC != nil { + in, out := &in.LyftVPC, &out.LyftVPC + *out = new(kops.LyftVPCNetworkingSpec) + if err := Convert_v1alpha2_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(*in, *out, s); err != nil { return err } } else { - out.AmazonVPCIPVlan = nil + out.LyftVPC = nil } return nil } @@ -3336,14 +3326,14 @@ func autoConvert_kops_NetworkingSpec_To_v1alpha2_NetworkingSpec(in *kops.Network } else { out.Cilium = nil } - if in.AmazonVPCIPVlan != nil { - in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan - *out = new(AmazonVPCIPVlanNetworkingSpec) - if err := Convert_kops_AmazonVPCIPVlanNetworkingSpec_To_v1alpha2_AmazonVPCIPVlanNetworkingSpec(*in, *out, s); err != nil { + if in.LyftVPC != nil { + in, out := &in.LyftVPC, &out.LyftVPC + *out = new(LyftVPCNetworkingSpec) + if err := Convert_kops_LyftVPCNetworkingSpec_To_v1alpha2_LyftVPCNetworkingSpec(*in, *out, s); err != nil { return err } } else { - out.AmazonVPCIPVlan = nil + out.LyftVPC = nil } return nil } diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index c1ad235f646b1..b656c0389e24d 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -91,34 +91,6 @@ func (in *AlwaysAllowAuthorizationSpec) DeepCopy() *AlwaysAllowAuthorizationSpec return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopyInto(out *AmazonVPCIPVlanNetworkingSpec) { - *out = *in - if in.SubnetTags != nil { - in, out := &in.SubnetTags, &out.SubnetTags - *out = make(map[string]string, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - if in.SecurityGroupIds != nil { - in, out := &in.SecurityGroupIds, &out.SecurityGroupIds - *out = make([]string, len(*in)) - copy(*out, *in) - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AmazonVPCIPVlanNetworkingSpec. -func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopy() *AmazonVPCIPVlanNetworkingSpec { - if in == nil { - return nil - } - out := new(AmazonVPCIPVlanNetworkingSpec) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AmazonVPCNetworkingSpec) DeepCopyInto(out *AmazonVPCNetworkingSpec) { *out = *in @@ -3076,6 +3048,22 @@ func (in *LoadBalancerAccessSpec) DeepCopy() *LoadBalancerAccessSpec { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *LyftVPCNetworkingSpec) DeepCopyInto(out *LyftVPCNetworkingSpec) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LyftVPCNetworkingSpec. +func (in *LyftVPCNetworkingSpec) DeepCopy() *LyftVPCNetworkingSpec { + if in == nil { + return nil + } + out := new(LyftVPCNetworkingSpec) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { *out = *in @@ -3196,13 +3184,13 @@ func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { (*in).DeepCopyInto(*out) } } - if in.AmazonVPCIPVlan != nil { - in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + if in.LyftVPC != nil { + in, out := &in.LyftVPC, &out.LyftVPC if *in == nil { *out = nil } else { - *out = new(AmazonVPCIPVlanNetworkingSpec) - (*in).DeepCopyInto(*out) + *out = new(LyftVPCNetworkingSpec) + **out = **in } } return diff --git a/pkg/apis/kops/validation/legacy.go b/pkg/apis/kops/validation/legacy.go index ea5d253bbabae..6d63ff3695ac9 100644 --- a/pkg/apis/kops/validation/legacy.go +++ b/pkg/apis/kops/validation/legacy.go @@ -192,7 +192,8 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { } - if networkCIDR != nil && subnet.Overlap(nonMasqueradeCIDR, networkCIDR) && c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC == nil && c.Spec.Networking.AmazonVPCIPVlan == nil { + if networkCIDR != nil && subnet.Overlap(nonMasqueradeCIDR, networkCIDR) && c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC == nil && c.Spec.Networking.LyftVPC == nil { + return field.Invalid(fieldSpec.Child("NonMasqueradeCIDR"), nonMasqueradeCIDRString, fmt.Sprintf("NonMasqueradeCIDR %q cannot overlap with NetworkCIDR %q", nonMasqueradeCIDRString, c.Spec.NetworkCIDR)) } @@ -599,7 +600,7 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { } - if c.Spec.Networking != nil && (c.Spec.Networking.AmazonVPC != nil || c.Spec.Networking.AmazonVPCIPVlan != nil) && + if c.Spec.Networking != nil && (c.Spec.Networking.AmazonVPC != nil || c.Spec.Networking.LyftVPC != nil) && c.Spec.CloudProvider != "aws" { return field.Invalid(fieldSpec.Child("Networking"), "amazon-vpc-routed-eni", "amazon-vpc-routed-eni networking is supported only in AWS") } @@ -613,7 +614,7 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { return field.Invalid(fieldSpec.Child("Networking"), "amazon-vpc-routed-eni", "amazon-vpc-routed-eni networking is not supported with kubernetes versions 1.6 or lower") } - if c.Spec.Networking != nil && c.Spec.Networking.AmazonVPCIPVlan != nil { + if c.Spec.Networking != nil && c.Spec.Networking.LyftVPC != nil { return field.Invalid(fieldSpec.Child("Networking"), "cni-ipvlan-vpc-k8s", "cni-ipvlan-vpc-k8s networking is not supported with kubernetes versions 1.6 or lower") } } diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index cc972f3f294fa..c2d2307c8f43e 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -91,34 +91,6 @@ func (in *AlwaysAllowAuthorizationSpec) DeepCopy() *AlwaysAllowAuthorizationSpec return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopyInto(out *AmazonVPCIPVlanNetworkingSpec) { - *out = *in - if in.SubnetTags != nil { - in, out := &in.SubnetTags, &out.SubnetTags - *out = make(map[string]string, len(*in)) - for key, val := range *in { - (*out)[key] = val - } - } - if in.SecurityGroupIds != nil { - in, out := &in.SecurityGroupIds, &out.SecurityGroupIds - *out = make([]string, len(*in)) - copy(*out, *in) - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AmazonVPCIPVlanNetworkingSpec. -func (in *AmazonVPCIPVlanNetworkingSpec) DeepCopy() *AmazonVPCIPVlanNetworkingSpec { - if in == nil { - return nil - } - out := new(AmazonVPCIPVlanNetworkingSpec) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AmazonVPCNetworkingSpec) DeepCopyInto(out *AmazonVPCNetworkingSpec) { *out = *in @@ -3280,6 +3252,22 @@ func (in *LoadBalancerAccessSpec) DeepCopy() *LoadBalancerAccessSpec { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *LyftVPCNetworkingSpec) DeepCopyInto(out *LyftVPCNetworkingSpec) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LyftVPCNetworkingSpec. +func (in *LyftVPCNetworkingSpec) DeepCopy() *LyftVPCNetworkingSpec { + if in == nil { + return nil + } + out := new(LyftVPCNetworkingSpec) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { *out = *in @@ -3400,13 +3388,13 @@ func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { (*in).DeepCopyInto(*out) } } - if in.AmazonVPCIPVlan != nil { - in, out := &in.AmazonVPCIPVlan, &out.AmazonVPCIPVlan + if in.LyftVPC != nil { + in, out := &in.LyftVPC, &out.LyftVPC if *in == nil { *out = nil } else { - *out = new(AmazonVPCIPVlanNetworkingSpec) - (*in).DeepCopyInto(*out) + *out = new(LyftVPCNetworkingSpec) + **out = **in } } return diff --git a/pkg/model/components/context.go b/pkg/model/components/context.go index 062907723fbaf..21e2cfcde1da4 100644 --- a/pkg/model/components/context.go +++ b/pkg/model/components/context.go @@ -78,7 +78,7 @@ func UsesKubenet(clusterSpec *kops.ClusterSpec) (bool, error) { } else if networking.External != nil { // external is based on kubenet return true, nil - } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.AmazonVPCIPVlan != nil { + } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.LyftVPC != nil { return false, nil } else if networking.Kopeio != nil { // Kopeio is based on kubenet / external diff --git a/pkg/model/components/kubecontrollermanager.go b/pkg/model/components/kubecontrollermanager.go index 468c24b77898f..bb4d4cede4dd7 100644 --- a/pkg/model/components/kubecontrollermanager.go +++ b/pkg/model/components/kubecontrollermanager.go @@ -152,7 +152,7 @@ func (b *KubeControllerManagerOptionsBuilder) BuildOptions(o interface{}) error kcm.ConfigureCloudRoutes = fi.Bool(true) } else if networking.External != nil { kcm.ConfigureCloudRoutes = fi.Bool(false) - } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.AmazonVPCIPVlan != nil { + } else if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.LyftVPC != nil { kcm.ConfigureCloudRoutes = fi.Bool(false) } else if networking.Kopeio != nil { // Kopeio is based on kubenet / external diff --git a/pkg/model/components/networking.go b/pkg/model/components/networking.go index e36154f2ef73a..53fa4df626c7b 100644 --- a/pkg/model/components/networking.go +++ b/pkg/model/components/networking.go @@ -49,7 +49,7 @@ func (b *NetworkingOptionsBuilder) BuildOptions(o interface{}) error { return fmt.Errorf("networking not set") } - if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.AmazonVPCIPVlan != nil { + if networking.CNI != nil || networking.Weave != nil || networking.Flannel != nil || networking.Calico != nil || networking.Canal != nil || networking.Kuberouter != nil || networking.Romana != nil || networking.AmazonVPC != nil || networking.Cilium != nil || networking.LyftVPC != nil { options.Kubelet.NetworkPluginName = "cni" if k8sVersion.Major == 1 && k8sVersion.Minor <= 4 { diff --git a/pkg/model/iam/iam_builder.go b/pkg/model/iam/iam_builder.go index 8684e34ccffb0..f5507bdec53dd 100644 --- a/pkg/model/iam/iam_builder.go +++ b/pkg/model/iam/iam_builder.go @@ -188,8 +188,8 @@ func (b *PolicyBuilder) BuildAWSPolicyMaster() (*Policy, error) { addAmazonVPCCNIPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) } - if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.AmazonVPCIPVlan != nil { - addAmazonVPCIPVlanPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) + if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.LyftVPC != nil { + addLyftVPCPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) } return p, nil @@ -225,8 +225,8 @@ func (b *PolicyBuilder) BuildAWSPolicyNode() (*Policy, error) { addAmazonVPCCNIPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) } - if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.AmazonVPCIPVlan != nil { - addAmazonVPCIPVlanPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) + if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.LyftVPC != nil { + addLyftVPCPermissions(p, resource, b.Cluster.Spec.IAM.Legacy, b.Cluster.GetName()) } return p, nil @@ -828,7 +828,7 @@ func addRomanaCNIPermissions(p *Policy, resource stringorslice.StringOrSlice, le ) } -func addAmazonVPCIPVlanPermissions(p *Policy, resource stringorslice.StringOrSlice, legacyIAM bool, clusterName string) { +func addLyftVPCPermissions(p *Policy, resource stringorslice.StringOrSlice, legacyIAM bool, clusterName string) { if legacyIAM { // Legacy IAM provides ec2:*, so no additional permissions required return diff --git a/upup/models/nodeup/resources/_amazon_vpc_ipvlan/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template b/upup/models/nodeup/resources/_amazon_vpc_ipvlan/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template deleted file mode 100644 index 246f8353bfdef..0000000000000 --- a/upup/models/nodeup/resources/_amazon_vpc_ipvlan/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template +++ /dev/null @@ -1,33 +0,0 @@ -{ - "cniVersion": "0.3.1", - "name": "cni-ipvlan-vpc-k8s", - "plugins": [ - { - "cniVersion": "0.3.1", - "type": "cni-ipvlan-vpc-k8s-ipvlan", - "mode": "l2", - "master": "ipam", - "ipam": { - "type": "cni-ipvlan-vpc-k8s-ipam", - "interfaceIndex": {{ .Networking.AmazonVPCIPVlan.InterfaceIndex }}, - {{- if .Networking.AmazonVPCIPVlan.SubnetTags }} - "subnetTags": {{ MapJson .Networking.AmazonVPCIPVlan.SubnetTags}}, - {{- end }} - "routeToVpcPeers": {{ .Networking.AmazonVPCIPVlan.RouteToVPCPeers }}, - "secGroupIds": [ - {{ range $index, $element := .Networking.AmazonVPCIPVlan.SecurityGroupIds}} - {{if $index}},{{end}} "{{$element}}" - {{end}} - - ] - } - }, - { - "cniVersion": "0.3.1", - "type": "cni-ipvlan-vpc-k8s-unnumbered-ptp", - "hostInterface": "eth0", - "containerInterface": "veth0", - "ipMasq": true - } - ] -} diff --git a/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template b/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template new file mode 100644 index 0000000000000..db0c1d21c94bd --- /dev/null +++ b/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template @@ -0,0 +1,28 @@ +{ + "cniVersion": "0.3.1", + "name": "cni-ipvlan-vpc-k8s", + "plugins": [ + { + "cniVersion": "0.3.1", + "type": "cni-ipvlan-vpc-k8s-ipvlan", + "mode": "l2", + "master": "ipam", + "ipam": { + "type": "cni-ipvlan-vpc-k8s-ipam", + "interfaceIndex": 1, + "subnetTags": { + "Type": "pod" + }, + "routeToVpcPeers": true, + "secGroupIds": {{ NodeSecurityGroups }} + } + }, + { + "cniVersion": "0.3.1", + "type": "cni-ipvlan-vpc-k8s-unnumbered-ptp", + "hostInterface": "eth0", + "containerInterface": "veth0", + "ipMasq": true + } + ] +} diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go index 032369e9c6bb5..3f5205a42cf93 100644 --- a/upup/pkg/fi/cloudup/apply_cluster.go +++ b/upup/pkg/fi/cloudup/apply_cluster.go @@ -1092,7 +1092,7 @@ func (c *ApplyClusterCmd) AddFileAssets(assetBuilder *assets.AssetBuilder) error c.Assets = append(c.Assets, cniAssetHashString+"@"+cniAsset.String()) } - if c.Cluster.Spec.Networking.AmazonVPCIPVlan != nil { + if c.Cluster.Spec.Networking.LyftVPC != nil { c.Assets = append(c.Assets, "818c50109eb6fb5bf2206426c4ceb1d48bab9ca52e1447335a9ce0788810d78c@https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.3.1/cni-ipvlan-vpc-k8s-v0.3.1.tar.gz") } diff --git a/upup/pkg/fi/cloudup/networking.go b/upup/pkg/fi/cloudup/networking.go index 64e0ed4f3a0f3..96e0f3d1af912 100644 --- a/upup/pkg/fi/cloudup/networking.go +++ b/upup/pkg/fi/cloudup/networking.go @@ -95,8 +95,8 @@ func usesCNI(c *api.Cluster) bool { return true } - if networkConfig.AmazonVPCIPVlan != nil { - // AmazonVPCIPVlan uses CNI + if networkConfig.LyftVPC != nil { + // LyftVPC uses CNI return true } diff --git a/upup/pkg/fi/cloudup/tagbuilder.go b/upup/pkg/fi/cloudup/tagbuilder.go index 54b96e25a2769..84462d32057f7 100644 --- a/upup/pkg/fi/cloudup/tagbuilder.go +++ b/upup/pkg/fi/cloudup/tagbuilder.go @@ -102,8 +102,8 @@ func buildNodeupTags(role api.InstanceGroupRole, cluster *api.Cluster, clusterTa return nil, fmt.Errorf("Networking is not set, and should not be nil here") } - if networking.AmazonVPCIPVlan != nil { - tags.Insert("_amazon_vpc_ipvlan") + if networking.LyftVPC != nil { + tags.Insert("_lyft_vpc_cni") } switch fi.StringValue(cluster.Spec.UpdatePolicy) { diff --git a/upup/pkg/fi/nodeup/command.go b/upup/pkg/fi/nodeup/command.go index 0df6c57d32981..a575c7c4b6918 100644 --- a/upup/pkg/fi/nodeup/command.go +++ b/upup/pkg/fi/nodeup/command.go @@ -252,12 +252,19 @@ func (c *NodeUpCommand) Run(out io.Writer) error { loader.Builders = append(loader.Builders, &model.EtcdTLSBuilder{NodeupModelContext: modelContext}) } - loader.TemplateFunctions["MapJson"] = func(m map[string]string) (string, error) { - bytes, err := json.Marshal(m) - if err != nil { - return "", err + if c.cluster.Spec.Networking.LyftVPC != nil { + loader.TemplateFunctions["NodeSecurityGroups"] = func() (string, error) { + // use the same security groups as the node + ids, err := evaluateSecurityGroups(c.cluster.Spec.NetworkID) + if err != nil { + return "", err + } + bytes, err := json.Marshal(ids) + if err != nil { + return "", err + } + return string(bytes), nil } - return string(bytes), nil } taskMap, err := loader.Build(c.ModelDir) @@ -353,15 +360,6 @@ func evaluateSpec(c *api.Cluster) error { } } - if c.Spec.Networking.AmazonVPCIPVlan != nil && len(c.Spec.Networking.AmazonVPCIPVlan.SecurityGroupIds) == 0 { - // use the same security groups as the node when no alternative has been provided - ids, err := evaluateSecurityGroups(c.Spec.NetworkID) - if err != nil { - return err - } - c.Spec.Networking.AmazonVPCIPVlan.SecurityGroupIds = ids - } - return nil } From cdeeb3704b0cdda390366d1cdece82afe6652abf Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Mon, 7 May 2018 13:38:22 -0700 Subject: [PATCH 052/163] allow overriding the cni plugin download url --- upup/pkg/fi/cloudup/apply_cluster.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go index 3f5205a42cf93..aeaa898495267 100644 --- a/upup/pkg/fi/cloudup/apply_cluster.go +++ b/upup/pkg/fi/cloudup/apply_cluster.go @@ -1093,7 +1093,12 @@ func (c *ApplyClusterCmd) AddFileAssets(assetBuilder *assets.AssetBuilder) error } if c.Cluster.Spec.Networking.LyftVPC != nil { - c.Assets = append(c.Assets, "818c50109eb6fb5bf2206426c4ceb1d48bab9ca52e1447335a9ce0788810d78c@https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.3.1/cni-ipvlan-vpc-k8s-v0.3.1.tar.gz") + lyftVPCDownloadURL := os.Getenv("LYFT_VPC_DOWNLOAD_URL") + if lyftVPCDownloadURL == "" { + lyftVPCDownloadURL = "818c50109eb6fb5bf2206426c4ceb1d48bab9ca52e1447335a9ce0788810d78c@https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.3.1/cni-ipvlan-vpc-k8s-v0.3.1.tar.gz" + } + + c.Assets = append(c.Assets, lyftVPCDownloadURL) } // TODO figure out if we can only do this for CoreOS only and GCE Container OS From 153dd977df7791235309837d10eb6de8a41b1d6c Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Tue, 8 May 2018 13:03:20 -0700 Subject: [PATCH 053/163] log when using the env var to override plugin url --- upup/pkg/fi/cloudup/apply_cluster.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go index aeaa898495267..048bb6d5e7aa3 100644 --- a/upup/pkg/fi/cloudup/apply_cluster.go +++ b/upup/pkg/fi/cloudup/apply_cluster.go @@ -1096,6 +1096,8 @@ func (c *ApplyClusterCmd) AddFileAssets(assetBuilder *assets.AssetBuilder) error lyftVPCDownloadURL := os.Getenv("LYFT_VPC_DOWNLOAD_URL") if lyftVPCDownloadURL == "" { lyftVPCDownloadURL = "818c50109eb6fb5bf2206426c4ceb1d48bab9ca52e1447335a9ce0788810d78c@https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.3.1/cni-ipvlan-vpc-k8s-v0.3.1.tar.gz" + } else { + glog.Warningf("Using url from LYFT_VPC_DOWNLOAD_URL env var: %q", lyftVPCDownloadURL) } c.Assets = append(c.Assets, lyftVPCDownloadURL) From af7377d530faee820983a5bcd12825701e2e4076 Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Fri, 25 May 2018 12:20:37 -0700 Subject: [PATCH 054/163] fix use of --networking in create cluster --- cmd/kops/create_cluster.go | 4 ++-- pkg/model/iam/iam_builder.go | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index ba4b13050763c..08d55abe67038 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -966,7 +966,7 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e case api.TopologyPrivate: if !supportsPrivateTopology(cluster.Spec.Networking) { - return fmt.Errorf("Invalid networking option %s. Currently only '--networking kopeio-vxlan (or kopeio)', '--networking weave', '--networking flannel', '--networking calico', '--networking canal', '--networking kube-router', '--networking romana', '--networking amazon-vpc-routed-eni' are supported for private topologies", c.Networking) + return fmt.Errorf("Invalid networking option %s. Currently only '--networking kopeio-vxlan (or kopeio)', '--networking weave', '--networking flannel', '--networking calico', '--networking canal', '--networking kube-router', '--networking romana', '--networking amazon-vpc-routed-eni' '--networking lyftvpc' are supported for private topologies", c.Networking) } cluster.Spec.Topology = &api.TopologySpec{ Masters: api.TopologyPrivate, @@ -1275,7 +1275,7 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e func supportsPrivateTopology(n *api.NetworkingSpec) bool { - if n.CNI != nil || n.Kopeio != nil || n.Weave != nil || n.Flannel != nil || n.Calico != nil || n.Canal != nil || n.Kuberouter != nil || n.Romana != nil || n.AmazonVPC != nil || n.Cilium != nil { + if n.CNI != nil || n.Kopeio != nil || n.Weave != nil || n.Flannel != nil || n.Calico != nil || n.Canal != nil || n.Kuberouter != nil || n.Romana != nil || n.AmazonVPC != nil || n.Cilium != nil || n.LyftVPC != nil { return true } return false diff --git a/pkg/model/iam/iam_builder.go b/pkg/model/iam/iam_builder.go index f5507bdec53dd..e3a7cb4654978 100644 --- a/pkg/model/iam/iam_builder.go +++ b/pkg/model/iam/iam_builder.go @@ -836,7 +836,6 @@ func addLyftVPCPermissions(p *Policy, resource stringorslice.StringOrSlice, lega p.Statement = append(p.Statement, &Statement{ - Sid: "cniIpvlanVpcK8s", Effect: StatementEffectAllow, Action: stringorslice.Slice([]string{ "ec2:DescribeSubnets", From f0a7fa785c35cb0295a314eab4be900e51a50a32 Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Fri, 22 Jun 2018 10:13:30 -0700 Subject: [PATCH 055/163] allow overriding subnet tags in the NetworkSpec --- pkg/apis/kops/networking.go | 4 +++- pkg/apis/kops/v1alpha1/networking.go | 4 +++- .../kops/v1alpha1/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go | 9 ++++++++- pkg/apis/kops/v1alpha2/networking.go | 4 +++- .../kops/v1alpha2/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go | 9 ++++++++- pkg/apis/kops/zz_generated.deepcopy.go | 9 ++++++++- .../10-cni-ipvlan-vpc-k8s.conflist.template | 4 +--- upup/pkg/fi/nodeup/command.go | 16 ++++++++++++++++ 10 files changed, 54 insertions(+), 9 deletions(-) diff --git a/pkg/apis/kops/networking.go b/pkg/apis/kops/networking.go index f7817c360114a..b0faab15503cf 100644 --- a/pkg/apis/kops/networking.go +++ b/pkg/apis/kops/networking.go @@ -191,4 +191,6 @@ type CiliumNetworkingSpec struct { } // LyftIpVlanNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking -type LyftVPCNetworkingSpec struct{} +type LyftVPCNetworkingSpec struct { + SubnetTags map[string]string `json:"subnetTags,omitempty"` +} diff --git a/pkg/apis/kops/v1alpha1/networking.go b/pkg/apis/kops/v1alpha1/networking.go index 07e4186fcd5c9..705a35f0929eb 100644 --- a/pkg/apis/kops/v1alpha1/networking.go +++ b/pkg/apis/kops/v1alpha1/networking.go @@ -188,4 +188,6 @@ type CiliumNetworkingSpec struct { } // LyftIpVlanNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking -type LyftVPCNetworkingSpec struct{} +type LyftVPCNetworkingSpec struct { + SubnetTags map[string]string `json:"subnetTags,omitempty"` +} diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index a0a8fdda879f9..3b9e054716193 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -2792,6 +2792,7 @@ func Convert_kops_LoadBalancerAccessSpec_To_v1alpha1_LoadBalancerAccessSpec(in * } func autoConvert_v1alpha1_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in *LyftVPCNetworkingSpec, out *kops.LyftVPCNetworkingSpec, s conversion.Scope) error { + out.SubnetTags = in.SubnetTags return nil } @@ -2801,6 +2802,7 @@ func Convert_v1alpha1_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in *Ly } func autoConvert_kops_LyftVPCNetworkingSpec_To_v1alpha1_LyftVPCNetworkingSpec(in *kops.LyftVPCNetworkingSpec, out *LyftVPCNetworkingSpec, s conversion.Scope) error { + out.SubnetTags = in.SubnetTags return nil } diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index ed101c6ffc518..79fd93ebe9eec 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -2970,6 +2970,13 @@ func (in *LoadBalancerAccessSpec) DeepCopy() *LoadBalancerAccessSpec { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *LyftVPCNetworkingSpec) DeepCopyInto(out *LyftVPCNetworkingSpec) { *out = *in + if in.SubnetTags != nil { + in, out := &in.SubnetTags, &out.SubnetTags + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } return } @@ -3109,7 +3116,7 @@ func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { *out = nil } else { *out = new(LyftVPCNetworkingSpec) - **out = **in + (*in).DeepCopyInto(*out) } } return diff --git a/pkg/apis/kops/v1alpha2/networking.go b/pkg/apis/kops/v1alpha2/networking.go index d0aaea509aaa7..ce3b22b69aff4 100644 --- a/pkg/apis/kops/v1alpha2/networking.go +++ b/pkg/apis/kops/v1alpha2/networking.go @@ -189,4 +189,6 @@ type CiliumNetworkingSpec struct { } // LyftIpVlanNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking -type LyftVPCNetworkingSpec struct{} +type LyftVPCNetworkingSpec struct { + SubnetTags map[string]string `json:"subnetTags,omitempty"` +} diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 28e5c2638f818..47320dac2d0dd 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -3056,6 +3056,7 @@ func Convert_kops_LoadBalancerAccessSpec_To_v1alpha2_LoadBalancerAccessSpec(in * } func autoConvert_v1alpha2_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in *LyftVPCNetworkingSpec, out *kops.LyftVPCNetworkingSpec, s conversion.Scope) error { + out.SubnetTags = in.SubnetTags return nil } @@ -3065,6 +3066,7 @@ func Convert_v1alpha2_LyftVPCNetworkingSpec_To_kops_LyftVPCNetworkingSpec(in *Ly } func autoConvert_kops_LyftVPCNetworkingSpec_To_v1alpha2_LyftVPCNetworkingSpec(in *kops.LyftVPCNetworkingSpec, out *LyftVPCNetworkingSpec, s conversion.Scope) error { + out.SubnetTags = in.SubnetTags return nil } diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index b656c0389e24d..2217484c0c32f 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -3051,6 +3051,13 @@ func (in *LoadBalancerAccessSpec) DeepCopy() *LoadBalancerAccessSpec { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *LyftVPCNetworkingSpec) DeepCopyInto(out *LyftVPCNetworkingSpec) { *out = *in + if in.SubnetTags != nil { + in, out := &in.SubnetTags, &out.SubnetTags + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } return } @@ -3190,7 +3197,7 @@ func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { *out = nil } else { *out = new(LyftVPCNetworkingSpec) - **out = **in + (*in).DeepCopyInto(*out) } } return diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index c2d2307c8f43e..08c4e17020ca2 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -3255,6 +3255,13 @@ func (in *LoadBalancerAccessSpec) DeepCopy() *LoadBalancerAccessSpec { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *LyftVPCNetworkingSpec) DeepCopyInto(out *LyftVPCNetworkingSpec) { *out = *in + if in.SubnetTags != nil { + in, out := &in.SubnetTags, &out.SubnetTags + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } return } @@ -3394,7 +3401,7 @@ func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) { *out = nil } else { *out = new(LyftVPCNetworkingSpec) - **out = **in + (*in).DeepCopyInto(*out) } } return diff --git a/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template b/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template index db0c1d21c94bd..e329d4f556bf8 100644 --- a/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template +++ b/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template @@ -10,9 +10,7 @@ "ipam": { "type": "cni-ipvlan-vpc-k8s-ipam", "interfaceIndex": 1, - "subnetTags": { - "Type": "pod" - }, + "subnetTags": {{ SubnetTags }}, "routeToVpcPeers": true, "secGroupIds": {{ NodeSecurityGroups }} } diff --git a/upup/pkg/fi/nodeup/command.go b/upup/pkg/fi/nodeup/command.go index a575c7c4b6918..7354984e90d01 100644 --- a/upup/pkg/fi/nodeup/command.go +++ b/upup/pkg/fi/nodeup/command.go @@ -253,6 +253,22 @@ func (c *NodeUpCommand) Run(out io.Writer) error { } if c.cluster.Spec.Networking.LyftVPC != nil { + + loader.TemplateFunctions["SubnetTags"] = func() (string, error) { + tags := map[string]string{ + "Type": "pod", + } + if len(c.cluster.Spec.Networking.LyftVPC.SubnetTags) > 0 { + tags = c.cluster.Spec.Networking.LyftVPC.SubnetTags + } + + bytes, err := json.Marshal(tags) + if err != nil { + return "", err + } + return string(bytes), nil + } + loader.TemplateFunctions["NodeSecurityGroups"] = func() (string, error) { // use the same security groups as the node ids, err := evaluateSecurityGroups(c.cluster.Spec.NetworkID) From 9792c02b48060e7b34a5b201a3958b31f1298cfb Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Fri, 3 Aug 2018 11:27:38 -0700 Subject: [PATCH 056/163] gofmt --- nodeup/pkg/model/context.go | 2 +- pkg/apis/kops/validation/legacy.go | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/nodeup/pkg/model/context.go b/nodeup/pkg/model/context.go index 326e626f5a783..14a545a70fe8b 100644 --- a/nodeup/pkg/model/context.go +++ b/nodeup/pkg/model/context.go @@ -288,7 +288,7 @@ func (c *NodeupModelContext) UseNodeAuthorizer() bool { // UsesSecondaryIP checks if the CNI in use attaches secondary interfaces to the host. func (c *NodeupModelContext) UsesSecondaryIP() bool { - if (c.Cluster.Spec.Networking.CNI != nil && c.Cluster.Spec.Networking.CNI.UsesSecondaryIP) || c.Cluster.Spec.Networking.AmazonVPC != nil || c.Cluster.Spec.Networking.LyftVPC != nil { + if (c.Cluster.Spec.Networking.CNI != nil && c.Cluster.Spec.Networking.CNI.UsesSecondaryIP) || c.Cluster.Spec.Networking.AmazonVPC != nil || c.Cluster.Spec.Networking.LyftVPC != nil { return true } diff --git a/pkg/apis/kops/validation/legacy.go b/pkg/apis/kops/validation/legacy.go index 6d63ff3695ac9..13c348b5a689f 100644 --- a/pkg/apis/kops/validation/legacy.go +++ b/pkg/apis/kops/validation/legacy.go @@ -599,7 +599,6 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { } } - if c.Spec.Networking != nil && (c.Spec.Networking.AmazonVPC != nil || c.Spec.Networking.LyftVPC != nil) && c.Spec.CloudProvider != "aws" { return field.Invalid(fieldSpec.Child("Networking"), "amazon-vpc-routed-eni", "amazon-vpc-routed-eni networking is supported only in AWS") From 9755318db903d27f21f0534dd39d9c22ee95836b Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Mon, 27 Aug 2018 14:22:10 -0700 Subject: [PATCH 057/163] update lyft cni plugin to 0.4.2 --- .../10-cni-ipvlan-vpc-k8s.conflist.template | 47 +++++++++---------- upup/pkg/fi/cloudup/apply_cluster.go | 2 +- 2 files changed, 24 insertions(+), 25 deletions(-) diff --git a/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template b/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template index e329d4f556bf8..b3b9b70d77f07 100644 --- a/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template +++ b/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template @@ -1,26 +1,25 @@ { - "cniVersion": "0.3.1", - "name": "cni-ipvlan-vpc-k8s", - "plugins": [ - { - "cniVersion": "0.3.1", - "type": "cni-ipvlan-vpc-k8s-ipvlan", - "mode": "l2", - "master": "ipam", - "ipam": { - "type": "cni-ipvlan-vpc-k8s-ipam", - "interfaceIndex": 1, - "subnetTags": {{ SubnetTags }}, - "routeToVpcPeers": true, - "secGroupIds": {{ NodeSecurityGroups }} - } - }, - { - "cniVersion": "0.3.1", - "type": "cni-ipvlan-vpc-k8s-unnumbered-ptp", - "hostInterface": "eth0", - "containerInterface": "veth0", - "ipMasq": true - } + "cniVersion": "0.3.1", + "name": "cni-ipvlan-vpc-k8s", + "plugins": [ + { + "cniVersion": "0.3.1", + "type": "cni-ipvlan-vpc-k8s-ipam", + "interfaceIndex": 1, + "subnetTags": {{ SubnetTags }}, + "secGroupIds": {{ NodeSecurityGroups }} + }, + { + "cniVersion": "0.3.1", + "type": "cni-ipvlan-vpc-k8s-ipvlan", + "mode": "l2" + }, + { + "cniVersion": "0.3.1", + "type": "cni-ipvlan-vpc-k8s-unnumbered-ptp", + "hostInterface": "eth0", + "containerInterface": "veth0", + "ipMasq": true + } ] -} +} \ No newline at end of file diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go index 048bb6d5e7aa3..5d64b3c53a8db 100644 --- a/upup/pkg/fi/cloudup/apply_cluster.go +++ b/upup/pkg/fi/cloudup/apply_cluster.go @@ -1095,7 +1095,7 @@ func (c *ApplyClusterCmd) AddFileAssets(assetBuilder *assets.AssetBuilder) error if c.Cluster.Spec.Networking.LyftVPC != nil { lyftVPCDownloadURL := os.Getenv("LYFT_VPC_DOWNLOAD_URL") if lyftVPCDownloadURL == "" { - lyftVPCDownloadURL = "818c50109eb6fb5bf2206426c4ceb1d48bab9ca52e1447335a9ce0788810d78c@https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.3.1/cni-ipvlan-vpc-k8s-v0.3.1.tar.gz" + lyftVPCDownloadURL = "bfdc65028a3bf8ffe14388fca28ede3600e7e2dee4e781908b6a23f9e79f86ad@https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.4.2/cni-ipvlan-vpc-k8s-v0.4.2.tar.gz" } else { glog.Warningf("Using url from LYFT_VPC_DOWNLOAD_URL env var: %q", lyftVPCDownloadURL) } From 1ceaa450356a796b6d8b662895c042dce93a3fea Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Tue, 2 Oct 2018 16:55:01 -0700 Subject: [PATCH 058/163] sets skipDeallocation=true to avoid https://github.com/lyft/cni-ipvlan-vpc-k8s/issues/41 --- .../files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template | 1 + 1 file changed, 1 insertion(+) diff --git a/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template b/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template index b3b9b70d77f07..7b2077fa8b813 100644 --- a/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template +++ b/upup/models/nodeup/resources/_lyft_vpc_cni/files/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist.template @@ -6,6 +6,7 @@ "cniVersion": "0.3.1", "type": "cni-ipvlan-vpc-k8s-ipam", "interfaceIndex": 1, + "skipDeallocation" : true, "subnetTags": {{ SubnetTags }}, "secGroupIds": {{ NodeSecurityGroups }} }, From 43bef0042f6a809200d973e7c4279fff2bd0a87f Mon Sep 17 00:00:00 2001 From: Chris Phillips Date: Wed, 7 Nov 2018 08:56:25 -0800 Subject: [PATCH 059/163] gofmt --- pkg/apis/kops/validation/legacy.go | 1 - 1 file changed, 1 deletion(-) diff --git a/pkg/apis/kops/validation/legacy.go b/pkg/apis/kops/validation/legacy.go index 13c348b5a689f..8b42543d96288 100644 --- a/pkg/apis/kops/validation/legacy.go +++ b/pkg/apis/kops/validation/legacy.go @@ -191,7 +191,6 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error { return field.Invalid(fieldSpec.Child("NonMasqueradeCIDR"), nonMasqueradeCIDRString, "Cluster had an invalid NonMasqueradeCIDR") } - if networkCIDR != nil && subnet.Overlap(nonMasqueradeCIDR, networkCIDR) && c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC == nil && c.Spec.Networking.LyftVPC == nil { return field.Invalid(fieldSpec.Child("NonMasqueradeCIDR"), nonMasqueradeCIDRString, fmt.Sprintf("NonMasqueradeCIDR %q cannot overlap with NetworkCIDR %q", nonMasqueradeCIDRString, c.Spec.NetworkCIDR)) From 3da3b415e0fcaa449ec64a2967fe33f001338e8c Mon Sep 17 00:00:00 2001 From: Erik Stidham Date: Thu, 3 May 2018 08:49:32 -0500 Subject: [PATCH 060/163] Adding Calico V3 - Add Calico configuration field to specify MajorVersion - Add Calico V3 manifest - Default new installations to Calico V3 - Set etcd to V3 when calico is specified for networking - Validate that etcd is V3 when Calico MajorVersion is v3 - Using Calico v3.2.1 --- cmd/kops/create_cluster.go | 14 +- pkg/apis/kops/networking.go | 2 + pkg/apis/kops/v1alpha1/networking.go | 2 + pkg/apis/kops/v1alpha2/networking.go | 2 + pkg/apis/kops/validation/validation.go | 47 ++ pkg/apis/kops/validation/validation_test.go | 44 ++ .../k8s-1.6.yaml.template | 6 +- .../k8s-1.7-v3.yaml.template | 748 ++++++++++++++++++ .../k8s-1.7.yaml.template | 8 +- .../pkg/fi/cloudup/bootstrapchannelbuilder.go | 98 ++- 10 files changed, 924 insertions(+), 47 deletions(-) create mode 100644 upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index 66184b1ac27e6..95f9c09d6c6c5 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -33,6 +33,7 @@ import ( apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/util/sets" + "k8s.io/apimachinery/pkg/util/validation/field" "k8s.io/kops" "k8s.io/kops/cmd/kops/util" api "k8s.io/kops/pkg/apis/kops" @@ -43,6 +44,7 @@ import ( "k8s.io/kops/pkg/commands" "k8s.io/kops/pkg/dns" "k8s.io/kops/pkg/featureflag" + "k8s.io/kops/pkg/model/components" "k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi/cloudup" "k8s.io/kops/upup/pkg/fi/cloudup/aliup" @@ -918,7 +920,17 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e Backend: "udp", } case "calico": - cluster.Spec.Networking.Calico = &api.CalicoNetworkingSpec{} + cluster.Spec.Networking.Calico = &api.CalicoNetworkingSpec{ + MajorVersion: "v3", + } + // Validate to check if etcd clusters have an acceptable version + if errList := validation.ValidateEtcdVersionForCalicoV3(cluster.Spec.EtcdClusters[0], cluster.Spec.Networking.Calico.MajorVersion, field.NewPath("Calico")); len(errList) != 0 { + + // This is not a special version but simply of the 3 series + for _, etcd := range cluster.Spec.EtcdClusters { + etcd.Version = components.DefaultEtcd3Version_1_11 + } + } case "canal": cluster.Spec.Networking.Canal = &api.CanalNetworkingSpec{} case "kube-router": diff --git a/pkg/apis/kops/networking.go b/pkg/apis/kops/networking.go index 33ba74d5dab86..8f9739f165a6e 100644 --- a/pkg/apis/kops/networking.go +++ b/pkg/apis/kops/networking.go @@ -87,6 +87,8 @@ type CalicoNetworkingSpec struct { PrometheusGoMetricsEnabled bool `json:"prometheusGoMetricsEnabled,omitempty"` // PrometheusProcessMetricsEnabled enables Prometheus process metrics collection PrometheusProcessMetricsEnabled bool `json:"prometheusProcessMetricsEnabled,omitempty"` + // MajorVersion is the version of Calico to use + MajorVersion string `json:"majorVersion,omitempty"` } // CanalNetworkingSpec declares that we want Canal networking diff --git a/pkg/apis/kops/v1alpha1/networking.go b/pkg/apis/kops/v1alpha1/networking.go index d30ce6c6081a4..8e09432cada74 100644 --- a/pkg/apis/kops/v1alpha1/networking.go +++ b/pkg/apis/kops/v1alpha1/networking.go @@ -87,6 +87,8 @@ type CalicoNetworkingSpec struct { PrometheusGoMetricsEnabled bool `json:"prometheusGoMetricsEnabled,omitempty"` // PrometheusProcessMetricsEnabled enables Prometheus process metrics collection PrometheusProcessMetricsEnabled bool `json:"prometheusProcessMetricsEnabled,omitempty"` + // MajorVersion is the version of Calico to use + MajorVersion string `json:"majorVersion,omitempty"` } // CanalNetworkingSpec declares that we want Canal networking diff --git a/pkg/apis/kops/v1alpha2/networking.go b/pkg/apis/kops/v1alpha2/networking.go index b6c60ffe25588..d499db1dcd05b 100644 --- a/pkg/apis/kops/v1alpha2/networking.go +++ b/pkg/apis/kops/v1alpha2/networking.go @@ -87,6 +87,8 @@ type CalicoNetworkingSpec struct { PrometheusGoMetricsEnabled bool `json:"prometheusGoMetricsEnabled,omitempty"` // PrometheusProcessMetricsEnabled enables Prometheus process metrics collection PrometheusProcessMetricsEnabled bool `json:"prometheusProcessMetricsEnabled,omitempty"` + // MajorVersion is the version of Calico to use + MajorVersion string `json:"majorVersion,omitempty"` } // CanalNetworkingSpec declares that we want Canal networking diff --git a/pkg/apis/kops/validation/validation.go b/pkg/apis/kops/validation/validation.go index 68831907296cd..f7ff84a249728 100644 --- a/pkg/apis/kops/validation/validation.go +++ b/pkg/apis/kops/validation/validation.go @@ -21,11 +21,14 @@ import ( "net" "strings" + "github.com/blang/semver" + "k8s.io/apimachinery/pkg/api/validation" utilnet "k8s.io/apimachinery/pkg/util/net" "k8s.io/apimachinery/pkg/util/sets" "k8s.io/apimachinery/pkg/util/validation/field" "k8s.io/kops/pkg/apis/kops" + "k8s.io/kops/pkg/model/components" "k8s.io/kops/pkg/model/iam" ) @@ -94,6 +97,9 @@ func validateClusterSpec(spec *kops.ClusterSpec, fieldPath *field.Path) field.Er if spec.Networking != nil { allErrs = append(allErrs, validateNetworking(spec.Networking, fieldPath.Child("networking"))...) + if spec.Networking.Calico != nil { + allErrs = append(allErrs, validateNetworkingCalico(spec.Networking.Calico, spec.EtcdClusters[0], fieldPath.Child("networking").Child("Calico"))...) + } } // IAM additionalPolicies @@ -341,3 +347,44 @@ func validateEtcdClusterSpec(spec *kops.EtcdClusterSpec, fieldPath *field.Path) return errs } + +func ValidateEtcdVersionForCalicoV3(e *kops.EtcdClusterSpec, majorVersion string, fldPath *field.Path) field.ErrorList { + allErrs := field.ErrorList{} + + version := e.Version + if e.Version == "" { + version = components.DefaultEtcd2Version + } + sem, err := semver.Parse(strings.TrimPrefix(version, "v")) + if err != nil { + allErrs = append(allErrs, field.InternalError(fldPath.Child("MajorVersion"), fmt.Errorf("Failed to parse Etcd version to check compatibility: %s", err))) + } + + if sem.Major != 3 { + if e.Version == "" { + allErrs = append(allErrs, + field.Invalid(fldPath.Child("MajorVersion"), majorVersion, + fmt.Sprintf("Unable to use v3 when ETCD version for %s cluster is default(%s)", + e.Name, components.DefaultEtcd2Version))) + } else { + allErrs = append(allErrs, + field.Invalid(fldPath.Child("MajorVersion"), majorVersion, + fmt.Sprintf("Unable to use v3 when ETCD version for %s cluster is %s", e.Name, e.Version))) + } + } + return allErrs +} + +func validateNetworkingCalico(v *kops.CalicoNetworkingSpec, e *kops.EtcdClusterSpec, fldPath *field.Path) field.ErrorList { + allErrs := field.ErrorList{} + switch v.MajorVersion { + case "": + // OK: + case "v3": + allErrs = append(allErrs, ValidateEtcdVersionForCalicoV3(e, v.MajorVersion, fldPath)...) + default: + allErrs = append(allErrs, field.NotSupported(fldPath.Child("MajorVersion"), v.MajorVersion, []string{"v3"})) + } + + return allErrs +} diff --git a/pkg/apis/kops/validation/validation_test.go b/pkg/apis/kops/validation/validation_test.go index 83dafb04ed2d9..c3cc2c31b0670 100644 --- a/pkg/apis/kops/validation/validation_test.go +++ b/pkg/apis/kops/validation/validation_test.go @@ -291,3 +291,47 @@ func Test_Validate_AdditionalPolicies(t *testing.T) { testErrors(t, g.Input, errs, g.ExpectedErrors) } } + +type caliInput struct { + Calico *kops.CalicoNetworkingSpec + Etcd *kops.EtcdClusterSpec +} + +func Test_Validate_Calico(t *testing.T) { + grid := []struct { + Input caliInput + ExpectedErrors []string + }{ + { + Input: caliInput{ + Calico: &kops.CalicoNetworkingSpec{}, + Etcd: &kops.EtcdClusterSpec{}, + }, + }, + { + Input: caliInput{ + Calico: &kops.CalicoNetworkingSpec{ + MajorVersion: "v3", + }, + Etcd: &kops.EtcdClusterSpec{ + Version: "3.2.18", + }, + }, + }, + { + Input: caliInput{ + Calico: &kops.CalicoNetworkingSpec{ + MajorVersion: "v3", + }, + Etcd: &kops.EtcdClusterSpec{ + Version: "2.2.18", + }, + }, + ExpectedErrors: []string{"Invalid value::Calico.MajorVersion"}, + }, + } + for _, g := range grid { + errs := validateNetworkingCalico(g.Input.Calico, g.Input.Etcd, field.NewPath("Calico")) + testErrors(t, g.Input, errs, g.ExpectedErrors) + } +} diff --git a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.6.yaml.template b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.6.yaml.template index 0a641b3af031d..6c97cb9c5795e 100644 --- a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.6.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.6.yaml.template @@ -141,7 +141,7 @@ spec: # container programs network policy and routes on each # host. - name: calico-node - image: quay.io/calico/node:v2.6.7 + image: quay.io/calico/node:v2.6.9 resources: requests: cpu: 10m @@ -226,7 +226,7 @@ spec: # This container installs the Calico CNI binaries # and CNI network config file on each node. - name: install-cni - image: quay.io/calico/cni:v1.11.2 + image: quay.io/calico/cni:v1.11.5 resources: requests: cpu: 10m @@ -379,7 +379,7 @@ spec: operator: Exists containers: - name: calico-kube-controllers - image: quay.io/calico/kube-controllers:v1.0.3 + image: quay.io/calico/kube-controllers:v1.0.4 resources: requests: cpu: 10m diff --git a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template new file mode 100644 index 0000000000000..aad4b3ed6f315 --- /dev/null +++ b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template @@ -0,0 +1,748 @@ +{{- $etcd_scheme := EtcdScheme }} +# This ConfigMap is used to configure a self-hosted Calico installation. +kind: ConfigMap +apiVersion: v1 +metadata: + name: calico-config + namespace: kube-system +data: + # The calico-etcd PetSet service IP:port + etcd_endpoints: "{{ $cluster := index .EtcdClusters 0 -}} + {{- range $j, $member := $cluster.Members -}} + {{- if $j }},{{ end -}} + {{ $etcd_scheme }}://etcd-{{ $member.Name }}.internal.{{ ClusterName }}:4001 + {{- end }}" + + # Configure the Calico backend to use. + calico_backend: "bird" + + # The CNI network configuration to install on each node. + cni_network_config: |- + { + "name": "k8s-pod-network", + "cniVersion": "0.3.0", + "plugins": [ + { + "type": "calico", + "etcd_endpoints": "__ETCD_ENDPOINTS__", + {{- if eq $etcd_scheme "https" }} + "etcd_ca_cert_file": "/srv/kubernetes/calico/ca.pem", + "etcd_cert_file": "/srv/kubernetes/calico/calico-client.pem", + "etcd_key_file": "/srv/kubernetes/calico/calico-client-key.pem", + "etcd_scheme": "https", + {{- end }} + "log_level": "info", + "ipam": { + "type": "calico-ipam" + }, + "policy": { + "type": "k8s", + }, + "kubernetes": { + "kubeconfig": "/etc/cni/net.d/__KUBECONFIG_FILENAME__" + } + }, + { + "type": "portmap", + "snat": true, + "capabilities": {"portMappings": true} + } + ] + } + +--- + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: calico-node + labels: + role.kubernetes.io/networking: "1" +rules: + - apiGroups: [""] + resources: + - pods + - nodes + verbs: + - get +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: calico-node + namespace: kube-system + labels: + role.kubernetes.io/networking: "1" +--- + +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: calico-node + labels: + role.kubernetes.io/networking: "1" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-node +subjects: +- kind: ServiceAccount + name: calico-node + namespace: kube-system +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: calico-kube-controllers + namespace: kube-system + labels: + role.kubernetes.io/networking: "1" +--- + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: calico-kube-controllers + labels: + role.kubernetes.io/networking: "1" +rules: + - apiGroups: + - "" + - extensions + resources: + - pods + - namespaces + - networkpolicies + - nodes + verbs: + - watch + - list + - apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - watch + - list +--- + +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: calico-kube-controllers + labels: + role.kubernetes.io/networking: "1" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-kube-controllers +subjects: +- kind: ServiceAccount + name: calico-kube-controllers + namespace: kube-system + +--- + +# This manifest installs the calico/node container, as well +# as the Calico CNI plugins and network config on +# each master and worker node in a Kubernetes cluster. +kind: DaemonSet +apiVersion: extensions/v1beta1 +metadata: + name: calico-node + namespace: kube-system + labels: + k8s-app: calico-node + role.kubernetes.io/networking: "1" +spec: + selector: + matchLabels: + k8s-app: calico-node + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + labels: + k8s-app: calico-node + role.kubernetes.io/networking: "1" + annotations: + scheduler.alpha.kubernetes.io/critical-pod: '' + spec: + hostNetwork: true + tolerations: + # Make sure calico/node gets scheduled on all nodes. + - effect: NoSchedule + operator: Exists + # Mark the pod as a critical add-on for rescheduling. + - key: CriticalAddonsOnly + operator: Exists + - effect: NoExecute + operator: Exists + serviceAccountName: calico-node + # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force + # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. + terminationGracePeriodSeconds: 0 + containers: + # Runs calico/node container on each Kubernetes node. This + # container programs network policy and routes on each + # host. + - name: calico-node + image: quay.io/calico/node:v3.2.1 + env: + # The location of the Calico etcd cluster. + - name: ETCD_ENDPOINTS + valueFrom: + configMapKeyRef: + name: calico-config + key: etcd_endpoints + {{- if eq $etcd_scheme "https" }} + - name: ETCD_CERT_FILE + value: /certs/calico-client.pem + - name: ETCD_KEY_FILE + value: /certs/calico-client-key.pem + - name: ETCD_CA_CERT_FILE + value: /certs/ca.pem + {{- end }} + # Choose the backend to use. + - name: CALICO_NETWORKING_BACKEND + valueFrom: + configMapKeyRef: + name: calico-config + key: calico_backend + # Cluster type to identify the deployment type + - name: CLUSTER_TYPE + value: "kops,bgp" + # Disable file logging so `kubectl logs` works. + - name: CALICO_DISABLE_FILE_LOGGING + value: "true" + # Set noderef for node controller. + - name: CALICO_K8S_NODE_REF + valueFrom: + fieldRef: + fieldPath: spec.nodeName + # Set Felix endpoint to host default action to ACCEPT. + - name: FELIX_DEFAULTENDPOINTTOHOSTACTION + value: "ACCEPT" + # The default IPv4 pool to create on startup if none exists. Pod IPs will be + # chosen from this range. Changing this value after installation will have + # no effect. This should fall within `--cluster-cidr`. + # Configure the IP Pool from which Pod IPs will be chosen. + - name: CALICO_IPV4POOL_CIDR + value: "{{ .KubeControllerManager.ClusterCIDR }}" + - name: CALICO_IPV4POOL_IPIP + value: "{{- if and (eq .CloudProvider "aws") (.Networking.Calico.CrossSubnet) -}}cross-subnet{{- else -}}always{{- end -}}" + # Disable IPv6 on Kubernetes. + - name: FELIX_IPV6SUPPORT + value: "false" + # Set Felix logging to the desired level + - name: FELIX_LOGSEVERITYSCREEN + value: "{{- or .Networking.Calico.LogSeverityScreen "info" }}" + # Set to enable the experimental Prometheus metrics server + - name: FELIX_PROMETHEUSMETRICSENABLED + value: "{{- or .Networking.Calico.PrometheusMetricsEnabled "false" }}" + # TCP port that the Prometheus metrics server should bind to + - name: FELIX_PROMETHEUSMETRICSPORT + value: "{{- or .Networking.Calico.PrometheusMetricsPort "9091" }}" + # Enable Prometheus Go runtime metrics collection + - name: FELIX_PROMETHEUSGOMETRICSENABLED + value: "{{- or .Networking.Calico.PrometheusGoMetricsEnabled "true" }}" + # Enable Prometheus process metrics collection + - name: FELIX_PROMETHEUSPROCESSMETRICSENABLED + value: "{{- or .Networking.Calico.PrometheusProcessMetricsEnabled "true" }}" + # Auto-detect the BGP IP address. + - name: IP + value: "autodetect" + - name: FELIX_HEALTHENABLED + value: "true" + securityContext: + privileged: true + resources: + requests: + cpu: 10m + livenessProbe: + httpGet: + path: /liveness + port: 9099 + host: localhost + periodSeconds: 10 + initialDelaySeconds: 10 + failureThreshold: 6 + readinessProbe: + exec: + command: + - /bin/calico-node + - -bird-ready + - -felix-ready + periodSeconds: 10 + volumeMounts: + - mountPath: /lib/modules + name: lib-modules + readOnly: true + - mountPath: /var/run/calico + name: var-run-calico + readOnly: false + - mountPath: /var/lib/calico + name: var-lib-calico + readOnly: false + # Necessary for gossip based DNS + - mountPath: /etc/hosts + name: etc-hosts + readOnly: true + {{- if eq $etcd_scheme "https" }} + - mountPath: /certs + name: calico + readOnly: true + {{- end }} + # This container installs the Calico CNI binaries + # and CNI network config file on each node. + - name: install-cni + image: quay.io/calico/cni:v3.2.1 + command: ["/install-cni.sh"] + env: + # Name of the CNI config file to create. + - name: CNI_CONF_NAME + value: "10-calico.conflist" + # The location of the Calico etcd cluster. + - name: ETCD_ENDPOINTS + valueFrom: + configMapKeyRef: + name: calico-config + key: etcd_endpoints + # The CNI network config to install on each node. + - name: CNI_NETWORK_CONFIG + valueFrom: + configMapKeyRef: + name: calico-config + key: cni_network_config + volumeMounts: + - mountPath: /host/opt/cni/bin + name: cni-bin-dir + - mountPath: /host/etc/cni/net.d + name: cni-net-dir + # Necessary for gossip based DNS + - mountPath: /etc/hosts + name: etc-hosts + readOnly: true + resources: + requests: + cpu: 10m + initContainers: + - name: migrate + image: calico/upgrade:v1.0.5 + command: ['/bin/sh', '-c', '/node-init-container.sh'] + env: + - name: CALICO_ETCD_ENDPOINTS + valueFrom: + configMapKeyRef: + name: calico-config + key: etcd_endpoints + - name: CALICO_APIV1_DATASTORE_TYPE + value: "etcdv2" + - name: CALICO_APIV1_ETCD_ENDPOINTS + valueFrom: + configMapKeyRef: + name: calico-config + key: etcd_endpoints + {{- if eq $etcd_scheme "https" }} + - name: CALICO_ETCD_CERT_FILE + value: /certs/calico-client.pem + - name: CALICO_ETCD_KEY_FILE + value: /certs/calico-client-key.pem + - name: CALICO_ETCD_CA_CERT_FILE + value: /certs/ca.pem + - name: CALICO_APIV1_ETCD_CERT_FILE + value: /certs/calico-client.pem + - name: CALICO_APIV1_ETCD_KEY_FILE + value: /certs/calico-client-key.pem + - name: CALICO_APIV1_ETCD_CA_CERT_FILE + value: /certs/ca.pem + {{- end }} + volumeMounts: + # Necessary for gossip based DNS + - mountPath: /etc/hosts + name: etc-hosts + readOnly: true + {{- if eq $etcd_scheme "https" }} + - mountPath: /certs + name: calico + readOnly: true + {{- end }} + volumes: + # Used by calico/node. + - name: lib-modules + hostPath: + path: /lib/modules + - name: var-run-calico + hostPath: + path: /var/run/calico + - name: var-lib-calico + hostPath: + path: /var/lib/calico + # Used to install CNI. + - name: cni-bin-dir + hostPath: + path: /opt/cni/bin + - name: cni-net-dir + hostPath: + path: /etc/cni/net.d + # Necessary for gossip based DNS + - name: etc-hosts + hostPath: + path: /etc/hosts + {{- if eq $etcd_scheme "https" }} + - name: calico + hostPath: + path: /srv/kubernetes/calico + {{- end }} + +--- + +# This manifest deploys the Calico Kubernetes controllers. +# See https://github.com/projectcalico/kube-controllers +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: calico-kube-controllers + namespace: kube-system + labels: + k8s-app: calico-kube-controllers + role.kubernetes.io/networking: "1" + annotations: + scheduler.alpha.kubernetes.io/critical-pod: '' +spec: + # The controllers can only have a single active instance. + replicas: 1 + strategy: + type: Recreate + template: + metadata: + name: calico-kube-controllers + namespace: kube-system + labels: + k8s-app: calico-kube-controllers + role.kubernetes.io/networking: "1" + spec: + # The controllers must run in the host network namespace so that + # it isn't governed by policy that would prevent it from working. + hostNetwork: true + tolerations: + # Mark the pod as a critical add-on for rescheduling. + - key: CriticalAddonsOnly + operator: Exists + - key: node-role.kubernetes.io/master + effect: NoSchedule + serviceAccountName: calico-kube-controllers + containers: + - name: calico-kube-controllers + image: quay.io/calico/kube-controllers:v3.2.1 + resources: + requests: + cpu: 10m + env: + # The location of the Calico etcd cluster. + - name: ETCD_ENDPOINTS + valueFrom: + configMapKeyRef: + name: calico-config + key: etcd_endpoints + # Choose which controllers to run. + - name: ENABLED_CONTROLLERS + value: policy,profile,workloadendpoint,node + {{- if eq $etcd_scheme "https" }} + - name: ETCD_CERT_FILE + value: /certs/calico-client.pem + - name: ETCD_KEY_FILE + value: /certs/calico-client-key.pem + - name: ETCD_CA_CERT_FILE + value: /certs/ca.pem + volumeMounts: + - mountPath: /certs + name: calico + readOnly: true + {{- end }} + readinessProbe: + exec: + command: + - /usr/bin/check-status + - -r + initContainers: + - name: migrate + image: calico/upgrade:v1.0.5 + command: ['/bin/sh', '-c', '/controller-init.sh'] + env: + - name: CALICO_ETCD_ENDPOINTS + valueFrom: + configMapKeyRef: + name: calico-config + key: etcd_endpoints + - name: CALICO_APIV1_DATASTORE_TYPE + value: "etcdv2" + - name: CALICO_APIV1_ETCD_ENDPOINTS + valueFrom: + configMapKeyRef: + name: calico-config + key: etcd_endpoints + {{- if eq $etcd_scheme "https" }} + - name: CALICO_ETCD_CERT_FILE + value: /certs/calico-client.pem + - name: CALICO_ETCD_KEY_FILE + value: /certs/calico-client-key.pem + - name: CALICO_ETCD_CA_CERT_FILE + value: /certs/ca.pem + - name: CALICO_APIV1_ETCD_CERT_FILE + value: /certs/calico-client.pem + - name: CALICO_APIV1_ETCD_KEY_FILE + value: /certs/calico-client-key.pem + - name: CALICO_APIV1_ETCD_CA_CERT_FILE + value: /certs/ca.pem + {{- end }} + volumeMounts: + # Necessary for gossip based DNS + - mountPath: /etc/hosts + name: etc-hosts + readOnly: true + {{- if eq $etcd_scheme "https" }} + - mountPath: /certs + name: calico + readOnly: true + {{- end }} + volumes: + # Necessary for gossip based DNS + - name: etc-hosts + hostPath: + path: /etc/hosts + {{- if eq $etcd_scheme "https" }} + - name: calico + hostPath: + path: /srv/kubernetes/calico + {{- end }} + +# This manifest runs the Migration complete container that monitors for the +# completion of the calico-node Daemonset rollout and when it finishes +# successfully rolling out it will mark the migration complete and allow pods +# to be created again. +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: calico-upgrade-job + namespace: kube-system + labels: + role.kubernetes.io/networking: "1" +--- + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: calico-upgrade-job + labels: + role.kubernetes.io/networking: "1" +rules: + - apiGroups: + - extensions + resources: + - daemonsets + - daemonsets/status + verbs: + - get + - list + - watch +--- + +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: calico-upgrade-job + labels: + role.kubernetes.io/networking: "1" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: calico-upgrade-job +subjects: +- kind: ServiceAccount + name: calico-upgrade-job + namespace: kube-system +--- +# If anything in this job is changed then the name of the job +# should be changed because Jobs cannot be updated, so changing +# the name would run a different Job if the previous version had been +# created before and it does not hurt to rerun this job. + +apiVersion: batch/v1 +kind: Job +metadata: + name: calico-complete-upgrade + namespace: kube-system + labels: + role.kubernetes.io/networking: "1" +spec: + template: + metadata: + labels: + role.kubernetes.io/networking: "1" + spec: + hostNetwork: true + serviceAccountName: calico-upgrade-job + restartPolicy: OnFailure + containers: + - name: migrate-completion + image: calico/upgrade:v1.0.5 + command: ['/bin/sh', '-c', '/completion-job.sh'] + env: + - name: EXPECTED_NODE_IMAGE + value: quay.io/calico/node:v3.1.1 + # The location of the Calico etcd cluster. + - name: CALICO_ETCD_ENDPOINTS + valueFrom: + configMapKeyRef: + name: calico-config + key: etcd_endpoints + - name: CALICO_APIV1_DATASTORE_TYPE + value: "etcdv2" + - name: CALICO_APIV1_ETCD_ENDPOINTS + valueFrom: + configMapKeyRef: + name: calico-config + key: etcd_endpoints + {{- if eq $etcd_scheme "https" }} + - name: CALICO_ETCD_CERT_FILE + value: /certs/calico-client.pem + - name: CALICO_ETCD_KEY_FILE + value: /certs/calico-client-key.pem + - name: CALICO_ETCD_CA_CERT_FILE + value: /certs/ca.pem + - name: CALICO_APIV1_ETCD_CERT_FILE + value: /certs/calico-client.pem + - name: CALICO_APIV1_ETCD_KEY_FILE + value: /certs/calico-client-key.pem + - name: CALICO_APIV1_ETCD_CA_CERT_FILE + value: /certs/ca.pem + {{- end }} + volumeMounts: + # Necessary for gossip based DNS + - mountPath: /etc/hosts + name: etc-hosts + readOnly: true + {{- if eq $etcd_scheme "https" }} + - mountPath: /certs + name: calico + readOnly: true + {{- end }} + volumes: + - name: etc-hosts + hostPath: + path: /etc/hosts + {{- if eq $etcd_scheme "https" }} + - name: calico + hostPath: + path: /srv/kubernetes/calico + {{- end }} + +{{ if and (eq .CloudProvider "aws") (.Networking.Calico.CrossSubnet) -}} +# This manifest installs the k8s-ec2-srcdst container, which disables +# src/dst ip checks to allow BGP to function for calico for hosts within subnets +# This only applies for AWS environments. +--- + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: k8s-ec2-srcdst + labels: + role.kubernetes.io/networking: "1" +rules: +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - update + - patch + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-ec2-srcdst + namespace: kube-system + labels: + role.kubernetes.io/networking: "1" +--- + +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: k8s-ec2-srcdst + labels: + role.kubernetes.io/networking: "1" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: k8s-ec2-srcdst +subjects: +- kind: ServiceAccount + name: k8s-ec2-srcdst + namespace: kube-system + +--- + +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: k8s-ec2-srcdst + namespace: kube-system + labels: + k8s-app: k8s-ec2-srcdst + role.kubernetes.io/networking: "1" +spec: + replicas: 1 + selector: + matchLabels: + k8s-app: k8s-ec2-srcdst + template: + metadata: + labels: + k8s-app: k8s-ec2-srcdst + role.kubernetes.io/networking: "1" + annotations: + scheduler.alpha.kubernetes.io/critical-pod: '' + spec: + hostNetwork: true + tolerations: + - key: node-role.kubernetes.io/master + effect: NoSchedule + - key: CriticalAddonsOnly + operator: Exists + serviceAccountName: k8s-ec2-srcdst + containers: + - image: ottoyiu/k8s-ec2-srcdst:v0.2.1 + name: k8s-ec2-srcdst + resources: + requests: + cpu: 10m + memory: 64Mi + env: + - name: AWS_REGION + value: {{ Region }} + volumeMounts: + - name: ssl-certs + mountPath: "/etc/ssl/certs/ca-certificates.crt" + readOnly: true + imagePullPolicy: "Always" + volumes: + - name: ssl-certs + hostPath: + path: "/etc/ssl/certs/ca-certificates.crt" + nodeSelector: + node-role.kubernetes.io/master: "" +{{- end -}} diff --git a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7.yaml.template b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7.yaml.template index 61cfc73e623a9..6b1f3fc6f6433 100644 --- a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7.yaml.template @@ -155,7 +155,7 @@ spec: # container programs network policy and routes on each # host. - name: calico-node - image: quay.io/calico/node:v2.6.7 + image: quay.io/calico/node:v2.6.9 resources: requests: cpu: 10m @@ -244,7 +244,7 @@ spec: # This container installs the Calico CNI binaries # and CNI network config file on each node. - name: install-cni - image: quay.io/calico/cni:v1.11.2 + image: quay.io/calico/cni:v1.11.5 resources: requests: cpu: 10m @@ -314,6 +314,8 @@ metadata: spec: # The controllers can only have a single active instance. replicas: 1 + strategy: + type: Recreate template: metadata: name: calico-kube-controllers @@ -335,7 +337,7 @@ spec: operator: Exists containers: - name: calico-kube-controllers - image: quay.io/calico/kube-controllers:v1.0.3 + image: quay.io/calico/kube-controllers:v1.0.4 resources: requests: cpu: 10m diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index 9c84789b7a523..4f10710892248 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -643,53 +643,71 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri key := "networking.projectcalico.org" versions := map[string]string{ "pre-k8s-1.6": "2.4.2-kops.1", - "k8s-1.6": "2.6.7-kops.2", - "k8s-1.7": "2.6.7-kops.3", + "k8s-1.6": "2.6.9-kops.1", + "k8s-1.7": "2.6.9-kops.1", + "k8s-1.7-v3": "3.2.1-kops.1", } - { - id := "pre-k8s-1.6" - location := key + "/" + id + ".yaml" + if b.cluster.Spec.Networking.Calico.MajorVersion == "v3" { + { + id := "k8s-1.7-v3" + location := key + "/" + id + ".yaml" - addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{ - Name: fi.String(key), - Version: fi.String(versions[id]), - Selector: networkingSelector, - Manifest: fi.String(location), - KubernetesVersion: "<1.6.0", - Id: id, - }) - manifests[key+"-"+id] = "addons/" + location - } + addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{ + Name: fi.String(key), + Version: fi.String(versions[id]), + Selector: networkingSelector, + Manifest: fi.String(location), + KubernetesVersion: ">=1.7.0", + Id: id, + }) + manifests[key+"-"+id] = "addons/" + location + } + } else { + { + id := "pre-k8s-1.6" + location := key + "/" + id + ".yaml" - { - id := "k8s-1.6" - location := key + "/" + id + ".yaml" + addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{ + Name: fi.String(key), + Version: fi.String(versions[id]), + Selector: networkingSelector, + Manifest: fi.String(location), + KubernetesVersion: "<1.6.0", + Id: id, + }) + manifests[key+"-"+id] = "addons/" + location + } - addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{ - Name: fi.String(key), - Version: fi.String(versions[id]), - Selector: networkingSelector, - Manifest: fi.String(location), - KubernetesVersion: ">=1.6.0 <1.7.0", - Id: id, - }) - manifests[key+"-"+id] = "addons/" + location - } + { + id := "k8s-1.6" + location := key + "/" + id + ".yaml" - { - id := "k8s-1.7" - location := key + "/" + id + ".yaml" + addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{ + Name: fi.String(key), + Version: fi.String(versions[id]), + Selector: networkingSelector, + Manifest: fi.String(location), + KubernetesVersion: ">=1.6.0 <1.7.0", + Id: id, + }) + manifests[key+"-"+id] = "addons/" + location + } - addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{ - Name: fi.String(key), - Version: fi.String(versions[id]), - Selector: networkingSelector, - Manifest: fi.String(location), - KubernetesVersion: ">=1.7.0", - Id: id, - }) - manifests[key+"-"+id] = "addons/" + location + { + id := "k8s-1.7" + location := key + "/" + id + ".yaml" + + addons.Spec.Addons = append(addons.Spec.Addons, &channelsapi.AddonSpec{ + Name: fi.String(key), + Version: fi.String(versions[id]), + Selector: networkingSelector, + Manifest: fi.String(location), + KubernetesVersion: ">=1.7.0", + Id: id, + }) + manifests[key+"-"+id] = "addons/" + location + } } } From 5fc7fbf81ea8b146a66f8e946484b9dfe6c9eccf Mon Sep 17 00:00:00 2001 From: Erik Stidham Date: Thu, 3 May 2018 08:53:12 -0500 Subject: [PATCH 061/163] API machinery generated code --- pkg/apis/kops/v1alpha1/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha2/zz_generated.conversion.go | 2 ++ 2 files changed, 4 insertions(+) diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 97f005eadabda..38f69727056c8 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -453,6 +453,7 @@ func autoConvert_v1alpha1_CalicoNetworkingSpec_To_kops_CalicoNetworkingSpec(in * out.PrometheusMetricsPort = in.PrometheusMetricsPort out.PrometheusGoMetricsEnabled = in.PrometheusGoMetricsEnabled out.PrometheusProcessMetricsEnabled = in.PrometheusProcessMetricsEnabled + out.MajorVersion = in.MajorVersion return nil } @@ -469,6 +470,7 @@ func autoConvert_kops_CalicoNetworkingSpec_To_v1alpha1_CalicoNetworkingSpec(in * out.PrometheusMetricsPort = in.PrometheusMetricsPort out.PrometheusGoMetricsEnabled = in.PrometheusGoMetricsEnabled out.PrometheusProcessMetricsEnabled = in.PrometheusProcessMetricsEnabled + out.MajorVersion = in.MajorVersion return nil } diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 1afc069620d4b..b8f4fd691fe11 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -489,6 +489,7 @@ func autoConvert_v1alpha2_CalicoNetworkingSpec_To_kops_CalicoNetworkingSpec(in * out.PrometheusMetricsPort = in.PrometheusMetricsPort out.PrometheusGoMetricsEnabled = in.PrometheusGoMetricsEnabled out.PrometheusProcessMetricsEnabled = in.PrometheusProcessMetricsEnabled + out.MajorVersion = in.MajorVersion return nil } @@ -505,6 +506,7 @@ func autoConvert_kops_CalicoNetworkingSpec_To_v1alpha2_CalicoNetworkingSpec(in * out.PrometheusMetricsPort = in.PrometheusMetricsPort out.PrometheusGoMetricsEnabled = in.PrometheusGoMetricsEnabled out.PrometheusProcessMetricsEnabled = in.PrometheusProcessMetricsEnabled + out.MajorVersion = in.MajorVersion return nil } From 17ad5af417cf84ffd35b477f43cdb8400665887a Mon Sep 17 00:00:00 2001 From: Ripta Pasay Date: Thu, 8 Nov 2018 09:04:10 +0000 Subject: [PATCH 062/163] Set dateformat on logrotate configs On CoreOS Container Linux, `dateext` is set, which causes log rotation based on maxsize to not run, when a previous rotation already happened on the calendar same day. (cherry picked from commit 585d0a0da42be1eae87fa879b0084d29d77ac605) --- nodeup/pkg/model/logrotate.go | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/nodeup/pkg/model/logrotate.go b/nodeup/pkg/model/logrotate.go index e78e50df293f7..53eed5fd625f1 100644 --- a/nodeup/pkg/model/logrotate.go +++ b/nodeup/pkg/model/logrotate.go @@ -113,7 +113,8 @@ func (b *LogrotateBuilder) addLogrotateService(c *fi.ModelBuilderContext) error } type logRotateOptions struct { - MaxSize string + MaxSize string + DateFormat string } func (b *LogrotateBuilder) addLogRotate(c *fi.ModelBuilderContext, name, path string, options logRotateOptions) { @@ -121,6 +122,12 @@ func (b *LogrotateBuilder) addLogRotate(c *fi.ModelBuilderContext, name, path st options.MaxSize = "100M" } + // CoreOS sets "dateext" options, and maxsize-based rotation will fail if + // the file has been previously rotated on the same calendar date. + if b.Distribution == distros.DistributionCoreOS { + options.DateFormat = "-%Y%m%d-%s" + } + lines := []string{ path + "{", " rotate 5", @@ -129,12 +136,20 @@ func (b *LogrotateBuilder) addLogRotate(c *fi.ModelBuilderContext, name, path st " notifempty", " delaycompress", " maxsize " + options.MaxSize, + } + + if options.DateFormat != "" { + lines = append(lines, " dateformat "+options.DateFormat) + } + + lines = append( + lines, " daily", " create 0644 root root", "}", - } + ) - contents := strings.Join(lines, "\n") + contents := strings.Join(lines, "\n") + "\n" c.AddTask(&nodetasks.File{ Path: "/etc/logrotate.d/" + name, From 06ff74f91b093cde579ac2675792a206c2e1410c Mon Sep 17 00:00:00 2001 From: Erik Stidham Date: Mon, 7 May 2018 21:46:06 -0500 Subject: [PATCH 063/163] Calico V3 doc updates --- docs/calico-v3.md | 96 ++++++++++++++++++++++++++++++++++++++++++++++ docs/networking.md | 8 +++- 2 files changed, 102 insertions(+), 2 deletions(-) create mode 100644 docs/calico-v3.md diff --git a/docs/calico-v3.md b/docs/calico-v3.md new file mode 100644 index 0000000000000..7e85183ec4323 --- /dev/null +++ b/docs/calico-v3.md @@ -0,0 +1,96 @@ +# Calico Version 3 +In early 2018 Version 3 of Calico was released, it included a reworked data +model and with that a switch from the etcd v2 to v3 API. This document covers +the requirements, upgrade process, and configuration to install +Calico Version 3. + +## Requirements +- The main requirement needed for Calico Version 3 is the etcd v3 API available + with etcd server version 3. +- Another requirement is for the Kubernetes version to be a minimum of v1.7.0. + +### etcd +Due to the etcd v3 API being a requirement of Calico Version 3 +(when using etcd as the datastore) not all Kops installations will be +upgradable to Calico V3. Installations using etcd v2 (or earlier) will need +to remain on Calico V2 or update to etcdv3. + +## Configuration of a new cluster +To ensure a new cluster will have Calico Version 3 installed the following +two configurations options should be set: +- `spec.etcdClusters.etcdMembers[0].Version` (Main cluster) should be + set to a Version of etcd greater than 3.x or the default version + needs to be greater than 3.x. +- The Networking config must have the Calico MajorVersion set to `v3` like + the following: + ``` + spec: + networking: + calico: + majorVersion: v3 + ``` + +Both of the above two settings can be set by doing a `kops edit cluster ...` +before bringing the cluster up for the first time. + +With the above two settings your Kops deployed cluster will be running with +Calico Version 3. + +### Create cluster networking flag + +When enabling Calico with the `--networking calico` flag, etcd will be set to +a v3 version. Feel free to change to a different v3 version of etcd. + +## Upgrading an existing cluster +Assuming your cluster meets the requirements it is possible to upgrade +your Calico Kops cluster. + +A few notes about the upgrade: +- During the first portion of the migration, while the calico-kube-controllers + pod is running its Init, no new policies will be applied though already + applied policy will be active. +- During the migration no new pods will be scheduled as adding new workloads + to Calico is blocked. Once the calico-complete-upgrade job has completed + pods will once again be schedulable. +- The upgrade process that has been automated in kops can be found in + [the Upgrading Calico docs](https://docs.projectcalico.org/v3.1/getting-started/kubernetes/upgrade/upgrade). + +Perform the upgrade with the following steps: + +1. First you must ensure that you are running Calico V2.6.5+. With the + latest Kops (greater than 1.9) ensuring your cluster is updated can be + done by doing a `kops update` on the cluster. +1. Verify your Calico data will migrate successfully by installing and + configuring the + [calico-upgrade command](https://docs.projectcalico.org/v3.1/getting-started/kubernetes/upgrade/setup) + and then run `calico-upgrade dry-run` and verify it reports that the + migration can be completed successfully. +1. Set `majorVersion` field as below by editing + your cluster configuration with `kops edit cluster`. + ``` + spec: + networking: + calico: + majorVersion: v3 + ``` +1. Update your cluster with `kops update` like you would normally update. +1. Monitor the progress of the migration by using + `kubectl get pods -n kube-system` and checking the status of the following pods: + - calico-node pods should restart one at a time and all becoming Running + - calico-kube-controllers pod will restart and after the first calico-node + pod starts running it will start running + - calico-complete-upgrade pod will be Completed after all the calico-node + pods start running + If any of the above fail by entering a crash loop you should investigate + by checking the logs with `kubectl -n kube-system logs `. +1. Once the calico-node and calico-kube-controllers are running and the + calico-complete-upgrade pod has completed the migration has finished + successfully. + +### Recovering from a partial migration + +The InitContainer of the first calico-node pod that starts will perform the +datastore migration necessary for upgrading from Calico v2 to Calico v3, if +this InitContainer is killed or restarted when the new datastore is being +populated it will be necessary to manually remove the Calico data in the +etcd v3 API before the migration will be successful. diff --git a/docs/networking.md b/docs/networking.md index 3c53fc9c5c111..a1aed38b3ee2c 100644 --- a/docs/networking.md +++ b/docs/networking.md @@ -34,7 +34,7 @@ has built in support for CNI networking components. Several different CNI providers are currently built into kops: -* [Calico](http://docs.projectcalico.org/v2.0/getting-started/kubernetes/installation/hosted/) +* [Calico](https://docs.projectcalico.org/v3.1/getting-started/kubernetes/installation/calico#installing-with-the-etcd-datastore) * [Canal (Flannel + Calico)](https://github.com/projectcalico/canal) * [flannel](https://github.com/coreos/flannel) - use `--networking flannel-vxlan` (recommended) or `--networking flannel-udp` (legacy). `--networking flannel` now selects `flannel-vxlan`. * [kopeio-vxlan](https://github.com/kopeio/networking) @@ -170,7 +170,8 @@ To enable this mode in a cluster, with Calico as the CNI and Network Policy prov ``` networking: - calico: {} + calico: + majorVersion: v3 ``` You will need to change that block, and add an additional field, to look like this: @@ -178,6 +179,7 @@ You will need to change that block, and add an additional field, to look like th ``` networking: calico: + majorVersion: v3 crossSubnet: true ``` @@ -194,6 +196,8 @@ Only the masters have the IAM policy (`ec2:*`) to allow k8s-ec2-srcdst to execut For Calico specific documentation please visit the [Calico Docs](http://docs.projectcalico.org/latest/getting-started/kubernetes/). +For details on upgrading a Calico v2 deployment see [Calico Version 3](calico-v3.md). + #### Getting help with Calico For help with Calico or to report any issues: From 79940f6644dccecf87cea8e453569510c3fb1b30 Mon Sep 17 00:00:00 2001 From: Erik Stidham Date: Wed, 7 Nov 2018 13:59:51 -0600 Subject: [PATCH 064/163] Update bazel --- cmd/kops/BUILD.bazel | 1 + 1 file changed, 1 insertion(+) diff --git a/cmd/kops/BUILD.bazel b/cmd/kops/BUILD.bazel index 4a6c0bb91f05c..b9ab429c25cf7 100644 --- a/cmd/kops/BUILD.bazel +++ b/cmd/kops/BUILD.bazel @@ -78,6 +78,7 @@ go_library( "//pkg/instancegroups:go_default_library", "//pkg/kopscodecs:go_default_library", "//pkg/kubeconfig:go_default_library", + "//pkg/model/components:go_default_library", "//pkg/pki:go_default_library", "//pkg/pretty:go_default_library", "//pkg/resources:go_default_library", From 99795490500800d67323530f8cafe454b96e3f1e Mon Sep 17 00:00:00 2001 From: xichengliudui Date: Thu, 8 Nov 2018 12:40:13 -0500 Subject: [PATCH 065/163] Remove unnecessary code --- cmd/kops/create_cluster_test.go | 2 +- cmd/kops/replace.go | 2 +- cmd/kops/root.go | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/cmd/kops/create_cluster_test.go b/cmd/kops/create_cluster_test.go index 17f4b69eaedf6..483b61303f4a4 100644 --- a/cmd/kops/create_cluster_test.go +++ b/cmd/kops/create_cluster_test.go @@ -36,7 +36,7 @@ func checkParse(t *testing.T, s string, expect map[string]string, shouldErr bool if err != nil { if shouldErr { return - } + } t.Errorf(err.Error()) } diff --git a/cmd/kops/replace.go b/cmd/kops/replace.go index 38688946928b5..7d502583c8aa3 100644 --- a/cmd/kops/replace.go +++ b/cmd/kops/replace.go @@ -165,7 +165,7 @@ func RunReplace(f *util.Factory, cmd *cobra.Command, out io.Writer, c *replaceOp if err != nil { if errors.IsNotFound(err) { return fmt.Errorf("cluster %q not found", clusterName) - } + } return fmt.Errorf("error fetching cluster %q: %v", clusterName, err) } // check if the instancegroup exists already diff --git a/cmd/kops/root.go b/cmd/kops/root.go index 9c483f567f41b..87e02b923f121 100644 --- a/cmd/kops/root.go +++ b/cmd/kops/root.go @@ -221,7 +221,7 @@ func (c *RootCmd) ProcessArgs(args []string) error { if len(args) == 1 { return fmt.Errorf("Cannot specify cluster via --name and positional argument") - } + } return fmt.Errorf("expected a single to be passed as an argument") } From d8a80a79ee75a567f5a494c88dba5208d9b99a5a Mon Sep 17 00:00:00 2001 From: Justin SB Date: Sun, 28 Oct 2018 19:33:53 -0400 Subject: [PATCH 066/163] Bump kopeio-networking to latest version Also add the RBAC permissions needed for operation on GCE. --- .../addons/networking.kope.io/k8s-1.6.yaml | 13 ++++++++++++- .../addons/networking.kope.io/pre-k8s-1.6.yaml | 2 +- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- .../kopeio-vxlan/manifest.yaml | 4 ++-- 4 files changed, 16 insertions(+), 5 deletions(-) diff --git a/upup/models/cloudup/resources/addons/networking.kope.io/k8s-1.6.yaml b/upup/models/cloudup/resources/addons/networking.kope.io/k8s-1.6.yaml index cde015ac5ee9f..5df99fb0462b1 100644 --- a/upup/models/cloudup/resources/addons/networking.kope.io/k8s-1.6.yaml +++ b/upup/models/cloudup/resources/addons/networking.kope.io/k8s-1.6.yaml @@ -28,12 +28,17 @@ spec: memory: 100Mi securityContext: privileged: true - image: kopeio/networking-agent:1.0.20180319 + image: kopeio/networking-agent:1.0.20181028 name: networking-agent volumeMounts: - name: lib-modules mountPath: /lib/modules readOnly: true + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName serviceAccountName: kopeio-networking-agent tolerations: - effect: NoSchedule @@ -74,6 +79,12 @@ rules: - list - watch - patch +- apiGroups: + - "" + resources: + - nodes/status + verbs: + - patch --- diff --git a/upup/models/cloudup/resources/addons/networking.kope.io/pre-k8s-1.6.yaml b/upup/models/cloudup/resources/addons/networking.kope.io/pre-k8s-1.6.yaml index 116d2655b05ef..8babc915ae77f 100644 --- a/upup/models/cloudup/resources/addons/networking.kope.io/pre-k8s-1.6.yaml +++ b/upup/models/cloudup/resources/addons/networking.kope.io/pre-k8s-1.6.yaml @@ -28,7 +28,7 @@ spec: memory: 100Mi securityContext: privileged: true - image: kopeio/networking-agent:1.0.20180319 + image: kopeio/networking-agent:1.0.20181028 name: networking-agent volumeMounts: - name: lib-modules diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index 9c84789b7a523..5cadb2d806c32 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -501,7 +501,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri if b.cluster.Spec.Networking.Kopeio != nil { key := "networking.kope.io" - version := "1.0.20180319-kops.2" + version := "1.0.20181028-kops.1" { location := key + "/pre-k8s-1.6.yaml" diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml index bf8129bfc4dd5..4c7d06b00ed44 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml @@ -69,11 +69,11 @@ spec: name: networking.kope.io selector: role.kubernetes.io/networking: "1" - version: 1.0.20180319-kops.2 + version: 1.0.20181028-kops.1 - id: k8s-1.6 kubernetesVersion: '>=1.6.0' manifest: networking.kope.io/k8s-1.6.yaml name: networking.kope.io selector: role.kubernetes.io/networking: "1" - version: 1.0.20180319-kops.2 + version: 1.0.20181028-kops.1 From 0be767a90a2c42a2b29184b2b149d5309c5ed1e9 Mon Sep 17 00:00:00 2001 From: Kierran McPherson Date: Sat, 10 Nov 2018 11:02:34 +1300 Subject: [PATCH 067/163] Request AWS ASGs in batches Signed-off-by: Kierran McPherson --- upup/pkg/fi/cloudup/awsup/aws_cloud.go | 47 ++++++++++++++++---------- 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/upup/pkg/fi/cloudup/awsup/aws_cloud.go b/upup/pkg/fi/cloudup/awsup/aws_cloud.go index 1f2e15f530139..a15a41d62dd12 100644 --- a/upup/pkg/fi/cloudup/awsup/aws_cloud.go +++ b/upup/pkg/fi/cloudup/awsup/aws_cloud.go @@ -491,26 +491,29 @@ func FindAutoscalingGroups(c AWSCloud, tags map[string]string) ([]*autoscaling.G } if len(asgNames) != 0 { - request := &autoscaling.DescribeAutoScalingGroupsInput{ - AutoScalingGroupNames: asgNames, - } - err := c.Autoscaling().DescribeAutoScalingGroupsPages(request, func(p *autoscaling.DescribeAutoScalingGroupsOutput, lastPage bool) bool { - for _, asg := range p.AutoScalingGroups { - if !matchesAsgTags(tags, asg.Tags) { - // We used an inexact filter above - continue - } - // Check for "Delete in progress" (the only use of .Status) - if asg.Status != nil { - glog.Warningf("Skipping ASG %v (which matches tags): %v", *asg.AutoScalingGroupARN, *asg.Status) - continue + for i := 0; i < len(asgNames); i += 50 { + batch := asgNames[i:minInt(i+50, len(asgNames))] + request := &autoscaling.DescribeAutoScalingGroupsInput{ + AutoScalingGroupNames: batch, + } + err := c.Autoscaling().DescribeAutoScalingGroupsPages(request, func(p *autoscaling.DescribeAutoScalingGroupsOutput, lastPage bool) bool { + for _, asg := range p.AutoScalingGroups { + if !matchesAsgTags(tags, asg.Tags) { + // We used an inexact filter above + continue + } + // Check for "Delete in progress" (the only use of .Status) + if asg.Status != nil { + glog.Warningf("Skipping ASG %v (which matches tags): %v", *asg.AutoScalingGroupARN, *asg.Status) + continue + } + asgs = append(asgs, asg) } - asgs = append(asgs, asg) + return true + }) + if err != nil { + return nil, fmt.Errorf("error listing autoscaling groups: %v", err) } - return true - }) - if err != nil { - return nil, fmt.Errorf("error listing autoscaling groups: %v", err) } } @@ -518,6 +521,14 @@ func FindAutoscalingGroups(c AWSCloud, tags map[string]string) ([]*autoscaling.G return asgs, nil } +// Returns the minimum of two ints +func minInt(a int, b int) int { + if a < b { + return a + } + return b +} + // matchesAsgTags is used to filter an asg by tags func matchesAsgTags(tags map[string]string, actual []*autoscaling.TagDescription) bool { for k, v := range tags { From 55425e16ae0598386f2a3d3000cac13fed45aae3 Mon Sep 17 00:00:00 2001 From: mooncake Date: Sat, 10 Nov 2018 18:37:57 +0800 Subject: [PATCH 068/163] Fix some typos Signed-off-by: mooncake --- docs/single-to-multi-master.md | 2 +- nodeup/pkg/model/kube_proxy.go | 2 +- upup/pkg/fi/fitasks/mirrorsecrets.go | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/single-to-multi-master.md b/docs/single-to-multi-master.md index 0c7add57b87ff..5b5202a66f8a6 100644 --- a/docs/single-to-multi-master.md +++ b/docs/single-to-multi-master.md @@ -292,7 +292,7 @@ and not during a future upgrade or, worse, during a master failure. In case you failed to upgrade to multi-master you will need to restore from the backup you have taken previously. -Take extra care becase kops will not start etcd and etcd-events with the same ID on an/or for example but will mix them (ex: etcd-b and etcd-events-c on & etcd-c and etcd-events-b on ); this can be double checked in Route53 where kops will create DNS records for your services. +Take extra care because kops will not start etcd and etcd-events with the same ID on an/or for example but will mix them (ex: etcd-b and etcd-events-c on & etcd-c and etcd-events-b on ); this can be double checked in Route53 where kops will create DNS records for your services. If your 2nd spinned master failed and cluster becomes inconsistent edit the corresponding kops master instancegroup and switch ``MinSize`` and ``MaxSize`` to "0" and run an update on your cluster. diff --git a/nodeup/pkg/model/kube_proxy.go b/nodeup/pkg/model/kube_proxy.go index fbefcba843528..4a335b805049f 100644 --- a/nodeup/pkg/model/kube_proxy.go +++ b/nodeup/pkg/model/kube_proxy.go @@ -102,7 +102,7 @@ func (b *KubeProxyBuilder) Build(c *fi.ModelBuilderContext) error { return nil } -// buildPod is responsble constructing the pod spec +// buildPod is responsible constructing the pod spec func (b *KubeProxyBuilder) buildPod() (*v1.Pod, error) { c := b.Cluster.Spec.KubeProxy if c == nil { diff --git a/upup/pkg/fi/fitasks/mirrorsecrets.go b/upup/pkg/fi/fitasks/mirrorsecrets.go index 407788a06b61e..afbf2339c82f4 100644 --- a/upup/pkg/fi/fitasks/mirrorsecrets.go +++ b/upup/pkg/fi/fitasks/mirrorsecrets.go @@ -57,7 +57,7 @@ func (e *MirrorSecrets) Find(c *fi.Context) (*MirrorSecrets, error) { return nil, nil } -// Run implemements fi.Task::Run +// Run implements fi.Task::Run func (e *MirrorSecrets) Run(c *fi.Context) error { return fi.DefaultDeltaRunMethod(e, c) } From 6414b9e892eec1b8e25d69c77409bbf65ccfb451 Mon Sep 17 00:00:00 2001 From: xichengliudui Date: Tue, 13 Nov 2018 13:22:58 -0500 Subject: [PATCH 069/163] delete some code --- channels/pkg/channels/channel_version.go | 3 +-- cmd/kops/create.go | 8 +++----- dns-controller/pkg/dns/dnscache.go | 3 +-- kube-discovery/cmd/kube-discovery/main.go | 3 +-- 4 files changed, 6 insertions(+), 11 deletions(-) diff --git a/channels/pkg/channels/channel_version.go b/channels/pkg/channels/channel_version.go index ab6a53e3e60aa..57ff01e205a5b 100644 --- a/channels/pkg/channels/channel_version.go +++ b/channels/pkg/channels/channel_version.go @@ -120,9 +120,8 @@ func (c *ChannelVersion) replaces(existing *ChannelVersion) bool { // Same version; check ids if c.Id == existing.Id { return false - } else { - glog.V(4).Infof("Channels had same version %q but different ids (%q vs %q); will replace", *c.Version, c.Id, existing.Id) } + glog.V(4).Infof("Channels had same version %q but different ids (%q vs %q); will replace", *c.Version, c.Id, existing.Id) } } diff --git a/cmd/kops/create.go b/cmd/kops/create.go index e76afec41c9b4..4d31b2f14ef0b 100644 --- a/cmd/kops/create.go +++ b/cmd/kops/create.go @@ -166,10 +166,9 @@ func RunCreate(f *util.Factory, out io.Writer, c *CreateOptions) error { return fmt.Errorf("cluster %q already exists", v.ObjectMeta.Name) } return fmt.Errorf("error creating cluster: %v", err) - } else { - fmt.Fprintf(&sb, "Created cluster/%s\n", v.ObjectMeta.Name) - //cSpec = true } + fmt.Fprintf(&sb, "Created cluster/%s\n", v.ObjectMeta.Name) + //cSpec = true case *kopsapi.InstanceGroup: clusterName = v.ObjectMeta.Labels[kopsapi.LabelClusterName] @@ -218,9 +217,8 @@ func RunCreate(f *util.Factory, out io.Writer, c *CreateOptions) error { err = sshCredentialStore.AddSSHPublicKey("admin", sshKeyArr) if err != nil { return err - } else { - fmt.Fprintf(&sb, "Added ssh credential\n") } + fmt.Fprintf(&sb, "Added ssh credential\n") default: glog.V(2).Infof("Type of object was %T", v) diff --git a/dns-controller/pkg/dns/dnscache.go b/dns-controller/pkg/dns/dnscache.go index 1817673d5bb0f..5bc61ab9c3ac5 100644 --- a/dns-controller/pkg/dns/dnscache.go +++ b/dns-controller/pkg/dns/dnscache.go @@ -68,9 +68,8 @@ func (d *dnsCache) ListZones(validity time.Duration) ([]dnsprovider.Zone, error) if d.cachedZones != nil { if (d.cachedZonesTimestamp + validity.Nanoseconds()) > now { return d.cachedZones, nil - } else { - glog.V(2).Infof("querying all DNS zones (cache expired)") } + glog.V(2).Infof("querying all DNS zones (cache expired)") } else { glog.V(2).Infof("querying all DNS zones (no cached results)") } diff --git a/kube-discovery/cmd/kube-discovery/main.go b/kube-discovery/cmd/kube-discovery/main.go index ff01bc4ab5ecf..cae7009180ac6 100644 --- a/kube-discovery/cmd/kube-discovery/main.go +++ b/kube-discovery/cmd/kube-discovery/main.go @@ -146,9 +146,8 @@ func (c *DiscoveryController) runOnce() error { // TODO: Verify resolved records against certificates? if err := hosts.UpdateHostsFileWithRecords(hostsPath, addrToHosts); err != nil { return fmt.Errorf("error updating hosts file: %v", err) - } else { - glog.Infof("updated %s", hostsPath) } + glog.Infof("updated %s", hostsPath) return nil } From 4c5f52b8675249f248568522ff5cd449727a0d66 Mon Sep 17 00:00:00 2001 From: Casey Davenport Date: Tue, 13 Nov 2018 19:08:37 -0800 Subject: [PATCH 070/163] Update Calico to v3.3.1 --- .../networking.projectcalico.org/k8s-1.7-v3.yaml.template | 7 ++++--- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template index aad4b3ed6f315..1063bce91000c 100644 --- a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template @@ -63,6 +63,7 @@ rules: resources: - pods - nodes + - namespaces verbs: - get --- @@ -191,7 +192,7 @@ spec: # container programs network policy and routes on each # host. - name: calico-node - image: quay.io/calico/node:v3.2.1 + image: quay.io/calico/node:v3.3.1 env: # The location of the Calico etcd cluster. - name: ETCD_ENDPOINTS @@ -300,7 +301,7 @@ spec: # This container installs the Calico CNI binaries # and CNI network config file on each node. - name: install-cni - image: quay.io/calico/cni:v3.2.1 + image: quay.io/calico/cni:v3.3.1 command: ["/install-cni.sh"] env: # Name of the CNI config file to create. @@ -438,7 +439,7 @@ spec: serviceAccountName: calico-kube-controllers containers: - name: calico-kube-controllers - image: quay.io/calico/kube-controllers:v3.2.1 + image: quay.io/calico/kube-controllers:v3.3.1 resources: requests: cpu: 10m diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index ce552d219d71b..93e6b7fd6db6c 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -645,7 +645,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri "pre-k8s-1.6": "2.4.2-kops.1", "k8s-1.6": "2.6.9-kops.1", "k8s-1.7": "2.6.9-kops.1", - "k8s-1.7-v3": "3.2.1-kops.1", + "k8s-1.7-v3": "3.3.1-kops.1", } if b.cluster.Spec.Networking.Calico.MajorVersion == "v3" { From e90d9aabea90642cf476613f4c7e6a0cade93f0e Mon Sep 17 00:00:00 2001 From: Tuan Nguyen Date: Tue, 9 Oct 2018 12:20:06 +0800 Subject: [PATCH 071/163] add 1.7 version --- addons/monitoring-standalone/addon.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/addons/monitoring-standalone/addon.yaml b/addons/monitoring-standalone/addon.yaml index 1f5d82c889ba7..af0995839a284 100644 --- a/addons/monitoring-standalone/addon.yaml +++ b/addons/monitoring-standalone/addon.yaml @@ -19,7 +19,11 @@ spec: selector: k8s-addon: monitoring-standalone.addons.k8s.io manifest: v1.6.0.yaml - kubernetesVersion: ">=1.6.0" + - version: 1.7.0 + selector: + k8s-addon: monitoring-standalone.addons.k8s.io + manifest: v1.7.0.yaml + kubernetesVersion: ">=1.7.0" - version: 1.11.0 selector: k8s-addon: monitoring-standalone.addons.k8s.io From 2388bdb7ef01953c5d12bcd954827a779ed07066 Mon Sep 17 00:00:00 2001 From: Timothy van Zadelhoff Date: Thu, 15 Nov 2018 16:21:01 +0100 Subject: [PATCH 072/163] add SSL certificate ARN to Terraform output --- upup/pkg/fi/cloudup/awstasks/load_balancer.go | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/upup/pkg/fi/cloudup/awstasks/load_balancer.go b/upup/pkg/fi/cloudup/awstasks/load_balancer.go index 257c2b066d572..86489e2910aaf 100644 --- a/upup/pkg/fi/cloudup/awstasks/load_balancer.go +++ b/upup/pkg/fi/cloudup/awstasks/load_balancer.go @@ -657,6 +657,7 @@ type terraformLoadBalancerListener struct { InstanceProtocol string `json:"instance_protocol"` LBPort int64 `json:"lb_port"` LBProtocol string `json:"lb_protocol"` + SSLCertificateID string `json:"ssl_certificate_id,omitempty"` } type terraformLoadBalancerHealthCheck struct { @@ -697,12 +698,23 @@ func (_ *LoadBalancer) RenderTerraform(t *terraform.TerraformTarget, a, e, chang return fmt.Errorf("error parsing load balancer listener port: %q", loadBalancerPort) } - tf.Listener = append(tf.Listener, &terraformLoadBalancerListener{ - InstanceProtocol: "TCP", - InstancePort: listener.InstancePort, - LBPort: loadBalancerPortInt, - LBProtocol: "TCP", - }) + if listener.SSLCertificateID != "" { + tf.Listener = append(tf.Listener, &terraformLoadBalancerListener{ + InstanceProtocol: "SSL", + InstancePort: listener.InstancePort, + LBPort: loadBalancerPortInt, + LBProtocol: "SSL", + SSLCertificateID: listener.SSLCertificateID, + }) + } else { + tf.Listener = append(tf.Listener, &terraformLoadBalancerListener{ + InstanceProtocol: "TCP", + InstancePort: listener.InstancePort, + LBPort: loadBalancerPortInt, + LBProtocol: "TCP", + }) + } + } if e.HealthCheck != nil { From 3f231b34268c250324b52c8d498676b255e4bf0e Mon Sep 17 00:00:00 2001 From: James Bowes Date: Thu, 15 Nov 2018 19:36:25 -0400 Subject: [PATCH 073/163] Use a single command in Linux install instructions cURL and Wget are both great commands, but the Linux install instructions should stick to just using one. Similar to https://github.com/kubernetes/kops/pull/5901, which changed this for MacOS. --- docs/install.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/install.md b/docs/install.md index 446766bf43207..98d9450116f8d 100644 --- a/docs/install.md +++ b/docs/install.md @@ -25,7 +25,7 @@ You can also [install from source](development/building.md). From Github: ```bash -wget -O kops https://github.com/kubernetes/kops/releases/download/$(curl -s https://api.github.com/repos/kubernetes/kops/releases/latest | grep tag_name | cut -d '"' -f 4)/kops-linux-amd64 +curl -Lo kops https://github.com/kubernetes/kops/releases/download/$(curl -s https://api.github.com/repos/kubernetes/kops/releases/latest | grep tag_name | cut -d '"' -f 4)/kops-linux-amd64 chmod +x ./kops sudo mv ./kops /usr/local/bin/ ``` @@ -58,7 +58,7 @@ sudo mv ./kubectl /usr/local/bin/kubectl From the [official kubernetes kubectl release](https://kubernetes.io/docs/tasks/tools/install-kubectl/): ``` -wget -O kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl +curl -Lo kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl chmod +x ./kubectl sudo mv ./kubectl /usr/local/bin/kubectl ``` From 18ed48e99bff06cfb8276cc84f9dc497cbe2372c Mon Sep 17 00:00:00 2001 From: Alex Williams Date: Fri, 16 Nov 2018 13:41:18 +0000 Subject: [PATCH 074/163] Remove trailing comma from from k8s-1.7-v3.yaml.template --- .../networking.projectcalico.org/k8s-1.7-v3.yaml.template | 2 +- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template index 1063bce91000c..e2191ec29982f 100644 --- a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template @@ -36,7 +36,7 @@ data: "type": "calico-ipam" }, "policy": { - "type": "k8s", + "type": "k8s" }, "kubernetes": { "kubeconfig": "/etc/cni/net.d/__KUBECONFIG_FILENAME__" diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index 93e6b7fd6db6c..c30956d7ccb27 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -645,7 +645,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri "pre-k8s-1.6": "2.4.2-kops.1", "k8s-1.6": "2.6.9-kops.1", "k8s-1.7": "2.6.9-kops.1", - "k8s-1.7-v3": "3.3.1-kops.1", + "k8s-1.7-v3": "3.3.1-kops.2", } if b.cluster.Spec.Networking.Calico.MajorVersion == "v3" { From c5606ac15337db18ae46c040f6311e289ceaad6d Mon Sep 17 00:00:00 2001 From: JoeWrightss Date: Sat, 17 Nov 2018 02:59:06 +0800 Subject: [PATCH 075/163] Typo fix: Deploy -> Deploying --- docs/api-server/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/api-server/README.md b/docs/api-server/README.md index 5d7d16e69016f..b34f9dd4dcdcf 100644 --- a/docs/api-server/README.md +++ b/docs/api-server/README.md @@ -14,7 +14,7 @@ Build the kops API server container, and push the image up to your registry. kops-server-push ``` -# Deploy the kops API server to a cluster +# Deploying the kops API server to a cluster From the kops directory run the following `helm` command. More information on `helm` can be found [here](https://github.com/kubernetes/helm) From ec06216b75439530478e10283853f6162d51bcc1 Mon Sep 17 00:00:00 2001 From: Eric Herot <400447+eherot@users.noreply.github.com> Date: Fri, 16 Nov 2018 16:16:08 -0500 Subject: [PATCH 076/163] autoscaler setup: Use set -x to stop execution if errors are encountered --- addons/cluster-autoscaler/cluster-autoscaler.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/addons/cluster-autoscaler/cluster-autoscaler.sh b/addons/cluster-autoscaler/cluster-autoscaler.sh index ba983762021fa..ccacb58d0b107 100755 --- a/addons/cluster-autoscaler/cluster-autoscaler.sh +++ b/addons/cluster-autoscaler/cluster-autoscaler.sh @@ -14,6 +14,8 @@ # See the License for the specific language governing permissions and # limitations under the License. +set -e + #Set all the variables in this section CLUSTER_NAME="myfirstcluster.k8s.local" CLOUD_PROVIDER=aws From 6e6329db0543475eff7c7d59bd8528e24fd5c726 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Fri, 16 Nov 2018 22:10:56 -0800 Subject: [PATCH 077/163] feat(cmd/kops/create_cluster): default to kubelet anonymousAuth true --- cmd/kops/create_cluster.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index ed564182779db..b1a999a3a4a91 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -987,6 +987,12 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e cluster.Spec.MasterPublicName = c.MasterPublicName } + // Default to kubelet auth being turned off + if cluster.Spec.Kubelet == nil { + cluster.Spec.Kubelet = &api.KubeletConfigSpec{} + } + cluster.Spec.Kubelet.AnonymousAuth = fi.Bool(true) + // Populate the API access, so that it can be discoverable // TODO: This is the same code as in defaults - try to dedup? if cluster.Spec.API == nil { From 9b5b56aa6344313a724ea262805aa4b8361c8728 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Fri, 16 Nov 2018 22:40:25 -0800 Subject: [PATCH 078/163] chore(tests/integration/create_cluster): add new field --- tests/integration/create_cluster/complex/expected-v1alpha2.yaml | 2 ++ tests/integration/create_cluster/ha/expected-v1alpha1.yaml | 2 ++ tests/integration/create_cluster/ha/expected-v1alpha2.yaml | 2 ++ .../create_cluster/ha_encrypt/expected-v1alpha1.yaml | 2 ++ .../create_cluster/ha_encrypt/expected-v1alpha2.yaml | 2 ++ tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml | 2 ++ .../create_cluster/ha_shared_zones/expected-v1alpha2.yaml | 2 ++ tests/integration/create_cluster/minimal/expected-v1alpha1.yaml | 2 ++ tests/integration/create_cluster/minimal/expected-v1alpha2.yaml | 2 ++ .../create_cluster/ngwspecified/expected-v1alpha1.yaml | 2 ++ .../create_cluster/ngwspecified/expected-v1alpha2.yaml | 2 ++ .../integration/create_cluster/overrides/expected-v1alpha2.yaml | 2 ++ tests/integration/create_cluster/private/expected-v1alpha1.yaml | 2 ++ tests/integration/create_cluster/private/expected-v1alpha2.yaml | 2 ++ .../private_shared_subnets/expected-v1alpha2.yaml | 2 ++ .../create_cluster/shared_subnets/expected-v1alpha1.yaml | 2 ++ .../create_cluster/shared_subnets/expected-v1alpha2.yaml | 2 ++ .../shared_subnets_vpc_lookup/expected-v1alpha1.yaml | 2 ++ .../shared_subnets_vpc_lookup/expected-v1alpha2.yaml | 2 ++ .../create_cluster/shared_vpc/expected-v1alpha1.yaml | 2 ++ .../create_cluster/shared_vpc/expected-v1alpha2.yaml | 2 ++ 21 files changed, 42 insertions(+) diff --git a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml index 84ff48a61cca1..8da88c1e1d18c 100644 --- a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: complex.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: diff --git a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml index 9178f249d6b95..77325ee73c1bb 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: + kubelet: + anonymousAuth: true adminAccess: - 0.0.0.0/0 api: diff --git a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml index 7a8d6d56c17ad..086720e9bf3f2 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml index 6e7275b5ae67e..277841d4706c3 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: + kubelet: + anonymousAuth: true adminAccess: - 0.0.0.0/0 api: diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml index 0362654337313..92576c3453d17 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: diff --git a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml index bc04b12777edb..58d59df9e739c 100644 --- a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha-gce.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: diff --git a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml index e5c1632341208..acfb7bca46bfc 100644 --- a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml index 0294c44e55a2b..3c0afb3e188e2 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: minimal.example.com spec: + kubelet: + anonymousAuth: true adminAccess: - 0.0.0.0/0 api: diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml index c1ab20b716632..4b644ac61ea72 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: minimal.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml index 25c045be52826..ff813f2b7d744 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private.example.com spec: + kubelet: + anonymousAuth: true adminAccess: - 0.0.0.0/0 api: diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml index c498ac7b4ce23..24692ca11a85b 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private.example.com spec: + kubelet: + anonymousAuth: true api: loadBalancer: type: Public diff --git a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml index 9ebdbd2470b04..c3f919df7ac98 100644 --- a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: overrides.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: diff --git a/tests/integration/create_cluster/private/expected-v1alpha1.yaml b/tests/integration/create_cluster/private/expected-v1alpha1.yaml index 890b74d5640e3..46bb2ed997118 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha1.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private.example.com spec: + kubelet: + anonymousAuth: true adminAccess: - 0.0.0.0/0 api: diff --git a/tests/integration/create_cluster/private/expected-v1alpha2.yaml b/tests/integration/create_cluster/private/expected-v1alpha2.yaml index f0c2eeaa349e1..03597bb7ea418 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private.example.com spec: + kubelet: + anonymousAuth: true api: loadBalancer: type: Public diff --git a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml index 76cd9a1ec67e3..a4da37da77b83 100644 --- a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private-subnets.example.com spec: + kubelet: + anonymousAuth: true api: loadBalancer: type: Public diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml index 1a08f3bdfbcee..c6893da872e70 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: subnet.example.com spec: + kubelet: + anonymousAuth: true adminAccess: - 0.0.0.0/0 api: diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml index ecfa7d33ae87a..bc27584eb52d4 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: subnet.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml index 1a08f3bdfbcee..c6893da872e70 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: subnet.example.com spec: + kubelet: + anonymousAuth: true adminAccess: - 0.0.0.0/0 api: diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml index ecfa7d33ae87a..bc27584eb52d4 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: subnet.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml index 3c86dd0e5c39a..2534bc157af40 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: vpc.example.com spec: + kubelet: + anonymousAuth: true adminAccess: - 0.0.0.0/0 api: diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml index 8b2a6bbc21c65..0f278ae24fb77 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml @@ -4,6 +4,8 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: vpc.example.com spec: + kubelet: + anonymousAuth: true api: dns: {} authorization: From b075964a1d791483639afa0096376ee01862455c Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Fri, 16 Nov 2018 23:02:05 -0800 Subject: [PATCH 079/163] chore(tests/integration/create_cluster): move test defns lower --- .../integration/create_cluster/complex/expected-v1alpha2.yaml | 4 ++-- tests/integration/create_cluster/ha/expected-v1alpha1.yaml | 4 ++-- tests/integration/create_cluster/ha/expected-v1alpha2.yaml | 4 ++-- .../create_cluster/ha_encrypt/expected-v1alpha1.yaml | 4 ++-- .../create_cluster/ha_encrypt/expected-v1alpha2.yaml | 4 ++-- .../integration/create_cluster/ha_gce/expected-v1alpha2.yaml | 4 ++-- .../create_cluster/ha_shared_zones/expected-v1alpha2.yaml | 4 ++-- .../integration/create_cluster/minimal/expected-v1alpha1.yaml | 4 ++-- .../integration/create_cluster/minimal/expected-v1alpha2.yaml | 4 ++-- .../create_cluster/ngwspecified/expected-v1alpha1.yaml | 4 ++-- .../create_cluster/ngwspecified/expected-v1alpha2.yaml | 4 ++-- .../create_cluster/overrides/expected-v1alpha2.yaml | 4 ++-- .../integration/create_cluster/private/expected-v1alpha1.yaml | 4 ++-- .../integration/create_cluster/private/expected-v1alpha2.yaml | 4 ++-- .../private_shared_subnets/expected-v1alpha2.yaml | 4 ++-- .../create_cluster/shared_subnets/expected-v1alpha1.yaml | 4 ++-- .../create_cluster/shared_subnets/expected-v1alpha2.yaml | 4 ++-- .../shared_subnets_vpc_lookup/expected-v1alpha1.yaml | 4 ++-- .../shared_subnets_vpc_lookup/expected-v1alpha2.yaml | 4 ++-- .../create_cluster/shared_vpc/expected-v1alpha1.yaml | 4 ++-- .../create_cluster/shared_vpc/expected-v1alpha2.yaml | 4 ++-- 21 files changed, 42 insertions(+), 42 deletions(-) diff --git a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml index 8da88c1e1d18c..3b4e32921b6df 100644 --- a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: complex.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -25,6 +23,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.7.1 diff --git a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml index 77325ee73c1bb..28cd8b1f274fb 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: - kubelet: - anonymousAuth: true adminAccess: - 0.0.0.0/0 api: @@ -35,6 +33,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml index 086720e9bf3f2..63867d07c1695 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -33,6 +31,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.6.0-alpha.3 diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml index 277841d4706c3..dbfad82e8a8aa 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: - kubelet: - anonymousAuth: true adminAccess: - 0.0.0.0/0 api: @@ -41,6 +39,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml index 92576c3453d17..411bca2fdc3f6 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -39,6 +37,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.6.0-alpha.3 diff --git a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml index 58d59df9e739c..0188c64da9f89 100644 --- a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha-gce.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -33,6 +31,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.8.0-beta.1 diff --git a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml index acfb7bca46bfc..e4f7ab6797acc 100644 --- a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: ha.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -41,6 +39,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml index 3c0afb3e188e2..eaef2a9794b43 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: minimal.example.com spec: - kubelet: - anonymousAuth: true adminAccess: - 0.0.0.0/0 api: @@ -27,6 +25,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesVersion: v1.4.8 masterPublicName: api.minimal.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml index 4b644ac61ea72..3b3e5947252fd 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: minimal.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -25,6 +23,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml index ff813f2b7d744..2493b8d5d01b4 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private.example.com spec: - kubelet: - anonymousAuth: true adminAccess: - 0.0.0.0/0 api: @@ -28,6 +26,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml index 24692ca11a85b..239190e9bcf80 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private.example.com spec: - kubelet: - anonymousAuth: true api: loadBalancer: type: Public @@ -26,6 +24,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml index c3f919df7ac98..3bfb4c44344d4 100644 --- a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: overrides.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -25,6 +23,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.7.5 diff --git a/tests/integration/create_cluster/private/expected-v1alpha1.yaml b/tests/integration/create_cluster/private/expected-v1alpha1.yaml index 46bb2ed997118..7da2b79255574 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha1.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private.example.com spec: - kubelet: - anonymousAuth: true adminAccess: - 0.0.0.0/0 api: @@ -32,6 +30,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/private/expected-v1alpha2.yaml b/tests/integration/create_cluster/private/expected-v1alpha2.yaml index 03597bb7ea418..50014e118afa4 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private.example.com spec: - kubelet: - anonymousAuth: true api: loadBalancer: type: Public @@ -30,6 +28,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml index a4da37da77b83..d08f77e6cba29 100644 --- a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: private-subnets.example.com spec: - kubelet: - anonymousAuth: true api: loadBalancer: type: Public @@ -26,6 +24,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml index c6893da872e70..a0b4579e4cdc6 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: subnet.example.com spec: - kubelet: - anonymousAuth: true adminAccess: - 0.0.0.0/0 api: @@ -27,6 +25,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml index bc27584eb52d4..17338584b2154 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: subnet.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -25,6 +23,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml index c6893da872e70..a0b4579e4cdc6 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: subnet.example.com spec: - kubelet: - anonymousAuth: true adminAccess: - 0.0.0.0/0 api: @@ -27,6 +25,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml index bc27584eb52d4..17338584b2154 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: subnet.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -25,6 +23,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml index 2534bc157af40..a24ab94b6df43 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: vpc.example.com spec: - kubelet: - anonymousAuth: true adminAccess: - 0.0.0.0/0 api: @@ -27,6 +25,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesVersion: v1.4.8 masterPublicName: api.vpc.example.com networkCIDR: 10.0.0.0/12 diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml index 0f278ae24fb77..06baf7bfea4ed 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml @@ -4,8 +4,6 @@ metadata: creationTimestamp: 2017-01-01T00:00:00Z name: vpc.example.com spec: - kubelet: - anonymousAuth: true api: dns: {} authorization: @@ -25,6 +23,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 From 2336498467ee37df46797417e0b3bd6c2da08b5e Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Fri, 16 Nov 2018 23:11:00 -0800 Subject: [PATCH 080/163] chore(tests/integration/create_cluster): finalize tests --- .../create_cluster/ingwspecified/expected-v1alpha1.yaml | 2 ++ .../create_cluster/ingwspecified/expected-v1alpha2.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml index 4e65951a5f5d6..31fbc82dd5072 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml @@ -26,6 +26,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml index 3508601a1fcdc..bca40e03d501c 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml @@ -24,6 +24,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: true kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 From 9e2d3948c9b1be705af3daed28e114321dfd293f Mon Sep 17 00:00:00 2001 From: JoeWrightss Date: Sat, 17 Nov 2018 15:13:08 +0800 Subject: [PATCH 081/163] Typo fix "api server" -> "API server" --- dns-controller/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dns-controller/README.md b/dns-controller/README.md index ba977385d53f7..bce977c1fbed6 100644 --- a/dns-controller/README.md +++ b/dns-controller/README.md @@ -7,7 +7,7 @@ we have an `etcd` cluster and an `apiserver`. It also sets up DNS records for the `etcd` nodes (this is a much simpler problem, because we have a 1:1 mapping from an `etcd` node to a DNS name.) -However, none of the nodes can reach the api server to register. Nor +However, none of the nodes can reach the API server to register. Nor can end-users reach the API. In future we might expose the API server as a normal service via `Type=LoadBalancer` or via a normal Ingress, but for now we just expose it via DNS. From 769995d92a5567c3371453f3aa185fb6a3c34606 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 17 Nov 2018 00:41:52 -0800 Subject: [PATCH 082/163] chore(cmd/kops/create_cluster): better comment --- cmd/kops/create_cluster.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index ec9237d65aa39..b8770adb8b0dc 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -1059,7 +1059,7 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e cluster.Spec.MasterPublicName = c.MasterPublicName } - // Default to kubelet auth being turned off + // Default to kubelet anon authentication being turned off if cluster.Spec.Kubelet == nil { cluster.Spec.Kubelet = &api.KubeletConfigSpec{} } From d83fd29d0ab49cc243eb1165c33065d073b1faba Mon Sep 17 00:00:00 2001 From: Justin SB Date: Sun, 18 Nov 2018 14:26:38 -0500 Subject: [PATCH 083/163] Fix typo in CRD: singuar The upstream file has the correct form singular, so this looks like our own error. --- .../networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template | 2 +- .../networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template | 2 +- .../networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template index 15dbcbf9eae18..5a1911d058179 100644 --- a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template @@ -133,5 +133,5 @@ spec: names: scope: Cluster plural: eniconfigs - singuar: eniconfig + singular: eniconfig kind: ENIConfig diff --git a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template index 422832539a65c..1a3a8d53a63f7 100644 --- a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template @@ -133,7 +133,7 @@ spec: names: scope: Cluster plural: eniconfigs - singuar: eniconfig + singular: eniconfig kind: ENIConfig --- diff --git a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template index 1f07bdd7add23..6de995a5c6380 100644 --- a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template @@ -133,7 +133,7 @@ spec: names: scope: Cluster plural: eniconfigs - singuar: eniconfig + singular: eniconfig kind: ENIConfig --- From fbcf95f611f48127428bb1ed456f35caed193a47 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Sun, 18 Nov 2018 14:29:13 -0500 Subject: [PATCH 084/163] Bump version of amazon-vpc-cni in bootstrapchannelbuilder We need to bump this version whenever we change the manifest, to ensure that updates are actually applied. Bump it to catch up. --- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index c30956d7ccb27..653a77f97ffe8 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -837,7 +837,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri if b.cluster.Spec.Networking.AmazonVPC != nil { key := "networking.amazon-vpc-routed-eni" - version := "1.0.0-kops.3" + version := "1.2.1-kops.1" { id := "k8s-1.7" From 5dfcb9b59e86448eb15a411f3c5e94524283652b Mon Sep 17 00:00:00 2001 From: Justin SB Date: Sun, 18 Nov 2018 21:02:40 -0500 Subject: [PATCH 085/163] Update machine type generator * Handle NA ECU value (map to zero) * Deduplicate machine types (I was getting duplicates) --- hack/machine_types/machine_types.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hack/machine_types/machine_types.go b/hack/machine_types/machine_types.go index a9a6ee7810cb9..93fafef09b241 100644 --- a/hack/machine_types/machine_types.go +++ b/hack/machine_types/machine_types.go @@ -189,6 +189,8 @@ func run() error { if attributes["ecu"] == "Variable" { machine.Burstable = true machine.ECU = t2CreditsPerHour[machine.Name] // This is actually credits * ECUs, but we'll add that later + } else if attributes["ecu"] == "NA" { + machine.ECU = 0 } else { machine.ECU = stringToFloat32(attributes["ecu"]) } @@ -230,7 +232,14 @@ func run() error { for _, f := range sortedFamilies { output = output + fmt.Sprintf("\n// %s family", f) + previousMachine := "" for _, m := range machines { + // Ignore duplicates + if m.Name == previousMachine { + continue + } + previousMachine = m.Name + if family := strings.Split(m.Name, ".")[0]; family == f { var ecu string if m.Burstable { From be04f8b7c4167c53d2bb344832136248935b9639 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Sun, 18 Nov 2018 21:03:55 -0500 Subject: [PATCH 086/163] Updated generated machine_types --- upup/pkg/fi/cloudup/awsup/machine_types.go | 110 ++++++++++++++++++++- 1 file changed, 109 insertions(+), 1 deletion(-) diff --git a/upup/pkg/fi/cloudup/awsup/machine_types.go b/upup/pkg/fi/cloudup/awsup/machine_types.go index 49f40a5f0f216..4ff45460292af 100644 --- a/upup/pkg/fi/cloudup/awsup/machine_types.go +++ b/upup/pkg/fi/cloudup/awsup/machine_types.go @@ -271,7 +271,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 144, ECU: 281, Cores: 72, - EphemeralDisks: []int{1800}, + EphemeralDisks: []int{900, 900}, }, // cc2 family @@ -397,6 +397,16 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ GPU: true, }, + // g3s family + { + Name: "g3s.xlarge", + MemoryGB: 30.5, + ECU: 13, + Cores: 4, + EphemeralDisks: nil, + GPU: true, + }, + // h1 family { Name: "h1.2xlarge", @@ -718,6 +728,55 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ EphemeralDisks: nil, }, + // m5a family + { + Name: "m5a.large", + MemoryGB: 8, + ECU: 0, + Cores: 2, + EphemeralDisks: nil, + }, + + { + Name: "m5a.xlarge", + MemoryGB: 16, + ECU: 0, + Cores: 4, + EphemeralDisks: nil, + }, + + { + Name: "m5a.2xlarge", + MemoryGB: 32, + ECU: 0, + Cores: 8, + EphemeralDisks: nil, + }, + + { + Name: "m5a.4xlarge", + MemoryGB: 64, + ECU: 0, + Cores: 16, + EphemeralDisks: nil, + }, + + { + Name: "m5a.12xlarge", + MemoryGB: 192, + ECU: 0, + Cores: 48, + EphemeralDisks: nil, + }, + + { + Name: "m5a.24xlarge", + MemoryGB: 384, + ECU: 0, + Cores: 96, + EphemeralDisks: nil, + }, + // m5d family { Name: "m5d.large", @@ -962,6 +1021,55 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ EphemeralDisks: nil, }, + // r5a family + { + Name: "r5a.large", + MemoryGB: 16, + ECU: 0, + Cores: 2, + EphemeralDisks: nil, + }, + + { + Name: "r5a.xlarge", + MemoryGB: 32, + ECU: 0, + Cores: 4, + EphemeralDisks: nil, + }, + + { + Name: "r5a.2xlarge", + MemoryGB: 64, + ECU: 0, + Cores: 8, + EphemeralDisks: nil, + }, + + { + Name: "r5a.4xlarge", + MemoryGB: 128, + ECU: 0, + Cores: 16, + EphemeralDisks: nil, + }, + + { + Name: "r5a.12xlarge", + MemoryGB: 384, + ECU: 0, + Cores: 48, + EphemeralDisks: nil, + }, + + { + Name: "r5a.24xlarge", + MemoryGB: 768, + ECU: 0, + Cores: 96, + EphemeralDisks: nil, + }, + // r5d family { Name: "r5d.large", From 7c4b2a6a5eaede4e1b27151716a9a66e5e45f978 Mon Sep 17 00:00:00 2001 From: mmerrill3 Date: Sat, 13 Oct 2018 09:29:33 -0400 Subject: [PATCH 087/163] Setting the manifest directory when it is required by kubelet --- nodeup/pkg/model/kubelet.go | 20 ++++++++++++++++++- nodeup/pkg/model/kubelet_test.go | 9 +++++++++ .../tests/kubelet/featuregates/cluster.yaml | 1 + .../tests/kubelet/featuregates/tasks.yaml | 6 +++++- 4 files changed, 34 insertions(+), 2 deletions(-) diff --git a/nodeup/pkg/model/kubelet.go b/nodeup/pkg/model/kubelet.go index 446fd9c217329..73b0eb4684128 100644 --- a/nodeup/pkg/model/kubelet.go +++ b/nodeup/pkg/model/kubelet.go @@ -88,7 +88,15 @@ func (b *KubeletBuilder) Build(c *fi.ModelBuilderContext) error { Mode: s("0755"), }) } - + { + if kubeletConfig.PodManifestPath != "" { + t, err := b.buildManifestDirectory(kubeletConfig) + if err != nil { + return err + } + c.AddTask(t) + } + } { // @check if bootstrap tokens are enabled and create the appropreiate certificates if b.UseBootstrapTokens() { @@ -149,6 +157,16 @@ func (b *KubeletBuilder) kubeletPath() string { return kubeletCommand } +// buildManifestDirectory creates the directory where kubelet expects static manifests to reside +func (b *KubeletBuilder) buildManifestDirectory(kubeletConfig *kops.KubeletConfigSpec) (*nodetasks.File, error) { + directory := &nodetasks.File{ + Path: kubeletConfig.PodManifestPath, + Type: nodetasks.FileType_Directory, + Mode: s("0755"), + } + return directory, nil +} + // buildSystemdEnvironmentFile renders the environment file for the kubelet func (b *KubeletBuilder) buildSystemdEnvironmentFile(kubeletConfig *kops.KubeletConfigSpec) (*nodetasks.File, error) { // @step: ensure the masters do not get a bootstrap configuration diff --git a/nodeup/pkg/model/kubelet_test.go b/nodeup/pkg/model/kubelet_test.go index e19a8ce23ab11..dddd64246033e 100644 --- a/nodeup/pkg/model/kubelet_test.go +++ b/nodeup/pkg/model/kubelet_test.go @@ -182,6 +182,15 @@ func Test_RunKubeletBuilder(t *testing.T) { } context.AddTask(fileTask) + { + task, err := builder.buildManifestDirectory(kubeletConfig) + if err != nil { + t.Fatalf("error from KubeletBuilder buildManifestDirectory: %v", err) + return + } + context.AddTask(task) + } + testutils.ValidateTasks(t, basedir, context) } diff --git a/nodeup/pkg/model/tests/kubelet/featuregates/cluster.yaml b/nodeup/pkg/model/tests/kubelet/featuregates/cluster.yaml index 3639005c04841..6c3b281b42dbe 100644 --- a/nodeup/pkg/model/tests/kubelet/featuregates/cluster.yaml +++ b/nodeup/pkg/model/tests/kubelet/featuregates/cluster.yaml @@ -22,6 +22,7 @@ spec: featureGates: ExperimentalCriticalPodAnnotation: "true" AllowExtTrafficLocalEndpoints: "false" + podManifestPath: "/etc/kubernetes/manifests" kubernetesVersion: v1.5.0 masterInternalName: api.internal.minimal.example.com masterPublicName: api.minimal.example.com diff --git a/nodeup/pkg/model/tests/kubelet/featuregates/tasks.yaml b/nodeup/pkg/model/tests/kubelet/featuregates/tasks.yaml index a0d60b74f39a2..ad79c9e4a8c8c 100644 --- a/nodeup/pkg/model/tests/kubelet/featuregates/tasks.yaml +++ b/nodeup/pkg/model/tests/kubelet/featuregates/tasks.yaml @@ -1,5 +1,9 @@ +mode: "0755" +path: /etc/kubernetes/manifests +type: directory +--- contents: | - DAEMON_ARGS="--feature-gates=AllowExtTrafficLocalEndpoints=false,ExperimentalCriticalPodAnnotation=true --node-labels=kubernetes.io/role=node,node-role.kubernetes.io/node= --cni-bin-dir=/opt/cni/bin/ --cni-conf-dir=/etc/cni/net.d/ --network-plugin-dir=/opt/cni/bin/" + DAEMON_ARGS="--feature-gates=AllowExtTrafficLocalEndpoints=false,ExperimentalCriticalPodAnnotation=true --node-labels=kubernetes.io/role=node,node-role.kubernetes.io/node= --pod-manifest-path=/etc/kubernetes/manifests --cni-bin-dir=/opt/cni/bin/ --cni-conf-dir=/etc/cni/net.d/ --network-plugin-dir=/opt/cni/bin/" HOME="/root" path: /etc/sysconfig/kubelet type: file From 5943b13264593de9ce8fc7833b7b773235b08368 Mon Sep 17 00:00:00 2001 From: Sandeep Rajan Date: Mon, 19 Nov 2018 11:25:41 -0500 Subject: [PATCH 088/163] CoreDNS version 1.2.6 --- .../addons/coredns.addons.k8s.io/k8s-1.6.yaml.template | 2 +- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template b/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template index 6a3a41329eda7..5ad294aee5dad 100644 --- a/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template +++ b/upup/models/cloudup/resources/addons/coredns.addons.k8s.io/k8s-1.6.yaml.template @@ -106,7 +106,7 @@ spec: beta.kubernetes.io/os: linux containers: - name: coredns - image: k8s.gcr.io/coredns:1.2.4 + image: k8s.gcr.io/coredns:1.2.6 imagePullPolicy: IfNotPresent resources: limits: diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index 653a77f97ffe8..f5f4bc44b3b16 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -211,7 +211,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri if kubeDNS.Provider == "CoreDNS" { { key := "coredns.addons.k8s.io" - version := "1.2.4-kops.1" + version := "1.2.6-kops.1" { location := key + "/k8s-1.6.yaml" From a907550e0b0a4d8408deeb42aabf3faf5e0244fa Mon Sep 17 00:00:00 2001 From: Rohith Date: Tue, 12 Jun 2018 22:06:56 +0100 Subject: [PATCH 089/163] Node Authorizer Recovery Middleware - adding a recovery middles to capture panics --- node-authorizer/pkg/server/middleware.go | 17 +++++++++++++++++ node-authorizer/pkg/server/server.go | 10 +++++----- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/node-authorizer/pkg/server/middleware.go b/node-authorizer/pkg/server/middleware.go index 91401da7b3eb6..22b8e790fc531 100644 --- a/node-authorizer/pkg/server/middleware.go +++ b/node-authorizer/pkg/server/middleware.go @@ -17,6 +17,7 @@ limitations under the License. package server import ( + "fmt" "net/http" "k8s.io/kops/node-authorizer/pkg/utils" @@ -24,6 +25,22 @@ import ( "go.uber.org/zap" ) +// recovery is responsible for ensuring we don't exit on a panic +func recovery(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { + defer func() { + if err := recover(); err != nil { + w.WriteHeader(http.StatusInternalServerError) + + utils.Logger.Error("failed to handle request, threw exception", + zap.String("error", fmt.Sprintf("%v", err))) + } + }() + + next.ServeHTTP(w, req) + }) +} + // authorized is responsible for validating the client certificate func authorized(next http.HandlerFunc, commonName string, requireAuth bool) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { diff --git a/node-authorizer/pkg/server/server.go b/node-authorizer/pkg/server/server.go index 78f9d2acb37ad..d3d22294460b6 100644 --- a/node-authorizer/pkg/server/server.go +++ b/node-authorizer/pkg/server/server.go @@ -58,14 +58,14 @@ func New(config *Config, authorizer Authorizer) (*NodeAuthorizer, error) { zap.String("listen", config.Listen), zap.String("version", Version)) - if err := config.IsValid(); err != nil { - return nil, fmt.Errorf("configuration error: %s", err) - } - if authorizer == nil { return nil, errors.New("no authorizer") } + if err := config.IsValid(); err != nil { + return nil, fmt.Errorf("configuration error: %s", err) + } + return &NodeAuthorizer{ authorizer: authorizer, config: config, @@ -109,7 +109,7 @@ func (n *NodeAuthorizer) Run() error { r.Handle("/authorize/{name}", authorized(n.authorizeHandler, n.config.ClientCommonName, n.useMutualTLS())).Methods(http.MethodPost) r.Handle("/metrics", prometheus.Handler()).Methods(http.MethodGet) r.HandleFunc("/health", n.healthHandler).Methods(http.MethodGet) - server.Handler = r + server.Handler = recovery(r) // @step: wait for either an error or a termination signal errs := make(chan error, 2) From d6a72990381a9b6ca777f8798f6cf37e05914da0 Mon Sep 17 00:00:00 2001 From: SataQiu Date: Wed, 21 Nov 2018 18:47:47 +0800 Subject: [PATCH 090/163] fix typos: dnsmaq -> dnsmasq, mutiple -> multiple --- pkg/apis/kops/cluster.go | 2 +- pkg/apis/kops/v1alpha1/cluster.go | 2 +- pkg/apis/kops/v1alpha2/cluster.go | 2 +- pkg/resources/aws/securitygroup.go | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/apis/kops/cluster.go b/pkg/apis/kops/cluster.go index f53cb4f81ae08..69c0e699df337 100644 --- a/pkg/apis/kops/cluster.go +++ b/pkg/apis/kops/cluster.go @@ -333,7 +333,7 @@ type LoadBalancerAccessSpec struct { // KubeDNSConfig defines the kube dns configuration type KubeDNSConfig struct { - // CacheMaxSize is the maximum entries to keep in dnsmaq + // CacheMaxSize is the maximum entries to keep in dnsmasq CacheMaxSize int `json:"cacheMaxSize,omitempty"` // CacheMaxConcurrent is the maximum number of concurrent queries for dnsmasq CacheMaxConcurrent int `json:"cacheMaxConcurrent,omitempty"` diff --git a/pkg/apis/kops/v1alpha1/cluster.go b/pkg/apis/kops/v1alpha1/cluster.go index 1100c7a78c7d8..64ecdb6d98474 100644 --- a/pkg/apis/kops/v1alpha1/cluster.go +++ b/pkg/apis/kops/v1alpha1/cluster.go @@ -332,7 +332,7 @@ type LoadBalancerAccessSpec struct { // KubeDNSConfig defines the kube dns configuration type KubeDNSConfig struct { - // CacheMaxSize is the maximum entries to keep in dnsmaq + // CacheMaxSize is the maximum entries to keep in dnsmasq CacheMaxSize int `json:"cacheMaxSize,omitempty"` // CacheMaxConcurrent is the maximum number of concurrent queries for dnsmasq CacheMaxConcurrent int `json:"cacheMaxConcurrent,omitempty"` diff --git a/pkg/apis/kops/v1alpha2/cluster.go b/pkg/apis/kops/v1alpha2/cluster.go index f32f5553f4218..0aec4f76585b9 100644 --- a/pkg/apis/kops/v1alpha2/cluster.go +++ b/pkg/apis/kops/v1alpha2/cluster.go @@ -333,7 +333,7 @@ type LoadBalancerAccessSpec struct { // KubeDNSConfig defines the kube dns configuration type KubeDNSConfig struct { - // CacheMaxSize is the maximum entries to keep in dnsmaq + // CacheMaxSize is the maximum entries to keep in dnsmasq CacheMaxSize int `json:"cacheMaxSize,omitempty"` // CacheMaxConcurrent is the maximum number of concurrent queries for dnsmasq CacheMaxConcurrent int `json:"cacheMaxConcurrent,omitempty"` diff --git a/pkg/resources/aws/securitygroup.go b/pkg/resources/aws/securitygroup.go index 56e4cf31a5f73..0bb874e703246 100644 --- a/pkg/resources/aws/securitygroup.go +++ b/pkg/resources/aws/securitygroup.go @@ -51,7 +51,7 @@ func DeleteSecurityGroup(cloud fi.Cloud, t *resources.Resource) error { return nil } if len(response.SecurityGroups) != 1 { - return fmt.Errorf("found mutiple SecurityGroups with ID %q", id) + return fmt.Errorf("found multiple SecurityGroups with ID %q", id) } sg := response.SecurityGroups[0] From bd680c4bf949981081018be8251076a561d5e8ec Mon Sep 17 00:00:00 2001 From: Jonas Lergell Date: Thu, 15 Nov 2018 15:07:26 +0100 Subject: [PATCH 091/163] Document how to create a custom addon --- docs/addons.md | 69 +++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 68 insertions(+), 1 deletion(-) diff --git a/docs/addons.md b/docs/addons.md index 304a4ae393ddd..fb3634e734b62 100644 --- a/docs/addons.md +++ b/docs/addons.md @@ -8,7 +8,74 @@ Addons in Kubernetes are traditionally done by copying files to `/etc/kubernetes doesn't really make sense in HA master configurations. We also have kubectl available, and addons are just a thin wrapper over calling kubectl. -This document describes how to install some common addons. +The command `kops create cluster` does not support specifying addons to be added to the cluster when it is created. Instead they can be added after cluster creation using kubectl. Alternatively when creating a cluster from a yaml manifest, addons can be specified using `spec.addons`. +```yaml +spec: + addons: + - kubernetes-dashboard + - s3://kops-addons/addon.yaml +``` + +This document describes how to install some common addons and how to create your own custom ones. + +### Custom addons + +The docs about the [addon manager](addon_manager.md) describe in more detail how to define a addon resource with regards to versioning. +Here is a minimal example of an addon manifest that would install two different addons. + +```yaml +kind: Addons +metadata: + name: example +spec: + addons: + - name: foo.addons.org.io + version: 0.0.1 + selector: + k8s-addon: foo.addons.org.io + manifest: foo.addons.org.io/v0.0.1.yaml + - name: bar.addons.org.io + version: 0.0.1 + selector: + k8s-addon: bar.addons.org.io + manifest: bar.addons.org.io/v0.0.1.yaml +``` + +In this this example the folder structure should look like this; + +``` +addon.yaml + foo.addons.org.io + v0.0.1.yaml + bar.addons.org.io + v0.0.1.yaml +``` + +The yaml files in the foo/bar folders can be any kubernetes resource. Typically this file structure would be pushed to S3 or another of the supported backends and then referenced as above in `spec.addons`. In order for master nodes to be able to access the S3 bucket containing the addon manifests, one might have to add additional iam policies to the master nodes using `spec.additionalPolicies`, like so; +```yaml +spec: + additionalPolicies: + master: | + [ + { + "Effect": "Allow", + "Action": [ + "s3:GetObject" + ], + "Resource": ["arn:aws:s3:::kops-addons/*"] + }, + { + "Effect": "Allow", + "Action": [ + "s3:GetBucketLocation", + "s3:ListBucket" + ], + "Resource": ["arn:aws:s3:::kops-addons"] + } + ] +``` +The masters will poll for changes changes in the bucket and keep the addons up to date. + ### Dashboard From 6bba0b6fcdfcb13d80f3476fa0aae4fad6be3858 Mon Sep 17 00:00:00 2001 From: Zhenhai Gao Date: Sat, 24 Nov 2018 17:19:29 +0800 Subject: [PATCH 092/163] Fix log warning info Signed-off-by: gaozhenhai --- upup/pkg/kutil/import_cluster.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/upup/pkg/kutil/import_cluster.go b/upup/pkg/kutil/import_cluster.go index c9c38e0db4425..0c73d21468fcf 100644 --- a/upup/pkg/kutil/import_cluster.go +++ b/upup/pkg/kutil/import_cluster.go @@ -324,7 +324,7 @@ func (x *ImportCluster) ImportAWSCluster() error { } if launchConfiguration == nil { - glog.Warningf("LaunchConfiguration %q not found; ignoring", name) + glog.Warningf("ignoring error launchConfiguration %q not found", name) continue } From 2182b879d96d16a11254c2fc4005fed2ba88a35b Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 10:57:47 -0800 Subject: [PATCH 093/163] fix(cmd/kops/create_cluster): set anonymousAuth to false not true, whoops --- cmd/kops/create_cluster.go | 2 +- tests/integration/create_cluster/complex/expected-v1alpha2.yaml | 2 +- tests/integration/create_cluster/ha/expected-v1alpha1.yaml | 2 +- tests/integration/create_cluster/ha/expected-v1alpha2.yaml | 2 +- .../create_cluster/ha_encrypt/expected-v1alpha1.yaml | 2 +- .../create_cluster/ha_encrypt/expected-v1alpha2.yaml | 2 +- tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml | 2 +- .../create_cluster/ha_shared_zones/expected-v1alpha2.yaml | 2 +- .../create_cluster/ingwspecified/expected-v1alpha1.yaml | 2 +- .../create_cluster/ingwspecified/expected-v1alpha2.yaml | 2 +- tests/integration/create_cluster/minimal/expected-v1alpha1.yaml | 2 +- tests/integration/create_cluster/minimal/expected-v1alpha2.yaml | 2 +- .../create_cluster/ngwspecified/expected-v1alpha1.yaml | 2 +- .../create_cluster/ngwspecified/expected-v1alpha2.yaml | 2 +- .../integration/create_cluster/overrides/expected-v1alpha2.yaml | 2 +- tests/integration/create_cluster/private/expected-v1alpha1.yaml | 2 +- tests/integration/create_cluster/private/expected-v1alpha2.yaml | 2 +- .../private_shared_subnets/expected-v1alpha2.yaml | 2 +- .../create_cluster/shared_subnets/expected-v1alpha1.yaml | 2 +- .../create_cluster/shared_subnets/expected-v1alpha2.yaml | 2 +- .../shared_subnets_vpc_lookup/expected-v1alpha1.yaml | 2 +- .../shared_subnets_vpc_lookup/expected-v1alpha2.yaml | 2 +- .../create_cluster/shared_vpc/expected-v1alpha1.yaml | 2 +- .../create_cluster/shared_vpc/expected-v1alpha2.yaml | 2 +- 24 files changed, 24 insertions(+), 24 deletions(-) diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index 3ec2f0405ef09..2d28817efa90d 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -1065,7 +1065,7 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e if cluster.Spec.Kubelet == nil { cluster.Spec.Kubelet = &api.KubeletConfigSpec{} } - cluster.Spec.Kubelet.AnonymousAuth = fi.Bool(true) + cluster.Spec.Kubelet.AnonymousAuth = fi.Bool(false) // Populate the API access, so that it can be discoverable // TODO: This is the same code as in defaults - try to dedup? diff --git a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml index 2c6f10fdf871b..91c3dd3107298 100644 --- a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml @@ -24,7 +24,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.7.1 diff --git a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml index d4e521b9cad13..de6e82e009ffd 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml @@ -34,7 +34,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml index cd62c2a573e8e..038fd814ad083 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml @@ -32,7 +32,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.6.0-alpha.3 diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml index 9c7436956aadb..99986596067cd 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml @@ -40,7 +40,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml index 7c928fc898222..a7244134f4ed3 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml @@ -38,7 +38,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.6.0-alpha.3 diff --git a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml index 38ba41d5a1031..abb0a7f04bcea 100644 --- a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml @@ -32,7 +32,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.8.0-beta.1 diff --git a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml index e4f7ab6797acc..8231783e4f7e3 100644 --- a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml @@ -40,7 +40,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml index 31fbc82dd5072..e0571953cac17 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml @@ -27,7 +27,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml index bca40e03d501c..d06032c2d572b 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml @@ -25,7 +25,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml index 2cb630ff5b954..1ad95f66e101a 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml @@ -26,7 +26,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesVersion: v1.12.0 masterPublicName: api.minimal.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml index 5f7334ea30cf3..b42f6fd60dc13 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml @@ -24,7 +24,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.12.0 diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml index 2493b8d5d01b4..8b523835cb452 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml @@ -27,7 +27,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml index 239190e9bcf80..488f8d41a5905 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml @@ -25,7 +25,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml index 06434b8f2888c..67f50c07fcb9e 100644 --- a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml @@ -24,7 +24,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.7.5 diff --git a/tests/integration/create_cluster/private/expected-v1alpha1.yaml b/tests/integration/create_cluster/private/expected-v1alpha1.yaml index 7da2b79255574..690e5c40cc86d 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha1.yaml @@ -31,7 +31,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/private/expected-v1alpha2.yaml b/tests/integration/create_cluster/private/expected-v1alpha2.yaml index 50014e118afa4..7e9c991acdc62 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha2.yaml @@ -29,7 +29,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml index d08f77e6cba29..ad45253a69097 100644 --- a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml @@ -25,7 +25,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml index a0b4579e4cdc6..a3f1924b6e2dd 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml @@ -26,7 +26,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml index 17338584b2154..dcc37ac6e67d1 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml @@ -24,7 +24,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml index a0b4579e4cdc6..a3f1924b6e2dd 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml @@ -26,7 +26,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml index 17338584b2154..dcc37ac6e67d1 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml @@ -24,7 +24,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml index a24ab94b6df43..53f8344cf969d 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml @@ -26,7 +26,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesVersion: v1.4.8 masterPublicName: api.vpc.example.com networkCIDR: 10.0.0.0/12 diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml index 06baf7bfea4ed..1781308b257c8 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml @@ -24,7 +24,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: true + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 From beb78dd7e39aeac99a5c20299575ad35aa07504a Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 15:55:22 -0800 Subject: [PATCH 094/163] feat: set anonymousAuth to false on clusters >1.10, and recommend it on upgrade --- cmd/kops/create_cluster.go | 14 +++++++-- upup/pkg/fi/cloudup/apply_cluster.go | 45 +++++++++++++++++++++------- 2 files changed, 47 insertions(+), 12 deletions(-) diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index 2d28817efa90d..005f01465f847 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -44,6 +44,7 @@ import ( "k8s.io/kops/pkg/commands" "k8s.io/kops/pkg/dns" "k8s.io/kops/pkg/featureflag" + "k8s.io/kops/pkg/k8sversion" "k8s.io/kops/pkg/model/components" "k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi/cloudup" @@ -1061,11 +1062,20 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e cluster.Spec.MasterPublicName = c.MasterPublicName } - // Default to kubelet anon authentication being turned off + kv, err := k8sversion.Parse(cluster.Spec.KubernetesVersion) + if err != nil { + return err + } + + // check if we should set anonymousAuth to false on k8s versions gte than 1.10 + // we do 1.10 since this is a really critical issues and 1.10 has support if cluster.Spec.Kubelet == nil { cluster.Spec.Kubelet = &api.KubeletConfigSpec{} } - cluster.Spec.Kubelet.AnonymousAuth = fi.Bool(false) + + if kv.IsGTE("1.10") && cluster.Spec.Kubelet.AnonymousAuth == nil { + cluster.Spec.Kubelet.AnonymousAuth = fi.Bool(false) + } // Populate the API access, so that it can be discoverable // TODO: This is the same code as in defaults - try to dedup? diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go index 5d64b3c53a8db..0e1d7bb4cf3bf 100644 --- a/upup/pkg/fi/cloudup/apply_cluster.go +++ b/upup/pkg/fi/cloudup/apply_cluster.go @@ -23,6 +23,8 @@ import ( "path" "strings" + "k8s.io/kops/pkg/k8sversion" + "github.com/blang/semver" "github.com/golang/glog" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -278,6 +280,29 @@ func (c *ApplyClusterCmd) Run() error { cluster.Spec.KubernetesVersion = versionWithoutV } + // TODO: consider moving this somewhere, it's duplicated on create + kv, err := k8sversion.Parse(cluster.Spec.KubernetesVersion) + if err != nil { + return err + } + + // check if we should recommend turning off anonymousAuth on k8s versions gte than 1.10 + // we do 1.10 since this is a really critical issues and 1.10 has it + if cluster.Spec.Kubelet == nil { + cluster.Spec.Kubelet = &kops.KubeletConfigSpec{} + } + + if kv.IsGTE("1.10") && cluster.Spec.Kubelet.AnonymousAuth == nil { + fmt.Println("") + fmt.Printf(starline) + fmt.Println("") + fmt.Println("Kubelet anonymousAuth is currently turned on. This allows RBAC escalation and remote code execution possibilites.") + fmt.Println("It is highly recommended you turn it off by setting 'spec.kubelet.anonymousAuth' to 'false' via 'kops edit cluster'") + fmt.Println("") + fmt.Printf(starline) + fmt.Println("") + } + if err := c.AddFileAssets(assetBuilder); err != nil { return err } @@ -382,16 +407,16 @@ func (c *ApplyClusterCmd) Run() error { "iamRolePolicy": &awstasks.IAMRolePolicy{}, // VPC / Networking - "dhcpOptions": &awstasks.DHCPOptions{}, - "internetGateway": &awstasks.InternetGateway{}, - "route": &awstasks.Route{}, - "routeTable": &awstasks.RouteTable{}, - "routeTableAssociation": &awstasks.RouteTableAssociation{}, - "securityGroup": &awstasks.SecurityGroup{}, - "securityGroupRule": &awstasks.SecurityGroupRule{}, - "subnet": &awstasks.Subnet{}, - "vpc": &awstasks.VPC{}, - "ngw": &awstasks.NatGateway{}, + "dhcpOptions": &awstasks.DHCPOptions{}, + "internetGateway": &awstasks.InternetGateway{}, + "route": &awstasks.Route{}, + "routeTable": &awstasks.RouteTable{}, + "routeTableAssociation": &awstasks.RouteTableAssociation{}, + "securityGroup": &awstasks.SecurityGroup{}, + "securityGroupRule": &awstasks.SecurityGroupRule{}, + "subnet": &awstasks.Subnet{}, + "vpc": &awstasks.VPC{}, + "ngw": &awstasks.NatGateway{}, "vpcDHDCPOptionsAssociation": &awstasks.VPCDHCPOptionsAssociation{}, // ELB From b36fda8e397dbe103be029bc350d9e3ea4eca3c3 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 15:58:26 -0800 Subject: [PATCH 095/163] chore: ./hack/update-bazel.sh --- cmd/kops/BUILD.bazel | 1 + upup/pkg/fi/cloudup/BUILD.bazel | 1 + 2 files changed, 2 insertions(+) diff --git a/cmd/kops/BUILD.bazel b/cmd/kops/BUILD.bazel index b9ab429c25cf7..76f7f26d7912f 100644 --- a/cmd/kops/BUILD.bazel +++ b/cmd/kops/BUILD.bazel @@ -76,6 +76,7 @@ go_library( "//pkg/featureflag:go_default_library", "//pkg/formatter:go_default_library", "//pkg/instancegroups:go_default_library", + "//pkg/k8sversion:go_default_library", "//pkg/kopscodecs:go_default_library", "//pkg/kubeconfig:go_default_library", "//pkg/model/components:go_default_library", diff --git a/upup/pkg/fi/cloudup/BUILD.bazel b/upup/pkg/fi/cloudup/BUILD.bazel index 9219a3244b38e..9a6d4a9696451 100644 --- a/upup/pkg/fi/cloudup/BUILD.bazel +++ b/upup/pkg/fi/cloudup/BUILD.bazel @@ -39,6 +39,7 @@ go_library( "//pkg/client/simple/vfsclientset:go_default_library", "//pkg/dns:go_default_library", "//pkg/featureflag:go_default_library", + "//pkg/k8sversion:go_default_library", "//pkg/model:go_default_library", "//pkg/model/alimodel:go_default_library", "//pkg/model/awsmodel:go_default_library", From 68c04a903a45687ea79811482ba5ca98ea3e3900 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 16:01:14 -0800 Subject: [PATCH 096/163] chore: run gofmt (stop yelling at me tests please :cry:) --- cloudmock/aws/mockautoscaling/group.go | 14 +++++++------- nodeup/pkg/model/kubelet.go | 2 +- pkg/model/firewall_test.go | 2 +- pkg/pki/certificate_test.go | 2 +- upup/pkg/fi/fitasks/keypair.go | 2 +- upup/pkg/fi/vfs_castore.go | 2 +- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/cloudmock/aws/mockautoscaling/group.go b/cloudmock/aws/mockautoscaling/group.go index a013ff43fefb1..3360291348061 100644 --- a/cloudmock/aws/mockautoscaling/group.go +++ b/cloudmock/aws/mockautoscaling/group.go @@ -58,13 +58,13 @@ func (m *MockAutoscaling) CreateAutoScalingGroup(input *autoscaling.CreateAutoSc DefaultCooldown: input.DefaultCooldown, DesiredCapacity: input.DesiredCapacity, // EnabledMetrics: input.EnabledMetrics, - HealthCheckGracePeriod: input.HealthCheckGracePeriod, - HealthCheckType: input.HealthCheckType, - Instances: []*autoscaling.Instance{}, - LaunchConfigurationName: input.LaunchConfigurationName, - LoadBalancerNames: input.LoadBalancerNames, - MaxSize: input.MaxSize, - MinSize: input.MinSize, + HealthCheckGracePeriod: input.HealthCheckGracePeriod, + HealthCheckType: input.HealthCheckType, + Instances: []*autoscaling.Instance{}, + LaunchConfigurationName: input.LaunchConfigurationName, + LoadBalancerNames: input.LoadBalancerNames, + MaxSize: input.MaxSize, + MinSize: input.MinSize, NewInstancesProtectedFromScaleIn: input.NewInstancesProtectedFromScaleIn, PlacementGroup: input.PlacementGroup, // Status: input.Status, diff --git a/nodeup/pkg/model/kubelet.go b/nodeup/pkg/model/kubelet.go index 73b0eb4684128..f00e7b9e39391 100644 --- a/nodeup/pkg/model/kubelet.go +++ b/nodeup/pkg/model/kubelet.go @@ -535,7 +535,7 @@ func (b *KubeletBuilder) buildMasterKubeletKubeconfig() (*nodetasks.File, error) template := &x509.Certificate{ BasicConstraintsValid: true, - IsCA: false, + IsCA: false, } template.Subject = pkix.Name{ diff --git a/pkg/model/firewall_test.go b/pkg/model/firewall_test.go index 7dcb74ab3fd0a..93244a0779af8 100644 --- a/pkg/model/firewall_test.go +++ b/pkg/model/firewall_test.go @@ -64,7 +64,7 @@ func Test_SharedGroups(t *testing.T) { func makeTestInstanceGroupSec(role kops.InstanceGroupRole, secGroup *string) *kops.InstanceGroup { return &kops.InstanceGroup{ Spec: kops.InstanceGroupSpec{ - Role: role, + Role: role, SecurityGroupOverride: secGroup, }, } diff --git a/pkg/pki/certificate_test.go b/pkg/pki/certificate_test.go index 18a795dcb69a9..5e08e3dd57c3c 100644 --- a/pkg/pki/certificate_test.go +++ b/pkg/pki/certificate_test.go @@ -58,7 +58,7 @@ func TestGenerateCertificate(t *testing.T) { KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign, ExtKeyUsage: []x509.ExtKeyUsage{}, BasicConstraintsValid: true, - IsCA: true, + IsCA: true, } cert, err := SignNewCertificate(key, template, nil, nil) diff --git a/upup/pkg/fi/fitasks/keypair.go b/upup/pkg/fi/fitasks/keypair.go index c44a75dc9dbcb..828d1a4be5eb6 100644 --- a/upup/pkg/fi/fitasks/keypair.go +++ b/upup/pkg/fi/fitasks/keypair.go @@ -293,7 +293,7 @@ func buildCertificateTemplateForType(certificateType string) (*x509.Certificate, template := &x509.Certificate{ BasicConstraintsValid: true, - IsCA: false, + IsCA: false, } tokens := strings.Split(certificateType, ",") diff --git a/upup/pkg/fi/vfs_castore.go b/upup/pkg/fi/vfs_castore.go index c216d3b4de79c..bbf9f7afdadb0 100644 --- a/upup/pkg/fi/vfs_castore.go +++ b/upup/pkg/fi/vfs_castore.go @@ -144,7 +144,7 @@ func BuildCAX509Template() *x509.Certificate { KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign, ExtKeyUsage: []x509.ExtKeyUsage{}, BasicConstraintsValid: true, - IsCA: true, + IsCA: true, } return template } From 377274103d71bcdeab1577146ec12955595646c6 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 16:07:03 -0800 Subject: [PATCH 097/163] chore: run gofmt v2.... --- node-authorizer/pkg/client/helper.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/node-authorizer/pkg/client/helper.go b/node-authorizer/pkg/client/helper.go index 129ce2f633f78..519553ea449fb 100644 --- a/node-authorizer/pkg/client/helper.go +++ b/node-authorizer/pkg/client/helper.go @@ -98,7 +98,7 @@ func makeKubeconfig(ctx context.Context, config *Config, token string) ([]byte, { Name: clusterName, Cluster: v1.Cluster{ - Server: config.KubeAPI, + Server: config.KubeAPI, CertificateAuthorityData: content, }, }, From 49ceb0a8dc1d60539d9970ad6c5f0031c7601f7b Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 16:17:32 -0800 Subject: [PATCH 098/163] feat: fix tests and ref link in apply_cluster --- .../complex/expected-v1alpha2.yaml | 3 +- .../create_cluster/ha/expected-v1alpha1.yaml | 3 +- .../create_cluster/ha/expected-v1alpha2.yaml | 3 +- .../ha_encrypt/expected-v1alpha1.yaml | 3 +- .../ha_encrypt/expected-v1alpha2.yaml | 3 +- .../ha_gce/expected-v1alpha2.yaml | 3 +- .../ha_shared_zones/expected-v1alpha2.yaml | 3 +- .../ingwspecified/expected-v1alpha1.yaml | 3 +- .../ingwspecified/expected-v1alpha2.yaml | 3 +- .../minimal/expected-v1alpha1.yaml | 3 +- .../minimal/expected-v1alpha2.yaml | 3 +- .../ngwspecified/expected-v1alpha1.yaml | 3 +- .../ngwspecified/expected-v1alpha2.yaml | 3 +- .../overrides/expected-v1alpha2.yaml | 3 +- .../private/expected-v1alpha1.yaml | 3 +- .../private/expected-v1alpha2.yaml | 3 +- .../expected-v1alpha2.yaml | 3 +- .../security/expected-v1alpha2.yaml | 124 ++++++++++++++++++ .../create_cluster/security/options.yaml | 15 +++ .../shared_subnets/expected-v1alpha1.yaml | 3 +- .../shared_subnets/expected-v1alpha2.yaml | 3 +- .../expected-v1alpha1.yaml | 3 +- .../expected-v1alpha2.yaml | 3 +- .../shared_vpc/expected-v1alpha1.yaml | 3 +- .../shared_vpc/expected-v1alpha2.yaml | 3 +- ...asters.k8s-iam.us-west-2.td.priv_user_data | 1 - .../cloudformation.json.extracted.yaml | 3 +- upup/pkg/fi/cloudup/apply_cluster.go | 2 + 28 files changed, 165 insertions(+), 49 deletions(-) create mode 100644 tests/integration/create_cluster/security/expected-v1alpha2.yaml create mode 100644 tests/integration/create_cluster/security/options.yaml diff --git a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml index 91c3dd3107298..f3ebd36601c36 100644 --- a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml @@ -23,8 +23,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.7.1 diff --git a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml index de6e82e009ffd..ea141ed121b82 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml @@ -34,8 +34,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: false - kubernetesVersion: v1.6.0-alpha.3 + kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml index 038fd814ad083..902546c7850ac 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml @@ -31,8 +31,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.6.0-alpha.3 diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml index 99986596067cd..c0a28abdfdb79 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml @@ -40,8 +40,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: false - kubernetesVersion: v1.6.0-alpha.3 + kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml index a7244134f4ed3..15e3bcf87cf5b 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml @@ -37,8 +37,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.6.0-alpha.3 diff --git a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml index abb0a7f04bcea..a41fc1b0e476b 100644 --- a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml @@ -31,8 +31,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.8.0-beta.1 diff --git a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml index 8231783e4f7e3..e94417164d346 100644 --- a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml @@ -39,8 +39,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml index e0571953cac17..403d5be7dd7da 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml @@ -27,8 +27,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: false - kubernetesVersion: v1.4.8 + kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml index d06032c2d572b..2bce16242275a 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml @@ -24,8 +24,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml index 1ad95f66e101a..fa473088f12c3 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml @@ -26,8 +26,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: false - kubernetesVersion: v1.12.0 + kubernetesVersion: v1.12.0 masterPublicName: api.minimal.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml index b42f6fd60dc13..191b1d69837cb 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml @@ -23,8 +23,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.12.0 diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml index 8b523835cb452..c41cde5710c31 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml @@ -27,8 +27,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: false - kubernetesVersion: v1.4.8 + kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml index 488f8d41a5905..32eae0b0b9cda 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml @@ -24,8 +24,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml index 67f50c07fcb9e..b715a8d48926d 100644 --- a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml @@ -23,8 +23,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.7.5 diff --git a/tests/integration/create_cluster/private/expected-v1alpha1.yaml b/tests/integration/create_cluster/private/expected-v1alpha1.yaml index 690e5c40cc86d..af1358e5fb2d5 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha1.yaml @@ -31,8 +31,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: false - kubernetesVersion: v1.4.8 + kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/private/expected-v1alpha2.yaml b/tests/integration/create_cluster/private/expected-v1alpha2.yaml index 7e9c991acdc62..cc75ab3d81720 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha2.yaml @@ -28,8 +28,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml index ad45253a69097..b938f9c678c36 100644 --- a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml @@ -24,8 +24,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/security/expected-v1alpha2.yaml b/tests/integration/create_cluster/security/expected-v1alpha2.yaml new file mode 100644 index 0000000000000..e02662c392d07 --- /dev/null +++ b/tests/integration/create_cluster/security/expected-v1alpha2.yaml @@ -0,0 +1,124 @@ +apiVersion: kops/v1alpha2 +kind: Cluster +metadata: + creationTimestamp: 2017-01-01T00:00:00Z + name: private.example.com +spec: + api: + loadBalancer: + type: Public + authorization: + rbac: {} + channel: stable + cloudLabels: + Owner: John Doe + dn: 'cn=John Doe: dc=example dc=com' + foo/bar: fib+baz + cloudProvider: aws + configBase: memfs://tests/private.example.com + etcdClusters: + - etcdMembers: + - instanceGroup: master-us-test-1a + name: a + name: main + - etcdMembers: + - instanceGroup: master-us-test-1a + name: a + name: events + iam: + allowContainerRegistry: true + legacy: false + kubelet: + anonymousAuth: false + kubernetesApiAccess: + - 0.0.0.0/0 + kubernetesVersion: v1.10.0 + masterPublicName: api.private.example.com + networkCIDR: 172.20.0.0/16 + networking: + kopeio: {} + nonMasqueradeCIDR: 100.64.0.0/10 + sshAccess: + - 0.0.0.0/0 + subnets: + - cidr: 172.20.32.0/19 + name: us-test-1a + type: Private + zone: us-test-1a + - cidr: 172.20.0.0/22 + name: utility-us-test-1a + type: Utility + zone: us-test-1a + topology: + bastion: + bastionPublicName: bastion.private.example.com + dns: + type: Public + masters: private + nodes: private + +--- + +apiVersion: kops/v1alpha2 +kind: InstanceGroup +metadata: + creationTimestamp: 2017-01-01T00:00:00Z + labels: + kops.k8s.io/cluster: private.example.com + name: bastions +spec: + image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2017-07-28 + machineType: t2.micro + maxSize: 1 + minSize: 1 + nodeLabels: + kops.k8s.io/instancegroup: bastions + role: Bastion + subnets: + - utility-us-test-1a + +--- + +apiVersion: kops/v1alpha2 +kind: InstanceGroup +metadata: + creationTimestamp: 2017-01-01T00:00:00Z + labels: + kops.k8s.io/cluster: private.example.com + name: master-us-test-1a +spec: + additionalSecurityGroups: + - sg-exampleid3 + - sg-exampleid4 + image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2017-07-28 + machineType: m3.medium + maxSize: 1 + minSize: 1 + nodeLabels: + kops.k8s.io/instancegroup: master-us-test-1a + role: Master + subnets: + - us-test-1a + +--- + +apiVersion: kops/v1alpha2 +kind: InstanceGroup +metadata: + creationTimestamp: 2017-01-01T00:00:00Z + labels: + kops.k8s.io/cluster: private.example.com + name: nodes +spec: + additionalSecurityGroups: + - sg-exampleid + - sg-exampleid2 + image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2017-07-28 + machineType: t2.medium + maxSize: 2 + minSize: 2 + nodeLabels: + kops.k8s.io/instancegroup: nodes + role: Node + subnets: + - us-test-1a diff --git a/tests/integration/create_cluster/security/options.yaml b/tests/integration/create_cluster/security/options.yaml new file mode 100644 index 0000000000000..457d045863012 --- /dev/null +++ b/tests/integration/create_cluster/security/options.yaml @@ -0,0 +1,15 @@ +ClusterName: private.example.com +Zones: +- us-test-1a +Cloud: aws +Topology: private +Networking: kopeio-vxlan +Bastion: true +NodeSecurityGroups: +- sg-exampleid +- sg-exampleid2 +MasterSecurityGroups: +- sg-exampleid3 +- sg-exampleid4 +KubernetesVersion: v1.10.0 +cloudLabels: "Owner=John Doe,dn=\"cn=John Doe: dc=example dc=com\", foo/bar=fib+baz" diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml index a3f1924b6e2dd..f07f8bd3b63e1 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml @@ -26,8 +26,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: false - kubernetesVersion: v1.4.8 + kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 networkID: vpc-12345678 diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml index dcc37ac6e67d1..ce6caea228b62 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml @@ -23,8 +23,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml index a3f1924b6e2dd..f07f8bd3b63e1 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml @@ -26,8 +26,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: false - kubernetesVersion: v1.4.8 + kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 networkID: vpc-12345678 diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml index dcc37ac6e67d1..ce6caea228b62 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml @@ -23,8 +23,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml index 53f8344cf969d..df179c88c9bd2 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml @@ -26,8 +26,7 @@ spec: allowContainerRegistry: true legacy: false kubelet: - anonymousAuth: false - kubernetesVersion: v1.4.8 + kubernetesVersion: v1.4.8 masterPublicName: api.vpc.example.com networkCIDR: 10.0.0.0/12 networkID: vpc-12345678 diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml index 1781308b257c8..720f6b23a39c1 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml @@ -23,8 +23,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false + kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/update_cluster/existing_iam_cloudformation/data/aws_launch_configuration_master-us-west-2a.masters.k8s-iam.us-west-2.td.priv_user_data b/tests/integration/update_cluster/existing_iam_cloudformation/data/aws_launch_configuration_master-us-west-2a.masters.k8s-iam.us-west-2.td.priv_user_data index 070f6cdfe36db..85089e632a711 100644 --- a/tests/integration/update_cluster/existing_iam_cloudformation/data/aws_launch_configuration_master-us-west-2a.masters.k8s-iam.us-west-2.td.priv_user_data +++ b/tests/integration/update_cluster/existing_iam_cloudformation/data/aws_launch_configuration_master-us-west-2a.masters.k8s-iam.us-west-2.td.priv_user_data @@ -171,7 +171,6 @@ kubeAPIServer: - Priority - ResourceQuota allowPrivileged: true - anonymousAuth: false apiServerCount: 1 authorizationMode: RBAC cloudProvider: aws diff --git a/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml index cfa0d3c387239..785a04efe78fc 100644 --- a/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml +++ b/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml @@ -174,8 +174,7 @@ Resources.AWSAutoScalingLaunchConfigurationmasterustest1amastersexternallbexampl - NodeRestriction - ResourceQuota allowPrivileged: true - anonymousAuth: false - apiServerCount: 1 + apiServerCount: 1 authorizationMode: AlwaysAllow cloudProvider: aws etcdServers: diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go index 0e1d7bb4cf3bf..e5f65dd0ae824 100644 --- a/upup/pkg/fi/cloudup/apply_cluster.go +++ b/upup/pkg/fi/cloudup/apply_cluster.go @@ -299,6 +299,8 @@ func (c *ApplyClusterCmd) Run() error { fmt.Println("Kubelet anonymousAuth is currently turned on. This allows RBAC escalation and remote code execution possibilites.") fmt.Println("It is highly recommended you turn it off by setting 'spec.kubelet.anonymousAuth' to 'false' via 'kops edit cluster'") fmt.Println("") + fmt.Println("See https://github.com/kubernetes/kops/blob/master/docs/security.md#kubelet-api") + fmt.Println("") fmt.Printf(starline) fmt.Println("") } From f4de6285191ec49248f0269f0278c254da84ddd0 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 16:23:05 -0800 Subject: [PATCH 099/163] chore(tests): fix some find and replace issues --- tests/integration/create_cluster/ha/expected-v1alpha1.yaml | 4 ++-- .../create_cluster/ha_encrypt/expected-v1alpha1.yaml | 4 ++-- .../create_cluster/ingwspecified/expected-v1alpha1.yaml | 4 ++-- .../integration/create_cluster/minimal/expected-v1alpha1.yaml | 4 ++-- .../create_cluster/ngwspecified/expected-v1alpha1.yaml | 4 ++-- .../integration/create_cluster/private/expected-v1alpha1.yaml | 4 ++-- .../create_cluster/shared_subnets/expected-v1alpha1.yaml | 4 ++-- .../shared_subnets_vpc_lookup/expected-v1alpha1.yaml | 4 ++-- .../create_cluster/shared_vpc/expected-v1alpha1.yaml | 4 ++-- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml index ea141ed121b82..b158e70b560c8 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml @@ -33,8 +33,8 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - kubernetesVersion: v1.6.0-alpha.3 + kubelet: {} + kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml index c0a28abdfdb79..f3a9291dee8c5 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml @@ -39,8 +39,8 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - kubernetesVersion: v1.6.0-alpha.3 + kubelet: {} + kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml index 403d5be7dd7da..35200a32b9794 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml @@ -26,8 +26,8 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - kubernetesVersion: v1.4.8 + kubelet: {} + kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml index fa473088f12c3..f2e93423b2af8 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml @@ -25,8 +25,8 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - kubernetesVersion: v1.12.0 + kubelet: {} + kubernetesVersion: v1.12.0 masterPublicName: api.minimal.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml index c41cde5710c31..2c06561cbdf0b 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml @@ -26,8 +26,8 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - kubernetesVersion: v1.4.8 + kubelet: {} + kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/private/expected-v1alpha1.yaml b/tests/integration/create_cluster/private/expected-v1alpha1.yaml index af1358e5fb2d5..0c2bf1270f242 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha1.yaml @@ -30,8 +30,8 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - kubernetesVersion: v1.4.8 + kubelet: {} + kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml index f07f8bd3b63e1..846c3a2a37ffe 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml @@ -25,8 +25,8 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - kubernetesVersion: v1.4.8 + kubelet: {} + kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 networkID: vpc-12345678 diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml index f07f8bd3b63e1..846c3a2a37ffe 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml @@ -25,8 +25,8 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - kubernetesVersion: v1.4.8 + kubelet: {} + kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 networkID: vpc-12345678 diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml index df179c88c9bd2..72c8d3ecba133 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml @@ -25,8 +25,8 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - kubernetesVersion: v1.4.8 + kubelet: {} + kubernetesVersion: v1.4.8 masterPublicName: api.vpc.example.com networkCIDR: 10.0.0.0/12 networkID: vpc-12345678 From 19811d975936f522a9857c83296222f199b005bb Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 17:03:50 -0800 Subject: [PATCH 100/163] chore(tests): fix them up --- cmd/kops/create_cluster.go | 14 ++++---- .../complex/expected-v1alpha2.yaml | 1 - .../create_cluster/ha/expected-v1alpha1.yaml | 1 - .../create_cluster/ha/expected-v1alpha2.yaml | 1 - .../ha_encrypt/expected-v1alpha1.yaml | 1 - .../ha_encrypt/expected-v1alpha2.yaml | 1 - .../ha_gce/expected-v1alpha2.yaml | 1 - .../ha_shared_zones/expected-v1alpha2.yaml | 1 - .../ingwspecified/expected-v1alpha1.yaml | 1 - .../ingwspecified/expected-v1alpha2.yaml | 1 - .../minimal/expected-v1alpha1.yaml | 3 +- .../minimal/expected-v1alpha2.yaml | 3 +- .../create_cluster/minimal/options.yaml | 2 +- .../ngwspecified/expected-v1alpha1.yaml | 1 - .../ngwspecified/expected-v1alpha2.yaml | 1 - .../overrides/expected-v1alpha2.yaml | 1 - .../private/expected-v1alpha1.yaml | 1 - .../private/expected-v1alpha2.yaml | 1 - .../expected-v1alpha2.yaml | 1 - .../shared_subnets/expected-v1alpha1.yaml | 1 - .../shared_subnets/expected-v1alpha2.yaml | 1 - .../expected-v1alpha1.yaml | 1 - .../expected-v1alpha2.yaml | 1 - .../shared_vpc/expected-v1alpha1.yaml | 1 - .../shared_vpc/expected-v1alpha2.yaml | 1 - upup/pkg/fi/cloudup/apply_cluster.go | 35 +++++++++++-------- 26 files changed, 31 insertions(+), 47 deletions(-) diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index 005f01465f847..3ef1342d96119 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -1064,17 +1064,19 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e kv, err := k8sversion.Parse(cluster.Spec.KubernetesVersion) if err != nil { - return err + return fmt.Errorf("failed to parse kubernetes version: %s", err.Error()) } // check if we should set anonymousAuth to false on k8s versions gte than 1.10 // we do 1.10 since this is a really critical issues and 1.10 has support - if cluster.Spec.Kubelet == nil { - cluster.Spec.Kubelet = &api.KubeletConfigSpec{} - } + if kv.IsGTE("1.10") { + if cluster.Spec.Kubelet == nil { + cluster.Spec.Kubelet = &api.KubeletConfigSpec{} + } - if kv.IsGTE("1.10") && cluster.Spec.Kubelet.AnonymousAuth == nil { - cluster.Spec.Kubelet.AnonymousAuth = fi.Bool(false) + if cluster.Spec.Kubelet.AnonymousAuth == nil { + cluster.Spec.Kubelet.AnonymousAuth = fi.Bool(false) + } } // Populate the API access, so that it can be discoverable diff --git a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml index f3ebd36601c36..c1d57594acad2 100644 --- a/tests/integration/create_cluster/complex/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/complex/expected-v1alpha2.yaml @@ -23,7 +23,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.7.1 diff --git a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml index b158e70b560c8..bb00604a198bd 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha1.yaml @@ -33,7 +33,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml index 902546c7850ac..0d04b32f11de6 100644 --- a/tests/integration/create_cluster/ha/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha/expected-v1alpha2.yaml @@ -31,7 +31,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.6.0-alpha.3 diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml index f3a9291dee8c5..738062bc005fb 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha1.yaml @@ -39,7 +39,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesVersion: v1.6.0-alpha.3 masterPublicName: api.ha.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml index 15e3bcf87cf5b..4e2715d5a41d8 100644 --- a/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_encrypt/expected-v1alpha2.yaml @@ -37,7 +37,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.6.0-alpha.3 diff --git a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml index a41fc1b0e476b..a45247200a729 100644 --- a/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_gce/expected-v1alpha2.yaml @@ -31,7 +31,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.8.0-beta.1 diff --git a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml index e94417164d346..e5c1632341208 100644 --- a/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ha_shared_zones/expected-v1alpha2.yaml @@ -39,7 +39,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml index 35200a32b9794..4e65951a5f5d6 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml @@ -26,7 +26,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml index 2bce16242275a..3508601a1fcdc 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml @@ -24,7 +24,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml index f2e93423b2af8..bdc157968930f 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml @@ -25,8 +25,7 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} - kubernetesVersion: v1.12.0 + kubernetesVersion: v1.11.0 masterPublicName: api.minimal.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml index 191b1d69837cb..96624a4c93748 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml @@ -23,10 +23,9 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 - kubernetesVersion: v1.12.0 + kubernetesVersion: v1.11.0 masterPublicName: api.minimal.example.com networkCIDR: 172.20.0.0/16 networking: diff --git a/tests/integration/create_cluster/minimal/options.yaml b/tests/integration/create_cluster/minimal/options.yaml index be32b6109f346..ffa0cbd53570e 100644 --- a/tests/integration/create_cluster/minimal/options.yaml +++ b/tests/integration/create_cluster/minimal/options.yaml @@ -2,4 +2,4 @@ ClusterName: minimal.example.com Zones: - us-test-1a Cloud: aws -KubernetesVersion: v1.12.0 +KubernetesVersion: v1.11.0 diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml index 2c06561cbdf0b..25c045be52826 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha1.yaml @@ -26,7 +26,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml index 32eae0b0b9cda..c498ac7b4ce23 100644 --- a/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ngwspecified/expected-v1alpha2.yaml @@ -24,7 +24,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml index b715a8d48926d..b2d02730efef0 100644 --- a/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/overrides/expected-v1alpha2.yaml @@ -23,7 +23,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.7.5 diff --git a/tests/integration/create_cluster/private/expected-v1alpha1.yaml b/tests/integration/create_cluster/private/expected-v1alpha1.yaml index 0c2bf1270f242..890b74d5640e3 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha1.yaml @@ -30,7 +30,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/private/expected-v1alpha2.yaml b/tests/integration/create_cluster/private/expected-v1alpha2.yaml index cc75ab3d81720..f0c2eeaa349e1 100644 --- a/tests/integration/create_cluster/private/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private/expected-v1alpha2.yaml @@ -28,7 +28,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml index b938f9c678c36..76cd9a1ec67e3 100644 --- a/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/private_shared_subnets/expected-v1alpha2.yaml @@ -24,7 +24,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml index 846c3a2a37ffe..1a08f3bdfbcee 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha1.yaml @@ -25,7 +25,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 diff --git a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml index ce6caea228b62..ecfa7d33ae87a 100644 --- a/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets/expected-v1alpha2.yaml @@ -23,7 +23,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml index 846c3a2a37ffe..1a08f3bdfbcee 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha1.yaml @@ -25,7 +25,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesVersion: v1.4.8 masterPublicName: api.subnet.example.com networkCIDR: 10.0.0.0/12 diff --git a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml index ce6caea228b62..ecfa7d33ae87a 100644 --- a/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_subnets_vpc_lookup/expected-v1alpha2.yaml @@ -23,7 +23,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml index 72c8d3ecba133..3c86dd0e5c39a 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha1.yaml @@ -25,7 +25,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesVersion: v1.4.8 masterPublicName: api.vpc.example.com networkCIDR: 10.0.0.0/12 diff --git a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml index 720f6b23a39c1..8b2a6bbc21c65 100644 --- a/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/shared_vpc/expected-v1alpha2.yaml @@ -23,7 +23,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: {} kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go index e5f65dd0ae824..180e1aa3c3696 100644 --- a/upup/pkg/fi/cloudup/apply_cluster.go +++ b/upup/pkg/fi/cloudup/apply_cluster.go @@ -280,7 +280,6 @@ func (c *ApplyClusterCmd) Run() error { cluster.Spec.KubernetesVersion = versionWithoutV } - // TODO: consider moving this somewhere, it's duplicated on create kv, err := k8sversion.Parse(cluster.Spec.KubernetesVersion) if err != nil { return err @@ -288,21 +287,27 @@ func (c *ApplyClusterCmd) Run() error { // check if we should recommend turning off anonymousAuth on k8s versions gte than 1.10 // we do 1.10 since this is a really critical issues and 1.10 has it - if cluster.Spec.Kubelet == nil { - cluster.Spec.Kubelet = &kops.KubeletConfigSpec{} - } + if kv.IsGTE("1.10") { + // we do a check here because setting modifying the kubelet object messes with the output + warn := false + if cluster.Spec.Kubelet == nil { + warn = true + } else if cluster.Spec.Kubelet.AnonymousAuth == nil { + warn = true + } - if kv.IsGTE("1.10") && cluster.Spec.Kubelet.AnonymousAuth == nil { - fmt.Println("") - fmt.Printf(starline) - fmt.Println("") - fmt.Println("Kubelet anonymousAuth is currently turned on. This allows RBAC escalation and remote code execution possibilites.") - fmt.Println("It is highly recommended you turn it off by setting 'spec.kubelet.anonymousAuth' to 'false' via 'kops edit cluster'") - fmt.Println("") - fmt.Println("See https://github.com/kubernetes/kops/blob/master/docs/security.md#kubelet-api") - fmt.Println("") - fmt.Printf(starline) - fmt.Println("") + if warn { + fmt.Println("") + fmt.Printf(starline) + fmt.Println("") + fmt.Println("Kubelet anonymousAuth is currently turned on. This allows RBAC escalation and remote code execution possibilites.") + fmt.Println("It is highly recommended you turn it off by setting 'spec.kubelet.anonymousAuth' to 'false' via 'kops edit cluster'") + fmt.Println("") + fmt.Println("See https://github.com/kubernetes/kops/blob/master/docs/security.md#kubelet-api") + fmt.Println("") + fmt.Printf(starline) + fmt.Println("") + } } if err := c.AddFileAssets(assetBuilder); err != nil { From c54222bdb82aed74e8eafc3f0e1c115e1c3c589e Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 17:07:19 -0800 Subject: [PATCH 101/163] chore(tests): use minimal as the test not dedicated security one --- .../ingwspecified/expected-v1alpha1.yaml | 2 + .../ingwspecified/expected-v1alpha2.yaml | 2 + .../security/expected-v1alpha2.yaml | 124 ------------------ .../create_cluster/security/options.yaml | 15 --- 4 files changed, 4 insertions(+), 139 deletions(-) delete mode 100644 tests/integration/create_cluster/security/expected-v1alpha2.yaml delete mode 100644 tests/integration/create_cluster/security/options.yaml diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml index 4e65951a5f5d6..e0571953cac17 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml @@ -26,6 +26,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: false kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml index 3508601a1fcdc..d06032c2d572b 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml @@ -24,6 +24,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/security/expected-v1alpha2.yaml b/tests/integration/create_cluster/security/expected-v1alpha2.yaml deleted file mode 100644 index e02662c392d07..0000000000000 --- a/tests/integration/create_cluster/security/expected-v1alpha2.yaml +++ /dev/null @@ -1,124 +0,0 @@ -apiVersion: kops/v1alpha2 -kind: Cluster -metadata: - creationTimestamp: 2017-01-01T00:00:00Z - name: private.example.com -spec: - api: - loadBalancer: - type: Public - authorization: - rbac: {} - channel: stable - cloudLabels: - Owner: John Doe - dn: 'cn=John Doe: dc=example dc=com' - foo/bar: fib+baz - cloudProvider: aws - configBase: memfs://tests/private.example.com - etcdClusters: - - etcdMembers: - - instanceGroup: master-us-test-1a - name: a - name: main - - etcdMembers: - - instanceGroup: master-us-test-1a - name: a - name: events - iam: - allowContainerRegistry: true - legacy: false - kubelet: - anonymousAuth: false - kubernetesApiAccess: - - 0.0.0.0/0 - kubernetesVersion: v1.10.0 - masterPublicName: api.private.example.com - networkCIDR: 172.20.0.0/16 - networking: - kopeio: {} - nonMasqueradeCIDR: 100.64.0.0/10 - sshAccess: - - 0.0.0.0/0 - subnets: - - cidr: 172.20.32.0/19 - name: us-test-1a - type: Private - zone: us-test-1a - - cidr: 172.20.0.0/22 - name: utility-us-test-1a - type: Utility - zone: us-test-1a - topology: - bastion: - bastionPublicName: bastion.private.example.com - dns: - type: Public - masters: private - nodes: private - ---- - -apiVersion: kops/v1alpha2 -kind: InstanceGroup -metadata: - creationTimestamp: 2017-01-01T00:00:00Z - labels: - kops.k8s.io/cluster: private.example.com - name: bastions -spec: - image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2017-07-28 - machineType: t2.micro - maxSize: 1 - minSize: 1 - nodeLabels: - kops.k8s.io/instancegroup: bastions - role: Bastion - subnets: - - utility-us-test-1a - ---- - -apiVersion: kops/v1alpha2 -kind: InstanceGroup -metadata: - creationTimestamp: 2017-01-01T00:00:00Z - labels: - kops.k8s.io/cluster: private.example.com - name: master-us-test-1a -spec: - additionalSecurityGroups: - - sg-exampleid3 - - sg-exampleid4 - image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2017-07-28 - machineType: m3.medium - maxSize: 1 - minSize: 1 - nodeLabels: - kops.k8s.io/instancegroup: master-us-test-1a - role: Master - subnets: - - us-test-1a - ---- - -apiVersion: kops/v1alpha2 -kind: InstanceGroup -metadata: - creationTimestamp: 2017-01-01T00:00:00Z - labels: - kops.k8s.io/cluster: private.example.com - name: nodes -spec: - additionalSecurityGroups: - - sg-exampleid - - sg-exampleid2 - image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2017-07-28 - machineType: t2.medium - maxSize: 2 - minSize: 2 - nodeLabels: - kops.k8s.io/instancegroup: nodes - role: Node - subnets: - - us-test-1a diff --git a/tests/integration/create_cluster/security/options.yaml b/tests/integration/create_cluster/security/options.yaml deleted file mode 100644 index 457d045863012..0000000000000 --- a/tests/integration/create_cluster/security/options.yaml +++ /dev/null @@ -1,15 +0,0 @@ -ClusterName: private.example.com -Zones: -- us-test-1a -Cloud: aws -Topology: private -Networking: kopeio-vxlan -Bastion: true -NodeSecurityGroups: -- sg-exampleid -- sg-exampleid2 -MasterSecurityGroups: -- sg-exampleid3 -- sg-exampleid4 -KubernetesVersion: v1.10.0 -cloudLabels: "Owner=John Doe,dn=\"cn=John Doe: dc=example dc=com\", foo/bar=fib+baz" From 4c4dd466da536063af26621fb3d0662a1d42a757 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 17:09:57 -0800 Subject: [PATCH 102/163] fix(tests/integration/update_cluster): accidentally broke test earlier --- .../externallb/cloudformation.json.extracted.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml index 785a04efe78fc..cfa0d3c387239 100644 --- a/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml +++ b/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml @@ -174,7 +174,8 @@ Resources.AWSAutoScalingLaunchConfigurationmasterustest1amastersexternallbexampl - NodeRestriction - ResourceQuota allowPrivileged: true - apiServerCount: 1 + anonymousAuth: false + apiServerCount: 1 authorizationMode: AlwaysAllow cloudProvider: aws etcdServers: From fee9bb1f90efe2f4ea8838f49fc033a469b0d4d2 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Sat, 24 Nov 2018 17:12:04 -0800 Subject: [PATCH 103/163] fix(tests/integration/create_cluster): fix up minimal <-> ing mixup --- .../create_cluster/ingwspecified/expected-v1alpha1.yaml | 2 -- .../create_cluster/ingwspecified/expected-v1alpha2.yaml | 2 -- tests/integration/create_cluster/minimal/expected-v1alpha1.yaml | 2 ++ tests/integration/create_cluster/minimal/expected-v1alpha2.yaml | 2 ++ 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml index e0571953cac17..4e65951a5f5d6 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha1.yaml @@ -26,8 +26,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false kubernetesVersion: v1.4.8 masterPublicName: api.private.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml index d06032c2d572b..3508601a1fcdc 100644 --- a/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/ingwspecified/expected-v1alpha2.yaml @@ -24,8 +24,6 @@ spec: iam: allowContainerRegistry: true legacy: false - kubelet: - anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.4.8 diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml index bdc157968930f..b15bf1583f97a 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha1.yaml @@ -25,6 +25,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: false kubernetesVersion: v1.11.0 masterPublicName: api.minimal.example.com networkCIDR: 172.20.0.0/16 diff --git a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml index 96624a4c93748..c10c4b58d26df 100644 --- a/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml +++ b/tests/integration/create_cluster/minimal/expected-v1alpha2.yaml @@ -23,6 +23,8 @@ spec: iam: allowContainerRegistry: true legacy: false + kubelet: + anonymousAuth: false kubernetesApiAccess: - 0.0.0.0/0 kubernetesVersion: v1.11.0 From 3405ee1382086fd7d16a960421294daf163acdb0 Mon Sep 17 00:00:00 2001 From: Justin Santa Barbara Date: Sat, 24 Nov 2018 22:21:21 -0500 Subject: [PATCH 104/163] Create separate certificate for etcd peer authentication This works around the (very unusual) etcd changes for validation of peer certificates by DNS lookup, which were introduced in etcd 3.2. Issue #6024 --- nodeup/pkg/model/protokube.go | 8 ++++---- pkg/model/pki.go | 34 ++++++++++++++++++++++++++++++++-- 2 files changed, 36 insertions(+), 6 deletions(-) diff --git a/nodeup/pkg/model/protokube.go b/nodeup/pkg/model/protokube.go index c198bcdc3ea05..4f60a3866bb5c 100644 --- a/nodeup/pkg/model/protokube.go +++ b/nodeup/pkg/model/protokube.go @@ -69,12 +69,12 @@ func (t *ProtokubeBuilder) Build(c *fi.ModelBuilderContext) error { // retrieve the etcd peer certificates and private keys from the keystore if t.UseEtcdTLS() { - for _, x := range []string{"etcd", "etcd-client"} { + for _, x := range []string{"etcd", "etcd-peer", "etcd-client"} { if err := t.BuildCertificateTask(c, x, fmt.Sprintf("%s.pem", x)); err != nil { return err } } - for _, x := range []string{"etcd", "etcd-client"} { + for _, x := range []string{"etcd", "etcd-peer", "etcd-client"} { if err := t.BuildPrivateKeyTask(c, x, fmt.Sprintf("%s-key.pem", x)); err != nil { return err } @@ -290,8 +290,8 @@ func (t *ProtokubeBuilder) ProtokubeFlags(k8sVersion semver.Version) (*Protokube // check if we are using tls and add the options to protokube if t.UseEtcdTLS() { f.PeerTLSCaFile = s(filepath.Join(t.PathSrvKubernetes(), "ca.crt")) - f.PeerTLSCertFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd.pem")) - f.PeerTLSKeyFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-key.pem")) + f.PeerTLSCertFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-peer.pem")) + f.PeerTLSKeyFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-peer-key.pem")) f.TLSCAFile = s(filepath.Join(t.PathSrvKubernetes(), "ca.crt")) f.TLSCertFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd.pem")) f.TLSKeyFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-key.pem")) diff --git a/pkg/model/pki.go b/pkg/model/pki.go index eb5c86e0d5900..2c0eec9bb3a6b 100644 --- a/pkg/model/pki.go +++ b/pkg/model/pki.go @@ -121,18 +121,48 @@ func (b *PKIModelBuilder) Build(c *fi.ModelBuilderContext) error { // that mutual tls used to verify between the peers we don't want certificates for kubernetes able to act as a peer. // For clients assuming we are using etcdv3 is can switch on user authentication and map the common names for auth. if b.UseEtcdTLS() { - alternativeNames := []string{fmt.Sprintf("*.internal.%s", b.ClusterName()), "localhost", "127.0.0.1"} + servingNames := []string{fmt.Sprintf("*.internal.%s", b.ClusterName()), "localhost", "127.0.0.1"} // @question should wildcard's be here instead of generating per node. If we ever provide the // ability to resize the master, this will become a blocker c.AddTask(&fitasks.Keypair{ - AlternateNames: alternativeNames, + AlternateNames: servingNames, Lifecycle: b.Lifecycle, Name: fi.String("etcd"), Subject: "cn=etcd", + // TODO: Can this be "server" now that we're not using it for peer connectivity? + Type: "clientServer", + Signer: defaultCA, + Format: format, + }) + + // For peer authentication, the same cert is used both as a client + // cert and as a server cert (which is unusual). Moreover, etcd + // 3.2 introduces some breaking changes to certificate validation + // where it tries to match any IP or DNS names to the client IP + // (including reverse DNS lookups!) We _could_ include a wildcard + // reverse DNS name e.g. *.ec2.internal for EC2, but it seems + // better just to list the names that we expect peer connectivity + // to happen on. + var peerNames []string + for _, etcdCluster := range b.Cluster.Spec.EtcdClusters { + prefix := "etcd-" + etcdCluster.Name + "-" + if prefix == "etcd-main-" { + prefix = "etcd-" + } + for _, m := range etcdCluster.Members { + peerNames = append(peerNames, prefix+m.Name+".internal."+b.ClusterName()) + } + } + c.AddTask(&fitasks.Keypair{ + AlternateNames: peerNames, + Lifecycle: b.Lifecycle, + Name: fi.String("etcd-peer"), + Subject: "cn=etcd-peer", Type: "clientServer", Signer: defaultCA, Format: format, }) + c.AddTask(&fitasks.Keypair{ Name: fi.String("etcd-client"), Lifecycle: b.Lifecycle, From b56457dc056df0b9466cc8b527eadea1684c396d Mon Sep 17 00:00:00 2001 From: Justin Santa Barbara Date: Sat, 24 Nov 2018 22:23:41 -0500 Subject: [PATCH 105/163] kops set: support for enableEtcdTLS and enableTLSAuth These shortcut commands make it easy to set enableEtcdTLS and enableTLSAuth. `kops set cluster cluster.spec.etcdClusters[*].enableEtcdTLS=true` `kops set cluster cluster.spec.etcdClusters[*].enableTLSAuth=true` --- pkg/commands/set_cluster.go | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/pkg/commands/set_cluster.go b/pkg/commands/set_cluster.go index a45b283b52e85..b64ea14df74d5 100644 --- a/pkg/commands/set_cluster.go +++ b/pkg/commands/set_cluster.go @@ -19,6 +19,7 @@ package commands import ( "fmt" "io" + "strconv" "strings" "github.com/spf13/cobra" @@ -84,6 +85,25 @@ func SetClusterFields(fields []string, cluster *api.Cluster, instanceGroups []*a cluster.Spec.NodePortAccess = append(cluster.Spec.NodePortAccess, kv[1]) case "spec.kubernetesVersion": cluster.Spec.KubernetesVersion = kv[1] + + case "cluster.spec.etcdClusters[*].enableEtcdTLS": + v, err := strconv.ParseBool(kv[1]) + if err != nil { + return fmt.Errorf("unknown boolean value: %q", kv[1]) + } + for _, c := range cluster.Spec.EtcdClusters { + c.EnableEtcdTLS = v + } + + case "cluster.spec.etcdClusters[*].enableTLSAuth": + v, err := strconv.ParseBool(kv[1]) + if err != nil { + return fmt.Errorf("unknown boolean value: %q", kv[1]) + } + for _, c := range cluster.Spec.EtcdClusters { + c.EnableTLSAuth = v + } + case "cluster.spec.etcdClusters[*].version": for _, c := range cluster.Spec.EtcdClusters { c.Version = kv[1] From 60c152c89defd1ddd16d2d1f83903adf38faaa40 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 25 Nov 2018 11:12:00 +0900 Subject: [PATCH 106/163] Mention about possible state store vendors in error message --- cmd/kops/util/factory.go | 10 +++++----- docs/philosophy.md | 6 ++---- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/cmd/kops/util/factory.go b/cmd/kops/util/factory.go index e368f57fd64fe..75d9210222ef7 100644 --- a/cmd/kops/util/factory.go +++ b/cmd/kops/util/factory.go @@ -53,12 +53,12 @@ func NewFactory(options *FactoryOptions) *Factory { const ( STATE_ERROR = `Please set the --state flag or export KOPS_STATE_STORE. -A valid value follows the format s3://. -A s3 bucket is required to store cluster state information.` +For example, a valid value follows the format s3://. +You can find the supported stores in https://github.com/kubernetes/kops/blob/master/docs/state.md.` - INVALID_STATE_ERROR = `Unable to read state store s3 bucket. -Please use a valid s3 bucket uri when setting --state or KOPS_STATE_STORE env var. -A valid value follows the format s3://. + INVALID_STATE_ERROR = `Unable to read state store. +Please use a valid state store when setting --state or KOPS_STATE_STORE env var. +For example, a valid value follows the format s3://. Trailing slash will be trimmed.` ) diff --git a/docs/philosophy.md b/docs/philosophy.md index 80aa97316909c..2f5b3cd2f9830 100644 --- a/docs/philosophy.md +++ b/docs/philosophy.md @@ -32,9 +32,7 @@ There are two primary types: ## State Store -The API objects are currently stored in an abstraction called a "state store", and currently the only implemented -storage is an S3 bucket. The storage of files in the S3 bucket is an implementation detail. Expect more state -stores soon. For example, it might be convenient to put the InstanceGroup into the kubernetes API itself. +The API objects are currently stored in an abstraction called a "state store". [state.md](/docs/state.md) has more detail. ## Configuration inference @@ -53,4 +51,4 @@ single source of truth and it is practical to implement alternatives to nodeup & such as kubelet might read their configuration directly from the state store in future, eliminating the need to have a management process that copies values around. -Currently the 'completed' cluster specification is stored in the state store in a file called `cluster.spec` \ No newline at end of file +Currently the 'completed' cluster specification is stored in the state store in a file called `cluster.spec` From cd63aa5429de1949a44b4697555b506a6645b701 Mon Sep 17 00:00:00 2001 From: Seth Pollack Date: Tue, 24 Jul 2018 16:06:01 -0400 Subject: [PATCH 107/163] set max pods when using aws vpc cni (cherry picked from commit 92fd86f04a866b0965b2ced91a631b588b458c53) --- nodeup/pkg/model/BUILD.bazel | 1 + nodeup/pkg/model/kubelet.go | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/nodeup/pkg/model/BUILD.bazel b/nodeup/pkg/model/BUILD.bazel index fe83f434227d8..5d61c73d835da 100644 --- a/nodeup/pkg/model/BUILD.bazel +++ b/nodeup/pkg/model/BUILD.bazel @@ -51,6 +51,7 @@ go_library( "//pkg/tokens:go_default_library", "//pkg/try:go_default_library", "//upup/pkg/fi:go_default_library", + "//upup/pkg/fi/cloudup/awsup:go_default_library", "//upup/pkg/fi/nodeup/nodetasks:go_default_library", "//util/pkg/exec:go_default_library", "//util/pkg/reflectutils:go_default_library", diff --git a/nodeup/pkg/model/kubelet.go b/nodeup/pkg/model/kubelet.go index 73b0eb4684128..40cb0580acbc5 100644 --- a/nodeup/pkg/model/kubelet.go +++ b/nodeup/pkg/model/kubelet.go @@ -37,6 +37,7 @@ import ( "k8s.io/kops/pkg/pki" "k8s.io/kops/pkg/systemd" "k8s.io/kops/upup/pkg/fi" + "k8s.io/kops/upup/pkg/fi/cloudup/awsup" "k8s.io/kops/upup/pkg/fi/nodeup/nodetasks" "k8s.io/kops/util/pkg/reflectutils" ) @@ -459,6 +460,21 @@ func (b *KubeletBuilder) buildKubeletConfigSpec() (*kops.KubeletConfigSpec, erro c.BootstrapKubeconfig = "" } + if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.AmazonVPC != nil { + instanceType, err := awsup.GetMachineTypeInfo(b.InstanceGroup.Spec.MachineType) + if err != nil { + return c, err + } + + maxPods := int32(instanceType.MaxPods) + c.MaxPods = &maxPods + if b.InstanceGroup.Spec.Kubelet != nil { + if b.InstanceGroup.Spec.Kubelet.MaxPods == nil { + b.InstanceGroup.Spec.Kubelet.MaxPods = &maxPods + } + } + } + if b.InstanceGroup.Spec.Kubelet != nil { reflectutils.JsonMergeStruct(c, b.InstanceGroup.Spec.Kubelet) } From c2d82abd88d4f77ca2d4bf3dd09cefbac29539cc Mon Sep 17 00:00:00 2001 From: Ripta Pasay Date: Thu, 8 Nov 2018 07:39:00 +0000 Subject: [PATCH 108/163] Calculate max pods based on Amazon VPC CNI plugin library --- hack/machine_types/BUILD.bazel | 1 + hack/machine_types/machine_types.go | 12 +++++++++++- upup/pkg/fi/cloudup/awsup/machine_types.go | 1 + 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/hack/machine_types/BUILD.bazel b/hack/machine_types/BUILD.bazel index 8c93f7bceb825..7cac3d58e1e5a 100644 --- a/hack/machine_types/BUILD.bazel +++ b/hack/machine_types/BUILD.bazel @@ -7,6 +7,7 @@ go_library( visibility = ["//visibility:private"], deps = [ "//upup/pkg/fi/cloudup/awsup:go_default_library", + "//vendor/github.com/aws/amazon-vpc-cni-k8s/pkg/awsutils:go_default_library", "//vendor/github.com/aws/aws-sdk-go/aws:go_default_library", "//vendor/github.com/aws/aws-sdk-go/aws/awserr:go_default_library", "//vendor/github.com/aws/aws-sdk-go/aws/session:go_default_library", diff --git a/hack/machine_types/machine_types.go b/hack/machine_types/machine_types.go index 93fafef09b241..5aa3e48679edf 100644 --- a/hack/machine_types/machine_types.go +++ b/hack/machine_types/machine_types.go @@ -27,6 +27,7 @@ import ( "strconv" "strings" + "github.com/aws/amazon-vpc-cni-k8s/pkg/awsutils" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/session" @@ -195,6 +196,14 @@ func run() error { machine.ECU = stringToFloat32(attributes["ecu"]) } + // AWS VPC CNI plugin-specific maximum pod calculation based on: + // https://github.com/aws/amazon-vpc-cni-k8s/blob/f52ad45/README.md + enisPerInstance, enisOK := awsutils.InstanceENIsAvailable[attributes["instanceType"]] + ipsPerENI, ipsOK := awsutils.InstanceIPsAvailable[attributes["instanceType"]] + if enisOK && ipsOK { + machine.MaxPods = enisPerInstance*(int(ipsPerENI)-1) + 2 + } + machines = append(machines, machine) family := strings.Split(attributes["instanceType"], ".")[0] @@ -254,7 +263,8 @@ func run() error { MemoryGB: %v, ECU: %v, Cores: %v, - `, m.Name, m.MemoryGB, ecu, m.Cores) + MaxPods: %v, + `, m.Name, m.MemoryGB, ecu, m.Cores, m.MaxPods) output = output + body // Avoid awkward []int(nil) syntax diff --git a/upup/pkg/fi/cloudup/awsup/machine_types.go b/upup/pkg/fi/cloudup/awsup/machine_types.go index 4ff45460292af..c32ff3b3fcd62 100644 --- a/upup/pkg/fi/cloudup/awsup/machine_types.go +++ b/upup/pkg/fi/cloudup/awsup/machine_types.go @@ -33,6 +33,7 @@ type AWSMachineTypeInfo struct { EphemeralDisks []int Burstable bool GPU bool + MaxPods int } type EphemeralDevice struct { From aa34956560b995d5f59783f926e8ff1aebf5505e Mon Sep 17 00:00:00 2001 From: Ripta Pasay Date: Thu, 8 Nov 2018 08:07:57 +0000 Subject: [PATCH 109/163] Ignore any duplicates being returned by the pricing API when rebuilding machine types --- hack/machine_types/machine_types.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hack/machine_types/machine_types.go b/hack/machine_types/machine_types.go index 5aa3e48679edf..7d130169e71ed 100644 --- a/hack/machine_types/machine_types.go +++ b/hack/machine_types/machine_types.go @@ -153,6 +153,7 @@ func run() error { } } + seen := map[string]bool{} for _, item := range prices { for k, v := range item { if k == "product" { @@ -162,6 +163,11 @@ func run() error { attributes[k] = v.(string) } + if _, ok := seen[attributes["instanceType"]]; ok { + continue + } + seen[attributes["instanceType"]] = true + machine := awsup.AWSMachineTypeInfo{ Name: attributes["instanceType"], Cores: stringToInt(attributes["vcpu"]), From ab8565df9c62154ff2a6b9c8521629410cae4b94 Mon Sep 17 00:00:00 2001 From: Ripta Pasay Date: Sun, 25 Nov 2018 20:39:43 +0000 Subject: [PATCH 110/163] Import awsutils from amazon-vpc-cni-k8s plugin https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/master/pkg/awsutils/vpc_ip_resource_limit.go --- Makefile | 2 +- hack/machine_types/machine_types.go | 5 +- hack/machine_types/vpc_ip_resource_limit.go | 338 ++++++++++++++++++++ 3 files changed, 341 insertions(+), 4 deletions(-) create mode 100644 hack/machine_types/vpc_ip_resource_limit.go diff --git a/Makefile b/Makefile index ca2ecaa58ac14..e555501bbd0ce 100644 --- a/Makefile +++ b/Makefile @@ -786,6 +786,6 @@ build-docs: .PHONY: update-machine-types update-machine-types: #Update machine_types.go - go build -o hack/machine_types/machine_types ${KOPS_ROOT}/hack/machine_types/machine_types.go + go build -o hack/machine_types/machine_types ${KOPS_ROOT}/hack/machine_types/machine_types.go ${KOPS_ROOT}/hack/machine_types/vpc_ip_resource_limit.go hack/machine_types/machine_types --out upup/pkg/fi/cloudup/awsup/machine_types.go go fmt upup/pkg/fi/cloudup/awsup/machine_types.go diff --git a/hack/machine_types/machine_types.go b/hack/machine_types/machine_types.go index 7d130169e71ed..a26d0cccfc480 100644 --- a/hack/machine_types/machine_types.go +++ b/hack/machine_types/machine_types.go @@ -27,7 +27,6 @@ import ( "strconv" "strings" - "github.com/aws/amazon-vpc-cni-k8s/pkg/awsutils" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/session" @@ -204,8 +203,8 @@ func run() error { // AWS VPC CNI plugin-specific maximum pod calculation based on: // https://github.com/aws/amazon-vpc-cni-k8s/blob/f52ad45/README.md - enisPerInstance, enisOK := awsutils.InstanceENIsAvailable[attributes["instanceType"]] - ipsPerENI, ipsOK := awsutils.InstanceIPsAvailable[attributes["instanceType"]] + enisPerInstance, enisOK := InstanceENIsAvailable[attributes["instanceType"]] + ipsPerENI, ipsOK := InstanceIPsAvailable[attributes["instanceType"]] if enisOK && ipsOK { machine.MaxPods = enisPerInstance*(int(ipsPerENI)-1) + 2 } diff --git a/hack/machine_types/vpc_ip_resource_limit.go b/hack/machine_types/vpc_ip_resource_limit.go new file mode 100644 index 0000000000000..a14ad019863f0 --- /dev/null +++ b/hack/machine_types/vpc_ip_resource_limit.go @@ -0,0 +1,338 @@ +// Copyright 2017-2018 Amazon.com, Inc. or its affiliates. All Rights Reserved. +// +// Licensed under the Apache License, Version 2.0 (the "License"). You may +// not use this file except in compliance with the License. A copy of the +// License is located at +// +// http://aws.amazon.com/apache2.0/ +// +// or in the "license" file accompanying this file. This file is distributed +// on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either +// express or implied. See the License for the specific language governing +// permissions and limitations under the License. + +package main + +// InstanceENIsAvailable contains a mapping of instance types to the number of ENIs available which is described at +// https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI +var InstanceENIsAvailable = map[string]int{ + "c1.medium": 2, + "c1.xlarge": 4, + "c3.large": 3, + "c3.xlarge": 4, + "c3.2xlarge": 4, + "c3.4xlarge": 8, + "c3.8xlarge": 8, + "c4.large": 3, + "c4.xlarge": 4, + "c4.2xlarge": 4, + "c4.4xlarge": 8, + "c4.8xlarge": 8, + "c5.large": 3, + "c5.xlarge": 4, + "c5.2xlarge": 4, + "c5.4xlarge": 8, + "c5.9xlarge": 8, + "c5.18xlarge": 15, + "c5d.large": 3, + "c5d.xlarge": 4, + "c5d.2xlarge": 4, + "c5d.4xlarge": 8, + "c5d.9xlarge": 8, + "c5d.18xlarge": 15, + "cc2.8xlarge": 8, + "cr1.8xlarge": 8, + "d2.xlarge": 4, + "d2.2xlarge": 4, + "d2.4xlarge": 8, + "d2.8xlarge": 8, + "f1.2xlarge": 4, + "f1.4xlarge": 8, + "f1.16xlarge": 8, + "g2.2xlarge": 4, + "g2.8xlarge": 8, + "g3s.xlarge": 4, + "g3.4xlarge": 8, + "g3.8xlarge": 8, + "g3.16xlarge": 15, + "h1.2xlarge": 4, + "h1.4xlarge": 8, + "h1.8xlarge": 8, + "h1.16xlarge": 15, + "hs1.8xlarge": 8, + "i2.xlarge": 4, + "i2.2xlarge": 4, + "i2.4xlarge": 8, + "i2.8xlarge": 8, + "i3.large": 3, + "i3.xlarge": 4, + "i3.2xlarge": 4, + "i3.4xlarge": 8, + "i3.8xlarge": 8, + "i3.16xlarge": 15, + "i3.metal": 15, + "m1.small": 2, + "m1.medium": 2, + "m1.large": 3, + "m1.xlarge": 4, + "m2.xlarge": 4, + "m2.2xlarge": 4, + "m2.4xlarge": 8, + "m3.medium": 2, + "m3.large": 3, + "m3.xlarge": 4, + "m3.2xlarge": 4, + "m4.large": 2, + "m4.xlarge": 4, + "m4.2xlarge": 4, + "m4.4xlarge": 8, + "m4.10xlarge": 8, + "m4.16xlarge": 8, + "m5.large": 3, + "m5.xlarge": 4, + "m5.2xlarge": 4, + "m5.4xlarge": 8, + "m5.12xlarge": 8, + "m5.24xlarge": 15, + "m5a.large": 3, + "m5a.xlarge": 4, + "m5a.2xlarge": 4, + "m5a.4xlarge": 8, + "m5a.12xlarge": 8, + "m5a.24xlarge": 15, + "m5d.large": 3, + "m5d.xlarge": 4, + "m5d.2xlarge": 4, + "m5d.4xlarge": 8, + "m5d.12xlarge": 8, + "m5d.24xlarge": 15, + "p2.xlarge": 4, + "p2.8xlarge": 8, + "p2.16xlarge": 8, + "p3.2xlarge": 4, + "p3.8xlarge": 8, + "p3.16xlarge": 8, + "r3.large": 3, + "r3.xlarge": 4, + "r3.2xlarge": 4, + "r3.4xlarge": 8, + "r3.8xlarge": 8, + "r4.large": 3, + "r4.xlarge": 4, + "r4.2xlarge": 4, + "r4.4xlarge": 8, + "r4.8xlarge": 8, + "r4.16xlarge": 15, + "r5.large": 3, + "r5.xlarge": 4, + "r5.2xlarge": 4, + "r5.4xlarge": 8, + "r5.12xlarge": 8, + "r5.24xlarge": 15, + "r5a.large": 3, + "r5a.xlarge": 4, + "r5a.2xlarge": 4, + "r5a.4xlarge": 8, + "r5a.12xlarge": 8, + "r5a.24xlarge": 15, + "r5d.large": 3, + "r5d.xlarge": 4, + "r5d.2xlarge": 4, + "r5d.4xlarge": 8, + "r5d.12xlarge": 8, + "r5d.24xlarge": 15, + "t1.micro": 2, + "t2.nano": 2, + "t2.micro": 2, + "t2.small": 3, + "t2.medium": 3, + "t2.large": 3, + "t2.xlarge": 3, + "t2.2xlarge": 3, + "t3.nano": 2, + "t3.micro": 2, + "t3.small": 3, + "t3.medium": 3, + "t3.large": 3, + "t3.xlarge": 4, + "t3.2xlarge": 4, + "u-6tb1.metal": 5, + "u-9tb1.metal": 5, + "u-12tb1.metal": 5, + "x1.16xlarge": 8, + "x1.32xlarge": 8, + "x1e.xlarge": 3, + "x1e.2xlarge": 4, + "x1e.4xlarge": 4, + "x1e.8xlarge": 4, + "x1e.16xlarge": 8, + "x1e.32xlarge": 8, + "z1d.large": 3, + "z1d.xlarge": 4, + "z1d.2xlarge": 4, + "z1d.3xlarge": 8, + "z1d.6xlarge": 8, + "z1d.12xlarge": 15, +} + +// InstanceIPsAvailable contains a mapping of instance types to the number of IPs per ENI +// https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI +var InstanceIPsAvailable = map[string]int64{ + "c1.medium": 6, + "c1.xlarge": 15, + "c3.large": 10, + "c3.xlarge": 15, + "c3.2xlarge": 15, + "c3.4xlarge": 30, + "c3.8xlarge": 30, + "c4.large": 10, + "c4.xlarge": 15, + "c4.2xlarge": 15, + "c4.4xlarge": 30, + "c4.8xlarge": 30, + "c5.large": 10, + "c5.xlarge": 15, + "c5.2xlarge": 15, + "c5.4xlarge": 30, + "c5.9xlarge": 30, + "c5.18xlarge": 50, + "c5d.large": 10, + "c5d.xlarge": 15, + "c5d.2xlarge": 15, + "c5d.4xlarge": 30, + "c5d.9xlarge": 30, + "c5d.18xlarge": 50, + "cc2.8xlarge": 30, + "cr1.8xlarge": 30, + "d2.xlarge": 15, + "d2.2xlarge": 15, + "d2.4xlarge": 30, + "d2.8xlarge": 30, + "f1.2xlarge": 15, + "f1.4xlarge": 30, + "f1.16xlarge": 50, + "g2.2xlarge": 15, + "g2.8xlarge": 30, + "g3s.xlarge": 15, + "g3.4xlarge": 30, + "g3.8xlarge": 30, + "g3.16xlarge": 50, + "h1.2xlarge": 15, + "h1.4xlarge": 30, + "h1.8xlarge": 30, + "h1.16xlarge": 50, + "hs1.8xlarge": 30, + "i2.xlarge": 15, + "i2.2xlarge": 15, + "i2.4xlarge": 30, + "i2.8xlarge": 30, + "i3.large": 10, + "i3.xlarge": 15, + "i3.2xlarge": 15, + "i3.4xlarge": 30, + "i3.8xlarge": 30, + "i3.16xlarge": 50, + "i3.metal": 50, + "m1.small": 4, + "m1.medium": 6, + "m1.large": 10, + "m1.xlarge": 15, + "m2.xlarge": 15, + "m2.2xlarge": 30, + "m2.4xlarge": 30, + "m3.medium": 6, + "m3.large": 10, + "m3.xlarge": 15, + "m3.2xlarge": 30, + "m4.large": 10, + "m4.xlarge": 15, + "m4.2xlarge": 15, + "m4.4xlarge": 30, + "m4.10xlarge": 30, + "m4.16xlarge": 30, + "m5.large": 10, + "m5.xlarge": 15, + "m5.2xlarge": 15, + "m5.4xlarge": 30, + "m5.12xlarge": 30, + "m5.24xlarge": 50, + "m5a.large": 10, + "m5a.xlarge": 15, + "m5a.2xlarge": 15, + "m5a.4xlarge": 30, + "m5a.12xlarge": 30, + "m5a.24xlarge": 50, + "m5d.large": 10, + "m5d.xlarge": 15, + "m5d.2xlarge": 15, + "m5d.4xlarge": 30, + "m5d.12xlarge": 30, + "m5d.24xlarge": 50, + "p2.xlarge": 15, + "p2.8xlarge": 30, + "p2.16xlarge": 30, + "p3.2xlarge": 15, + "p3.8xlarge": 30, + "p3.16xlarge": 30, + "r3.large": 10, + "r3.xlarge": 15, + "r3.2xlarge": 15, + "r3.4xlarge": 30, + "r3.8xlarge": 30, + "r4.large": 10, + "r4.xlarge": 15, + "r4.2xlarge": 15, + "r4.4xlarge": 30, + "r4.8xlarge": 30, + "r4.16xlarge": 50, + "r5.large": 10, + "r5.xlarge": 15, + "r5.2xlarge": 15, + "r5.4xlarge": 30, + "r5.12xlarge": 30, + "r5.24xlarge": 50, + "r5a.large": 10, + "r5a.xlarge": 15, + "r5a.2xlarge": 15, + "r5a.4xlarge": 30, + "r5a.12xlarge": 30, + "r5a.24xlarge": 50, + "r5d.large": 10, + "r5d.xlarge": 15, + "r5d.2xlarge": 15, + "r5d.4xlarge": 30, + "r5d.12xlarge": 30, + "r5d.24xlarge": 50, + "t1.micro": 2, + "t2.nano": 2, + "t2.micro": 2, + "t2.small": 4, + "t2.medium": 6, + "t2.large": 12, + "t2.xlarge": 15, + "t2.2xlarge": 15, + "t3.nano": 2, + "t3.micro": 2, + "t3.small": 4, + "t3.medium": 6, + "t3.large": 12, + "t3.xlarge": 15, + "t3.2xlarge": 15, + "u-6tb1.metal": 30, + "u-9tb1.metal": 30, + "u-12tb1.metal": 30, + "x1.16xlarge": 30, + "x1.32xlarge": 30, + "x1e.xlarge": 10, + "x1e.2xlarge": 15, + "x1e.4xlarge": 15, + "x1e.8xlarge": 15, + "x1e.16xlarge": 30, + "x1e.32xlarge": 30, + "z1d.large": 10, + "z1d.xlarge": 15, + "z1d.2xlarge": 15, + "z1d.3xlarge": 30, + "z1d.6xlarge": 30, + "z1d.12xlarge": 50, +} From 37b7d0b020779cfdfcf8b88aca0c34485a95e654 Mon Sep 17 00:00:00 2001 From: Ripta Pasay Date: Thu, 8 Nov 2018 08:08:10 +0000 Subject: [PATCH 111/163] Regenerate machine types --- upup/pkg/fi/cloudup/awsup/machine_types.go | 154 +++++++++++++++++++++ 1 file changed, 154 insertions(+) diff --git a/upup/pkg/fi/cloudup/awsup/machine_types.go b/upup/pkg/fi/cloudup/awsup/machine_types.go index c32ff3b3fcd62..bf246a38dc10b 100644 --- a/upup/pkg/fi/cloudup/awsup/machine_types.go +++ b/upup/pkg/fi/cloudup/awsup/machine_types.go @@ -84,6 +84,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 1.7, ECU: 5, Cores: 2, + MaxPods: 12, EphemeralDisks: []int{350}, }, @@ -92,6 +93,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 7, ECU: 20, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{420, 420, 420, 420}, }, @@ -101,6 +103,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 3.75, ECU: 7, Cores: 2, + MaxPods: 29, EphemeralDisks: []int{16, 16}, }, @@ -109,6 +112,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 7.5, ECU: 14, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{40, 40}, }, @@ -117,6 +121,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 15, ECU: 28, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{80, 80}, }, @@ -125,6 +130,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 30, ECU: 55, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{160, 160}, }, @@ -133,6 +139,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 60, ECU: 108, Cores: 32, + MaxPods: 234, EphemeralDisks: []int{320, 320}, }, @@ -142,6 +149,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 3.75, ECU: 8, Cores: 2, + MaxPods: 29, EphemeralDisks: nil, }, @@ -150,6 +158,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 7.5, ECU: 16, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, }, @@ -158,6 +167,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 15, ECU: 31, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, }, @@ -166,6 +176,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 30, ECU: 62, Cores: 16, + MaxPods: 234, EphemeralDisks: nil, }, @@ -174,6 +185,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 60, ECU: 132, Cores: 36, + MaxPods: 234, EphemeralDisks: nil, }, @@ -183,6 +195,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 4, ECU: 9, Cores: 2, + MaxPods: 29, EphemeralDisks: nil, }, @@ -191,6 +204,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 8, ECU: 17, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, }, @@ -199,6 +213,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 34, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, }, @@ -207,6 +222,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 68, Cores: 16, + MaxPods: 234, EphemeralDisks: nil, }, @@ -215,6 +231,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 72, ECU: 141, Cores: 36, + MaxPods: 234, EphemeralDisks: nil, }, @@ -223,6 +240,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 144, ECU: 281, Cores: 72, + MaxPods: 737, EphemeralDisks: nil, }, @@ -232,6 +250,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 4, ECU: 9, Cores: 2, + MaxPods: 29, EphemeralDisks: []int{50}, }, @@ -240,6 +259,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 8, ECU: 17, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{100}, }, @@ -248,6 +268,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 34, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{200}, }, @@ -256,6 +277,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 68, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{400}, }, @@ -264,6 +286,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 72, ECU: 141, Cores: 36, + MaxPods: 234, EphemeralDisks: []int{900}, }, @@ -272,6 +295,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 144, ECU: 281, Cores: 72, + MaxPods: 737, EphemeralDisks: []int{900, 900}, }, @@ -281,6 +305,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 60.5, ECU: 88, Cores: 32, + MaxPods: 234, EphemeralDisks: []int{840, 840, 840, 840}, }, @@ -290,6 +315,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 88, Cores: 32, + MaxPods: 234, EphemeralDisks: []int{120, 120}, }, @@ -299,6 +325,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 30.5, ECU: 14, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{2000, 2000, 2000}, }, @@ -307,6 +334,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 61, ECU: 28, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000}, }, @@ -315,6 +343,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 122, ECU: 56, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, }, @@ -323,6 +352,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 116, Cores: 36, + MaxPods: 234, EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, }, @@ -332,6 +362,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 122, ECU: 26, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, }, @@ -340,6 +371,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 52, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{940}, }, @@ -348,6 +380,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 976, ECU: 188, Cores: 64, + MaxPods: 394, EphemeralDisks: nil, }, @@ -357,6 +390,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 15, ECU: 26, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{60}, GPU: true, }, @@ -366,6 +400,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 60, ECU: 104, Cores: 32, + MaxPods: 234, EphemeralDisks: []int{120, 120}, GPU: true, }, @@ -376,6 +411,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 122, ECU: 47, Cores: 16, + MaxPods: 234, EphemeralDisks: nil, GPU: true, }, @@ -385,6 +421,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 94, Cores: 32, + MaxPods: 234, EphemeralDisks: nil, GPU: true, }, @@ -394,6 +431,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 488, ECU: 188, Cores: 64, + MaxPods: 737, EphemeralDisks: nil, GPU: true, }, @@ -404,6 +442,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 30.5, ECU: 13, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, GPU: true, }, @@ -414,6 +453,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 26, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{2000}, }, @@ -422,6 +462,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 64, ECU: 53.5, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{2000, 2000}, }, @@ -430,6 +471,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 128, ECU: 99, Cores: 32, + MaxPods: 234, EphemeralDisks: []int{2000, 2000, 2000, 2000}, }, @@ -438,6 +480,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 256, ECU: 188, Cores: 64, + MaxPods: 737, EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, }, @@ -447,6 +490,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 117, ECU: 35, Cores: 17, + MaxPods: 234, EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, }, @@ -456,6 +500,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 30.5, ECU: 14, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{800}, }, @@ -464,6 +509,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 61, ECU: 27, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{800, 800}, }, @@ -472,6 +518,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 122, ECU: 53, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{800, 800, 800, 800}, }, @@ -480,6 +527,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 104, Cores: 32, + MaxPods: 234, EphemeralDisks: []int{800, 800, 800, 800, 800, 800, 800, 800}, }, @@ -489,6 +537,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 15.25, ECU: 7, Cores: 2, + MaxPods: 29, EphemeralDisks: []int{475}, }, @@ -497,6 +546,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 30.5, ECU: 13, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{950}, }, @@ -505,6 +555,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 61, ECU: 27, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{1900}, }, @@ -513,6 +564,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 122, ECU: 53, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{1900, 1900}, }, @@ -521,6 +573,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 99, Cores: 32, + MaxPods: 234, EphemeralDisks: []int{1900, 1900, 1900, 1900}, }, @@ -529,6 +582,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 488, ECU: 200, Cores: 64, + MaxPods: 737, EphemeralDisks: []int{1900, 1900, 1900, 1900, 1900, 1900, 1900, 1900}, }, @@ -537,6 +591,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 512, ECU: 208, Cores: 72, + MaxPods: 737, EphemeralDisks: []int{1900, 1900, 1900, 1900, 1900, 1900, 1900, 1900}, }, @@ -546,6 +601,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 1.7, ECU: 1, Cores: 1, + MaxPods: 8, EphemeralDisks: []int{160}, }, @@ -554,6 +610,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 3.75, ECU: 2, Cores: 1, + MaxPods: 12, EphemeralDisks: []int{410}, }, @@ -562,6 +619,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 7.5, ECU: 4, Cores: 2, + MaxPods: 29, EphemeralDisks: []int{420, 420}, }, @@ -570,6 +628,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 15, ECU: 8, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{420, 420, 420, 420}, }, @@ -579,6 +638,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 17.1, ECU: 6.5, Cores: 2, + MaxPods: 58, EphemeralDisks: []int{420}, }, @@ -587,6 +647,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 34.2, ECU: 13, Cores: 4, + MaxPods: 118, EphemeralDisks: []int{850}, }, @@ -595,6 +656,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 68.4, ECU: 26, Cores: 8, + MaxPods: 234, EphemeralDisks: []int{840, 840}, }, @@ -604,6 +666,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 3.75, ECU: 3, Cores: 1, + MaxPods: 12, EphemeralDisks: []int{4}, }, @@ -612,6 +675,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 7.5, ECU: 6.5, Cores: 2, + MaxPods: 29, EphemeralDisks: []int{32}, }, @@ -620,6 +684,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 15, ECU: 13, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{40, 40}, }, @@ -628,6 +693,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 30, ECU: 26, Cores: 8, + MaxPods: 118, EphemeralDisks: []int{80, 80}, }, @@ -637,6 +703,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 8, ECU: 6.5, Cores: 2, + MaxPods: 20, EphemeralDisks: nil, }, @@ -645,6 +712,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 13, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, }, @@ -653,6 +721,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 26, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, }, @@ -661,6 +730,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 64, ECU: 53.5, Cores: 16, + MaxPods: 234, EphemeralDisks: nil, }, @@ -669,6 +739,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 160, ECU: 124.5, Cores: 40, + MaxPods: 234, EphemeralDisks: nil, }, @@ -677,6 +748,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 256, ECU: 188, Cores: 64, + MaxPods: 234, EphemeralDisks: nil, }, @@ -686,6 +758,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 8, ECU: 8, Cores: 2, + MaxPods: 29, EphemeralDisks: nil, }, @@ -694,6 +767,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 16, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, }, @@ -702,6 +776,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 31, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, }, @@ -710,6 +785,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 64, ECU: 60, Cores: 16, + MaxPods: 234, EphemeralDisks: nil, }, @@ -718,6 +794,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 192, ECU: 173, Cores: 48, + MaxPods: 234, EphemeralDisks: nil, }, @@ -726,6 +803,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 384, ECU: 345, Cores: 96, + MaxPods: 737, EphemeralDisks: nil, }, @@ -735,6 +813,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 8, ECU: 0, Cores: 2, + MaxPods: 29, EphemeralDisks: nil, }, @@ -743,6 +822,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 0, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, }, @@ -751,6 +831,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 0, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, }, @@ -759,6 +840,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 64, ECU: 0, Cores: 16, + MaxPods: 234, EphemeralDisks: nil, }, @@ -767,6 +849,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 192, ECU: 0, Cores: 48, + MaxPods: 234, EphemeralDisks: nil, }, @@ -775,6 +858,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 384, ECU: 0, Cores: 96, + MaxPods: 737, EphemeralDisks: nil, }, @@ -784,6 +868,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 8, ECU: 8, Cores: 2, + MaxPods: 29, EphemeralDisks: []int{75}, }, @@ -792,6 +877,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 16, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{150}, }, @@ -800,6 +886,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 31, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{300}, }, @@ -808,6 +895,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 64, ECU: 60, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{300, 300}, }, @@ -816,6 +904,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 192, ECU: 173, Cores: 48, + MaxPods: 234, EphemeralDisks: []int{900, 900}, }, @@ -824,6 +913,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 384, ECU: 345, Cores: 96, + MaxPods: 737, EphemeralDisks: []int{900, 900, 900, 900}, }, @@ -833,6 +923,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 61, ECU: 12, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, GPU: true, }, @@ -842,6 +933,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 488, ECU: 94, Cores: 32, + MaxPods: 234, EphemeralDisks: nil, GPU: true, }, @@ -851,6 +943,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 768, ECU: 188, Cores: 64, + MaxPods: 234, EphemeralDisks: nil, GPU: true, }, @@ -861,6 +954,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 61, ECU: 26, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, GPU: true, }, @@ -870,6 +964,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 94, Cores: 32, + MaxPods: 234, EphemeralDisks: nil, GPU: true, }, @@ -879,6 +974,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 488, ECU: 188, Cores: 64, + MaxPods: 234, EphemeralDisks: nil, GPU: true, }, @@ -889,6 +985,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 15.25, ECU: 6.5, Cores: 2, + MaxPods: 29, EphemeralDisks: []int{32}, }, @@ -897,6 +994,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 30.5, ECU: 13, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{80}, }, @@ -905,6 +1003,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 61, ECU: 26, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{160}, }, @@ -913,6 +1012,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 122, ECU: 52, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{320}, }, @@ -921,6 +1021,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 104, Cores: 32, + MaxPods: 234, EphemeralDisks: []int{320, 320}, }, @@ -930,6 +1031,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 15.25, ECU: 7, Cores: 2, + MaxPods: 29, EphemeralDisks: nil, }, @@ -938,6 +1040,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 30.5, ECU: 13.5, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, }, @@ -946,6 +1049,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 61, ECU: 27, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, }, @@ -954,6 +1058,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 122, ECU: 53, Cores: 16, + MaxPods: 234, EphemeralDisks: nil, }, @@ -962,6 +1067,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 99, Cores: 32, + MaxPods: 234, EphemeralDisks: nil, }, @@ -970,6 +1076,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 488, ECU: 195, Cores: 64, + MaxPods: 737, EphemeralDisks: nil, }, @@ -979,6 +1086,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 10, Cores: 2, + MaxPods: 29, EphemeralDisks: nil, }, @@ -987,6 +1095,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 19, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, }, @@ -995,6 +1104,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 64, ECU: 38, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, }, @@ -1003,6 +1113,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 128, ECU: 71, Cores: 16, + MaxPods: 234, EphemeralDisks: nil, }, @@ -1011,6 +1122,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 384, ECU: 173, Cores: 48, + MaxPods: 234, EphemeralDisks: nil, }, @@ -1019,6 +1131,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 768, ECU: 347, Cores: 96, + MaxPods: 737, EphemeralDisks: nil, }, @@ -1028,6 +1141,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 0, Cores: 2, + MaxPods: 29, EphemeralDisks: nil, }, @@ -1036,6 +1150,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 0, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, }, @@ -1044,6 +1159,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 64, ECU: 0, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, }, @@ -1052,6 +1168,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 128, ECU: 0, Cores: 16, + MaxPods: 234, EphemeralDisks: nil, }, @@ -1060,6 +1177,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 384, ECU: 0, Cores: 48, + MaxPods: 234, EphemeralDisks: nil, }, @@ -1068,6 +1186,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 768, ECU: 0, Cores: 96, + MaxPods: 737, EphemeralDisks: nil, }, @@ -1077,6 +1196,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 10, Cores: 2, + MaxPods: 29, EphemeralDisks: []int{75}, }, @@ -1085,6 +1205,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 19, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{150}, }, @@ -1093,6 +1214,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 64, ECU: 38, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{300}, }, @@ -1101,6 +1223,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 128, ECU: 71, Cores: 16, + MaxPods: 234, EphemeralDisks: []int{300, 300}, }, @@ -1109,6 +1232,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 384, ECU: 173, Cores: 48, + MaxPods: 234, EphemeralDisks: []int{900, 900}, }, @@ -1117,6 +1241,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 768, ECU: 347, Cores: 96, + MaxPods: 737, EphemeralDisks: []int{900, 900, 900, 900}, }, @@ -1126,6 +1251,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 0.613, ECU: 1 * BurstableCreditsToECUS, Cores: 1, + MaxPods: 4, EphemeralDisks: nil, Burstable: true, }, @@ -1136,6 +1262,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 0.5, ECU: 3 * BurstableCreditsToECUS, Cores: 1, + MaxPods: 4, EphemeralDisks: nil, Burstable: true, }, @@ -1145,6 +1272,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 1, ECU: 6 * BurstableCreditsToECUS, Cores: 1, + MaxPods: 4, EphemeralDisks: nil, Burstable: true, }, @@ -1154,6 +1282,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 2, ECU: 12 * BurstableCreditsToECUS, Cores: 1, + MaxPods: 11, EphemeralDisks: nil, Burstable: true, }, @@ -1163,6 +1292,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 4, ECU: 24 * BurstableCreditsToECUS, Cores: 2, + MaxPods: 17, EphemeralDisks: nil, Burstable: true, }, @@ -1172,6 +1302,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 8, ECU: 36 * BurstableCreditsToECUS, Cores: 2, + MaxPods: 35, EphemeralDisks: nil, Burstable: true, }, @@ -1181,6 +1312,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 54 * BurstableCreditsToECUS, Cores: 4, + MaxPods: 44, EphemeralDisks: nil, Burstable: true, }, @@ -1190,6 +1322,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 81.6 * BurstableCreditsToECUS, Cores: 8, + MaxPods: 44, EphemeralDisks: nil, Burstable: true, }, @@ -1200,6 +1333,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 0.5, ECU: 6 * BurstableCreditsToECUS, Cores: 2, + MaxPods: 4, EphemeralDisks: nil, Burstable: true, }, @@ -1209,6 +1343,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 1, ECU: 12 * BurstableCreditsToECUS, Cores: 2, + MaxPods: 4, EphemeralDisks: nil, Burstable: true, }, @@ -1218,6 +1353,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 2, ECU: 24 * BurstableCreditsToECUS, Cores: 2, + MaxPods: 11, EphemeralDisks: nil, Burstable: true, }, @@ -1227,6 +1363,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 4, ECU: 24 * BurstableCreditsToECUS, Cores: 2, + MaxPods: 17, EphemeralDisks: nil, Burstable: true, }, @@ -1236,6 +1373,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 8, ECU: 36 * BurstableCreditsToECUS, Cores: 2, + MaxPods: 35, EphemeralDisks: nil, Burstable: true, }, @@ -1245,6 +1383,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 96 * BurstableCreditsToECUS, Cores: 4, + MaxPods: 58, EphemeralDisks: nil, Burstable: true, }, @@ -1254,6 +1393,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 192 * BurstableCreditsToECUS, Cores: 8, + MaxPods: 58, EphemeralDisks: nil, Burstable: true, }, @@ -1264,6 +1404,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 976, ECU: 174.5, Cores: 64, + MaxPods: 234, EphemeralDisks: []int{1920}, }, @@ -1272,6 +1413,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 1952, ECU: 349, Cores: 128, + MaxPods: 234, EphemeralDisks: []int{1920, 1920}, }, @@ -1281,6 +1423,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 122, ECU: 12, Cores: 4, + MaxPods: 29, EphemeralDisks: []int{120}, }, @@ -1289,6 +1432,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 244, ECU: 23, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{240}, }, @@ -1297,6 +1441,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 488, ECU: 47, Cores: 16, + MaxPods: 58, EphemeralDisks: []int{480}, }, @@ -1305,6 +1450,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 976, ECU: 91, Cores: 32, + MaxPods: 58, EphemeralDisks: []int{960}, }, @@ -1313,6 +1459,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 1952, ECU: 179, Cores: 64, + MaxPods: 234, EphemeralDisks: []int{1920}, }, @@ -1321,6 +1468,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 3904, ECU: 340, Cores: 128, + MaxPods: 234, EphemeralDisks: []int{1920, 1920}, }, @@ -1330,6 +1478,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 16, ECU: 15, Cores: 2, + MaxPods: 29, EphemeralDisks: []int{75}, }, @@ -1338,6 +1487,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 32, ECU: 28, Cores: 4, + MaxPods: 58, EphemeralDisks: []int{150}, }, @@ -1346,6 +1496,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 64, ECU: 53, Cores: 8, + MaxPods: 58, EphemeralDisks: []int{300}, }, @@ -1354,6 +1505,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 96, ECU: 75, Cores: 12, + MaxPods: 234, EphemeralDisks: []int{450}, }, @@ -1362,6 +1514,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 192, ECU: 134, Cores: 24, + MaxPods: 234, EphemeralDisks: []int{900}, }, @@ -1370,6 +1523,7 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ MemoryGB: 384, ECU: 271, Cores: 48, + MaxPods: 737, EphemeralDisks: []int{900, 900}, }, From 7ca6ddc9e03628e1a2a18325cdcd1dc6b50f1170 Mon Sep 17 00:00:00 2001 From: Ripta Pasay Date: Sun, 25 Nov 2018 22:35:25 +0000 Subject: [PATCH 112/163] Replace MaxPods in machine type data with InstanceENIs and InstanceIPsPerENI --- hack/machine_types/machine_types.go | 16 +- nodeup/pkg/model/kubelet.go | 23 +- upup/pkg/fi/cloudup/awsup/machine_types.go | 2074 +++++++++++--------- 3 files changed, 1145 insertions(+), 968 deletions(-) diff --git a/hack/machine_types/machine_types.go b/hack/machine_types/machine_types.go index a26d0cccfc480..dc09d40714a50 100644 --- a/hack/machine_types/machine_types.go +++ b/hack/machine_types/machine_types.go @@ -201,12 +201,11 @@ func run() error { machine.ECU = stringToFloat32(attributes["ecu"]) } - // AWS VPC CNI plugin-specific maximum pod calculation based on: - // https://github.com/aws/amazon-vpc-cni-k8s/blob/f52ad45/README.md - enisPerInstance, enisOK := InstanceENIsAvailable[attributes["instanceType"]] - ipsPerENI, ipsOK := InstanceIPsAvailable[attributes["instanceType"]] - if enisOK && ipsOK { - machine.MaxPods = enisPerInstance*(int(ipsPerENI)-1) + 2 + if enis, enisOK := InstanceENIsAvailable[attributes["instanceType"]]; enisOK { + machine.InstanceENIs = enis + } + if ipsPerENI, ipsOK := InstanceIPsAvailable[attributes["instanceType"]]; ipsOK { + machine.InstanceIPsPerENI = int(ipsPerENI) } machines = append(machines, machine) @@ -268,8 +267,9 @@ func run() error { MemoryGB: %v, ECU: %v, Cores: %v, - MaxPods: %v, - `, m.Name, m.MemoryGB, ecu, m.Cores, m.MaxPods) + InstanceENIs: %v, + InstanceIPsPerENI: %v, + `, m.Name, m.MemoryGB, ecu, m.Cores, m.InstanceENIs, m.InstanceIPsPerENI) output = output + body // Avoid awkward []int(nil) syntax diff --git a/nodeup/pkg/model/kubelet.go b/nodeup/pkg/model/kubelet.go index 40cb0580acbc5..9f099a8292fae 100644 --- a/nodeup/pkg/model/kubelet.go +++ b/nodeup/pkg/model/kubelet.go @@ -466,7 +466,28 @@ func (b *KubeletBuilder) buildKubeletConfigSpec() (*kops.KubeletConfigSpec, erro return c, err } - maxPods := int32(instanceType.MaxPods) + // Default maximum pods per node defined by KubeletConfiguration, but + // respect any value the user sets explicitly. + maxPods := int32(110) + if c.MaxPods != nil { + maxPods = *c.MaxPods + } + + // AWS VPC CNI plugin-specific maximum pod calculation based on: + // https://github.com/aws/amazon-vpc-cni-k8s/blob/f52ad45/README.md + // + // Treat the calculated value as a hard max, since networking with the CNI + // plugin won't work correctly once we exceed that maximum. + enis := instanceType.InstanceENIs + ips := instanceType.InstanceIPsPerENI + if enis > 0 && ips > 0 { + instanceMaxPods := enis*(ips-1) + 2 + if int32(instanceMaxPods) < maxPods { + maxPods = int32(instanceMaxPods) + } + } + + // Write back values that could have changed c.MaxPods = &maxPods if b.InstanceGroup.Spec.Kubelet != nil { if b.InstanceGroup.Spec.Kubelet.MaxPods == nil { diff --git a/upup/pkg/fi/cloudup/awsup/machine_types.go b/upup/pkg/fi/cloudup/awsup/machine_types.go index bf246a38dc10b..07e5944e079e6 100644 --- a/upup/pkg/fi/cloudup/awsup/machine_types.go +++ b/upup/pkg/fi/cloudup/awsup/machine_types.go @@ -26,14 +26,16 @@ import ( const BurstableCreditsToECUS float32 = 3.0 / 60.0 type AWSMachineTypeInfo struct { - Name string - MemoryGB float32 - ECU float32 - Cores int - EphemeralDisks []int - Burstable bool - GPU bool - MaxPods int + Name string + MemoryGB float32 + ECU float32 + Cores int + EphemeralDisks []int + Burstable bool + GPU bool + MaxPods int + InstanceENIs int + InstanceIPsPerENI int } type EphemeralDevice struct { @@ -80,1451 +82,1605 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ // c1 family { - Name: "c1.medium", - MemoryGB: 1.7, - ECU: 5, - Cores: 2, - MaxPods: 12, - EphemeralDisks: []int{350}, + Name: "c1.medium", + MemoryGB: 1.7, + ECU: 5, + Cores: 2, + InstanceENIs: 2, + InstanceIPsPerENI: 6, + EphemeralDisks: []int{350}, }, { - Name: "c1.xlarge", - MemoryGB: 7, - ECU: 20, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{420, 420, 420, 420}, + Name: "c1.xlarge", + MemoryGB: 7, + ECU: 20, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{420, 420, 420, 420}, }, // c3 family { - Name: "c3.large", - MemoryGB: 3.75, - ECU: 7, - Cores: 2, - MaxPods: 29, - EphemeralDisks: []int{16, 16}, + Name: "c3.large", + MemoryGB: 3.75, + ECU: 7, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{16, 16}, }, { - Name: "c3.xlarge", - MemoryGB: 7.5, - ECU: 14, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{40, 40}, + Name: "c3.xlarge", + MemoryGB: 7.5, + ECU: 14, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{40, 40}, }, { - Name: "c3.2xlarge", - MemoryGB: 15, - ECU: 28, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{80, 80}, + Name: "c3.2xlarge", + MemoryGB: 15, + ECU: 28, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{80, 80}, }, { - Name: "c3.4xlarge", - MemoryGB: 30, - ECU: 55, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{160, 160}, + Name: "c3.4xlarge", + MemoryGB: 30, + ECU: 55, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{160, 160}, }, { - Name: "c3.8xlarge", - MemoryGB: 60, - ECU: 108, - Cores: 32, - MaxPods: 234, - EphemeralDisks: []int{320, 320}, + Name: "c3.8xlarge", + MemoryGB: 60, + ECU: 108, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{320, 320}, }, // c4 family { - Name: "c4.large", - MemoryGB: 3.75, - ECU: 8, - Cores: 2, - MaxPods: 29, - EphemeralDisks: nil, + Name: "c4.large", + MemoryGB: 3.75, + ECU: 8, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, }, { - Name: "c4.xlarge", - MemoryGB: 7.5, - ECU: 16, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, + Name: "c4.xlarge", + MemoryGB: 7.5, + ECU: 16, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "c4.2xlarge", - MemoryGB: 15, - ECU: 31, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, + Name: "c4.2xlarge", + MemoryGB: 15, + ECU: 31, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "c4.4xlarge", - MemoryGB: 30, - ECU: 62, - Cores: 16, - MaxPods: 234, - EphemeralDisks: nil, + Name: "c4.4xlarge", + MemoryGB: 30, + ECU: 62, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "c4.8xlarge", - MemoryGB: 60, - ECU: 132, - Cores: 36, - MaxPods: 234, - EphemeralDisks: nil, + Name: "c4.8xlarge", + MemoryGB: 60, + ECU: 132, + Cores: 36, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, // c5 family { - Name: "c5.large", - MemoryGB: 4, - ECU: 9, - Cores: 2, - MaxPods: 29, - EphemeralDisks: nil, + Name: "c5.large", + MemoryGB: 4, + ECU: 9, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, }, { - Name: "c5.xlarge", - MemoryGB: 8, - ECU: 17, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, + Name: "c5.xlarge", + MemoryGB: 8, + ECU: 17, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "c5.2xlarge", - MemoryGB: 16, - ECU: 34, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, + Name: "c5.2xlarge", + MemoryGB: 16, + ECU: 34, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "c5.4xlarge", - MemoryGB: 32, - ECU: 68, - Cores: 16, - MaxPods: 234, - EphemeralDisks: nil, + Name: "c5.4xlarge", + MemoryGB: 32, + ECU: 68, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "c5.9xlarge", - MemoryGB: 72, - ECU: 141, - Cores: 36, - MaxPods: 234, - EphemeralDisks: nil, + Name: "c5.9xlarge", + MemoryGB: 72, + ECU: 141, + Cores: 36, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "c5.18xlarge", - MemoryGB: 144, - ECU: 281, - Cores: 72, - MaxPods: 737, - EphemeralDisks: nil, + Name: "c5.18xlarge", + MemoryGB: 144, + ECU: 281, + Cores: 72, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, }, // c5d family { - Name: "c5d.large", - MemoryGB: 4, - ECU: 9, - Cores: 2, - MaxPods: 29, - EphemeralDisks: []int{50}, + Name: "c5d.large", + MemoryGB: 4, + ECU: 9, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{50}, }, { - Name: "c5d.xlarge", - MemoryGB: 8, - ECU: 17, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{100}, + Name: "c5d.xlarge", + MemoryGB: 8, + ECU: 17, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{100}, }, { - Name: "c5d.2xlarge", - MemoryGB: 16, - ECU: 34, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{200}, + Name: "c5d.2xlarge", + MemoryGB: 16, + ECU: 34, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{200}, }, { - Name: "c5d.4xlarge", - MemoryGB: 32, - ECU: 68, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{400}, + Name: "c5d.4xlarge", + MemoryGB: 32, + ECU: 68, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{400}, }, { - Name: "c5d.9xlarge", - MemoryGB: 72, - ECU: 141, - Cores: 36, - MaxPods: 234, - EphemeralDisks: []int{900}, + Name: "c5d.9xlarge", + MemoryGB: 72, + ECU: 141, + Cores: 36, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{900}, }, { - Name: "c5d.18xlarge", - MemoryGB: 144, - ECU: 281, - Cores: 72, - MaxPods: 737, - EphemeralDisks: []int{900, 900}, + Name: "c5d.18xlarge", + MemoryGB: 144, + ECU: 281, + Cores: 72, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{900, 900}, }, // cc2 family { - Name: "cc2.8xlarge", - MemoryGB: 60.5, - ECU: 88, - Cores: 32, - MaxPods: 234, - EphemeralDisks: []int{840, 840, 840, 840}, + Name: "cc2.8xlarge", + MemoryGB: 60.5, + ECU: 88, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{840, 840, 840, 840}, }, // cr1 family { - Name: "cr1.8xlarge", - MemoryGB: 244, - ECU: 88, - Cores: 32, - MaxPods: 234, - EphemeralDisks: []int{120, 120}, + Name: "cr1.8xlarge", + MemoryGB: 244, + ECU: 88, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{120, 120}, }, // d2 family { - Name: "d2.xlarge", - MemoryGB: 30.5, - ECU: 14, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{2000, 2000, 2000}, + Name: "d2.xlarge", + MemoryGB: 30.5, + ECU: 14, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{2000, 2000, 2000}, }, { - Name: "d2.2xlarge", - MemoryGB: 61, - ECU: 28, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000}, + Name: "d2.2xlarge", + MemoryGB: 61, + ECU: 28, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000}, }, { - Name: "d2.4xlarge", - MemoryGB: 122, - ECU: 56, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, + Name: "d2.4xlarge", + MemoryGB: 122, + ECU: 56, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, }, { - Name: "d2.8xlarge", - MemoryGB: 244, - ECU: 116, - Cores: 36, - MaxPods: 234, - EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, + Name: "d2.8xlarge", + MemoryGB: 244, + ECU: 116, + Cores: 36, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, }, // f1 family { - Name: "f1.2xlarge", - MemoryGB: 122, - ECU: 26, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, + Name: "f1.2xlarge", + MemoryGB: 122, + ECU: 26, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "f1.4xlarge", - MemoryGB: 244, - ECU: 52, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{940}, + Name: "f1.4xlarge", + MemoryGB: 244, + ECU: 52, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{940}, }, { - Name: "f1.16xlarge", - MemoryGB: 976, - ECU: 188, - Cores: 64, - MaxPods: 394, - EphemeralDisks: nil, + Name: "f1.16xlarge", + MemoryGB: 976, + ECU: 188, + Cores: 64, + InstanceENIs: 8, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, }, // g2 family { - Name: "g2.2xlarge", - MemoryGB: 15, - ECU: 26, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{60}, - GPU: true, + Name: "g2.2xlarge", + MemoryGB: 15, + ECU: 26, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{60}, + GPU: true, }, { - Name: "g2.8xlarge", - MemoryGB: 60, - ECU: 104, - Cores: 32, - MaxPods: 234, - EphemeralDisks: []int{120, 120}, - GPU: true, + Name: "g2.8xlarge", + MemoryGB: 60, + ECU: 104, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{120, 120}, + GPU: true, }, // g3 family { - Name: "g3.4xlarge", - MemoryGB: 122, - ECU: 47, - Cores: 16, - MaxPods: 234, - EphemeralDisks: nil, - GPU: true, + Name: "g3.4xlarge", + MemoryGB: 122, + ECU: 47, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, + GPU: true, }, { - Name: "g3.8xlarge", - MemoryGB: 244, - ECU: 94, - Cores: 32, - MaxPods: 234, - EphemeralDisks: nil, - GPU: true, + Name: "g3.8xlarge", + MemoryGB: 244, + ECU: 94, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, + GPU: true, }, { - Name: "g3.16xlarge", - MemoryGB: 488, - ECU: 188, - Cores: 64, - MaxPods: 737, - EphemeralDisks: nil, - GPU: true, + Name: "g3.16xlarge", + MemoryGB: 488, + ECU: 188, + Cores: 64, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, + GPU: true, }, // g3s family { - Name: "g3s.xlarge", - MemoryGB: 30.5, - ECU: 13, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, - GPU: true, + Name: "g3s.xlarge", + MemoryGB: 30.5, + ECU: 13, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + GPU: true, }, // h1 family { - Name: "h1.2xlarge", - MemoryGB: 32, - ECU: 26, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{2000}, + Name: "h1.2xlarge", + MemoryGB: 32, + ECU: 26, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{2000}, }, { - Name: "h1.4xlarge", - MemoryGB: 64, - ECU: 53.5, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{2000, 2000}, + Name: "h1.4xlarge", + MemoryGB: 64, + ECU: 53.5, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{2000, 2000}, }, { - Name: "h1.8xlarge", - MemoryGB: 128, - ECU: 99, - Cores: 32, - MaxPods: 234, - EphemeralDisks: []int{2000, 2000, 2000, 2000}, + Name: "h1.8xlarge", + MemoryGB: 128, + ECU: 99, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{2000, 2000, 2000, 2000}, }, { - Name: "h1.16xlarge", - MemoryGB: 256, - ECU: 188, - Cores: 64, - MaxPods: 737, - EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, + Name: "h1.16xlarge", + MemoryGB: 256, + ECU: 188, + Cores: 64, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, }, // hs1 family { - Name: "hs1.8xlarge", - MemoryGB: 117, - ECU: 35, - Cores: 17, - MaxPods: 234, - EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, + Name: "hs1.8xlarge", + MemoryGB: 117, + ECU: 35, + Cores: 17, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000, 2000}, }, // i2 family { - Name: "i2.xlarge", - MemoryGB: 30.5, - ECU: 14, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{800}, + Name: "i2.xlarge", + MemoryGB: 30.5, + ECU: 14, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{800}, }, { - Name: "i2.2xlarge", - MemoryGB: 61, - ECU: 27, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{800, 800}, + Name: "i2.2xlarge", + MemoryGB: 61, + ECU: 27, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{800, 800}, }, { - Name: "i2.4xlarge", - MemoryGB: 122, - ECU: 53, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{800, 800, 800, 800}, + Name: "i2.4xlarge", + MemoryGB: 122, + ECU: 53, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{800, 800, 800, 800}, }, { - Name: "i2.8xlarge", - MemoryGB: 244, - ECU: 104, - Cores: 32, - MaxPods: 234, - EphemeralDisks: []int{800, 800, 800, 800, 800, 800, 800, 800}, + Name: "i2.8xlarge", + MemoryGB: 244, + ECU: 104, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{800, 800, 800, 800, 800, 800, 800, 800}, }, // i3 family { - Name: "i3.large", - MemoryGB: 15.25, - ECU: 7, - Cores: 2, - MaxPods: 29, - EphemeralDisks: []int{475}, + Name: "i3.large", + MemoryGB: 15.25, + ECU: 7, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{475}, }, { - Name: "i3.xlarge", - MemoryGB: 30.5, - ECU: 13, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{950}, + Name: "i3.xlarge", + MemoryGB: 30.5, + ECU: 13, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{950}, }, { - Name: "i3.2xlarge", - MemoryGB: 61, - ECU: 27, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{1900}, + Name: "i3.2xlarge", + MemoryGB: 61, + ECU: 27, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{1900}, }, { - Name: "i3.4xlarge", - MemoryGB: 122, - ECU: 53, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{1900, 1900}, + Name: "i3.4xlarge", + MemoryGB: 122, + ECU: 53, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{1900, 1900}, }, { - Name: "i3.8xlarge", - MemoryGB: 244, - ECU: 99, - Cores: 32, - MaxPods: 234, - EphemeralDisks: []int{1900, 1900, 1900, 1900}, + Name: "i3.8xlarge", + MemoryGB: 244, + ECU: 99, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{1900, 1900, 1900, 1900}, }, { - Name: "i3.16xlarge", - MemoryGB: 488, - ECU: 200, - Cores: 64, - MaxPods: 737, - EphemeralDisks: []int{1900, 1900, 1900, 1900, 1900, 1900, 1900, 1900}, + Name: "i3.16xlarge", + MemoryGB: 488, + ECU: 200, + Cores: 64, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{1900, 1900, 1900, 1900, 1900, 1900, 1900, 1900}, }, { - Name: "i3.metal", - MemoryGB: 512, - ECU: 208, - Cores: 72, - MaxPods: 737, - EphemeralDisks: []int{1900, 1900, 1900, 1900, 1900, 1900, 1900, 1900}, + Name: "i3.metal", + MemoryGB: 512, + ECU: 208, + Cores: 72, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{1900, 1900, 1900, 1900, 1900, 1900, 1900, 1900}, }, // m1 family { - Name: "m1.small", - MemoryGB: 1.7, - ECU: 1, - Cores: 1, - MaxPods: 8, - EphemeralDisks: []int{160}, + Name: "m1.small", + MemoryGB: 1.7, + ECU: 1, + Cores: 1, + InstanceENIs: 2, + InstanceIPsPerENI: 4, + EphemeralDisks: []int{160}, }, { - Name: "m1.medium", - MemoryGB: 3.75, - ECU: 2, - Cores: 1, - MaxPods: 12, - EphemeralDisks: []int{410}, + Name: "m1.medium", + MemoryGB: 3.75, + ECU: 2, + Cores: 1, + InstanceENIs: 2, + InstanceIPsPerENI: 6, + EphemeralDisks: []int{410}, }, { - Name: "m1.large", - MemoryGB: 7.5, - ECU: 4, - Cores: 2, - MaxPods: 29, - EphemeralDisks: []int{420, 420}, + Name: "m1.large", + MemoryGB: 7.5, + ECU: 4, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{420, 420}, }, { - Name: "m1.xlarge", - MemoryGB: 15, - ECU: 8, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{420, 420, 420, 420}, + Name: "m1.xlarge", + MemoryGB: 15, + ECU: 8, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{420, 420, 420, 420}, }, // m2 family { - Name: "m2.xlarge", - MemoryGB: 17.1, - ECU: 6.5, - Cores: 2, - MaxPods: 58, - EphemeralDisks: []int{420}, + Name: "m2.xlarge", + MemoryGB: 17.1, + ECU: 6.5, + Cores: 2, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{420}, }, { - Name: "m2.2xlarge", - MemoryGB: 34.2, - ECU: 13, - Cores: 4, - MaxPods: 118, - EphemeralDisks: []int{850}, + Name: "m2.2xlarge", + MemoryGB: 34.2, + ECU: 13, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{850}, }, { - Name: "m2.4xlarge", - MemoryGB: 68.4, - ECU: 26, - Cores: 8, - MaxPods: 234, - EphemeralDisks: []int{840, 840}, + Name: "m2.4xlarge", + MemoryGB: 68.4, + ECU: 26, + Cores: 8, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{840, 840}, }, // m3 family { - Name: "m3.medium", - MemoryGB: 3.75, - ECU: 3, - Cores: 1, - MaxPods: 12, - EphemeralDisks: []int{4}, + Name: "m3.medium", + MemoryGB: 3.75, + ECU: 3, + Cores: 1, + InstanceENIs: 2, + InstanceIPsPerENI: 6, + EphemeralDisks: []int{4}, }, { - Name: "m3.large", - MemoryGB: 7.5, - ECU: 6.5, - Cores: 2, - MaxPods: 29, - EphemeralDisks: []int{32}, + Name: "m3.large", + MemoryGB: 7.5, + ECU: 6.5, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{32}, }, { - Name: "m3.xlarge", - MemoryGB: 15, - ECU: 13, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{40, 40}, + Name: "m3.xlarge", + MemoryGB: 15, + ECU: 13, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{40, 40}, }, { - Name: "m3.2xlarge", - MemoryGB: 30, - ECU: 26, - Cores: 8, - MaxPods: 118, - EphemeralDisks: []int{80, 80}, + Name: "m3.2xlarge", + MemoryGB: 30, + ECU: 26, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{80, 80}, }, // m4 family { - Name: "m4.large", - MemoryGB: 8, - ECU: 6.5, - Cores: 2, - MaxPods: 20, - EphemeralDisks: nil, + Name: "m4.large", + MemoryGB: 8, + ECU: 6.5, + Cores: 2, + InstanceENIs: 2, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, }, { - Name: "m4.xlarge", - MemoryGB: 16, - ECU: 13, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, + Name: "m4.xlarge", + MemoryGB: 16, + ECU: 13, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "m4.2xlarge", - MemoryGB: 32, - ECU: 26, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, + Name: "m4.2xlarge", + MemoryGB: 32, + ECU: 26, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "m4.4xlarge", - MemoryGB: 64, - ECU: 53.5, - Cores: 16, - MaxPods: 234, - EphemeralDisks: nil, + Name: "m4.4xlarge", + MemoryGB: 64, + ECU: 53.5, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "m4.10xlarge", - MemoryGB: 160, - ECU: 124.5, - Cores: 40, - MaxPods: 234, - EphemeralDisks: nil, + Name: "m4.10xlarge", + MemoryGB: 160, + ECU: 124.5, + Cores: 40, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "m4.16xlarge", - MemoryGB: 256, - ECU: 188, - Cores: 64, - MaxPods: 234, - EphemeralDisks: nil, + Name: "m4.16xlarge", + MemoryGB: 256, + ECU: 188, + Cores: 64, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, // m5 family { - Name: "m5.large", - MemoryGB: 8, - ECU: 8, - Cores: 2, - MaxPods: 29, - EphemeralDisks: nil, + Name: "m5.large", + MemoryGB: 8, + ECU: 8, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, }, { - Name: "m5.xlarge", - MemoryGB: 16, - ECU: 16, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, + Name: "m5.xlarge", + MemoryGB: 16, + ECU: 16, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "m5.2xlarge", - MemoryGB: 32, - ECU: 31, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, + Name: "m5.2xlarge", + MemoryGB: 32, + ECU: 31, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "m5.4xlarge", - MemoryGB: 64, - ECU: 60, - Cores: 16, - MaxPods: 234, - EphemeralDisks: nil, + Name: "m5.4xlarge", + MemoryGB: 64, + ECU: 60, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "m5.12xlarge", - MemoryGB: 192, - ECU: 173, - Cores: 48, - MaxPods: 234, - EphemeralDisks: nil, + Name: "m5.12xlarge", + MemoryGB: 192, + ECU: 173, + Cores: 48, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "m5.24xlarge", - MemoryGB: 384, - ECU: 345, - Cores: 96, - MaxPods: 737, - EphemeralDisks: nil, + Name: "m5.24xlarge", + MemoryGB: 384, + ECU: 345, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, }, // m5a family { - Name: "m5a.large", - MemoryGB: 8, - ECU: 0, - Cores: 2, - MaxPods: 29, - EphemeralDisks: nil, + Name: "m5a.large", + MemoryGB: 8, + ECU: 0, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, }, { - Name: "m5a.xlarge", - MemoryGB: 16, - ECU: 0, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, + Name: "m5a.xlarge", + MemoryGB: 16, + ECU: 0, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "m5a.2xlarge", - MemoryGB: 32, - ECU: 0, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, + Name: "m5a.2xlarge", + MemoryGB: 32, + ECU: 0, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "m5a.4xlarge", - MemoryGB: 64, - ECU: 0, - Cores: 16, - MaxPods: 234, - EphemeralDisks: nil, + Name: "m5a.4xlarge", + MemoryGB: 64, + ECU: 0, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "m5a.12xlarge", - MemoryGB: 192, - ECU: 0, - Cores: 48, - MaxPods: 234, - EphemeralDisks: nil, + Name: "m5a.12xlarge", + MemoryGB: 192, + ECU: 0, + Cores: 48, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "m5a.24xlarge", - MemoryGB: 384, - ECU: 0, - Cores: 96, - MaxPods: 737, - EphemeralDisks: nil, + Name: "m5a.24xlarge", + MemoryGB: 384, + ECU: 0, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, }, // m5d family { - Name: "m5d.large", - MemoryGB: 8, - ECU: 8, - Cores: 2, - MaxPods: 29, - EphemeralDisks: []int{75}, + Name: "m5d.large", + MemoryGB: 8, + ECU: 8, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{75}, }, { - Name: "m5d.xlarge", - MemoryGB: 16, - ECU: 16, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{150}, + Name: "m5d.xlarge", + MemoryGB: 16, + ECU: 16, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{150}, }, { - Name: "m5d.2xlarge", - MemoryGB: 32, - ECU: 31, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{300}, + Name: "m5d.2xlarge", + MemoryGB: 32, + ECU: 31, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{300}, }, { - Name: "m5d.4xlarge", - MemoryGB: 64, - ECU: 60, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{300, 300}, + Name: "m5d.4xlarge", + MemoryGB: 64, + ECU: 60, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{300, 300}, }, { - Name: "m5d.12xlarge", - MemoryGB: 192, - ECU: 173, - Cores: 48, - MaxPods: 234, - EphemeralDisks: []int{900, 900}, + Name: "m5d.12xlarge", + MemoryGB: 192, + ECU: 173, + Cores: 48, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{900, 900}, }, { - Name: "m5d.24xlarge", - MemoryGB: 384, - ECU: 345, - Cores: 96, - MaxPods: 737, - EphemeralDisks: []int{900, 900, 900, 900}, + Name: "m5d.24xlarge", + MemoryGB: 384, + ECU: 345, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{900, 900, 900, 900}, }, // p2 family { - Name: "p2.xlarge", - MemoryGB: 61, - ECU: 12, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, - GPU: true, + Name: "p2.xlarge", + MemoryGB: 61, + ECU: 12, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + GPU: true, }, { - Name: "p2.8xlarge", - MemoryGB: 488, - ECU: 94, - Cores: 32, - MaxPods: 234, - EphemeralDisks: nil, - GPU: true, + Name: "p2.8xlarge", + MemoryGB: 488, + ECU: 94, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, + GPU: true, }, { - Name: "p2.16xlarge", - MemoryGB: 768, - ECU: 188, - Cores: 64, - MaxPods: 234, - EphemeralDisks: nil, - GPU: true, + Name: "p2.16xlarge", + MemoryGB: 768, + ECU: 188, + Cores: 64, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, + GPU: true, }, // p3 family { - Name: "p3.2xlarge", - MemoryGB: 61, - ECU: 26, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, - GPU: true, + Name: "p3.2xlarge", + MemoryGB: 61, + ECU: 26, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + GPU: true, }, { - Name: "p3.8xlarge", - MemoryGB: 244, - ECU: 94, - Cores: 32, - MaxPods: 234, - EphemeralDisks: nil, - GPU: true, + Name: "p3.8xlarge", + MemoryGB: 244, + ECU: 94, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, + GPU: true, }, { - Name: "p3.16xlarge", - MemoryGB: 488, - ECU: 188, - Cores: 64, - MaxPods: 234, - EphemeralDisks: nil, - GPU: true, + Name: "p3.16xlarge", + MemoryGB: 488, + ECU: 188, + Cores: 64, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, + GPU: true, }, // r3 family { - Name: "r3.large", - MemoryGB: 15.25, - ECU: 6.5, - Cores: 2, - MaxPods: 29, - EphemeralDisks: []int{32}, + Name: "r3.large", + MemoryGB: 15.25, + ECU: 6.5, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{32}, }, { - Name: "r3.xlarge", - MemoryGB: 30.5, - ECU: 13, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{80}, + Name: "r3.xlarge", + MemoryGB: 30.5, + ECU: 13, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{80}, }, { - Name: "r3.2xlarge", - MemoryGB: 61, - ECU: 26, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{160}, + Name: "r3.2xlarge", + MemoryGB: 61, + ECU: 26, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{160}, }, { - Name: "r3.4xlarge", - MemoryGB: 122, - ECU: 52, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{320}, + Name: "r3.4xlarge", + MemoryGB: 122, + ECU: 52, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{320}, }, { - Name: "r3.8xlarge", - MemoryGB: 244, - ECU: 104, - Cores: 32, - MaxPods: 234, - EphemeralDisks: []int{320, 320}, + Name: "r3.8xlarge", + MemoryGB: 244, + ECU: 104, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{320, 320}, }, // r4 family { - Name: "r4.large", - MemoryGB: 15.25, - ECU: 7, - Cores: 2, - MaxPods: 29, - EphemeralDisks: nil, + Name: "r4.large", + MemoryGB: 15.25, + ECU: 7, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, }, { - Name: "r4.xlarge", - MemoryGB: 30.5, - ECU: 13.5, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, + Name: "r4.xlarge", + MemoryGB: 30.5, + ECU: 13.5, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "r4.2xlarge", - MemoryGB: 61, - ECU: 27, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, + Name: "r4.2xlarge", + MemoryGB: 61, + ECU: 27, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "r4.4xlarge", - MemoryGB: 122, - ECU: 53, - Cores: 16, - MaxPods: 234, - EphemeralDisks: nil, + Name: "r4.4xlarge", + MemoryGB: 122, + ECU: 53, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "r4.8xlarge", - MemoryGB: 244, - ECU: 99, - Cores: 32, - MaxPods: 234, - EphemeralDisks: nil, + Name: "r4.8xlarge", + MemoryGB: 244, + ECU: 99, + Cores: 32, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "r4.16xlarge", - MemoryGB: 488, - ECU: 195, - Cores: 64, - MaxPods: 737, - EphemeralDisks: nil, + Name: "r4.16xlarge", + MemoryGB: 488, + ECU: 195, + Cores: 64, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, }, // r5 family { - Name: "r5.large", - MemoryGB: 16, - ECU: 10, - Cores: 2, - MaxPods: 29, - EphemeralDisks: nil, + Name: "r5.large", + MemoryGB: 16, + ECU: 10, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, }, { - Name: "r5.xlarge", - MemoryGB: 32, - ECU: 19, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, + Name: "r5.xlarge", + MemoryGB: 32, + ECU: 19, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "r5.2xlarge", - MemoryGB: 64, - ECU: 38, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, + Name: "r5.2xlarge", + MemoryGB: 64, + ECU: 38, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "r5.4xlarge", - MemoryGB: 128, - ECU: 71, - Cores: 16, - MaxPods: 234, - EphemeralDisks: nil, + Name: "r5.4xlarge", + MemoryGB: 128, + ECU: 71, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "r5.12xlarge", - MemoryGB: 384, - ECU: 173, - Cores: 48, - MaxPods: 234, - EphemeralDisks: nil, + Name: "r5.12xlarge", + MemoryGB: 384, + ECU: 173, + Cores: 48, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "r5.24xlarge", - MemoryGB: 768, - ECU: 347, - Cores: 96, - MaxPods: 737, - EphemeralDisks: nil, + Name: "r5.24xlarge", + MemoryGB: 768, + ECU: 347, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, }, // r5a family { - Name: "r5a.large", - MemoryGB: 16, - ECU: 0, - Cores: 2, - MaxPods: 29, - EphemeralDisks: nil, + Name: "r5a.large", + MemoryGB: 16, + ECU: 0, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, }, { - Name: "r5a.xlarge", - MemoryGB: 32, - ECU: 0, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, + Name: "r5a.xlarge", + MemoryGB: 32, + ECU: 0, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "r5a.2xlarge", - MemoryGB: 64, - ECU: 0, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, + Name: "r5a.2xlarge", + MemoryGB: 64, + ECU: 0, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, }, { - Name: "r5a.4xlarge", - MemoryGB: 128, - ECU: 0, - Cores: 16, - MaxPods: 234, - EphemeralDisks: nil, + Name: "r5a.4xlarge", + MemoryGB: 128, + ECU: 0, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "r5a.12xlarge", - MemoryGB: 384, - ECU: 0, - Cores: 48, - MaxPods: 234, - EphemeralDisks: nil, + Name: "r5a.12xlarge", + MemoryGB: 384, + ECU: 0, + Cores: 48, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, }, { - Name: "r5a.24xlarge", - MemoryGB: 768, - ECU: 0, - Cores: 96, - MaxPods: 737, - EphemeralDisks: nil, + Name: "r5a.24xlarge", + MemoryGB: 768, + ECU: 0, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, }, // r5d family { - Name: "r5d.large", - MemoryGB: 16, - ECU: 10, - Cores: 2, - MaxPods: 29, - EphemeralDisks: []int{75}, + Name: "r5d.large", + MemoryGB: 16, + ECU: 10, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{75}, }, { - Name: "r5d.xlarge", - MemoryGB: 32, - ECU: 19, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{150}, + Name: "r5d.xlarge", + MemoryGB: 32, + ECU: 19, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{150}, }, { - Name: "r5d.2xlarge", - MemoryGB: 64, - ECU: 38, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{300}, + Name: "r5d.2xlarge", + MemoryGB: 64, + ECU: 38, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{300}, }, { - Name: "r5d.4xlarge", - MemoryGB: 128, - ECU: 71, - Cores: 16, - MaxPods: 234, - EphemeralDisks: []int{300, 300}, + Name: "r5d.4xlarge", + MemoryGB: 128, + ECU: 71, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{300, 300}, }, { - Name: "r5d.12xlarge", - MemoryGB: 384, - ECU: 173, - Cores: 48, - MaxPods: 234, - EphemeralDisks: []int{900, 900}, + Name: "r5d.12xlarge", + MemoryGB: 384, + ECU: 173, + Cores: 48, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{900, 900}, }, { - Name: "r5d.24xlarge", - MemoryGB: 768, - ECU: 347, - Cores: 96, - MaxPods: 737, - EphemeralDisks: []int{900, 900, 900, 900}, + Name: "r5d.24xlarge", + MemoryGB: 768, + ECU: 347, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{900, 900, 900, 900}, }, // t1 family { - Name: "t1.micro", - MemoryGB: 0.613, - ECU: 1 * BurstableCreditsToECUS, - Cores: 1, - MaxPods: 4, - EphemeralDisks: nil, - Burstable: true, + Name: "t1.micro", + MemoryGB: 0.613, + ECU: 1 * BurstableCreditsToECUS, + Cores: 1, + InstanceENIs: 2, + InstanceIPsPerENI: 2, + EphemeralDisks: nil, + Burstable: true, }, // t2 family { - Name: "t2.nano", - MemoryGB: 0.5, - ECU: 3 * BurstableCreditsToECUS, - Cores: 1, - MaxPods: 4, - EphemeralDisks: nil, - Burstable: true, + Name: "t2.nano", + MemoryGB: 0.5, + ECU: 3 * BurstableCreditsToECUS, + Cores: 1, + InstanceENIs: 2, + InstanceIPsPerENI: 2, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t2.micro", - MemoryGB: 1, - ECU: 6 * BurstableCreditsToECUS, - Cores: 1, - MaxPods: 4, - EphemeralDisks: nil, - Burstable: true, + Name: "t2.micro", + MemoryGB: 1, + ECU: 6 * BurstableCreditsToECUS, + Cores: 1, + InstanceENIs: 2, + InstanceIPsPerENI: 2, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t2.small", - MemoryGB: 2, - ECU: 12 * BurstableCreditsToECUS, - Cores: 1, - MaxPods: 11, - EphemeralDisks: nil, - Burstable: true, + Name: "t2.small", + MemoryGB: 2, + ECU: 12 * BurstableCreditsToECUS, + Cores: 1, + InstanceENIs: 3, + InstanceIPsPerENI: 4, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t2.medium", - MemoryGB: 4, - ECU: 24 * BurstableCreditsToECUS, - Cores: 2, - MaxPods: 17, - EphemeralDisks: nil, - Burstable: true, + Name: "t2.medium", + MemoryGB: 4, + ECU: 24 * BurstableCreditsToECUS, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 6, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t2.large", - MemoryGB: 8, - ECU: 36 * BurstableCreditsToECUS, - Cores: 2, - MaxPods: 35, - EphemeralDisks: nil, - Burstable: true, + Name: "t2.large", + MemoryGB: 8, + ECU: 36 * BurstableCreditsToECUS, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 12, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t2.xlarge", - MemoryGB: 16, - ECU: 54 * BurstableCreditsToECUS, - Cores: 4, - MaxPods: 44, - EphemeralDisks: nil, - Burstable: true, + Name: "t2.xlarge", + MemoryGB: 16, + ECU: 54 * BurstableCreditsToECUS, + Cores: 4, + InstanceENIs: 3, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t2.2xlarge", - MemoryGB: 32, - ECU: 81.6 * BurstableCreditsToECUS, - Cores: 8, - MaxPods: 44, - EphemeralDisks: nil, - Burstable: true, + Name: "t2.2xlarge", + MemoryGB: 32, + ECU: 81.6 * BurstableCreditsToECUS, + Cores: 8, + InstanceENIs: 3, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + Burstable: true, }, // t3 family { - Name: "t3.nano", - MemoryGB: 0.5, - ECU: 6 * BurstableCreditsToECUS, - Cores: 2, - MaxPods: 4, - EphemeralDisks: nil, - Burstable: true, + Name: "t3.nano", + MemoryGB: 0.5, + ECU: 6 * BurstableCreditsToECUS, + Cores: 2, + InstanceENIs: 2, + InstanceIPsPerENI: 2, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t3.micro", - MemoryGB: 1, - ECU: 12 * BurstableCreditsToECUS, - Cores: 2, - MaxPods: 4, - EphemeralDisks: nil, - Burstable: true, + Name: "t3.micro", + MemoryGB: 1, + ECU: 12 * BurstableCreditsToECUS, + Cores: 2, + InstanceENIs: 2, + InstanceIPsPerENI: 2, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t3.small", - MemoryGB: 2, - ECU: 24 * BurstableCreditsToECUS, - Cores: 2, - MaxPods: 11, - EphemeralDisks: nil, - Burstable: true, + Name: "t3.small", + MemoryGB: 2, + ECU: 24 * BurstableCreditsToECUS, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 4, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t3.medium", - MemoryGB: 4, - ECU: 24 * BurstableCreditsToECUS, - Cores: 2, - MaxPods: 17, - EphemeralDisks: nil, - Burstable: true, + Name: "t3.medium", + MemoryGB: 4, + ECU: 24 * BurstableCreditsToECUS, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 6, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t3.large", - MemoryGB: 8, - ECU: 36 * BurstableCreditsToECUS, - Cores: 2, - MaxPods: 35, - EphemeralDisks: nil, - Burstable: true, + Name: "t3.large", + MemoryGB: 8, + ECU: 36 * BurstableCreditsToECUS, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 12, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t3.xlarge", - MemoryGB: 16, - ECU: 96 * BurstableCreditsToECUS, - Cores: 4, - MaxPods: 58, - EphemeralDisks: nil, - Burstable: true, + Name: "t3.xlarge", + MemoryGB: 16, + ECU: 96 * BurstableCreditsToECUS, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + Burstable: true, }, { - Name: "t3.2xlarge", - MemoryGB: 32, - ECU: 192 * BurstableCreditsToECUS, - Cores: 8, - MaxPods: 58, - EphemeralDisks: nil, - Burstable: true, + Name: "t3.2xlarge", + MemoryGB: 32, + ECU: 192 * BurstableCreditsToECUS, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + Burstable: true, }, // x1 family { - Name: "x1.16xlarge", - MemoryGB: 976, - ECU: 174.5, - Cores: 64, - MaxPods: 234, - EphemeralDisks: []int{1920}, + Name: "x1.16xlarge", + MemoryGB: 976, + ECU: 174.5, + Cores: 64, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{1920}, }, { - Name: "x1.32xlarge", - MemoryGB: 1952, - ECU: 349, - Cores: 128, - MaxPods: 234, - EphemeralDisks: []int{1920, 1920}, + Name: "x1.32xlarge", + MemoryGB: 1952, + ECU: 349, + Cores: 128, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{1920, 1920}, }, // x1e family { - Name: "x1e.xlarge", - MemoryGB: 122, - ECU: 12, - Cores: 4, - MaxPods: 29, - EphemeralDisks: []int{120}, + Name: "x1e.xlarge", + MemoryGB: 122, + ECU: 12, + Cores: 4, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{120}, }, { - Name: "x1e.2xlarge", - MemoryGB: 244, - ECU: 23, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{240}, + Name: "x1e.2xlarge", + MemoryGB: 244, + ECU: 23, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{240}, }, { - Name: "x1e.4xlarge", - MemoryGB: 488, - ECU: 47, - Cores: 16, - MaxPods: 58, - EphemeralDisks: []int{480}, + Name: "x1e.4xlarge", + MemoryGB: 488, + ECU: 47, + Cores: 16, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{480}, }, { - Name: "x1e.8xlarge", - MemoryGB: 976, - ECU: 91, - Cores: 32, - MaxPods: 58, - EphemeralDisks: []int{960}, + Name: "x1e.8xlarge", + MemoryGB: 976, + ECU: 91, + Cores: 32, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{960}, }, { - Name: "x1e.16xlarge", - MemoryGB: 1952, - ECU: 179, - Cores: 64, - MaxPods: 234, - EphemeralDisks: []int{1920}, + Name: "x1e.16xlarge", + MemoryGB: 1952, + ECU: 179, + Cores: 64, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{1920}, }, { - Name: "x1e.32xlarge", - MemoryGB: 3904, - ECU: 340, - Cores: 128, - MaxPods: 234, - EphemeralDisks: []int{1920, 1920}, + Name: "x1e.32xlarge", + MemoryGB: 3904, + ECU: 340, + Cores: 128, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{1920, 1920}, }, // z1d family { - Name: "z1d.large", - MemoryGB: 16, - ECU: 15, - Cores: 2, - MaxPods: 29, - EphemeralDisks: []int{75}, + Name: "z1d.large", + MemoryGB: 16, + ECU: 15, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: []int{75}, }, { - Name: "z1d.xlarge", - MemoryGB: 32, - ECU: 28, - Cores: 4, - MaxPods: 58, - EphemeralDisks: []int{150}, + Name: "z1d.xlarge", + MemoryGB: 32, + ECU: 28, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{150}, }, { - Name: "z1d.2xlarge", - MemoryGB: 64, - ECU: 53, - Cores: 8, - MaxPods: 58, - EphemeralDisks: []int{300}, + Name: "z1d.2xlarge", + MemoryGB: 64, + ECU: 53, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: []int{300}, }, { - Name: "z1d.3xlarge", - MemoryGB: 96, - ECU: 75, - Cores: 12, - MaxPods: 234, - EphemeralDisks: []int{450}, + Name: "z1d.3xlarge", + MemoryGB: 96, + ECU: 75, + Cores: 12, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{450}, }, { - Name: "z1d.6xlarge", - MemoryGB: 192, - ECU: 134, - Cores: 24, - MaxPods: 234, - EphemeralDisks: []int{900}, + Name: "z1d.6xlarge", + MemoryGB: 192, + ECU: 134, + Cores: 24, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: []int{900}, }, { - Name: "z1d.12xlarge", - MemoryGB: 384, - ECU: 271, - Cores: 48, - MaxPods: 737, - EphemeralDisks: []int{900, 900}, + Name: "z1d.12xlarge", + MemoryGB: 384, + ECU: 271, + Cores: 48, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{900, 900}, }, // END GENERATED CONTENT From 56a8059f8ea19a84000f5c392a1695a5ec67a911 Mon Sep 17 00:00:00 2001 From: Ripta Pasay Date: Sun, 25 Nov 2018 22:46:38 +0000 Subject: [PATCH 113/163] Update bazel --- hack/machine_types/BUILD.bazel | 6 ++++-- hack/machine_types/vpc_ip_resource_limit.go | 16 ++++++++++++++++ 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/hack/machine_types/BUILD.bazel b/hack/machine_types/BUILD.bazel index 7cac3d58e1e5a..d99c3354bbba4 100644 --- a/hack/machine_types/BUILD.bazel +++ b/hack/machine_types/BUILD.bazel @@ -2,12 +2,14 @@ load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library") go_library( name = "go_default_library", - srcs = ["machine_types.go"], + srcs = [ + "machine_types.go", + "vpc_ip_resource_limit.go", + ], importpath = "k8s.io/kops/hack/machine_types", visibility = ["//visibility:private"], deps = [ "//upup/pkg/fi/cloudup/awsup:go_default_library", - "//vendor/github.com/aws/amazon-vpc-cni-k8s/pkg/awsutils:go_default_library", "//vendor/github.com/aws/aws-sdk-go/aws:go_default_library", "//vendor/github.com/aws/aws-sdk-go/aws/awserr:go_default_library", "//vendor/github.com/aws/aws-sdk-go/aws/session:go_default_library", diff --git a/hack/machine_types/vpc_ip_resource_limit.go b/hack/machine_types/vpc_ip_resource_limit.go index a14ad019863f0..cd75ed57e3b36 100644 --- a/hack/machine_types/vpc_ip_resource_limit.go +++ b/hack/machine_types/vpc_ip_resource_limit.go @@ -1,3 +1,19 @@ +/* +Copyright 2018 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + // Copyright 2017-2018 Amazon.com, Inc. or its affiliates. All Rights Reserved. // // Licensed under the Apache License, Version 2.0 (the "License"). You may From 034bda589e6f1741ed453aff620e827d66390c2a Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Mon, 26 Nov 2018 09:26:24 -0800 Subject: [PATCH 114/163] fix(cmd/kops/create_cluster) default to anonymousAuth false for >=1.11, warn >=1.10 --- cmd/kops/create_cluster.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go index 3ef1342d96119..d8fca3c2ed5fc 100644 --- a/cmd/kops/create_cluster.go +++ b/cmd/kops/create_cluster.go @@ -1067,9 +1067,8 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e return fmt.Errorf("failed to parse kubernetes version: %s", err.Error()) } - // check if we should set anonymousAuth to false on k8s versions gte than 1.10 - // we do 1.10 since this is a really critical issues and 1.10 has support - if kv.IsGTE("1.10") { + // check if we should set anonymousAuth to false on k8s versions >=1.11 + if kv.IsGTE("1.11") { if cluster.Spec.Kubelet == nil { cluster.Spec.Kubelet = &api.KubeletConfigSpec{} } From e0fb2462ee14a0b0bf206174c662cbac3230c244 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Mon, 26 Nov 2018 09:28:57 -0800 Subject: [PATCH 115/163] chore: gofmt 1.10 --- cloudmock/aws/mockautoscaling/group.go | 14 +++++++------- nodeup/pkg/model/kubelet.go | 2 +- pkg/model/firewall_test.go | 2 +- pkg/pki/certificate_test.go | 2 +- upup/pkg/fi/cloudup/apply_cluster.go | 20 ++++++++++---------- upup/pkg/fi/fitasks/keypair.go | 2 +- upup/pkg/fi/vfs_castore.go | 2 +- 7 files changed, 22 insertions(+), 22 deletions(-) diff --git a/cloudmock/aws/mockautoscaling/group.go b/cloudmock/aws/mockautoscaling/group.go index 3360291348061..a013ff43fefb1 100644 --- a/cloudmock/aws/mockautoscaling/group.go +++ b/cloudmock/aws/mockautoscaling/group.go @@ -58,13 +58,13 @@ func (m *MockAutoscaling) CreateAutoScalingGroup(input *autoscaling.CreateAutoSc DefaultCooldown: input.DefaultCooldown, DesiredCapacity: input.DesiredCapacity, // EnabledMetrics: input.EnabledMetrics, - HealthCheckGracePeriod: input.HealthCheckGracePeriod, - HealthCheckType: input.HealthCheckType, - Instances: []*autoscaling.Instance{}, - LaunchConfigurationName: input.LaunchConfigurationName, - LoadBalancerNames: input.LoadBalancerNames, - MaxSize: input.MaxSize, - MinSize: input.MinSize, + HealthCheckGracePeriod: input.HealthCheckGracePeriod, + HealthCheckType: input.HealthCheckType, + Instances: []*autoscaling.Instance{}, + LaunchConfigurationName: input.LaunchConfigurationName, + LoadBalancerNames: input.LoadBalancerNames, + MaxSize: input.MaxSize, + MinSize: input.MinSize, NewInstancesProtectedFromScaleIn: input.NewInstancesProtectedFromScaleIn, PlacementGroup: input.PlacementGroup, // Status: input.Status, diff --git a/nodeup/pkg/model/kubelet.go b/nodeup/pkg/model/kubelet.go index f00e7b9e39391..73b0eb4684128 100644 --- a/nodeup/pkg/model/kubelet.go +++ b/nodeup/pkg/model/kubelet.go @@ -535,7 +535,7 @@ func (b *KubeletBuilder) buildMasterKubeletKubeconfig() (*nodetasks.File, error) template := &x509.Certificate{ BasicConstraintsValid: true, - IsCA: false, + IsCA: false, } template.Subject = pkix.Name{ diff --git a/pkg/model/firewall_test.go b/pkg/model/firewall_test.go index 93244a0779af8..7dcb74ab3fd0a 100644 --- a/pkg/model/firewall_test.go +++ b/pkg/model/firewall_test.go @@ -64,7 +64,7 @@ func Test_SharedGroups(t *testing.T) { func makeTestInstanceGroupSec(role kops.InstanceGroupRole, secGroup *string) *kops.InstanceGroup { return &kops.InstanceGroup{ Spec: kops.InstanceGroupSpec{ - Role: role, + Role: role, SecurityGroupOverride: secGroup, }, } diff --git a/pkg/pki/certificate_test.go b/pkg/pki/certificate_test.go index 5e08e3dd57c3c..18a795dcb69a9 100644 --- a/pkg/pki/certificate_test.go +++ b/pkg/pki/certificate_test.go @@ -58,7 +58,7 @@ func TestGenerateCertificate(t *testing.T) { KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign, ExtKeyUsage: []x509.ExtKeyUsage{}, BasicConstraintsValid: true, - IsCA: true, + IsCA: true, } cert, err := SignNewCertificate(key, template, nil, nil) diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go index 180e1aa3c3696..5c233199a6d62 100644 --- a/upup/pkg/fi/cloudup/apply_cluster.go +++ b/upup/pkg/fi/cloudup/apply_cluster.go @@ -414,16 +414,16 @@ func (c *ApplyClusterCmd) Run() error { "iamRolePolicy": &awstasks.IAMRolePolicy{}, // VPC / Networking - "dhcpOptions": &awstasks.DHCPOptions{}, - "internetGateway": &awstasks.InternetGateway{}, - "route": &awstasks.Route{}, - "routeTable": &awstasks.RouteTable{}, - "routeTableAssociation": &awstasks.RouteTableAssociation{}, - "securityGroup": &awstasks.SecurityGroup{}, - "securityGroupRule": &awstasks.SecurityGroupRule{}, - "subnet": &awstasks.Subnet{}, - "vpc": &awstasks.VPC{}, - "ngw": &awstasks.NatGateway{}, + "dhcpOptions": &awstasks.DHCPOptions{}, + "internetGateway": &awstasks.InternetGateway{}, + "route": &awstasks.Route{}, + "routeTable": &awstasks.RouteTable{}, + "routeTableAssociation": &awstasks.RouteTableAssociation{}, + "securityGroup": &awstasks.SecurityGroup{}, + "securityGroupRule": &awstasks.SecurityGroupRule{}, + "subnet": &awstasks.Subnet{}, + "vpc": &awstasks.VPC{}, + "ngw": &awstasks.NatGateway{}, "vpcDHDCPOptionsAssociation": &awstasks.VPCDHCPOptionsAssociation{}, // ELB diff --git a/upup/pkg/fi/fitasks/keypair.go b/upup/pkg/fi/fitasks/keypair.go index 828d1a4be5eb6..c44a75dc9dbcb 100644 --- a/upup/pkg/fi/fitasks/keypair.go +++ b/upup/pkg/fi/fitasks/keypair.go @@ -293,7 +293,7 @@ func buildCertificateTemplateForType(certificateType string) (*x509.Certificate, template := &x509.Certificate{ BasicConstraintsValid: true, - IsCA: false, + IsCA: false, } tokens := strings.Split(certificateType, ",") diff --git a/upup/pkg/fi/vfs_castore.go b/upup/pkg/fi/vfs_castore.go index bbf9f7afdadb0..c216d3b4de79c 100644 --- a/upup/pkg/fi/vfs_castore.go +++ b/upup/pkg/fi/vfs_castore.go @@ -144,7 +144,7 @@ func BuildCAX509Template() *x509.Certificate { KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign, ExtKeyUsage: []x509.ExtKeyUsage{}, BasicConstraintsValid: true, - IsCA: true, + IsCA: true, } return template } From 7de1c47281e979f5f5cdea2605db485bdebd3097 Mon Sep 17 00:00:00 2001 From: Jared Allard Date: Mon, 26 Nov 2018 09:32:00 -0800 Subject: [PATCH 116/163] chore: final gofmt run --- node-authorizer/pkg/client/helper.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/node-authorizer/pkg/client/helper.go b/node-authorizer/pkg/client/helper.go index 519553ea449fb..129ce2f633f78 100644 --- a/node-authorizer/pkg/client/helper.go +++ b/node-authorizer/pkg/client/helper.go @@ -98,7 +98,7 @@ func makeKubeconfig(ctx context.Context, config *Config, token string) ([]byte, { Name: clusterName, Cluster: v1.Cluster{ - Server: config.KubeAPI, + Server: config.KubeAPI, CertificateAuthorityData: content, }, }, From 0c5a0a57d2c9f0e3300815b12cae696d7ec2086a Mon Sep 17 00:00:00 2001 From: Justin Santa Barbara Date: Tue, 27 Nov 2018 06:40:29 -0500 Subject: [PATCH 117/163] Mark 1.11.0-beta.1 --- Makefile | 2 +- .../dns-controller.addons.k8s.io/k8s-1.6.yaml.template | 6 +++--- .../dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template | 6 +++--- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- .../tests/bootstrapchannelbuilder/cilium/manifest.yaml | 4 ++-- .../bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml | 4 ++-- .../tests/bootstrapchannelbuilder/simple/manifest.yaml | 4 ++-- .../tests/bootstrapchannelbuilder/weave/manifest.yaml | 4 ++-- version.go | 4 ++-- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/Makefile b/Makefile index e555501bbd0ce..22f5686436f59 100644 --- a/Makefile +++ b/Makefile @@ -54,7 +54,7 @@ unexport KOPS_BASE_URL KOPS_CLUSTER_NAME KOPS_RUN_OBSOLETE_VERSION KOPS_STATE_ST unexport SKIP_REGION_CHECK S3_ACCESS_KEY_ID S3_ENDPOINT S3_REGION S3_SECRET_ACCESS_KEY VSPHERE_USERNAME VSPHERE_PASSWORD # Keep in sync with upup/models/cloudup/resources/addons/dns-controller/ -DNS_CONTROLLER_TAG=1.11.0-alpha.1 +DNS_CONTROLLER_TAG=1.11.0-beta.1 # Keep in sync with logic in get_workspace_status # TODO: just invoke tools/get_workspace_status.sh? diff --git a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.6.yaml.template b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.6.yaml.template index 28104844801b6..77e19dc4b03df 100644 --- a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.6.yaml.template +++ b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.6.yaml.template @@ -6,7 +6,7 @@ metadata: labels: k8s-addon: dns-controller.addons.k8s.io k8s-app: dns-controller - version: v1.11.0-alpha.1 + version: v1.11.0-beta.1 spec: replicas: 1 selector: @@ -17,7 +17,7 @@ spec: labels: k8s-addon: dns-controller.addons.k8s.io k8s-app: dns-controller - version: v1.11.0-alpha.1 + version: v1.11.0-beta.1 annotations: scheduler.alpha.kubernetes.io/critical-pod: '' # For 1.6, we keep the old tolerations in case of a downgrade to 1.5 @@ -33,7 +33,7 @@ spec: serviceAccount: dns-controller containers: - name: dns-controller - image: kope/dns-controller:1.11.0-alpha.1 + image: kope/dns-controller:1.11.0-beta.1 command: {{ range $arg := DnsControllerArgv }} - "{{ $arg }}" diff --git a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template index 0152cd5d15912..988a24e20b2c6 100644 --- a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template +++ b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template @@ -6,7 +6,7 @@ metadata: labels: k8s-addon: dns-controller.addons.k8s.io k8s-app: dns-controller - version: v1.11.0-alpha.1 + version: v1.11.0-beta.1 spec: replicas: 1 selector: @@ -17,7 +17,7 @@ spec: labels: k8s-addon: dns-controller.addons.k8s.io k8s-app: dns-controller - version: v1.11.0-alpha.1 + version: v1.11.0-beta.1 annotations: scheduler.alpha.kubernetes.io/critical-pod: '' scheduler.alpha.kubernetes.io/tolerations: '[{"key": "dedicated", "value": "master"}]' @@ -28,7 +28,7 @@ spec: hostNetwork: true containers: - name: dns-controller - image: kope/dns-controller:1.11.0-alpha.1 + image: kope/dns-controller:1.11.0-beta.1 command: {{ range $arg := DnsControllerArgv }} - "{{ $arg }}" diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index f5f4bc44b3b16..e3ab43e81333e 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -284,7 +284,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri if externalDNS == nil || !externalDNS.Disable { { key := "dns-controller.addons.k8s.io" - version := "1.11.0-alpha.1" + version := "1.11.0-beta.1" { location := key + "/pre-k8s-1.6.yaml" diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml index eb4d052a07221..4ea05cbdc9861 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml @@ -41,14 +41,14 @@ spec: name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-alpha.1 + version: 1.11.0-beta.1 - id: k8s-1.6 kubernetesVersion: '>=1.6.0' manifest: dns-controller.addons.k8s.io/k8s-1.6.yaml name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-alpha.1 + version: 1.11.0-beta.1 - id: v1.7.0 kubernetesVersion: '>=1.7.0' manifest: storage-aws.addons.k8s.io/v1.7.0.yaml diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml index 4c7d06b00ed44..bbf351fa76f34 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml @@ -41,14 +41,14 @@ spec: name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-alpha.1 + version: 1.11.0-beta.1 - id: k8s-1.6 kubernetesVersion: '>=1.6.0' manifest: dns-controller.addons.k8s.io/k8s-1.6.yaml name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-alpha.1 + version: 1.11.0-beta.1 - id: v1.7.0 kubernetesVersion: '>=1.7.0' manifest: storage-aws.addons.k8s.io/v1.7.0.yaml diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml index 86002b53a2e7b..0e2aa241101ff 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml @@ -41,14 +41,14 @@ spec: name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-alpha.1 + version: 1.11.0-beta.1 - id: k8s-1.6 kubernetesVersion: '>=1.6.0' manifest: dns-controller.addons.k8s.io/k8s-1.6.yaml name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-alpha.1 + version: 1.11.0-beta.1 - id: v1.7.0 kubernetesVersion: '>=1.7.0' manifest: storage-aws.addons.k8s.io/v1.7.0.yaml diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml index 4d02e19993837..758cffbee8d5f 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml @@ -41,14 +41,14 @@ spec: name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-alpha.1 + version: 1.11.0-beta.1 - id: k8s-1.6 kubernetesVersion: '>=1.6.0' manifest: dns-controller.addons.k8s.io/k8s-1.6.yaml name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-alpha.1 + version: 1.11.0-beta.1 - id: v1.7.0 kubernetesVersion: '>=1.7.0' manifest: storage-aws.addons.k8s.io/v1.7.0.yaml diff --git a/version.go b/version.go index 729c505ce1dd5..ec6e0aa4dd892 100644 --- a/version.go +++ b/version.go @@ -23,8 +23,8 @@ var Version = KOPS_RELEASE_VERSION // These constants are parsed by build tooling - be careful about changing the formats const ( - KOPS_RELEASE_VERSION = "1.11.0-alpha.1" - KOPS_CI_VERSION = "1.11.0-alpha.2" + KOPS_RELEASE_VERSION = "1.11.0-beta.1" + KOPS_CI_VERSION = "1.11.0-beta.2" ) // GitVersion should be replaced by the makefile From b0d717868eafbea9ccc793b9fcb27c2aa3d1b7f6 Mon Sep 17 00:00:00 2001 From: mikesplain Date: Wed, 28 Nov 2018 17:00:14 -0500 Subject: [PATCH 118/163] Update amazon cni to 1.3.0 --- .../k8s-1.10.yaml.template | 19 ++++--------------- .../k8s-1.7.yaml.template | 19 ++++--------------- .../k8s-1.8.yaml.template | 19 ++++--------------- .../pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- 4 files changed, 13 insertions(+), 46 deletions(-) diff --git a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template index 5a1911d058179..689a234bcc9e1 100644 --- a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.10.yaml.template @@ -1,4 +1,4 @@ -# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.2.0/config/v1.2/aws-k8s-cni.yaml +# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.3.0/config/v1.3/aws-k8s-cni.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -22,15 +22,12 @@ rules: resources: - daemonsets verbs: ["list", "watch"] - --- - apiVersion: v1 kind: ServiceAccount metadata: name: aws-node namespace: kube-system - --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -44,9 +41,7 @@ subjects: - kind: ServiceAccount name: aws-node namespace: kube-system - --- - kind: DaemonSet apiVersion: extensions/v1beta1 metadata: @@ -70,16 +65,11 @@ spec: serviceAccountName: aws-node hostNetwork: true tolerations: - - effect: NoSchedule - operator: Exists - - effect: NoExecute - operator: Exists - - key: CriticalAddonsOnly - operator: Exists + - operator: Exists containers: - - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.2.1" }}" + - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.3.0" }}" ports: - - containerPort: 60000 + - containerPort: 61678 name: metrics name: aws-node env: @@ -120,7 +110,6 @@ spec: - name: dockersock hostPath: path: /var/run/docker.sock - --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition diff --git a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template index 1a3a8d53a63f7..ef8ec8079ad14 100644 --- a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.7.yaml.template @@ -1,4 +1,4 @@ -# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.2.0/config/v1.2/aws-k8s-cni.yaml +# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.3.0/config/v1.3/aws-k8s-cni.yaml apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRole @@ -22,15 +22,12 @@ rules: resources: - daemonsets verbs: ["list", "watch"] - --- - apiVersion: v1 kind: ServiceAccount metadata: name: aws-node namespace: kube-system - --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding @@ -44,9 +41,7 @@ subjects: - kind: ServiceAccount name: aws-node namespace: kube-system - --- - kind: DaemonSet apiVersion: extensions/v1beta1 metadata: @@ -70,16 +65,11 @@ spec: serviceAccountName: aws-node hostNetwork: true tolerations: - - effect: NoSchedule - operator: Exists - - effect: NoExecute - operator: Exists - - key: CriticalAddonsOnly - operator: Exists + - operator: Exists containers: - - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.2.1" }}" + - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.3.0" }}" ports: - - containerPort: 60000 + - containerPort: 61678 name: metrics name: aws-node env: @@ -120,7 +110,6 @@ spec: - name: dockersock hostPath: path: /var/run/docker.sock - --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition diff --git a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template index 6de995a5c6380..c45ff28b86451 100644 --- a/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template @@ -1,4 +1,4 @@ -# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.2.0/config/v1.2/aws-k8s-cni.yaml +# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.3.0/config/v1.3/aws-k8s-cni.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -22,15 +22,12 @@ rules: resources: - daemonsets verbs: ["list", "watch"] - --- - apiVersion: v1 kind: ServiceAccount metadata: name: aws-node namespace: kube-system - --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -44,9 +41,7 @@ subjects: - kind: ServiceAccount name: aws-node namespace: kube-system - --- - kind: DaemonSet apiVersion: extensions/v1beta1 metadata: @@ -70,16 +65,11 @@ spec: serviceAccountName: aws-node hostNetwork: true tolerations: - - effect: NoSchedule - operator: Exists - - effect: NoExecute - operator: Exists - - key: CriticalAddonsOnly - operator: Exists + - operator: Exists containers: - - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.2.1" }}" + - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.3.0" }}" ports: - - containerPort: 60000 + - containerPort: 61678 name: metrics name: aws-node env: @@ -120,7 +110,6 @@ spec: - name: dockersock hostPath: path: /var/run/docker.sock - --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index e3ab43e81333e..bb2a8b140790b 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -837,7 +837,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri if b.cluster.Spec.Networking.AmazonVPC != nil { key := "networking.amazon-vpc-routed-eni" - version := "1.2.1-kops.1" + version := "1.3.0-kops.1" { id := "k8s-1.7" From 7937e3d7ee0a7bdb287587adb7a5f2323555a8e8 Mon Sep 17 00:00:00 2001 From: Liran Polak Date: Wed, 28 Nov 2018 16:58:11 -0800 Subject: [PATCH 119/163] feat: bump controller version to 1.0.18 --- .../v1.8.0.yaml.template | 2 +- .../v1.9.0.yaml.template | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/upup/models/cloudup/resources/addons/spotinst-kubernetes-cluster-controller.addons.k8s.io/v1.8.0.yaml.template b/upup/models/cloudup/resources/addons/spotinst-kubernetes-cluster-controller.addons.k8s.io/v1.8.0.yaml.template index f8146d93c236e..4f2cbb0838226 100644 --- a/upup/models/cloudup/resources/addons/spotinst-kubernetes-cluster-controller.addons.k8s.io/v1.8.0.yaml.template +++ b/upup/models/cloudup/resources/addons/spotinst-kubernetes-cluster-controller.addons.k8s.io/v1.8.0.yaml.template @@ -97,7 +97,7 @@ spec: spec: containers: - name: spotinst-kubernetes-cluster-controller - image: spotinst/kubernetes-cluster-controller:1.0.16 + image: spotinst/kubernetes-cluster-controller:1.0.18 imagePullPolicy: Always env: - name: SPOTINST_TOKEN diff --git a/upup/models/cloudup/resources/addons/spotinst-kubernetes-cluster-controller.addons.k8s.io/v1.9.0.yaml.template b/upup/models/cloudup/resources/addons/spotinst-kubernetes-cluster-controller.addons.k8s.io/v1.9.0.yaml.template index 832a4e60e03bc..539315499dbd7 100644 --- a/upup/models/cloudup/resources/addons/spotinst-kubernetes-cluster-controller.addons.k8s.io/v1.9.0.yaml.template +++ b/upup/models/cloudup/resources/addons/spotinst-kubernetes-cluster-controller.addons.k8s.io/v1.9.0.yaml.template @@ -97,7 +97,7 @@ spec: spec: containers: - name: spotinst-kubernetes-cluster-controller - image: spotinst/kubernetes-cluster-controller:1.0.16 + image: spotinst/kubernetes-cluster-controller:1.0.18 imagePullPolicy: Always env: - name: SPOTINST_TOKEN From 7558dd85759a238e51b1bab2355ec8f260a1186f Mon Sep 17 00:00:00 2001 From: Liran Polak Date: Thu, 29 Nov 2018 15:59:42 -0800 Subject: [PATCH 120/163] fix: update bootstrapchannelbuilder --- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index bb2a8b140790b..406041e4eb978 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -447,7 +447,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri if featureflag.Spotinst.Enabled() { key := "spotinst-kubernetes-cluster-controller.addons.k8s.io" - version := "1.0.16" + version := "1.0.18" { id := "v1.8.0" From 28cdf84e1c61ff819fbcbc41956635632ac69bc9 Mon Sep 17 00:00:00 2001 From: Erik Stidham Date: Tue, 4 Dec 2018 12:36:56 -0600 Subject: [PATCH 121/163] Fix Calico upgrade job to use the correct version --- .../networking.projectcalico.org/k8s-1.7-v3.yaml.template | 4 ++-- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template index e2191ec29982f..8848988370b1f 100644 --- a/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template +++ b/upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.7-v3.yaml.template @@ -578,7 +578,7 @@ subjects: apiVersion: batch/v1 kind: Job metadata: - name: calico-complete-upgrade + name: calico-complete-upgrade-v331 namespace: kube-system labels: role.kubernetes.io/networking: "1" @@ -597,7 +597,7 @@ spec: command: ['/bin/sh', '-c', '/completion-job.sh'] env: - name: EXPECTED_NODE_IMAGE - value: quay.io/calico/node:v3.1.1 + value: quay.io/calico/node:v3.3.1 # The location of the Calico etcd cluster. - name: CALICO_ETCD_ENDPOINTS valueFrom: diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index bb2a8b140790b..e781365926bf5 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -645,7 +645,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri "pre-k8s-1.6": "2.4.2-kops.1", "k8s-1.6": "2.6.9-kops.1", "k8s-1.7": "2.6.9-kops.1", - "k8s-1.7-v3": "3.3.1-kops.2", + "k8s-1.7-v3": "3.3.1-kops.3", } if b.cluster.Spec.Networking.Calico.MajorVersion == "v3" { From f35d41154451d20e1bbd5af9e9dbf38fa66cb69f Mon Sep 17 00:00:00 2001 From: Rodrigo Menezes Date: Thu, 6 Dec 2018 01:05:54 -0800 Subject: [PATCH 122/163] Fix for when node and master use the same SG. --- pkg/model/awsmodel/autoscalinggroup.go | 3 ++- pkg/model/firewall.go | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/model/awsmodel/autoscalinggroup.go b/pkg/model/awsmodel/autoscalinggroup.go index aa50828cd1753..c651ed056c8a3 100644 --- a/pkg/model/awsmodel/autoscalinggroup.go +++ b/pkg/model/awsmodel/autoscalinggroup.go @@ -81,8 +81,9 @@ func (b *AutoscalingGroupModelBuilder) Build(c *fi.ModelBuilderContext) error { if ig.Spec.SecurityGroupOverride != nil { glog.V(1).Infof("WARNING: You are overwriting the Instance Groups, Security Group. When this is done you are responsible for ensure the correct rules!") + sgName := fmt.Sprintf("%v-%v", fi.StringValue(ig.Spec.SecurityGroupOverride), ig.Spec.Role) sgLink = &awstasks.SecurityGroup{ - Name: ig.Spec.SecurityGroupOverride, + Name: &sgName, ID: ig.Spec.SecurityGroupOverride, Shared: fi.Bool(true), } diff --git a/pkg/model/firewall.go b/pkg/model/firewall.go index 41e23f7917acb..dea08e12d6f39 100644 --- a/pkg/model/firewall.go +++ b/pkg/model/firewall.go @@ -483,8 +483,9 @@ func (b *KopsModelContext) GetSecurityGroups(role kops.InstanceGroupRole) ([]Sec } done[name] = true + sgName := fmt.Sprintf("%v-%v", fi.StringValue(ig.Spec.SecurityGroupOverride), role) t := &awstasks.SecurityGroup{ - Name: ig.Spec.SecurityGroupOverride, + Name: &sgName, ID: ig.Spec.SecurityGroupOverride, VPC: b.LinkToVPC(), Shared: fi.Bool(true), From 8ab0405ad543d5e2601c153b3498361de1e0e09b Mon Sep 17 00:00:00 2001 From: mikesplain Date: Mon, 3 Dec 2018 15:15:16 -0500 Subject: [PATCH 123/163] Workspace updates for bazel --- WORKSPACE | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/WORKSPACE b/WORKSPACE index d9ed5b1c97a57..cf5737f779fd3 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -1,16 +1,19 @@ +load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") +load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository") + #============================================================================= # Go rules http_archive( name = "io_bazel_rules_go", - url = "https://github.com/bazelbuild/rules_go/releases/download/0.14.1/rules_go-0.14.1.tar.gz", - sha256 = "ee0e3b346388c447f13009d789c8bf2d7bae4643ac70bd7997ded0ad09b2fff7", + url = "https://github.com/bazelbuild/rules_go/releases/download/0.15.8/rules_go-0.15.8.tar.gz", + sha256 = "ca79fed5b24dcc0696e1651ecdd916f7a11111283ba46ea07633a53d8e1f5199", ) http_archive( name = "bazel_gazelle", - url = "https://github.com/bazelbuild/bazel-gazelle/releases/download/0.14.0/bazel-gazelle-0.14.0.tar.gz", - sha256 = "c0a5739d12c6d05b6c1ad56f2200cb0b57c5a70e03ebd2f7b87ce88cabf09c7b", + url = "https://github.com/bazelbuild/bazel-gazelle/releases/download/0.15.0/bazel-gazelle-0.15.0.tar.gz", + sha256 = "6e875ab4b6bf64a38c352887760f21203ab054676d9c1b274963907e0768740d", ) load("@io_bazel_rules_go//go:def.bzl", "go_rules_dependencies", "go_register_toolchains") @@ -18,7 +21,7 @@ load("@io_bazel_rules_go//go:def.bzl", "go_rules_dependencies", "go_register_too go_rules_dependencies() go_register_toolchains( - go_version = "1.10.3", + go_version = "1.10.5", ) load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies") @@ -31,7 +34,7 @@ gazelle_dependencies() git_repository( name = "io_bazel_rules_docker", remote = "https://github.com/bazelbuild/rules_docker.git", - tag = "v0.4.0", + tag = "v0.5.1", ) load( From 0498f506025e483bbdd59e235aeb648ab2c4c413 Mon Sep 17 00:00:00 2001 From: Justin Santa Barbara Date: Tue, 27 Nov 2018 06:57:06 -0500 Subject: [PATCH 124/163] Add a1 and c5n instance types * Updated vpc_ip_resource_limits * Ran `make update-machine-types` --- hack/machine_types/vpc_ip_resource_limit.go | 22 ++++ upup/pkg/fi/cloudup/awsup/machine_types.go | 112 ++++++++++++++++++++ 2 files changed, 134 insertions(+) diff --git a/hack/machine_types/vpc_ip_resource_limit.go b/hack/machine_types/vpc_ip_resource_limit.go index cd75ed57e3b36..10adf26616ea9 100644 --- a/hack/machine_types/vpc_ip_resource_limit.go +++ b/hack/machine_types/vpc_ip_resource_limit.go @@ -32,6 +32,11 @@ package main // InstanceENIsAvailable contains a mapping of instance types to the number of ENIs available which is described at // https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI var InstanceENIsAvailable = map[string]int{ + "a1.medium": 2, + "a1.large": 3, + "a1.xlarge": 4, + "a1.2xlarge": 4, + "a1.4xlarge": 8, "c1.medium": 2, "c1.xlarge": 4, "c3.large": 3, @@ -56,6 +61,12 @@ var InstanceENIsAvailable = map[string]int{ "c5d.4xlarge": 8, "c5d.9xlarge": 8, "c5d.18xlarge": 15, + "c5n.large": 3, + "c5n.xlarge": 4, + "c5n.2xlarge": 4, + "c5n.4xlarge": 8, + "c5n.9xlarge": 8, + "c5n.18xlarge": 15, "cc2.8xlarge": 8, "cr1.8xlarge": 8, "d2.xlarge": 4, @@ -194,6 +205,11 @@ var InstanceENIsAvailable = map[string]int{ // InstanceIPsAvailable contains a mapping of instance types to the number of IPs per ENI // https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI var InstanceIPsAvailable = map[string]int64{ + "a1.medium": 4, + "a1.large": 10, + "a1.xlarge": 15, + "a1.2xlarge": 15, + "a1.4xlarge": 30, "c1.medium": 6, "c1.xlarge": 15, "c3.large": 10, @@ -218,6 +234,12 @@ var InstanceIPsAvailable = map[string]int64{ "c5d.4xlarge": 30, "c5d.9xlarge": 30, "c5d.18xlarge": 50, + "c5n.large": 10, + "c5n.xlarge": 15, + "c5n.2xlarge": 15, + "c5n.4xlarge": 30, + "c5n.9xlarge": 30, + "c5n.18xlarge": 50, "cc2.8xlarge": 30, "cr1.8xlarge": 30, "d2.xlarge": 15, diff --git a/upup/pkg/fi/cloudup/awsup/machine_types.go b/upup/pkg/fi/cloudup/awsup/machine_types.go index 07e5944e079e6..cb59804ee1fcb 100644 --- a/upup/pkg/fi/cloudup/awsup/machine_types.go +++ b/upup/pkg/fi/cloudup/awsup/machine_types.go @@ -80,6 +80,57 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ // NOTE: Content below is auto generated by `make update-machine-types` // BEGIN GENERATED CONTENT + // a1 family + { + Name: "a1.medium", + MemoryGB: 2, + ECU: 0, + Cores: 1, + InstanceENIs: 2, + InstanceIPsPerENI: 4, + EphemeralDisks: nil, + }, + + { + Name: "a1.large", + MemoryGB: 4, + ECU: 0, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, + }, + + { + Name: "a1.xlarge", + MemoryGB: 8, + ECU: 0, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + }, + + { + Name: "a1.2xlarge", + MemoryGB: 16, + ECU: 0, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + }, + + { + Name: "a1.4xlarge", + MemoryGB: 32, + ECU: 0, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, + }, + // c1 family { Name: "c1.medium", @@ -325,6 +376,67 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ EphemeralDisks: []int{900, 900}, }, + // c5n family + { + Name: "c5n.large", + MemoryGB: 5.25, + ECU: 0, + Cores: 2, + InstanceENIs: 3, + InstanceIPsPerENI: 10, + EphemeralDisks: nil, + }, + + { + Name: "c5n.xlarge", + MemoryGB: 10.5, + ECU: 0, + Cores: 4, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + }, + + { + Name: "c5n.2xlarge", + MemoryGB: 21, + ECU: 0, + Cores: 8, + InstanceENIs: 4, + InstanceIPsPerENI: 15, + EphemeralDisks: nil, + }, + + { + Name: "c5n.4xlarge", + MemoryGB: 42, + ECU: 0, + Cores: 16, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, + }, + + { + Name: "c5n.9xlarge", + MemoryGB: 96, + ECU: 0, + Cores: 36, + InstanceENIs: 8, + InstanceIPsPerENI: 30, + EphemeralDisks: nil, + }, + + { + Name: "c5n.18xlarge", + MemoryGB: 192, + ECU: 0, + Cores: 72, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, + }, + // cc2 family { Name: "cc2.8xlarge", From 9e21d6768a249f74c21c6de21602aaa127733def Mon Sep 17 00:00:00 2001 From: Eetu Jalonen Date: Tue, 4 Dec 2018 12:33:34 +0200 Subject: [PATCH 125/163] Add GCE europe-north1-{a,b,c} --- upup/pkg/fi/cloud.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/upup/pkg/fi/cloud.go b/upup/pkg/fi/cloud.go index 5fb051799d83c..428380887b4d3 100644 --- a/upup/pkg/fi/cloud.go +++ b/upup/pkg/fi/cloud.go @@ -177,6 +177,10 @@ var zonesToCloud = map[string]kops.CloudProviderID{ "australia-southeast1-b": kops.CloudProviderGCE, "australia-southeast1-c": kops.CloudProviderGCE, + "europe-north1-a": kops.CloudProviderGCE, + "europe-north1-b": kops.CloudProviderGCE, + "europe-north1-c": kops.CloudProviderGCE, + "europe-west1-a": kops.CloudProviderGCE, "europe-west1-b": kops.CloudProviderGCE, "europe-west1-c": kops.CloudProviderGCE, From 0554e07776a876643d5f26bd90784b7d0c21ec52 Mon Sep 17 00:00:00 2001 From: Rodrigo Menezes Date: Fri, 7 Dec 2018 00:20:32 -0800 Subject: [PATCH 126/163] ExperimentalAllowedUnsafeSysctls has moved to AllowedUnsafeSysctls in k8s 1.11 --- nodeup/pkg/model/kubelet.go | 9 +++++++++ pkg/apis/kops/componentconfig.go | 3 +++ pkg/apis/kops/v1alpha1/componentconfig.go | 5 ++++- pkg/apis/kops/v1alpha1/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go | 5 +++++ pkg/apis/kops/v1alpha2/componentconfig.go | 5 ++++- pkg/apis/kops/v1alpha2/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go | 5 +++++ pkg/apis/kops/zz_generated.deepcopy.go | 5 +++++ 9 files changed, 39 insertions(+), 2 deletions(-) diff --git a/nodeup/pkg/model/kubelet.go b/nodeup/pkg/model/kubelet.go index 9f099a8292fae..2db4768615f63 100644 --- a/nodeup/pkg/model/kubelet.go +++ b/nodeup/pkg/model/kubelet.go @@ -175,6 +175,15 @@ func (b *KubeletBuilder) buildSystemdEnvironmentFile(kubeletConfig *kops.Kubelet kubeletConfig.BootstrapKubeconfig = "" } + if kubeletConfig.ExperimentalAllowedUnsafeSysctls != nil { + // The ExperimentalAllowedUnsafeSysctls flag was renamed in k/k #63717 + if b.IsKubernetesGTE("1.11") { + glog.V(1).Info("ExperimentalAllowedUnsafeSysctls was renamed in k8s 1.11+, please use AllowedUnsafeSysctls instead.") + kubeletConfig.AllowedUnsafeSysctls = append(kubeletConfig.ExperimentalAllowedUnsafeSysctls, kubeletConfig.AllowedUnsafeSysctls...) + kubeletConfig.ExperimentalAllowedUnsafeSysctls = nil + } + } + // TODO: Dump the separate file for flags - just complexity! flags, err := flagbuilder.BuildFlags(kubeletConfig) if err != nil { diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index 494b47eb758fa..60aaaf3bf83d3 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -165,7 +165,10 @@ type KubeletConfigSpec struct { // Tells the Kubelet to fail to start if swap is enabled on the node. FailSwapOn *bool `json:"failSwapOn,omitempty" flag:"fail-swap-on"` // ExperimentalAllowedUnsafeSysctls are passed to the kubelet config to whitelist allowable sysctls + // Was promoted to beta and renamed. https://github.com/kubernetes/kubernetes/pull/63717 ExperimentalAllowedUnsafeSysctls []string `json:"experimentalAllowedUnsafeSysctls,omitempty" flag:"experimental-allowed-unsafe-sysctls"` + // AllowedUnsafeSysctls are passed to the kubelet config to whitelist allowable sysctls + AllowedUnsafeSysctls []string `json:"sllowedUnsafeSysctls,omitempty" flag:"allowed-unsafe-sysctls"` // StreamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed StreamingConnectionIdleTimeout *metav1.Duration `json:"streamingConnectionIdleTimeout,omitempty" flag:"streaming-connection-idle-timeout"` // DockerDisableSharedPID uses a shared PID namespace for containers in a pod. diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index eb1691bfbd247..26bc0447eedfd 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -165,7 +165,10 @@ type KubeletConfigSpec struct { // Tells the Kubelet to fail to start if swap is enabled on the node. FailSwapOn *bool `json:"failSwapOn,omitempty" flag:"fail-swap-on"` // ExperimentalAllowedUnsafeSysctls are passed to the kubelet config to whitelist allowable sysctls - ExperimentalAllowedUnsafeSysctls []string `json:"experimental_allowed_unsafe_sysctls,omitempty" flag:"experimental-allowed-unsafe-sysctls"` + // Was promoted to beta and renamed. https://github.com/kubernetes/kubernetes/pull/63717 + ExperimentalAllowedUnsafeSysctls []string `json:"experimentalAllowedUnsafeSysctls,omitempty" flag:"experimental-allowed-unsafe-sysctls"` + // AllowedUnsafeSysctls are passed to the kubelet config to whitelist allowable sysctls + AllowedUnsafeSysctls []string `json:"sllowedUnsafeSysctls,omitempty" flag:"allowed-unsafe-sysctls"` // StreamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed StreamingConnectionIdleTimeout *metav1.Duration `json:"streamingConnectionIdleTimeout,omitempty" flag:"streaming-connection-idle-timeout"` // DockerDisableSharedPID uses a shared PID namespace for containers in a pod. diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 9a18b514f658d..4680ce5503f94 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -2600,6 +2600,7 @@ func autoConvert_v1alpha1_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele out.VolumeStatsAggPeriod = in.VolumeStatsAggPeriod out.FailSwapOn = in.FailSwapOn out.ExperimentalAllowedUnsafeSysctls = in.ExperimentalAllowedUnsafeSysctls + out.AllowedUnsafeSysctls = in.AllowedUnsafeSysctls out.StreamingConnectionIdleTimeout = in.StreamingConnectionIdleTimeout out.DockerDisableSharedPID = in.DockerDisableSharedPID out.RootDir = in.RootDir @@ -2676,6 +2677,7 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha1_KubeletConfigSpec(in *kops.K out.VolumeStatsAggPeriod = in.VolumeStatsAggPeriod out.FailSwapOn = in.FailSwapOn out.ExperimentalAllowedUnsafeSysctls = in.ExperimentalAllowedUnsafeSysctls + out.AllowedUnsafeSysctls = in.AllowedUnsafeSysctls out.StreamingConnectionIdleTimeout = in.StreamingConnectionIdleTimeout out.DockerDisableSharedPID = in.DockerDisableSharedPID out.RootDir = in.RootDir diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index 79fd93ebe9eec..71480de1ab1c1 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -2788,6 +2788,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.AllowedUnsafeSysctls != nil { + in, out := &in.AllowedUnsafeSysctls, &out.AllowedUnsafeSysctls + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.StreamingConnectionIdleTimeout != nil { in, out := &in.StreamingConnectionIdleTimeout, &out.StreamingConnectionIdleTimeout if *in == nil { diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 097f0001abbfc..1480f72e59072 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -165,7 +165,10 @@ type KubeletConfigSpec struct { // Tells the Kubelet to fail to start if swap is enabled on the node. FailSwapOn *bool `json:"failSwapOn,omitempty" flag:"fail-swap-on"` // ExperimentalAllowedUnsafeSysctls are passed to the kubelet config to whitelist allowable sysctls - ExperimentalAllowedUnsafeSysctls []string `json:"experimental_allowed_unsafe_sysctls,omitempty" flag:"experimental-allowed-unsafe-sysctls"` + // Was promoted to beta and renamed. https://github.com/kubernetes/kubernetes/pull/63717 + ExperimentalAllowedUnsafeSysctls []string `json:"experimentalAllowedUnsafeSysctls,omitempty" flag:"experimental-allowed-unsafe-sysctls"` + // AllowedUnsafeSysctls are passed to the kubelet config to whitelist allowable sysctls + AllowedUnsafeSysctls []string `json:"sllowedUnsafeSysctls,omitempty" flag:"allowed-unsafe-sysctls"` // StreamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed StreamingConnectionIdleTimeout *metav1.Duration `json:"streamingConnectionIdleTimeout,omitempty" flag:"streaming-connection-idle-timeout"` // DockerDisableSharedPID uses a shared PID namespace for containers in a pod. diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 9b5034f4c8a55..1e5b78439ba80 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -2864,6 +2864,7 @@ func autoConvert_v1alpha2_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele out.VolumeStatsAggPeriod = in.VolumeStatsAggPeriod out.FailSwapOn = in.FailSwapOn out.ExperimentalAllowedUnsafeSysctls = in.ExperimentalAllowedUnsafeSysctls + out.AllowedUnsafeSysctls = in.AllowedUnsafeSysctls out.StreamingConnectionIdleTimeout = in.StreamingConnectionIdleTimeout out.DockerDisableSharedPID = in.DockerDisableSharedPID out.RootDir = in.RootDir @@ -2940,6 +2941,7 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha2_KubeletConfigSpec(in *kops.K out.VolumeStatsAggPeriod = in.VolumeStatsAggPeriod out.FailSwapOn = in.FailSwapOn out.ExperimentalAllowedUnsafeSysctls = in.ExperimentalAllowedUnsafeSysctls + out.AllowedUnsafeSysctls = in.AllowedUnsafeSysctls out.StreamingConnectionIdleTimeout = in.StreamingConnectionIdleTimeout out.DockerDisableSharedPID = in.DockerDisableSharedPID out.RootDir = in.RootDir diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index 2217484c0c32f..ff1b9267a9745 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -2869,6 +2869,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.AllowedUnsafeSysctls != nil { + in, out := &in.AllowedUnsafeSysctls, &out.AllowedUnsafeSysctls + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.StreamingConnectionIdleTimeout != nil { in, out := &in.StreamingConnectionIdleTimeout, &out.StreamingConnectionIdleTimeout if *in == nil { diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index 08c4e17020ca2..06fc54ae35041 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -3057,6 +3057,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.AllowedUnsafeSysctls != nil { + in, out := &in.AllowedUnsafeSysctls, &out.AllowedUnsafeSysctls + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.StreamingConnectionIdleTimeout != nil { in, out := &in.StreamingConnectionIdleTimeout, &out.StreamingConnectionIdleTimeout if *in == nil { From 1da60ccf058bb7e41a1087d561a87cb235063b49 Mon Sep 17 00:00:00 2001 From: Rodrigo Menezes Date: Fri, 7 Dec 2018 02:02:18 -0800 Subject: [PATCH 127/163] fix typo --- pkg/apis/kops/componentconfig.go | 2 +- pkg/apis/kops/v1alpha1/componentconfig.go | 2 +- pkg/apis/kops/v1alpha2/componentconfig.go | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index 60aaaf3bf83d3..2f7bfd330024b 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -168,7 +168,7 @@ type KubeletConfigSpec struct { // Was promoted to beta and renamed. https://github.com/kubernetes/kubernetes/pull/63717 ExperimentalAllowedUnsafeSysctls []string `json:"experimentalAllowedUnsafeSysctls,omitempty" flag:"experimental-allowed-unsafe-sysctls"` // AllowedUnsafeSysctls are passed to the kubelet config to whitelist allowable sysctls - AllowedUnsafeSysctls []string `json:"sllowedUnsafeSysctls,omitempty" flag:"allowed-unsafe-sysctls"` + AllowedUnsafeSysctls []string `json:"allowedUnsafeSysctls,omitempty" flag:"allowed-unsafe-sysctls"` // StreamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed StreamingConnectionIdleTimeout *metav1.Duration `json:"streamingConnectionIdleTimeout,omitempty" flag:"streaming-connection-idle-timeout"` // DockerDisableSharedPID uses a shared PID namespace for containers in a pod. diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index 26bc0447eedfd..8226a662695ee 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -168,7 +168,7 @@ type KubeletConfigSpec struct { // Was promoted to beta and renamed. https://github.com/kubernetes/kubernetes/pull/63717 ExperimentalAllowedUnsafeSysctls []string `json:"experimentalAllowedUnsafeSysctls,omitempty" flag:"experimental-allowed-unsafe-sysctls"` // AllowedUnsafeSysctls are passed to the kubelet config to whitelist allowable sysctls - AllowedUnsafeSysctls []string `json:"sllowedUnsafeSysctls,omitempty" flag:"allowed-unsafe-sysctls"` + AllowedUnsafeSysctls []string `json:"allowedUnsafeSysctls,omitempty" flag:"allowed-unsafe-sysctls"` // StreamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed StreamingConnectionIdleTimeout *metav1.Duration `json:"streamingConnectionIdleTimeout,omitempty" flag:"streaming-connection-idle-timeout"` // DockerDisableSharedPID uses a shared PID namespace for containers in a pod. diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 1480f72e59072..ff8e8ad855211 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -168,7 +168,7 @@ type KubeletConfigSpec struct { // Was promoted to beta and renamed. https://github.com/kubernetes/kubernetes/pull/63717 ExperimentalAllowedUnsafeSysctls []string `json:"experimentalAllowedUnsafeSysctls,omitempty" flag:"experimental-allowed-unsafe-sysctls"` // AllowedUnsafeSysctls are passed to the kubelet config to whitelist allowable sysctls - AllowedUnsafeSysctls []string `json:"sllowedUnsafeSysctls,omitempty" flag:"allowed-unsafe-sysctls"` + AllowedUnsafeSysctls []string `json:"allowedUnsafeSysctls,omitempty" flag:"allowed-unsafe-sysctls"` // StreamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed StreamingConnectionIdleTimeout *metav1.Duration `json:"streamingConnectionIdleTimeout,omitempty" flag:"streaming-connection-idle-timeout"` // DockerDisableSharedPID uses a shared PID namespace for containers in a pod. From 3a0262677b902fb0bd8dc0961139bdf80ce95e64 Mon Sep 17 00:00:00 2001 From: mikesplain Date: Fri, 21 Dec 2018 10:06:28 -0500 Subject: [PATCH 128/163] Add p3dn.24xlarge --- upup/pkg/fi/cloudup/awsup/machine_types.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/upup/pkg/fi/cloudup/awsup/machine_types.go b/upup/pkg/fi/cloudup/awsup/machine_types.go index 07e5944e079e6..276cc955e2d32 100644 --- a/upup/pkg/fi/cloudup/awsup/machine_types.go +++ b/upup/pkg/fi/cloudup/awsup/machine_types.go @@ -1077,6 +1077,18 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ GPU: true, }, + // p3dn family + { + Name: "p3dn.24xlarge", + MemoryGB: 768, + ECU: 345, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{900, 900}, + GPU: true, + }, + // r3 family { Name: "r3.large", From 2c204246567cebcb5badf11550cc2778aa9b79a9 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Fri, 21 Dec 2018 11:03:57 -0500 Subject: [PATCH 129/163] Release 1.11.0 --- Makefile | 2 +- .../dns-controller.addons.k8s.io/k8s-1.6.yaml.template | 6 +++--- .../dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template | 6 +++--- upup/pkg/fi/cloudup/bootstrapchannelbuilder.go | 2 +- .../tests/bootstrapchannelbuilder/cilium/manifest.yaml | 4 ++-- .../bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml | 4 ++-- .../tests/bootstrapchannelbuilder/simple/manifest.yaml | 4 ++-- .../tests/bootstrapchannelbuilder/weave/manifest.yaml | 4 ++-- version.go | 4 ++-- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/Makefile b/Makefile index 22f5686436f59..151a5024281a4 100644 --- a/Makefile +++ b/Makefile @@ -54,7 +54,7 @@ unexport KOPS_BASE_URL KOPS_CLUSTER_NAME KOPS_RUN_OBSOLETE_VERSION KOPS_STATE_ST unexport SKIP_REGION_CHECK S3_ACCESS_KEY_ID S3_ENDPOINT S3_REGION S3_SECRET_ACCESS_KEY VSPHERE_USERNAME VSPHERE_PASSWORD # Keep in sync with upup/models/cloudup/resources/addons/dns-controller/ -DNS_CONTROLLER_TAG=1.11.0-beta.1 +DNS_CONTROLLER_TAG=1.11.0 # Keep in sync with logic in get_workspace_status # TODO: just invoke tools/get_workspace_status.sh? diff --git a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.6.yaml.template b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.6.yaml.template index 77e19dc4b03df..f9d37b24c17dd 100644 --- a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.6.yaml.template +++ b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.6.yaml.template @@ -6,7 +6,7 @@ metadata: labels: k8s-addon: dns-controller.addons.k8s.io k8s-app: dns-controller - version: v1.11.0-beta.1 + version: v1.11.0 spec: replicas: 1 selector: @@ -17,7 +17,7 @@ spec: labels: k8s-addon: dns-controller.addons.k8s.io k8s-app: dns-controller - version: v1.11.0-beta.1 + version: v1.11.0 annotations: scheduler.alpha.kubernetes.io/critical-pod: '' # For 1.6, we keep the old tolerations in case of a downgrade to 1.5 @@ -33,7 +33,7 @@ spec: serviceAccount: dns-controller containers: - name: dns-controller - image: kope/dns-controller:1.11.0-beta.1 + image: kope/dns-controller:1.11.0 command: {{ range $arg := DnsControllerArgv }} - "{{ $arg }}" diff --git a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template index 988a24e20b2c6..433a5c526fad5 100644 --- a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template +++ b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/pre-k8s-1.6.yaml.template @@ -6,7 +6,7 @@ metadata: labels: k8s-addon: dns-controller.addons.k8s.io k8s-app: dns-controller - version: v1.11.0-beta.1 + version: v1.11.0 spec: replicas: 1 selector: @@ -17,7 +17,7 @@ spec: labels: k8s-addon: dns-controller.addons.k8s.io k8s-app: dns-controller - version: v1.11.0-beta.1 + version: v1.11.0 annotations: scheduler.alpha.kubernetes.io/critical-pod: '' scheduler.alpha.kubernetes.io/tolerations: '[{"key": "dedicated", "value": "master"}]' @@ -28,7 +28,7 @@ spec: hostNetwork: true containers: - name: dns-controller - image: kope/dns-controller:1.11.0-beta.1 + image: kope/dns-controller:1.11.0 command: {{ range $arg := DnsControllerArgv }} - "{{ $arg }}" diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go index 0db9c43618053..51737e3fd2a24 100644 --- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go +++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go @@ -284,7 +284,7 @@ func (b *BootstrapChannelBuilder) buildManifest() (*channelsapi.Addons, map[stri if externalDNS == nil || !externalDNS.Disable { { key := "dns-controller.addons.k8s.io" - version := "1.11.0-beta.1" + version := "1.11.0" { location := key + "/pre-k8s-1.6.yaml" diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml index 4ea05cbdc9861..cc6a57b112d99 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml @@ -41,14 +41,14 @@ spec: name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-beta.1 + version: 1.11.0 - id: k8s-1.6 kubernetesVersion: '>=1.6.0' manifest: dns-controller.addons.k8s.io/k8s-1.6.yaml name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-beta.1 + version: 1.11.0 - id: v1.7.0 kubernetesVersion: '>=1.7.0' manifest: storage-aws.addons.k8s.io/v1.7.0.yaml diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml index bbf351fa76f34..627792c5c7c37 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml @@ -41,14 +41,14 @@ spec: name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-beta.1 + version: 1.11.0 - id: k8s-1.6 kubernetesVersion: '>=1.6.0' manifest: dns-controller.addons.k8s.io/k8s-1.6.yaml name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-beta.1 + version: 1.11.0 - id: v1.7.0 kubernetesVersion: '>=1.7.0' manifest: storage-aws.addons.k8s.io/v1.7.0.yaml diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml index 0e2aa241101ff..3fb96ffe3ba1e 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml @@ -41,14 +41,14 @@ spec: name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-beta.1 + version: 1.11.0 - id: k8s-1.6 kubernetesVersion: '>=1.6.0' manifest: dns-controller.addons.k8s.io/k8s-1.6.yaml name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-beta.1 + version: 1.11.0 - id: v1.7.0 kubernetesVersion: '>=1.7.0' manifest: storage-aws.addons.k8s.io/v1.7.0.yaml diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml index 758cffbee8d5f..ba5401db099a1 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml @@ -41,14 +41,14 @@ spec: name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-beta.1 + version: 1.11.0 - id: k8s-1.6 kubernetesVersion: '>=1.6.0' manifest: dns-controller.addons.k8s.io/k8s-1.6.yaml name: dns-controller.addons.k8s.io selector: k8s-addon: dns-controller.addons.k8s.io - version: 1.11.0-beta.1 + version: 1.11.0 - id: v1.7.0 kubernetesVersion: '>=1.7.0' manifest: storage-aws.addons.k8s.io/v1.7.0.yaml diff --git a/version.go b/version.go index ec6e0aa4dd892..ccc3af47e4943 100644 --- a/version.go +++ b/version.go @@ -23,8 +23,8 @@ var Version = KOPS_RELEASE_VERSION // These constants are parsed by build tooling - be careful about changing the formats const ( - KOPS_RELEASE_VERSION = "1.11.0-beta.1" - KOPS_CI_VERSION = "1.11.0-beta.2" + KOPS_RELEASE_VERSION = "1.11.0" + KOPS_CI_VERSION = "1.11.1-alpha.1" ) // GitVersion should be replaced by the makefile From e6b770c293035543f852012fbba79fdcf1becaf3 Mon Sep 17 00:00:00 2001 From: Rodrigo Menezes Date: Sat, 8 Dec 2018 14:54:30 -0800 Subject: [PATCH 130/163] Let a user specify the validation timeout when rotating a cluster. --- cmd/kops/rollingupdatecluster.go | 1 + 1 file changed, 1 insertion(+) diff --git a/cmd/kops/rollingupdatecluster.go b/cmd/kops/rollingupdatecluster.go index dc5e9d0a1f701..e77eace623311 100644 --- a/cmd/kops/rollingupdatecluster.go +++ b/cmd/kops/rollingupdatecluster.go @@ -177,6 +177,7 @@ func NewCmdRollingUpdateCluster(f *util.Factory, out io.Writer) *cobra.Command { cmd.Flags().BoolVar(&options.Force, "force", options.Force, "Force rolling update, even if no changes") cmd.Flags().BoolVar(&options.CloudOnly, "cloudonly", options.CloudOnly, "Perform rolling update without confirming progress with k8s") + cmd.Flags().DurationVar(&options.ValidationTimeout, "validation-timeout", options.ValidationTimeout, "Maximum time to wait for a cluster to validate") cmd.Flags().DurationVar(&options.MasterInterval, "master-interval", options.MasterInterval, "Time to wait between restarting masters") cmd.Flags().DurationVar(&options.NodeInterval, "node-interval", options.NodeInterval, "Time to wait between restarting nodes") cmd.Flags().DurationVar(&options.BastionInterval, "bastion-interval", options.BastionInterval, "Time to wait between restarting bastions") From 5503308d3c37cf29a251a801e2f2796d47e4b49f Mon Sep 17 00:00:00 2001 From: Rodrigo Menezes Date: Sat, 8 Dec 2018 17:45:51 -0800 Subject: [PATCH 131/163] add docs --- docs/cli/kops_rolling-update_cluster.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/cli/kops_rolling-update_cluster.md b/docs/cli/kops_rolling-update_cluster.md index 5259afd7e4e43..817912c6f2f15 100644 --- a/docs/cli/kops_rolling-update_cluster.md +++ b/docs/cli/kops_rolling-update_cluster.md @@ -78,6 +78,7 @@ kops rolling-update cluster [flags] -i, --interactive Prompt to continue after each instance is updated --master-interval duration Time to wait between restarting masters (default 5m0s) --node-interval duration Time to wait between restarting nodes (default 4m0s) + --validation-timeout duration Maximum time to wait for a cluster to validate (default 5m0s) -y, --yes Perform rolling update immediately, without --yes rolling-update executes a dry-run ``` From f79f3efbb98cd4be80ccfd7328aa5537e1ca3164 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Wed, 2 Jan 2019 18:30:54 -0500 Subject: [PATCH 132/163] Recognize 2019 as a year Happy new year! --- hack/boilerplate/boilerplate.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hack/boilerplate/boilerplate.py b/hack/boilerplate/boilerplate.py index 21da02db9022c..8adc5adfa4481 100755 --- a/hack/boilerplate/boilerplate.py +++ b/hack/boilerplate/boilerplate.py @@ -176,7 +176,7 @@ def get_regexs(): # Search for "YEAR" which exists in the boilerplate, but shouldn't in the real thing regexs["year"] = re.compile( 'YEAR' ) # dates can be 2014, 2015, 2016, or 2017; company holder names can be anything - regexs["date"] = re.compile( '(2014|2015|2016|2017|2018)' ) + regexs["date"] = re.compile( '(2014|2015|2016|2017|2018|2019|2020|2021|2022)' ) # strip // +build \n\n build constraints regexs["go_build_constraints"] = re.compile(r"^(// \+build.*\n)+\n", re.MULTILINE) # strip #!.* from shell scripts From 3d54c0a5c0a2172e94049b18ac726e6253d79cbb Mon Sep 17 00:00:00 2001 From: Justin SB Date: Wed, 2 Jan 2019 22:52:52 -0500 Subject: [PATCH 133/163] Regenerate apimachinery to pick up new year --- pkg/apis/kops/v1alpha1/zz_generated.conversion.go | 2 +- pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go | 2 +- pkg/apis/kops/v1alpha1/zz_generated.defaults.go | 2 +- pkg/apis/kops/v1alpha2/zz_generated.conversion.go | 2 +- pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go | 2 +- pkg/apis/kops/v1alpha2/zz_generated.defaults.go | 2 +- pkg/apis/kops/zz_generated.deepcopy.go | 2 +- pkg/client/clientset_generated/clientset/clientset.go | 2 +- pkg/client/clientset_generated/clientset/doc.go | 2 +- .../clientset_generated/clientset/fake/clientset_generated.go | 2 +- pkg/client/clientset_generated/clientset/fake/doc.go | 2 +- pkg/client/clientset_generated/clientset/fake/register.go | 2 +- pkg/client/clientset_generated/clientset/scheme/doc.go | 2 +- pkg/client/clientset_generated/clientset/scheme/register.go | 2 +- .../clientset/typed/kops/internalversion/cluster.go | 2 +- .../clientset/typed/kops/internalversion/doc.go | 2 +- .../clientset/typed/kops/internalversion/fake/doc.go | 2 +- .../clientset/typed/kops/internalversion/fake/fake_cluster.go | 2 +- .../typed/kops/internalversion/fake/fake_instancegroup.go | 2 +- .../clientset/typed/kops/internalversion/fake/fake_keyset.go | 2 +- .../typed/kops/internalversion/fake/fake_kops_client.go | 2 +- .../typed/kops/internalversion/fake/fake_sshcredential.go | 2 +- .../clientset/typed/kops/internalversion/generated_expansion.go | 2 +- .../clientset/typed/kops/internalversion/instancegroup.go | 2 +- .../clientset/typed/kops/internalversion/keyset.go | 2 +- .../clientset/typed/kops/internalversion/kops_client.go | 2 +- .../clientset/typed/kops/internalversion/sshcredential.go | 2 +- .../clientset/typed/kops/v1alpha1/cluster.go | 2 +- .../clientset_generated/clientset/typed/kops/v1alpha1/doc.go | 2 +- .../clientset/typed/kops/v1alpha1/fake/doc.go | 2 +- .../clientset/typed/kops/v1alpha1/fake/fake_cluster.go | 2 +- .../clientset/typed/kops/v1alpha1/fake/fake_instancegroup.go | 2 +- .../clientset/typed/kops/v1alpha1/fake/fake_kops_client.go | 2 +- .../clientset/typed/kops/v1alpha1/fake/fake_sshcredential.go | 2 +- .../clientset/typed/kops/v1alpha1/generated_expansion.go | 2 +- .../clientset/typed/kops/v1alpha1/instancegroup.go | 2 +- .../clientset/typed/kops/v1alpha1/kops_client.go | 2 +- .../clientset/typed/kops/v1alpha1/sshcredential.go | 2 +- .../clientset/typed/kops/v1alpha2/cluster.go | 2 +- .../clientset_generated/clientset/typed/kops/v1alpha2/doc.go | 2 +- .../clientset/typed/kops/v1alpha2/fake/doc.go | 2 +- .../clientset/typed/kops/v1alpha2/fake/fake_cluster.go | 2 +- .../clientset/typed/kops/v1alpha2/fake/fake_instancegroup.go | 2 +- .../clientset/typed/kops/v1alpha2/fake/fake_keyset.go | 2 +- .../clientset/typed/kops/v1alpha2/fake/fake_kops_client.go | 2 +- .../clientset/typed/kops/v1alpha2/fake/fake_sshcredential.go | 2 +- .../clientset/typed/kops/v1alpha2/generated_expansion.go | 2 +- .../clientset/typed/kops/v1alpha2/instancegroup.go | 2 +- .../clientset_generated/clientset/typed/kops/v1alpha2/keyset.go | 2 +- .../clientset/typed/kops/v1alpha2/kops_client.go | 2 +- .../clientset/typed/kops/v1alpha2/sshcredential.go | 2 +- pkg/client/clientset_generated/internalclientset/clientset.go | 2 +- pkg/client/clientset_generated/internalclientset/doc.go | 2 +- .../internalclientset/fake/clientset_generated.go | 2 +- pkg/client/clientset_generated/internalclientset/fake/doc.go | 2 +- .../clientset_generated/internalclientset/fake/register.go | 2 +- pkg/client/clientset_generated/internalclientset/scheme/doc.go | 2 +- .../clientset_generated/internalclientset/scheme/register.go | 2 +- .../internalclientset/typed/kops/internalversion/cluster.go | 2 +- .../internalclientset/typed/kops/internalversion/doc.go | 2 +- .../internalclientset/typed/kops/internalversion/fake/doc.go | 2 +- .../typed/kops/internalversion/fake/fake_cluster.go | 2 +- .../typed/kops/internalversion/fake/fake_instancegroup.go | 2 +- .../typed/kops/internalversion/fake/fake_keyset.go | 2 +- .../typed/kops/internalversion/fake/fake_kops_client.go | 2 +- .../typed/kops/internalversion/fake/fake_sshcredential.go | 2 +- .../typed/kops/internalversion/generated_expansion.go | 2 +- .../typed/kops/internalversion/instancegroup.go | 2 +- .../internalclientset/typed/kops/internalversion/keyset.go | 2 +- .../internalclientset/typed/kops/internalversion/kops_client.go | 2 +- .../typed/kops/internalversion/sshcredential.go | 2 +- .../internalclientset/typed/kops/v1alpha1/cluster.go | 2 +- .../internalclientset/typed/kops/v1alpha1/doc.go | 2 +- .../internalclientset/typed/kops/v1alpha1/fake/doc.go | 2 +- .../internalclientset/typed/kops/v1alpha1/fake/fake_cluster.go | 2 +- .../typed/kops/v1alpha1/fake/fake_instancegroup.go | 2 +- .../typed/kops/v1alpha1/fake/fake_kops_client.go | 2 +- .../typed/kops/v1alpha1/fake/fake_sshcredential.go | 2 +- .../typed/kops/v1alpha1/generated_expansion.go | 2 +- .../internalclientset/typed/kops/v1alpha1/instancegroup.go | 2 +- .../internalclientset/typed/kops/v1alpha1/kops_client.go | 2 +- .../internalclientset/typed/kops/v1alpha1/sshcredential.go | 2 +- .../internalclientset/typed/kops/v1alpha2/cluster.go | 2 +- .../internalclientset/typed/kops/v1alpha2/doc.go | 2 +- .../internalclientset/typed/kops/v1alpha2/fake/doc.go | 2 +- .../internalclientset/typed/kops/v1alpha2/fake/fake_cluster.go | 2 +- .../typed/kops/v1alpha2/fake/fake_instancegroup.go | 2 +- .../internalclientset/typed/kops/v1alpha2/fake/fake_keyset.go | 2 +- .../typed/kops/v1alpha2/fake/fake_kops_client.go | 2 +- .../typed/kops/v1alpha2/fake/fake_sshcredential.go | 2 +- .../typed/kops/v1alpha2/generated_expansion.go | 2 +- .../internalclientset/typed/kops/v1alpha2/instancegroup.go | 2 +- .../internalclientset/typed/kops/v1alpha2/keyset.go | 2 +- .../internalclientset/typed/kops/v1alpha2/kops_client.go | 2 +- .../internalclientset/typed/kops/v1alpha2/sshcredential.go | 2 +- 95 files changed, 95 insertions(+), 95 deletions(-) diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 4680ce5503f94..d2c6856dab49a 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -1,7 +1,7 @@ // +build !ignore_autogenerated /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index 71480de1ab1c1..9772441545707 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -1,7 +1,7 @@ // +build !ignore_autogenerated /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/apis/kops/v1alpha1/zz_generated.defaults.go b/pkg/apis/kops/v1alpha1/zz_generated.defaults.go index 536f360071481..96886b13709e2 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.defaults.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.defaults.go @@ -1,7 +1,7 @@ // +build !ignore_autogenerated /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 1e5b78439ba80..2297f66a87155 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -1,7 +1,7 @@ // +build !ignore_autogenerated /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index ff1b9267a9745..509e5db1a1c39 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -1,7 +1,7 @@ // +build !ignore_autogenerated /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/apis/kops/v1alpha2/zz_generated.defaults.go b/pkg/apis/kops/v1alpha2/zz_generated.defaults.go index a8e7066afbbe1..83b43cbd4ecad 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.defaults.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.defaults.go @@ -1,7 +1,7 @@ // +build !ignore_autogenerated /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index 06fc54ae35041..f074f40aeabce 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -1,7 +1,7 @@ // +build !ignore_autogenerated /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/clientset.go b/pkg/client/clientset_generated/clientset/clientset.go index 9575b87a0647c..594fa0386d560 100644 --- a/pkg/client/clientset_generated/clientset/clientset.go +++ b/pkg/client/clientset_generated/clientset/clientset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/doc.go b/pkg/client/clientset_generated/clientset/doc.go index 3421911a75a9a..42d06de7ad3a9 100644 --- a/pkg/client/clientset_generated/clientset/doc.go +++ b/pkg/client/clientset_generated/clientset/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/fake/clientset_generated.go b/pkg/client/clientset_generated/clientset/fake/clientset_generated.go index 3db2008b01eff..e1546c9406342 100644 --- a/pkg/client/clientset_generated/clientset/fake/clientset_generated.go +++ b/pkg/client/clientset_generated/clientset/fake/clientset_generated.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/fake/doc.go b/pkg/client/clientset_generated/clientset/fake/doc.go index 0bc260bcaa22a..acfa6173b9e8e 100644 --- a/pkg/client/clientset_generated/clientset/fake/doc.go +++ b/pkg/client/clientset_generated/clientset/fake/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/fake/register.go b/pkg/client/clientset_generated/clientset/fake/register.go index fa7c7f84d9324..248982e49adca 100644 --- a/pkg/client/clientset_generated/clientset/fake/register.go +++ b/pkg/client/clientset_generated/clientset/fake/register.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/scheme/doc.go b/pkg/client/clientset_generated/clientset/scheme/doc.go index 5c5c8debb6b4f..7f61dc1f9f6ec 100644 --- a/pkg/client/clientset_generated/clientset/scheme/doc.go +++ b/pkg/client/clientset_generated/clientset/scheme/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/scheme/register.go b/pkg/client/clientset_generated/clientset/scheme/register.go index 969dae2f7f033..ae73019ebd578 100644 --- a/pkg/client/clientset_generated/clientset/scheme/register.go +++ b/pkg/client/clientset_generated/clientset/scheme/register.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/cluster.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/cluster.go index 0d70898e7b99a..3a565b1bf2188 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/cluster.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/doc.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/doc.go index b057e52013085..e168891358392 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/doc.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/doc.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/doc.go index 87a1873edccb3..ab4fd43ad6e01 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/doc.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_cluster.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_cluster.go index a746be11a653b..e2caab37e29ff 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_cluster.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_instancegroup.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_instancegroup.go index 6647d8c828c67..e219d03b2723f 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_instancegroup.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_keyset.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_keyset.go index 0aeedde4a3743..7a514572fc6ae 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_keyset.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_keyset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_kops_client.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_kops_client.go index 9b67dbac25ab0..0da4252affd49 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_kops_client.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_sshcredential.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_sshcredential.go index 0a6bb3149071c..9c89c1047493e 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_sshcredential.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/fake/fake_sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/generated_expansion.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/generated_expansion.go index 41aba5b81adc6..f305c12cfbb3b 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/generated_expansion.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/generated_expansion.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/instancegroup.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/instancegroup.go index cd8e8468eb19d..d7c6568f5b103 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/instancegroup.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/keyset.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/keyset.go index dfa6de0843a89..0cd39a62e6e6c 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/keyset.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/keyset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/kops_client.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/kops_client.go index da7f81f41ad6a..0d7dd465f21f3 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/kops_client.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/sshcredential.go b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/sshcredential.go index 0657c4f30f4f5..ec520733c7edc 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/internalversion/sshcredential.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/internalversion/sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/cluster.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/cluster.go index a0595c2e55e76..adbd851ba8010 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/cluster.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/doc.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/doc.go index 69ca30111b4cd..9752e759caa07 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/doc.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/doc.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/doc.go index 87a1873edccb3..ab4fd43ad6e01 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/doc.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_cluster.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_cluster.go index f01ad222b6dc8..2908735bef423 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_cluster.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_instancegroup.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_instancegroup.go index 9815a09d966f0..c575da471ada2 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_instancegroup.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_kops_client.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_kops_client.go index a90ba1813f5c2..d3d688686ac80 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_kops_client.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_sshcredential.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_sshcredential.go index eb77602e270db..4508a54a25741 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_sshcredential.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/fake/fake_sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/generated_expansion.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/generated_expansion.go index 79fabfc3a2ada..37793a8c40516 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/generated_expansion.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/generated_expansion.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/instancegroup.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/instancegroup.go index 7bed24d96d61b..fd2c8117f35b1 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/instancegroup.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/kops_client.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/kops_client.go index c04b76b2b776e..2cf72b4fcea5c 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/kops_client.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/sshcredential.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/sshcredential.go index 084b8539f91b4..0efc5fac8b25d 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/sshcredential.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha1/sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/cluster.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/cluster.go index 84b0ec2b5fe6a..c5a40f129d955 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/cluster.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/doc.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/doc.go index 01dd46de84d8d..e4cda4fe26734 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/doc.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/doc.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/doc.go index 87a1873edccb3..ab4fd43ad6e01 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/doc.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_cluster.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_cluster.go index 94a3dcffe6a08..db23945ceed65 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_cluster.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_instancegroup.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_instancegroup.go index f4cd2508e1a8a..e78cf043f6641 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_instancegroup.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_keyset.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_keyset.go index c3a2bba02993d..d6a5e767d7882 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_keyset.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_keyset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_kops_client.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_kops_client.go index 564c3d183dc64..e1c8bc25d5588 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_kops_client.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_sshcredential.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_sshcredential.go index eb505ade8d3e1..e15c83d6932b4 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_sshcredential.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/fake/fake_sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/generated_expansion.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/generated_expansion.go index 9c61848846512..9b98449352673 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/generated_expansion.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/generated_expansion.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/instancegroup.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/instancegroup.go index eb2675ba21f23..1176424573a81 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/instancegroup.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/keyset.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/keyset.go index e6bcd4e5f9050..add0eb31415cc 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/keyset.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/keyset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/kops_client.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/kops_client.go index a3d396341b4c0..a62b6a5a0a5fc 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/kops_client.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/sshcredential.go b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/sshcredential.go index 00d427824b8da..026630b8e9e9e 100644 --- a/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/sshcredential.go +++ b/pkg/client/clientset_generated/clientset/typed/kops/v1alpha2/sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/clientset.go b/pkg/client/clientset_generated/internalclientset/clientset.go index b23d4f12b61ca..da7d7249213cd 100644 --- a/pkg/client/clientset_generated/internalclientset/clientset.go +++ b/pkg/client/clientset_generated/internalclientset/clientset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/doc.go b/pkg/client/clientset_generated/internalclientset/doc.go index 22ccee9196839..b48cc80c37a31 100644 --- a/pkg/client/clientset_generated/internalclientset/doc.go +++ b/pkg/client/clientset_generated/internalclientset/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/fake/clientset_generated.go b/pkg/client/clientset_generated/internalclientset/fake/clientset_generated.go index 78aefd7b88aed..a53091807ad71 100644 --- a/pkg/client/clientset_generated/internalclientset/fake/clientset_generated.go +++ b/pkg/client/clientset_generated/internalclientset/fake/clientset_generated.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/fake/doc.go b/pkg/client/clientset_generated/internalclientset/fake/doc.go index 0bc260bcaa22a..acfa6173b9e8e 100644 --- a/pkg/client/clientset_generated/internalclientset/fake/doc.go +++ b/pkg/client/clientset_generated/internalclientset/fake/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/fake/register.go b/pkg/client/clientset_generated/internalclientset/fake/register.go index fa7c7f84d9324..248982e49adca 100644 --- a/pkg/client/clientset_generated/internalclientset/fake/register.go +++ b/pkg/client/clientset_generated/internalclientset/fake/register.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/scheme/doc.go b/pkg/client/clientset_generated/internalclientset/scheme/doc.go index 5c5c8debb6b4f..7f61dc1f9f6ec 100644 --- a/pkg/client/clientset_generated/internalclientset/scheme/doc.go +++ b/pkg/client/clientset_generated/internalclientset/scheme/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/scheme/register.go b/pkg/client/clientset_generated/internalclientset/scheme/register.go index 969dae2f7f033..ae73019ebd578 100644 --- a/pkg/client/clientset_generated/internalclientset/scheme/register.go +++ b/pkg/client/clientset_generated/internalclientset/scheme/register.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/cluster.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/cluster.go index e118ae90c4441..c14763494cbe0 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/cluster.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/doc.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/doc.go index b057e52013085..e168891358392 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/doc.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/doc.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/doc.go index 87a1873edccb3..ab4fd43ad6e01 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/doc.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_cluster.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_cluster.go index a746be11a653b..e2caab37e29ff 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_cluster.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_instancegroup.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_instancegroup.go index 6647d8c828c67..e219d03b2723f 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_instancegroup.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_keyset.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_keyset.go index 0aeedde4a3743..7a514572fc6ae 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_keyset.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_keyset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_kops_client.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_kops_client.go index 307f3699a1bc6..37eec8de4e4ad 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_kops_client.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_sshcredential.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_sshcredential.go index 0a6bb3149071c..9c89c1047493e 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_sshcredential.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/fake/fake_sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/generated_expansion.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/generated_expansion.go index 41aba5b81adc6..f305c12cfbb3b 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/generated_expansion.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/generated_expansion.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/instancegroup.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/instancegroup.go index ee251de1be94d..6f23a76af4c10 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/instancegroup.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/keyset.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/keyset.go index 944a5ca542958..03341688b9f30 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/keyset.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/keyset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/kops_client.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/kops_client.go index 7988b7aeaa919..c7afe0f2c02fe 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/kops_client.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/sshcredential.go b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/sshcredential.go index 6f6fcdb08fb07..f5a95be0087a5 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/sshcredential.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/internalversion/sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/cluster.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/cluster.go index a16d4ac7c84fb..de841f68a3b16 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/cluster.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/doc.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/doc.go index 69ca30111b4cd..9752e759caa07 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/doc.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/doc.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/doc.go index 87a1873edccb3..ab4fd43ad6e01 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/doc.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_cluster.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_cluster.go index f01ad222b6dc8..2908735bef423 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_cluster.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_instancegroup.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_instancegroup.go index 9815a09d966f0..c575da471ada2 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_instancegroup.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_kops_client.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_kops_client.go index 83fa6ae395f28..ad0da22ba9a54 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_kops_client.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_sshcredential.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_sshcredential.go index eb77602e270db..4508a54a25741 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_sshcredential.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/fake/fake_sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/generated_expansion.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/generated_expansion.go index 79fabfc3a2ada..37793a8c40516 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/generated_expansion.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/generated_expansion.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/instancegroup.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/instancegroup.go index ab4bfe535a786..52c12d2ba4919 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/instancegroup.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/kops_client.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/kops_client.go index bfb6cc782c1c0..6d59b63ffafb8 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/kops_client.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/sshcredential.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/sshcredential.go index ee9c67557a640..ecb20d456e53f 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/sshcredential.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha1/sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/cluster.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/cluster.go index 548d7bb46ad09..1b76948afb7ce 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/cluster.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/doc.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/doc.go index 01dd46de84d8d..e4cda4fe26734 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/doc.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/doc.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/doc.go index 87a1873edccb3..ab4fd43ad6e01 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/doc.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_cluster.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_cluster.go index 94a3dcffe6a08..db23945ceed65 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_cluster.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_cluster.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_instancegroup.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_instancegroup.go index f4cd2508e1a8a..e78cf043f6641 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_instancegroup.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_keyset.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_keyset.go index c3a2bba02993d..d6a5e767d7882 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_keyset.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_keyset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_kops_client.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_kops_client.go index e6f0d4986f30f..b7bea481afd8a 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_kops_client.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_sshcredential.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_sshcredential.go index eb505ade8d3e1..e15c83d6932b4 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_sshcredential.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/fake/fake_sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/generated_expansion.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/generated_expansion.go index 9c61848846512..9b98449352673 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/generated_expansion.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/generated_expansion.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/instancegroup.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/instancegroup.go index 17bff7fa28d3c..4cb8bbb9264b3 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/instancegroup.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/instancegroup.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/keyset.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/keyset.go index 47bc758a122c1..9a844221deb5a 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/keyset.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/keyset.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/kops_client.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/kops_client.go index 09c345c643aa6..e57f2f5fced3f 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/kops_client.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/kops_client.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/sshcredential.go b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/sshcredential.go index ea966a6302720..4bbc8aa6998b4 100644 --- a/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/sshcredential.go +++ b/pkg/client/clientset_generated/internalclientset/typed/kops/v1alpha2/sshcredential.go @@ -1,5 +1,5 @@ /* -Copyright 2018 The Kubernetes Authors. +Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. From 2374b109293df0980868a84a3ab56eeeac09a943 Mon Sep 17 00:00:00 2001 From: Justin Santa Barbara Date: Fri, 7 Dec 2018 10:11:17 -0500 Subject: [PATCH 134/163] Don't panic when an etcd cluster is added Not entirely clear what validation we should do here, but we shouldn't panic! Fix #6133 --- pkg/apis/kops/validation/cluster.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkg/apis/kops/validation/cluster.go b/pkg/apis/kops/validation/cluster.go index 44e36be697be1..5d2e1890b4d30 100644 --- a/pkg/apis/kops/validation/cluster.go +++ b/pkg/apis/kops/validation/cluster.go @@ -44,7 +44,9 @@ func ValidateClusterUpdate(obj *kops.Cluster, status *kops.ClusterStatus, old *k fp := field.NewPath("spec", "etcdClusters").Key(k) oldCluster := oldClusters[k] - allErrs = append(allErrs, validateEtcdClusterUpdate(fp, newCluster, status, oldCluster)...) + if oldCluster != nil { + allErrs = append(allErrs, validateEtcdClusterUpdate(fp, newCluster, status, oldCluster)...) + } } for k := range oldClusters { newCluster := newClusters[k] From 7e6b0d0487e48d750ccc3e51453586867e87ee22 Mon Sep 17 00:00:00 2001 From: Bruno Date: Wed, 12 Dec 2018 11:46:22 +0100 Subject: [PATCH 135/163] Add Docker 18.06.1 for CentOS and RHEL 7 --- nodeup/pkg/model/docker.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/nodeup/pkg/model/docker.go b/nodeup/pkg/model/docker.go index b8ed571a72000..cbcd352b352fe 100644 --- a/nodeup/pkg/model/docker.go +++ b/nodeup/pkg/model/docker.go @@ -539,6 +539,18 @@ var dockerVersions = []dockerVersion{ Hash: "18473b80e61b6d4eb8b52d87313abd71261287e5", Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, }, + + // 18.06.1 - CentOS / Rhel7 + { + DockerVersion: "18.06.1", + Name: "docker-ce", + Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "18.06.1.ce", + Source: "https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-18.06.1.ce-3.el7.x86_64.rpm", + Hash: "0a1325e570c5e54111a79623c9fd0c0c714d3a11", + Dependencies: []string{"libtool-ltdl", "libseccomp", "libcgroup"}, + }, } func (d *dockerVersion) matches(arch Architecture, dockerVersion string, distro distros.Distribution) bool { From 4255107874184f2041cabdc679a6de41bcd4a155 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Fri, 25 Jan 2019 10:01:47 -0500 Subject: [PATCH 136/163] Update go version to 1.10.8 We pick up the crypto fixes --- WORKSPACE | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/WORKSPACE b/WORKSPACE index cf5737f779fd3..3e13483add90d 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -6,8 +6,8 @@ load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository") http_archive( name = "io_bazel_rules_go", - url = "https://github.com/bazelbuild/rules_go/releases/download/0.15.8/rules_go-0.15.8.tar.gz", - sha256 = "ca79fed5b24dcc0696e1651ecdd916f7a11111283ba46ea07633a53d8e1f5199", + url = "https://github.com/bazelbuild/rules_go/releases/download/0.15.11/rules_go-0.15.11.tar.gz", + sha256 = "7b7c74740e3a757204ddb93241ce728906af795d6c6aa0950e0e640716dc1e4a", ) http_archive( @@ -21,7 +21,7 @@ load("@io_bazel_rules_go//go:def.bzl", "go_rules_dependencies", "go_register_too go_rules_dependencies() go_register_toolchains( - go_version = "1.10.5", + go_version = "1.10.8", ) load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies") From b8f95d11650f626a8c3c5733b85945c91b07e873 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Mon, 28 Jan 2019 13:08:51 -0500 Subject: [PATCH 137/163] Normalize etcd cluster provider names Instead of just casting a string, we validate and normalize. --- pkg/commands/set_cluster.go | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/pkg/commands/set_cluster.go b/pkg/commands/set_cluster.go index b64ea14df74d5..4c4a9b08d36b8 100644 --- a/pkg/commands/set_cluster.go +++ b/pkg/commands/set_cluster.go @@ -109,8 +109,12 @@ func SetClusterFields(fields []string, cluster *api.Cluster, instanceGroups []*a c.Version = kv[1] } case "cluster.spec.etcdClusters[*].provider": + p, err := toEtcdProviderType(kv[1]) + if err != nil { + return err + } for _, etcd := range cluster.Spec.EtcdClusters { - etcd.Provider = api.EtcdProviderType(kv[1]) + etcd.Provider = p } case "cluster.spec.etcdClusters[*].manager.image": for _, etcd := range cluster.Spec.EtcdClusters { @@ -125,3 +129,15 @@ func SetClusterFields(fields []string, cluster *api.Cluster, instanceGroups []*a } return nil } + +func toEtcdProviderType(in string) (api.EtcdProviderType, error) { + s := strings.ToLower(in) + switch s { + case "legacy": + return api.EtcdProviderTypeLegacy, nil + case "manager": + return api.EtcdProviderTypeManager, nil + default: + return api.EtcdProviderTypeManager, fmt.Errorf("unknown etcd provider type %q", in) + } +} From 65e2fb2db4bb464eab32b5112243db620caa6fd5 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Mon, 28 Jan 2019 14:07:19 -0500 Subject: [PATCH 138/163] Support etcd-manager v3, suitable for backporting Add etcd-manager v3 in a way that we can safely backport. --- docs/etcd/manager.md | 2 +- nodeup/pkg/model/BUILD.bazel | 1 + nodeup/pkg/model/context.go | 14 ++++- nodeup/pkg/model/etcd_manager_tls.go | 63 +++++++++++++++++++ pkg/model/components/etcdmanager/model.go | 54 ++++++++++++++-- .../etcdmanager/tests/minimal/tasks.yaml | 56 +++++++++++++---- upup/pkg/fi/nodeup/command.go | 1 + 7 files changed, 171 insertions(+), 20 deletions(-) create mode 100644 nodeup/pkg/model/etcd_manager_tls.go diff --git a/docs/etcd/manager.md b/docs/etcd/manager.md index d24f9e35b84da..00ac322deb048 100644 --- a/docs/etcd/manager.md +++ b/docs/etcd/manager.md @@ -41,7 +41,7 @@ it won't change the configuration: ```bash # Enable etcd-manager -kops set cluster cluster.spec.etcdClusters[*].manager.image=kopeio/etcd-manager:latest +kops set cluster cluster.spec.etcdClusters[*].provider=Manager kops update cluster --yes kops rolling-update cluster --yes diff --git a/nodeup/pkg/model/BUILD.bazel b/nodeup/pkg/model/BUILD.bazel index 5d61c73d835da..e35410b3487a0 100644 --- a/nodeup/pkg/model/BUILD.bazel +++ b/nodeup/pkg/model/BUILD.bazel @@ -10,6 +10,7 @@ go_library( "directories.go", "docker.go", "etcd.go", + "etcd_manager_tls.go", "etcd_tls.go", "file_assets.go", "firewall.go", diff --git a/nodeup/pkg/model/context.go b/nodeup/pkg/model/context.go index 14a545a70fe8b..36bbab548eb20 100644 --- a/nodeup/pkg/model/context.go +++ b/nodeup/pkg/model/context.go @@ -371,8 +371,13 @@ func (c *NodeupModelContext) BuildCertificateTask(ctx *fi.ModelBuilderContext, n return err } + p := filename + if !filepath.IsAbs(p) { + p = filepath.Join(c.PathSrvKubernetes(), filename) + } + ctx.AddTask(&nodetasks.File{ - Path: filepath.Join(c.PathSrvKubernetes(), filename), + Path: p, Contents: fi.NewStringResource(serialized), Type: nodetasks.FileType_File, Mode: s("0600"), @@ -397,8 +402,13 @@ func (c *NodeupModelContext) BuildPrivateKeyTask(ctx *fi.ModelBuilderContext, na return err } + p := filename + if !filepath.IsAbs(p) { + p = filepath.Join(c.PathSrvKubernetes(), filename) + } + ctx.AddTask(&nodetasks.File{ - Path: filepath.Join(c.PathSrvKubernetes(), filename), + Path: p, Contents: fi.NewStringResource(serialized), Type: nodetasks.FileType_File, Mode: s("0600"), diff --git a/nodeup/pkg/model/etcd_manager_tls.go b/nodeup/pkg/model/etcd_manager_tls.go new file mode 100644 index 0000000000000..6fac2b4c2e900 --- /dev/null +++ b/nodeup/pkg/model/etcd_manager_tls.go @@ -0,0 +1,63 @@ +/* +Copyright 2019 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package model + +import ( + "github.com/golang/glog" + "k8s.io/kops/upup/pkg/fi" +) + +// EtcdManagerTLSBuilder configures TLS support for etcd-manager +type EtcdManagerTLSBuilder struct { + *NodeupModelContext +} + +var _ fi.ModelBuilder = &EtcdManagerTLSBuilder{} + +// Build is responsible for TLS configuration for etcd-manager +func (b *EtcdManagerTLSBuilder) Build(ctx *fi.ModelBuilderContext) error { + if !b.IsMaster { + return nil + } + + for _, k := range []string{"main", "events"} { + d := "/etc/kubernetes/pki/etcd-manager-" + k + + keys := make(map[string]string) + keys["etcd-manager-ca"] = "etcd-manager-ca-" + k + + for fileName, keystoreName := range keys { + cert, err := b.KeyStore.FindCert(keystoreName) + if err != nil { + return err + } + if cert == nil { + glog.Warningf("keypair %q not found, won't configure", keystoreName) + continue + } + + if err := b.BuildCertificateTask(ctx, keystoreName, d+"/"+fileName+".crt"); err != nil { + return err + } + if err := b.BuildPrivateKeyTask(ctx, keystoreName, d+"/"+fileName+".key"); err != nil { + return err + } + } + } + + return nil +} diff --git a/pkg/model/components/etcdmanager/model.go b/pkg/model/components/etcdmanager/model.go index eb2d01dd4e1fd..26f26fcc5de27 100644 --- a/pkg/model/components/etcdmanager/model.go +++ b/pkg/model/components/etcdmanager/model.go @@ -100,6 +100,8 @@ func (b *EtcdManagerBuilder) Build(c *fi.ModelBuilderContext) error { return err } + format := string(fi.KeysetFormatV1Alpha2) + c.AddTask(&fitasks.ManagedFile{ Contents: fi.WrapResource(fi.NewBytesResource(d)), Lifecycle: b.Lifecycle, @@ -107,14 +109,22 @@ func (b *EtcdManagerBuilder) Build(c *fi.ModelBuilderContext) error { Location: fi.String("backups/etcd/" + etcdCluster.Name + "/control/etcd-cluster-spec"), Name: fi.String("etcd-cluster-spec-" + name), }) + + // We create a CA keypair to enable secure communication + c.AddTask(&fitasks.Keypair{ + Name: fi.String("etcd-manager-ca-" + etcdCluster.Name), + Subject: "cn=etcd-manager-ca-" + etcdCluster.Name, + Type: "ca", + Format: format, + }) } return nil } type etcdClusterSpec struct { - MemberCount int32 `json:"member_count,omitempty"` - EtcdVersion string `json:"etcd_version,omitempty"` + MemberCount int32 `json:"memberCount,omitempty"` + EtcdVersion string `json:"etcdVersion,omitempty"` } func (b *EtcdManagerBuilder) buildManifest(etcdCluster *kops.EtcdClusterSpec) (*v1.Pod, error) { @@ -159,7 +169,7 @@ metadata: namespace: kube-system spec: containers: - - image: kopeio/etcd-manager:1.0.20181001 + - image: kopeio/etcd-manager:3.0.20190125 name: etcd-manager resources: requests: @@ -174,6 +184,8 @@ spec: # We write artificial hostnames into etc hosts for the etcd nodes, so they have stable names - mountPath: /etc/hosts name: hosts + - mountPath: /etc/kubernetes/pki/etcd-manager + name: pki hostNetwork: true hostPID: true # helps with mounting volumes from inside a container volumes: @@ -185,6 +197,10 @@ spec: path: /etc/hosts type: File name: hosts + - hostPath: + path: /etc/kubernetes/pki/etcd-manager + type: DirectoryOrCreate + name: pki ` // buildPod creates the pod spec, based on the EtcdClusterSpec @@ -300,6 +316,7 @@ func (b *EtcdManagerBuilder) buildPod(etcdCluster *kops.EtcdClusterSpec) (*v1.Po BackupStore: backupStore, GrpcPort: grpcPort, DNSSuffix: dnsInternalSuffix, + EtcdInsecure: !isTLS, } config.LogVerbosity = 8 @@ -389,12 +406,30 @@ func (b *EtcdManagerBuilder) buildPod(etcdCluster *kops.EtcdClusterSpec) (*v1.Po }, }, }) + } - if isTLS { - return nil, fmt.Errorf("TLS not supported for etcd-manager") + { + foundPKI := false + for i := range pod.Spec.Volumes { + v := &pod.Spec.Volumes[i] + if v.Name == "pki" { + if v.HostPath == nil { + return nil, fmt.Errorf("found PKI volume, but HostPath was nil") + } + dirname := "etcd-manager-" + etcdCluster.Name + v.HostPath.Path = "/etc/kubernetes/pki/" + dirname + foundPKI = true + } + } + if !foundPKI { + return nil, fmt.Errorf("did not find PKI volume") } } + if isTLS { + return nil, fmt.Errorf("TLS not supported for etcd-manager") + } + kubemanifest.MarkPodAsCritical(pod) return pod, nil @@ -408,6 +443,15 @@ type config struct { // Containerized is set if etcd-manager is running in a container Containerized bool `flag:"containerized"` + // PKIDir is set to the directory for PKI keys, used to secure commucations between etcd-manager peers + PKIDir string `flag:"pki-dir"` + + // Insecure can be used to turn off tls for etcd-manager (compare with EtcdInsecure) + Insecure bool `flag:"insecure"` + + // EtcdInsecure can be used to turn off tls for etcd itself (compare with Insecure) + EtcdInsecure bool `flag:"etcd-insecure"` + Address string `flag:"address"` PeerUrls string `flag:"peer-urls"` GrpcPort int `flag:"grpc-port"` diff --git a/pkg/model/components/etcdmanager/tests/minimal/tasks.yaml b/pkg/model/components/etcdmanager/tests/minimal/tasks.yaml index 4ea8ad7b17301..3b6eaa26bc9a3 100644 --- a/pkg/model/components/etcdmanager/tests/minimal/tasks.yaml +++ b/pkg/model/components/etcdmanager/tests/minimal/tasks.yaml @@ -1,8 +1,26 @@ +Lifecycle: null +Name: etcd-manager-ca-events +Signer: null +alternateNameTasks: null +alternateNames: null +format: v1alpha2 +subject: cn=etcd-manager-ca-events +type: ca +--- +Lifecycle: null +Name: etcd-manager-ca-main +Signer: null +alternateNameTasks: null +alternateNames: null +format: v1alpha2 +subject: cn=etcd-manager-ca-main +type: ca +--- Contents: Name: "" Resource: |- { - "member_count": 1 + "memberCount": 1 } Lifecycle: null Location: backups/etcd/events/control/etcd-cluster-spec @@ -12,7 +30,7 @@ Contents: Name: "" Resource: |- { - "member_count": 1 + "memberCount": 1 } Lifecycle: null Location: backups/etcd/main/control/etcd-cluster-spec @@ -39,11 +57,12 @@ Contents: - mkfifo /tmp/pipe; (tee -a /var/log/etcd.log < /tmp/pipe & ) ; exec /etcd-manager --backup-store=memfs://clusters.example.com/minimal.example.com/backups/etcd-events --client-urls=http://__name__:4002 --cluster-name=etcd-events --containerized=true - --dns-suffix=.internal.minimal.example.com --grpc-port=3997 --peer-urls=http://__name__:2381 - --quarantine-client-urls=http://__name__:3995 --v=8 --volume-name-tag=k8s.io/etcd/events - --volume-provider=aws --volume-tag=k8s.io/etcd/events --volume-tag=k8s.io/role/master=1 - --volume-tag=kubernetes.io/cluster/minimal.example.com=owned > /tmp/pipe 2>&1 - image: kopeio/etcd-manager:1.0.20181001 + --dns-suffix=.internal.minimal.example.com --etcd-insecure=true --grpc-port=3997 + --insecure=false --peer-urls=http://__name__:2381 --quarantine-client-urls=http://__name__:3995 + --v=8 --volume-name-tag=k8s.io/etcd/events --volume-provider=aws --volume-tag=k8s.io/etcd/events + --volume-tag=k8s.io/role/master=1 --volume-tag=kubernetes.io/cluster/minimal.example.com=owned + > /tmp/pipe 2>&1 + image: kopeio/etcd-manager:3.0.20190125 name: etcd-manager resources: requests: @@ -55,6 +74,8 @@ Contents: name: rootfs - mountPath: /etc/hosts name: hosts + - mountPath: /etc/kubernetes/pki/etcd-manager + name: pki - mountPath: /var/log/etcd.log name: varlogetcd hostNetwork: true @@ -71,6 +92,10 @@ Contents: path: /etc/hosts type: File name: hosts + - hostPath: + path: /etc/kubernetes/pki/etcd-manager-events + type: DirectoryOrCreate + name: pki - hostPath: path: /var/log/etcd-events.log type: FileOrCreate @@ -101,11 +126,12 @@ Contents: - mkfifo /tmp/pipe; (tee -a /var/log/etcd.log < /tmp/pipe & ) ; exec /etcd-manager --backup-store=memfs://clusters.example.com/minimal.example.com/backups/etcd-main --client-urls=http://__name__:4001 --cluster-name=etcd --containerized=true - --dns-suffix=.internal.minimal.example.com --grpc-port=3996 --peer-urls=http://__name__:2380 - --quarantine-client-urls=http://__name__:3994 --v=8 --volume-name-tag=k8s.io/etcd/main - --volume-provider=aws --volume-tag=k8s.io/etcd/main --volume-tag=k8s.io/role/master=1 - --volume-tag=kubernetes.io/cluster/minimal.example.com=owned > /tmp/pipe 2>&1 - image: kopeio/etcd-manager:1.0.20181001 + --dns-suffix=.internal.minimal.example.com --etcd-insecure=true --grpc-port=3996 + --insecure=false --peer-urls=http://__name__:2380 --quarantine-client-urls=http://__name__:3994 + --v=8 --volume-name-tag=k8s.io/etcd/main --volume-provider=aws --volume-tag=k8s.io/etcd/main + --volume-tag=k8s.io/role/master=1 --volume-tag=kubernetes.io/cluster/minimal.example.com=owned + > /tmp/pipe 2>&1 + image: kopeio/etcd-manager:3.0.20190125 name: etcd-manager resources: requests: @@ -117,6 +143,8 @@ Contents: name: rootfs - mountPath: /etc/hosts name: hosts + - mountPath: /etc/kubernetes/pki/etcd-manager + name: pki - mountPath: /var/log/etcd.log name: varlogetcd hostNetwork: true @@ -133,6 +161,10 @@ Contents: path: /etc/hosts type: File name: hosts + - hostPath: + path: /etc/kubernetes/pki/etcd-manager-main + type: DirectoryOrCreate + name: pki - hostPath: path: /var/log/etcd.log type: FileOrCreate diff --git a/upup/pkg/fi/nodeup/command.go b/upup/pkg/fi/nodeup/command.go index 7354984e90d01..c364608e0958e 100644 --- a/upup/pkg/fi/nodeup/command.go +++ b/upup/pkg/fi/nodeup/command.go @@ -243,6 +243,7 @@ func (c *NodeUpCommand) Run(out io.Writer) error { loader.Builders = append(loader.Builders, &model.KubeAPIServerBuilder{NodeupModelContext: modelContext}) loader.Builders = append(loader.Builders, &model.KubeControllerManagerBuilder{NodeupModelContext: modelContext}) loader.Builders = append(loader.Builders, &model.KubeSchedulerBuilder{NodeupModelContext: modelContext}) + loader.Builders = append(loader.Builders, &model.EtcdManagerTLSBuilder{NodeupModelContext: modelContext}) if c.cluster.Spec.Networking.Kuberouter == nil { loader.Builders = append(loader.Builders, &model.KubeProxyBuilder{NodeupModelContext: modelContext}) } else { From 7af22ea9ba159eff606fe1a03057891516e9ad5e Mon Sep 17 00:00:00 2001 From: mikesplain Date: Thu, 31 Jan 2019 17:44:18 -0500 Subject: [PATCH 139/163] Fix machine types and cleanup makefile --- Makefile | 15 +++++++++++---- hack/machine_types/vpc_ip_resource_limit.go | 2 ++ 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index 151a5024281a4..e3132d37dc2a0 100644 --- a/Makefile +++ b/Makefile @@ -773,8 +773,14 @@ bazel-version-dist: bazel-crossbuild-nodeup bazel-crossbuild-kops bazel-protokub bazel-upload: bazel-version-dist # Upload kops to S3 aws s3 sync --acl public-read ${BAZELUPLOAD}/ ${S3_BUCKET} -#----------------------------------------------------------- -# static html documentation +# prow-postsubmit is run by the prow postsubmit job +# It uploads a build to a staging directory, which in theory we can publish as a release +.PHONY: prow-postsubmit +prow-postsubmit: bazel-version-dist + ${UPLOAD} ${BAZELUPLOAD}/kops/${VERSION}/ ${UPLOAD_DEST}/${KOPS_RELEASE_VERSION}-${GITSHA}/ + +#----------------------------------------------------------- +# static html documentation .PHONY: live-docs live-docs: @@ -784,8 +790,9 @@ live-docs: build-docs: @docker run --rm -it -v ${PWD}:/docs aledbf/mkdocs:0.1 build +# Update machine_types.go .PHONY: update-machine-types -update-machine-types: #Update machine_types.go - go build -o hack/machine_types/machine_types ${KOPS_ROOT}/hack/machine_types/machine_types.go ${KOPS_ROOT}/hack/machine_types/vpc_ip_resource_limit.go +update-machine-types: + go build -o hack/machine_types/machine_types ${KOPS_ROOT}/hack/machine_types/ hack/machine_types/machine_types --out upup/pkg/fi/cloudup/awsup/machine_types.go go fmt upup/pkg/fi/cloudup/awsup/machine_types.go diff --git a/hack/machine_types/vpc_ip_resource_limit.go b/hack/machine_types/vpc_ip_resource_limit.go index 10adf26616ea9..3a83733587b26 100644 --- a/hack/machine_types/vpc_ip_resource_limit.go +++ b/hack/machine_types/vpc_ip_resource_limit.go @@ -139,6 +139,7 @@ var InstanceENIsAvailable = map[string]int{ "p3.2xlarge": 4, "p3.8xlarge": 8, "p3.16xlarge": 8, + "p3dn.24xlarge": 15, "r3.large": 3, "r3.xlarge": 4, "r3.2xlarge": 4, @@ -312,6 +313,7 @@ var InstanceIPsAvailable = map[string]int64{ "p3.2xlarge": 15, "p3.8xlarge": 30, "p3.16xlarge": 30, + "p3dn.24xlarge": 50, "r3.large": 10, "r3.xlarge": 15, "r3.2xlarge": 15, From 92ad214cc9510a4a97ebacde137d78399d5d2cc3 Mon Sep 17 00:00:00 2001 From: Ricardo La Rosa Date: Sun, 24 Feb 2019 20:59:11 +0000 Subject: [PATCH 140/163] Upgrade base image to alpine 3.8 and GO to 1.10.8 (#6458) Upgrade base image to alpine 3.8 and GO to 1.10.8 (#6458) --- Makefile | 2 +- docker/Dockerfile | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index 151a5024281a4..e995356474600 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -# Copyright 2016 The Kubernetes Authors. +# Copyright 2019 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/docker/Dockerfile b/docker/Dockerfile index ab0faf9104f4e..6d9d0b79b03f0 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,4 +1,4 @@ -# Copyright 2017 The Kubernetes Authors. +# Copyright 2019 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -12,9 +12,9 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.6 +FROM alpine:3.8 -ARG GO_VERSION=1.8.1 +ARG GO_VERSION=1.10.8 # KOPS_GITISH: Modify to build at an explicit tag/gitish ARG KOPS_GITISH=release From a200bc3387b29ce32f90d25b56d7dc698204bb72 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Tue, 19 Feb 2019 18:13:18 -0500 Subject: [PATCH 141/163] Choose docker version 18.06.2 for k8s >= 1.12 Helps us avoid the recent CVE --- pkg/model/components/docker.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkg/model/components/docker.go b/pkg/model/components/docker.go index 4a8bae23d5321..0c2d4afb24974 100644 --- a/pkg/model/components/docker.go +++ b/pkg/model/components/docker.go @@ -53,7 +53,9 @@ func (b *DockerOptionsBuilder) BuildOptions(o interface{}) error { } dockerVersion := "" - if sv.Major == 1 && sv.Minor >= 9 { + if sv.Major == 1 && sv.Minor >= 12 { + dockerVersion = "18.06.2" + } else if sv.Major == 1 && sv.Minor >= 9 { dockerVersion = "17.03.2" } else if sv.Major == 1 && sv.Minor >= 8 { dockerVersion = "1.13.1" From aef44d24560d566e1621d3767965b535a709f1b4 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Tue, 19 Feb 2019 18:08:40 -0500 Subject: [PATCH 142/163] Workaround for overlay2 vs rhel-family docker bug Docker 17.x with rhel-family fails to detect overlay2 correctly, and need us to pass overlay2.override_kernel_check=true for docker to correctly detect overlay2 support. --- nodeup/pkg/model/docker.go | 36 ++++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-) diff --git a/nodeup/pkg/model/docker.go b/nodeup/pkg/model/docker.go index b8ed571a72000..1ac3644f00b59 100644 --- a/nodeup/pkg/model/docker.go +++ b/nodeup/pkg/model/docker.go @@ -568,6 +568,18 @@ func (d *dockerVersion) matches(arch Architecture, dockerVersion string, distro return true } +func (b *DockerBuilder) dockerVersion() string { + dockerVersion := "" + if b.Cluster.Spec.Docker != nil { + dockerVersion = fi.StringValue(b.Cluster.Spec.Docker.Version) + } + if dockerVersion == "" { + dockerVersion = DefaultDockerVersion + glog.Warningf("DockerVersion not specified; using default %q", dockerVersion) + } + return dockerVersion +} + // Build is responsible for configuring the docker daemon func (b *DockerBuilder) Build(c *fi.ModelBuilderContext) error { @@ -598,14 +610,7 @@ func (b *DockerBuilder) Build(c *fi.ModelBuilderContext) error { c.AddTask(t) } - dockerVersion := "" - if b.Cluster.Spec.Docker != nil { - dockerVersion = fi.StringValue(b.Cluster.Spec.Docker.Version) - } - if dockerVersion == "" { - dockerVersion = DefaultDockerVersion - glog.Warningf("DockerVersion not specified; using default %q", dockerVersion) - } + dockerVersion := b.dockerVersion() // Add packages { @@ -883,6 +888,21 @@ func (b *DockerBuilder) buildSysconfig(c *fi.ModelBuilderContext) error { } } + // RHEL-family / docker has a bug with 17.x where it fails to use overlay2 because it does a broken kernel check + if b.Distribution.IsRHELFamily() { + dockerVersion := b.dockerVersion() + if strings.HasPrefix(dockerVersion, "17.") { + storageOpts := strings.Join(docker.StorageOpts, ",") + if strings.Contains(storageOpts, "overlay2.override_kernel_check=1") { + // Already there + } else if !strings.Contains(storageOpts, "overlay2.override_kernel_check") { + docker.StorageOpts = append(docker.StorageOpts, "overlay2.override_kernel_check=1") + } else { + glog.Infof("detected image was RHEL and overlay2.override_kernel_check=1 was probably needed, but overlay2.override_kernel_check was already set (%q) so won't set", storageOpts) + } + } + } + flagsString, err := flagbuilder.BuildFlags(&docker) if err != nil { return fmt.Errorf("error building docker flags: %v", err) From 69f5a431a35e42983ce429d8fbd567ffd01d1b3a Mon Sep 17 00:00:00 2001 From: Justin SB Date: Wed, 20 Feb 2019 22:02:54 -0500 Subject: [PATCH 143/163] Try using chattr to mark docker-runc as immutable May be a workaround for CVE-2019-5736, is defense in depth in any case. --- nodeup/pkg/model/docker.go | 27 ++++++- upup/pkg/fi/nodeup/nodetasks/BUILD.bazel | 1 + upup/pkg/fi/nodeup/nodetasks/chattr.go | 90 ++++++++++++++++++++++++ upup/pkg/fi/nodeup/nodetasks/service.go | 2 +- 4 files changed, 116 insertions(+), 4 deletions(-) create mode 100644 upup/pkg/fi/nodeup/nodetasks/chattr.go diff --git a/nodeup/pkg/model/docker.go b/nodeup/pkg/model/docker.go index b8ed571a72000..32e2b15bc6d04 100644 --- a/nodeup/pkg/model/docker.go +++ b/nodeup/pkg/model/docker.go @@ -55,6 +55,9 @@ type dockerVersion struct { // PlainBinary indicates that the Source is not an OS, but a "bare" tar.gz PlainBinary bool + + // MarkImmutable is a list of files on which we should perform a `chattr +i ` + MarkImmutable []string } // DefaultDockerVersion is the (legacy) docker version we use if one is not specified in the manifest. @@ -379,6 +382,7 @@ var dockerVersions = []dockerVersion{ Source: "http://download.docker.com/linux/debian/dists/stretch/pool/stable/amd64/docker-ce_17.03.2~ce-0~debian-stretch_amd64.deb", Hash: "36773361cf44817371770cb4e6e6823590d10297", Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, + MarkImmutable: []string{"/usr/bin/docker-runc"}, }, // 17.03.2 - Jessie @@ -391,6 +395,7 @@ var dockerVersions = []dockerVersion{ Source: "http://download.docker.com/linux/debian/dists/jessie/pool/stable/amd64/docker-ce_17.03.2~ce-0~debian-jessie_amd64.deb", Hash: "a7ac54aaa7d33122ca5f7a2df817cbefb5cdbfc7", Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, + MarkImmutable: []string{"/usr/bin/docker-runc"}, }, // 17.03.2 - Jessie on ARM @@ -403,6 +408,7 @@ var dockerVersions = []dockerVersion{ Source: "http://download.docker.com/linux/debian/dists/jessie/pool/stable/armhf/docker-ce_17.03.2~ce-0~debian-jessie_armhf.deb", Hash: "71e425b83ce0ef49d6298d61e61c4efbc76b9c65", Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, + MarkImmutable: []string{"/usr/bin/docker-runc"}, }, // 17.03.2 - Xenial @@ -415,6 +421,7 @@ var dockerVersions = []dockerVersion{ Source: "http://download.docker.com/linux/ubuntu/dists/xenial/pool/stable/amd64/docker-ce_17.03.2~ce-0~ubuntu-xenial_amd64.deb", Hash: "4dcee1a05ec592e8a76e53e5b464ea43085a2849", Dependencies: []string{"bridge-utils", "iptables", "libapparmor1", "libltdl7", "perl"}, + MarkImmutable: []string{"/usr/bin/docker-runc"}, }, // 17.03.2 - Ubuntu Bionic via binary download (no packages available) @@ -426,6 +433,7 @@ var dockerVersions = []dockerVersion{ Source: "http://download.docker.com/linux/static/stable/x86_64/docker-17.03.2-ce.tgz", Hash: "141716ae046016a1792ce232a0f4c8eed7fe37d1", Dependencies: []string{"bridge-utils", "iptables", "libapparmor1", "libltdl7", "perl"}, + MarkImmutable: []string{"/usr/bin/docker-runc"}, }, // 17.03.2 - Centos / Rhel7 (two packages) @@ -438,6 +446,7 @@ var dockerVersions = []dockerVersion{ Source: "https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-17.03.2.ce-1.el7.centos.x86_64.rpm", Hash: "494ca888f5b1553f93b9d9a5dad4a67f76cf9eb5", Dependencies: []string{"libtool-ltdl", "libseccomp", "libcgroup"}, + MarkImmutable: []string{"/usr/bin/docker-runc"}, }, { DockerVersion: "17.03.2", @@ -618,19 +627,21 @@ func (b *DockerBuilder) Build(c *fi.ModelBuilderContext) error { count++ + var packageTask fi.Task if dv.PlainBinary { - c.AddTask(&nodetasks.Archive{ + packageTask = &nodetasks.Archive{ Name: "docker", Source: dv.Source, Hash: dv.Hash, TargetDir: "/usr/bin/", StripComponents: 1, - }) + } + c.AddTask(packageTask) c.AddTask(b.buildDockerGroup()) c.AddTask(b.buildSystemdSocket()) } else { - c.AddTask(&nodetasks.Package{ + packageTask = &nodetasks.Package{ Name: dv.Name, Version: s(dv.Version), Source: s(dv.Source), @@ -638,6 +649,16 @@ func (b *DockerBuilder) Build(c *fi.ModelBuilderContext) error { // TODO: PreventStart is now unused? PreventStart: fi.Bool(true), + } + c.AddTask(packageTask) + } + + // As a mitigation for CVE-2019-5736 (possibly a fix, definitely defense-in-depth) we chattr docker-runc to be immutable + for _, f := range dv.MarkImmutable { + c.AddTask(&nodetasks.Chattr{ + File: f, + Mode: "+i", + Deps: []fi.Task{packageTask}, }) } diff --git a/upup/pkg/fi/nodeup/nodetasks/BUILD.bazel b/upup/pkg/fi/nodeup/nodetasks/BUILD.bazel index 2f9eb96f4f0e7..5c7e4dfb5901c 100644 --- a/upup/pkg/fi/nodeup/nodetasks/BUILD.bazel +++ b/upup/pkg/fi/nodeup/nodetasks/BUILD.bazel @@ -6,6 +6,7 @@ go_library( "archive.go", "asset.go", "bindmount.go", + "chattr.go", "createsdir.go", "file.go", "group.go", diff --git a/upup/pkg/fi/nodeup/nodetasks/chattr.go b/upup/pkg/fi/nodeup/nodetasks/chattr.go new file mode 100644 index 0000000000000..0e2551eb32073 --- /dev/null +++ b/upup/pkg/fi/nodeup/nodetasks/chattr.go @@ -0,0 +1,90 @@ +/* +Copyright 2019 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package nodetasks + +import ( + "fmt" + "strings" + + "github.com/golang/glog" + "k8s.io/kops/upup/pkg/fi" + "k8s.io/kops/upup/pkg/fi/nodeup/cloudinit" + "k8s.io/kops/upup/pkg/fi/nodeup/local" +) + +// Chattr performs a chattr command, in particular to set a file as immutable +type Chattr struct { + File string `json:"file"` + Mode string `json:"mode"` + + Deps []fi.Task `json:"-"` +} + +var _ fi.Task = &Chattr{} + +func (s *Chattr) String() string { + return fmt.Sprintf("Chattr: chattr %s %s", s.Mode, s.File) +} + +var _ fi.HasName = &Archive{} + +func (e *Chattr) GetName() *string { + return fi.String("Chattr-" + e.File) +} + +func (e *Chattr) SetName(name string) { + glog.Fatalf("SetName not supported for Chattr task") +} + +var _ fi.HasDependencies = &Chattr{} + +// GetDependencies implements HasDependencies::GetDependencies +func (e *Chattr) GetDependencies(tasks map[string]fi.Task) []fi.Task { + return e.Deps +} + +func (e *Chattr) Find(c *fi.Context) (*Chattr, error) { + // We always re-run the chattr command + return nil, nil +} + +func (e *Chattr) Run(c *fi.Context) error { + return fi.DefaultDeltaRunMethod(e, c) +} + +func (s *Chattr) CheckChanges(a, e, changes *Chattr) error { + return nil +} + +func (_ *Chattr) RenderLocal(t *local.LocalTarget, a, e, changes *Chattr) error { + return e.execute(t) +} + +func (e *Chattr) execute(t Executor) error { + chattrCommand := []string{"chattr", e.Mode, e.File} + + glog.Infof("running chattr command chattr %s", chattrCommand) + if output, err := t.CombinedOutput(chattrCommand); err != nil { + return fmt.Errorf("error doing %q: %v: %s", strings.Join(chattrCommand, " "), err, string(output)) + } + + return nil +} + +func (_ *Chattr) RenderCloudInit(t *cloudinit.CloudInitTarget, a, e, changes *Chattr) error { + return fmt.Errorf("Chattr::RenderCloudInit not implemented") +} diff --git a/upup/pkg/fi/nodeup/nodetasks/service.go b/upup/pkg/fi/nodeup/nodetasks/service.go index 1a0f4e5bcf4d0..3939a0869df76 100644 --- a/upup/pkg/fi/nodeup/nodetasks/service.go +++ b/upup/pkg/fi/nodeup/nodetasks/service.go @@ -70,7 +70,7 @@ func (p *Service) GetDependencies(tasks map[string]fi.Task) []fi.Task { // launching a custom Kubernetes build), they all depend on // the "docker.service" Service task. switch v.(type) { - case *File, *Package, *UpdatePackages, *UserTask, *GroupTask, *MountDiskTask: + case *File, *Package, *UpdatePackages, *UserTask, *GroupTask, *MountDiskTask, *Chattr: deps = append(deps, v) case *Service, *LoadImageTask: // ignore From 489142b84a6da300b9806e51ec1881cba369fe63 Mon Sep 17 00:00:00 2001 From: Naresh Kumar Amrutham Date: Mon, 14 Jan 2019 14:40:13 -0800 Subject: [PATCH 144/163] include docker 18.06.1 missed dependency container-selinux-2 --- nodeup/pkg/model/docker.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/nodeup/pkg/model/docker.go b/nodeup/pkg/model/docker.go index cbcd352b352fe..13d301e1629ea 100644 --- a/nodeup/pkg/model/docker.go +++ b/nodeup/pkg/model/docker.go @@ -540,7 +540,17 @@ var dockerVersions = []dockerVersion{ Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, }, - // 18.06.1 - CentOS / Rhel7 + // 18.06.1 - CentOS / Rhel7 (two packages) + { + DockerVersion: "18.06.1", + Name: "container-selinux-2", + Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "18.06.1.ce", + Source: "http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.68-1.el7.noarch.rpm", + Hash: "d9f87f7f4f2e8e611f556d873a17b8c0c580fec0", + Dependencies: []string{"policycoreutils-python"}, + }, { DockerVersion: "18.06.1", Name: "docker-ce", From cf3f9f4901951c2ba364493982b92fc653a518df Mon Sep 17 00:00:00 2001 From: Naresh Kumar Amrutham Date: Tue, 15 Jan 2019 10:01:28 -0800 Subject: [PATCH 145/163] include dependency container-selinux for docker v17.09 --- nodeup/pkg/model/docker.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/nodeup/pkg/model/docker.go b/nodeup/pkg/model/docker.go index 13d301e1629ea..f8fa53431548d 100644 --- a/nodeup/pkg/model/docker.go +++ b/nodeup/pkg/model/docker.go @@ -502,6 +502,16 @@ var dockerVersions = []dockerVersion{ }, // 17.09.0 - Centos / Rhel7 + { + DockerVersion: "17.09.0", + Name: "container-selinux-2", + Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "17.09.0.ce", + Source: "http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.68-1.el7.noarch.rpm", + Hash: "d9f87f7f4f2e8e611f556d873a17b8c0c580fec0", + Dependencies: []string{"policycoreutils-python"}, + }, { DockerVersion: "17.09.0", Name: "docker-ce", From 99d01adccdf4727a023a29c877483cec6a43c554 Mon Sep 17 00:00:00 2001 From: Naresh Kumar Amrutham Date: Tue, 15 Jan 2019 10:04:41 -0800 Subject: [PATCH 146/163] fixed comment --- nodeup/pkg/model/docker.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nodeup/pkg/model/docker.go b/nodeup/pkg/model/docker.go index f8fa53431548d..1c362813fc364 100644 --- a/nodeup/pkg/model/docker.go +++ b/nodeup/pkg/model/docker.go @@ -501,7 +501,7 @@ var dockerVersions = []dockerVersion{ //Recommends: aufs-tools, ca-certificates, cgroupfs-mount | cgroup-lite, git, xz-utils, apparmor }, - // 17.09.0 - Centos / Rhel7 + // 17.09.0 - Centos / Rhel7 (two packages) { DockerVersion: "17.09.0", Name: "container-selinux-2", From 7f978ab97c4455ba44ae00c37679521366113a11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Luis=20Ledesma?= Date: Tue, 15 Jan 2019 16:25:28 +0100 Subject: [PATCH 147/163] set net.ipv4.ip_local_reserved_ports to the KubeAPIServer ServiceNodePortRange parameter on nodeup --- nodeup/pkg/model/sysctls.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nodeup/pkg/model/sysctls.go b/nodeup/pkg/model/sysctls.go index 141d617b088cd..fec6353af2347 100644 --- a/nodeup/pkg/model/sysctls.go +++ b/nodeup/pkg/model/sysctls.go @@ -52,6 +52,14 @@ func (b *SysctlBuilder) Build(c *fi.ModelBuilderContext) error { "kernel.softlockup_all_cpu_backtrace = 1", "") + // See https://github.com/kubernetes/kops/issues/6342 + portRange := b.Cluster.Spec.KubeAPIServer.ServiceNodePortRange + if portRange == "" { + portRange = "30000-32767" // Default kube-apiserver ServiceNodePortRange + } + sysctls = append(sysctls, "net.ipv4.ip_local_reserved_ports = "+portRange, + "") + // See https://github.com/kubernetes/kube-deploy/issues/261 sysctls = append(sysctls, "# Increase the number of connections", From 140c982a856fb6116e798a7fcbe372001e1e96ee Mon Sep 17 00:00:00 2001 From: JuanJo Ciarlante Date: Mon, 11 Feb 2019 16:26:17 -0300 Subject: [PATCH 148/163] [jjo] update docker-ce 18.06 for CVE-2019-5736 Fixes #6459. * Update CoreOS, Debian Stretch and Ubuntu Bionic docker-ce packages to 18.06.2 --- nodeup/pkg/model/docker.go | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/nodeup/pkg/model/docker.go b/nodeup/pkg/model/docker.go index cbcd352b352fe..d4e236c32c587 100644 --- a/nodeup/pkg/model/docker.go +++ b/nodeup/pkg/model/docker.go @@ -515,42 +515,54 @@ var dockerVersions = []dockerVersion{ // 18.03.1 - Bionic { - DockerVersion: "18.03.1", + DockerVersion: "18.06.2", Name: "docker-ce", Distros: []distros.Distribution{distros.DistributionBionic}, Architectures: []Architecture{ArchitectureAmd64}, - Version: "18.03.1~ce~3-0~ubuntu", - Source: "https://download.docker.com/linux/ubuntu/dists/bionic/pool/stable/amd64/docker-ce_18.03.1~ce~3-0~ubuntu_amd64.deb", - Hash: "b55b32bd0e9176dd32b1e6128ad9fda10a65cc8b", + Version: "18.06.2~ce~3-0~ubuntu", + Source: "https://download.docker.com/linux/ubuntu/dists/bionic/pool/stable/amd64/docker-ce_18.06.2~ce~3-0~ubuntu_amd64.deb", + Hash: "9607c67644e3e1ad9661267c99499004f2e84e05", Dependencies: []string{"bridge-utils", "iptables", "libapparmor1", "libltdl7", "perl"}, //Depends: iptables, init-system-helpers, lsb-base, libapparmor1, libc6, libdevmapper1.02.1, libltdl7, libeseccomp2, libsystemd0 //Recommends: aufs-tools, ca-certificates, cgroupfs-mount | cgroup-lite, git, xz-utils, apparmor }, - // 18.06.1 - Debian Stretch + // 18.06.2 - Debian Stretch { - DockerVersion: "18.06.1", + DockerVersion: "18.06.2", Name: "docker-ce", Distros: []distros.Distribution{distros.DistributionDebian9}, Architectures: []Architecture{ArchitectureAmd64}, - Version: "18.06.1~ce-0~debian", - Source: "https://download.docker.com/linux/debian/dists/stretch/pool/stable/amd64/docker-ce_18.06.1~ce~3-0~debian_amd64.deb", - Hash: "18473b80e61b6d4eb8b52d87313abd71261287e5", + Version: "18.06.2~ce-0~debian", + Source: "https://download.docker.com/linux/debian/dists/stretch/pool/stable/amd64/docker-ce_18.06.2~ce~3-0~debian_amd64.deb", + Hash: "aad1efd2c90725034e996c6a368ccc2bf41ca5b8", Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, }, // 18.06.1 - CentOS / Rhel7 { - DockerVersion: "18.06.1", + DockerVersion: "18.06.2", Name: "docker-ce", Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, Architectures: []Architecture{ArchitectureAmd64}, - Version: "18.06.1.ce", - Source: "https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-18.06.1.ce-3.el7.x86_64.rpm", - Hash: "0a1325e570c5e54111a79623c9fd0c0c714d3a11", + Version: "18.06.2.ce", + Source: "https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-18.06.2.ce-3.el7.x86_64.rpm", + Hash: "456eb7c5bfb37fac342e9ade21b602c076c5b367", Dependencies: []string{"libtool-ltdl", "libseccomp", "libcgroup"}, }, + + // 18.06.2 - CentOS / Rhel7 (two packages) + { + DockerVersion: "18.06.2", + Name: "container-selinux-2", + Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "18.06.2.ce", + Source: "http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.68-1.el7.noarch.rpm", + Hash: "d9f87f7f4f2e8e611f556d873a17b8c0c580fec0", + Dependencies: []string{"policycoreutils-python"}, + }, } func (d *dockerVersion) matches(arch Architecture, dockerVersion string, distro distros.Distribution) bool { From d0524b7d1a70683ed184c7abf6e8ee617dd91d07 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Sun, 24 Feb 2019 15:14:30 -0500 Subject: [PATCH 149/163] Bump etcd-manager version to 3.0.20190224 Includes https://github.com/kopeio/etcd-manager/pull/190, fix for symlinks as seen on GCE. --- pkg/model/components/etcdmanager/model.go | 2 +- pkg/model/components/etcdmanager/tests/minimal/tasks.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/model/components/etcdmanager/model.go b/pkg/model/components/etcdmanager/model.go index 26f26fcc5de27..e02d144b26fa1 100644 --- a/pkg/model/components/etcdmanager/model.go +++ b/pkg/model/components/etcdmanager/model.go @@ -169,7 +169,7 @@ metadata: namespace: kube-system spec: containers: - - image: kopeio/etcd-manager:3.0.20190125 + - image: kopeio/etcd-manager:3.0.20190224 name: etcd-manager resources: requests: diff --git a/pkg/model/components/etcdmanager/tests/minimal/tasks.yaml b/pkg/model/components/etcdmanager/tests/minimal/tasks.yaml index 3b6eaa26bc9a3..ec165508d7a6b 100644 --- a/pkg/model/components/etcdmanager/tests/minimal/tasks.yaml +++ b/pkg/model/components/etcdmanager/tests/minimal/tasks.yaml @@ -62,7 +62,7 @@ Contents: --v=8 --volume-name-tag=k8s.io/etcd/events --volume-provider=aws --volume-tag=k8s.io/etcd/events --volume-tag=k8s.io/role/master=1 --volume-tag=kubernetes.io/cluster/minimal.example.com=owned > /tmp/pipe 2>&1 - image: kopeio/etcd-manager:3.0.20190125 + image: kopeio/etcd-manager:3.0.20190224 name: etcd-manager resources: requests: @@ -131,7 +131,7 @@ Contents: --v=8 --volume-name-tag=k8s.io/etcd/main --volume-provider=aws --volume-tag=k8s.io/etcd/main --volume-tag=k8s.io/role/master=1 --volume-tag=kubernetes.io/cluster/minimal.example.com=owned > /tmp/pipe 2>&1 - image: kopeio/etcd-manager:3.0.20190125 + image: kopeio/etcd-manager:3.0.20190224 name: etcd-manager resources: requests: From 12ee671f8285601726c4a12e3fdf2c2aab8d846e Mon Sep 17 00:00:00 2001 From: Justin SB Date: Sat, 23 Feb 2019 17:22:47 -0500 Subject: [PATCH 150/163] Make docker 18.06.3 the default for k8s >= 1.12 Includes the fix for CVE-2019-5736 --- pkg/model/components/docker.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/model/components/docker.go b/pkg/model/components/docker.go index 0c2d4afb24974..82f1983dd2fef 100644 --- a/pkg/model/components/docker.go +++ b/pkg/model/components/docker.go @@ -54,7 +54,7 @@ func (b *DockerOptionsBuilder) BuildOptions(o interface{}) error { dockerVersion := "" if sv.Major == 1 && sv.Minor >= 12 { - dockerVersion = "18.06.2" + dockerVersion = "18.06.3" } else if sv.Major == 1 && sv.Minor >= 9 { dockerVersion = "17.03.2" } else if sv.Major == 1 && sv.Minor >= 8 { From eae28aba1ec4b9a0019ac81393d085da9bf1c055 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Thu, 28 Feb 2019 15:48:11 -0500 Subject: [PATCH 151/163] update-machine-types: more metal instance types m5, m5d, r5, r5d, z1d metal types --- hack/machine_types/vpc_ip_resource_limit.go | 10 +++++ upup/pkg/fi/cloudup/awsup/machine_types.go | 50 +++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/hack/machine_types/vpc_ip_resource_limit.go b/hack/machine_types/vpc_ip_resource_limit.go index 3a83733587b26..e31372252e131 100644 --- a/hack/machine_types/vpc_ip_resource_limit.go +++ b/hack/machine_types/vpc_ip_resource_limit.go @@ -121,6 +121,7 @@ var InstanceENIsAvailable = map[string]int{ "m5.4xlarge": 8, "m5.12xlarge": 8, "m5.24xlarge": 15, + "m5.metal": 15, "m5a.large": 3, "m5a.xlarge": 4, "m5a.2xlarge": 4, @@ -133,6 +134,7 @@ var InstanceENIsAvailable = map[string]int{ "m5d.4xlarge": 8, "m5d.12xlarge": 8, "m5d.24xlarge": 15, + "m5d.metal": 15, "p2.xlarge": 4, "p2.8xlarge": 8, "p2.16xlarge": 8, @@ -157,6 +159,7 @@ var InstanceENIsAvailable = map[string]int{ "r5.4xlarge": 8, "r5.12xlarge": 8, "r5.24xlarge": 15, + "r5.metal": 15, "r5a.large": 3, "r5a.xlarge": 4, "r5a.2xlarge": 4, @@ -169,6 +172,7 @@ var InstanceENIsAvailable = map[string]int{ "r5d.4xlarge": 8, "r5d.12xlarge": 8, "r5d.24xlarge": 15, + "r5d.metal": 15, "t1.micro": 2, "t2.nano": 2, "t2.micro": 2, @@ -201,6 +205,7 @@ var InstanceENIsAvailable = map[string]int{ "z1d.3xlarge": 8, "z1d.6xlarge": 8, "z1d.12xlarge": 15, + "z1d.metal": 15, } // InstanceIPsAvailable contains a mapping of instance types to the number of IPs per ENI @@ -295,6 +300,7 @@ var InstanceIPsAvailable = map[string]int64{ "m5.4xlarge": 30, "m5.12xlarge": 30, "m5.24xlarge": 50, + "m5.metal": 50, "m5a.large": 10, "m5a.xlarge": 15, "m5a.2xlarge": 15, @@ -307,6 +313,7 @@ var InstanceIPsAvailable = map[string]int64{ "m5d.4xlarge": 30, "m5d.12xlarge": 30, "m5d.24xlarge": 50, + "m5d.metal": 50, "p2.xlarge": 15, "p2.8xlarge": 30, "p2.16xlarge": 30, @@ -331,6 +338,7 @@ var InstanceIPsAvailable = map[string]int64{ "r5.4xlarge": 30, "r5.12xlarge": 30, "r5.24xlarge": 50, + "r5.metal": 50, "r5a.large": 10, "r5a.xlarge": 15, "r5a.2xlarge": 15, @@ -343,6 +351,7 @@ var InstanceIPsAvailable = map[string]int64{ "r5d.4xlarge": 30, "r5d.12xlarge": 30, "r5d.24xlarge": 50, + "r5d.metal": 50, "t1.micro": 2, "t2.nano": 2, "t2.micro": 2, @@ -375,4 +384,5 @@ var InstanceIPsAvailable = map[string]int64{ "z1d.3xlarge": 30, "z1d.6xlarge": 30, "z1d.12xlarge": 50, + "z1d.metal": 50, } diff --git a/upup/pkg/fi/cloudup/awsup/machine_types.go b/upup/pkg/fi/cloudup/awsup/machine_types.go index 70806c44dbfce..de0bea0de9a63 100644 --- a/upup/pkg/fi/cloudup/awsup/machine_types.go +++ b/upup/pkg/fi/cloudup/awsup/machine_types.go @@ -999,6 +999,16 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ EphemeralDisks: nil, }, + { + Name: "m5.metal", + MemoryGB: 384, + ECU: 345, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, + }, + // m5a family { Name: "m5a.large", @@ -1121,6 +1131,16 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ EphemeralDisks: []int{900, 900, 900, 900}, }, + { + Name: "m5d.metal", + MemoryGB: 384, + ECU: 345, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{900, 900, 900, 900}, + }, + // p2 family { Name: "p2.xlarge", @@ -1374,6 +1394,16 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ EphemeralDisks: nil, }, + { + Name: "r5.metal", + MemoryGB: 768, + ECU: 347, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: nil, + }, + // r5a family { Name: "r5a.large", @@ -1496,6 +1526,16 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ EphemeralDisks: []int{900, 900, 900, 900}, }, + { + Name: "r5d.metal", + MemoryGB: 768, + ECU: 347, + Cores: 96, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{900, 900, 900, 900}, + }, + // t1 family { Name: "t1.micro", @@ -1807,5 +1847,15 @@ var MachineTypes []AWSMachineTypeInfo = []AWSMachineTypeInfo{ EphemeralDisks: []int{900, 900}, }, + { + Name: "z1d.metal", + MemoryGB: 384, + ECU: 271, + Cores: 48, + InstanceENIs: 15, + InstanceIPsPerENI: 50, + EphemeralDisks: []int{900, 900}, + }, + // END GENERATED CONTENT } From 7d56582d6216776753492174f3c1145b73345e92 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Sat, 23 Feb 2019 17:15:35 -0500 Subject: [PATCH 152/163] Map docker 18.06.3 Docker 18.06.2 on RHEL/Centos did not actually contain the fix, so we need 18.06.3. --- nodeup/pkg/model/docker.go | 93 +++++++++++++++++++++++++++++++-- nodeup/pkg/model/docker_test.go | 34 ++++++++++++ 2 files changed, 123 insertions(+), 4 deletions(-) diff --git a/nodeup/pkg/model/docker.go b/nodeup/pkg/model/docker.go index 718e2a0d77a89..74e39b2d090f2 100644 --- a/nodeup/pkg/model/docker.go +++ b/nodeup/pkg/model/docker.go @@ -43,10 +43,16 @@ type DockerBuilder struct { var _ fi.ModelBuilder = &DockerBuilder{} type dockerVersion struct { - Name string + Name string + + // Version is the version of docker, as specified in the kops Version string - Source string - Hash string + + // Source is the url where the package/tarfile can be found + Source string + + // Hash is the sha1 hash of the file + Hash string DockerVersion string Distros []distros.Distribution @@ -584,14 +590,93 @@ var dockerVersions = []dockerVersion{ // 18.06.2 - CentOS / Rhel7 (two packages) { DockerVersion: "18.06.2", - Name: "container-selinux-2", + Name: "container-selinux", + Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "2.68", + Source: "http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.68-1.el7.noarch.rpm", + Hash: "d9f87f7f4f2e8e611f556d873a17b8c0c580fec0", + Dependencies: []string{"policycoreutils-python"}, + }, + { + DockerVersion: "18.06.2", + Name: "docker-ce", Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, Architectures: []Architecture{ArchitectureAmd64}, Version: "18.06.2.ce", + Source: "https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-18.06.2.ce-3.el7.x86_64.rpm", + Hash: "456eb7c5bfb37fac342e9ade21b602c076c5b367", + Dependencies: []string{"libtool-ltdl", "libseccomp", "libcgroup"}, + }, + + // 18.06.3 (contains fix for CVE-2019-5736) + + // 18.06.3 - Bionic + { + DockerVersion: "18.06.3", + Name: "docker-ce", + Distros: []distros.Distribution{distros.DistributionBionic}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "18.06.3~ce~3-0~ubuntu", + Source: "https://download.docker.com/linux/ubuntu/dists/bionic/pool/stable/amd64/docker-ce_18.06.3~ce~3-0~ubuntu_amd64.deb", + Hash: "b396678a8b70f0503a7b944fa6e3297ab27b345b", + Dependencies: []string{"bridge-utils", "iptables", "libapparmor1", "libltdl7", "perl"}, + //Depends: iptables, init-system-helpers, lsb-base, libapparmor1, libc6, libdevmapper1.02.1, libltdl7, libeseccomp2, libsystemd0 + //Recommends: aufs-tools, ca-certificates, cgroupfs-mount | cgroup-lite, git, xz-utils, apparmor + }, + + // 18.06.3 - Debian Stretch + { + + DockerVersion: "18.06.3", + Name: "docker-ce", + Distros: []distros.Distribution{distros.DistributionDebian9}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "18.06.3~ce~3-0~debian", + Source: "https://download.docker.com/linux/debian/dists/stretch/pool/stable/amd64/docker-ce_18.06.3~ce~3-0~debian_amd64.deb", + Hash: "93b5a055a39462867d79109b00db1367e3d9e32f", + Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, + }, + + // 18.06.3 - Jessie + { + DockerVersion: "18.06.3", + Name: "docker-ce", + Distros: []distros.Distribution{distros.DistributionJessie}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "ce_18.06.3~ce~3-0~debian", + Source: "https://download.docker.com/linux/debian/dists/jessie/pool/stable/amd64/docker-ce_18.06.3~ce~3-0~debian_amd64.deb", + Hash: "058bcd4b055560866b8cad978c7aa224694602da", + Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, + }, + + // 18.06.3 - CentOS / Rhel7 (two packages) + { + DockerVersion: "18.06.3", + Name: "container-selinux", + Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "2.68", Source: "http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.68-1.el7.noarch.rpm", Hash: "d9f87f7f4f2e8e611f556d873a17b8c0c580fec0", Dependencies: []string{"policycoreutils-python"}, }, + { + DockerVersion: "18.06.3", + Name: "docker-ce", + Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "18.06.3.ce", + Source: "https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-18.06.3.ce-3.el7.x86_64.rpm", + Hash: "5369602f88406d4fb9159dc1d3fd44e76fb4cab8", + Dependencies: []string{"libtool-ltdl", "libseccomp", "libcgroup"}, + }, + + // TIP: When adding the next version, copy the previous + // version, string replace the version, run `VERIFY_HASHES=1 + // go test ./nodeup/pkg/model` (you might want to temporarily + // comment out older versions on a slower connection), and + // then validate the dependencies etc } func (d *dockerVersion) matches(arch Architecture, dockerVersion string, distro distros.Distribution) bool { diff --git a/nodeup/pkg/model/docker_test.go b/nodeup/pkg/model/docker_test.go index de6215ddf72bb..db6fd5b17d10f 100644 --- a/nodeup/pkg/model/docker_test.go +++ b/nodeup/pkg/model/docker_test.go @@ -17,6 +17,11 @@ limitations under the License. package model import ( + "crypto/sha1" + "encoding/hex" + "io" + "net/http" + "os" "path" "testing" @@ -26,6 +31,35 @@ import ( "k8s.io/kops/upup/pkg/fi" ) +func TestDockerHashes(t *testing.T) { + if os.Getenv("VERIFY_HASHES") == "" { + t.Skip("VERIFY_HASHES not set, won't download & verify docker hashes") + } + + for _, dockerVersion := range dockerVersions { + u := dockerVersion.Source + + resp, err := http.Get(u) + if err != nil { + t.Errorf("%s: error fetching: %v", u, err) + continue + } + defer resp.Body.Close() + + hasher := sha1.New() + if _, err := io.Copy(hasher, resp.Body); err != nil { + t.Errorf("%s: error reading: %v", u, err) + continue + } + + hash := hex.EncodeToString(hasher.Sum(nil)) + if hash != dockerVersion.Hash { + t.Errorf("%s: hash was %q", dockerVersion.Source, hash) + continue + } + } +} + func TestDockerBuilder_Simple(t *testing.T) { runDockerBuilderTest(t, "simple") } From b001290ea7b59865e2dc6b7904152b8d71e0b8ea Mon Sep 17 00:00:00 2001 From: Justin SB Date: Thu, 28 Feb 2019 21:54:08 -0500 Subject: [PATCH 153/163] Sync up docker with master After all the cherry-picks against this file, the state drifted a little. Resync with master (this shouldn't be version specific anyway) --- nodeup/pkg/model/docker.go | 71 +++++++++++++++++++++++++++++++++----- 1 file changed, 62 insertions(+), 9 deletions(-) diff --git a/nodeup/pkg/model/docker.go b/nodeup/pkg/model/docker.go index 74e39b2d090f2..d5357e519c823 100644 --- a/nodeup/pkg/model/docker.go +++ b/nodeup/pkg/model/docker.go @@ -516,13 +516,27 @@ var dockerVersions = []dockerVersion{ //Recommends: aufs-tools, ca-certificates, cgroupfs-mount | cgroup-lite, git, xz-utils, apparmor }, + // 18.06.2 - Xenial + { + DockerVersion: "18.06.2", + Name: "docker-ce", + Distros: []distros.Distribution{distros.DistributionXenial}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "18.06.2~ce~3-0~ubuntu", + Source: "https://download.docker.com/linux/ubuntu/dists/xenial/pool/stable/amd64/docker-ce_18.06.2~ce~3-0~ubuntu_amd64.deb", + Hash: "03e5eaae9c84b144e1140d9b418e43fce0311892", + Dependencies: []string{"bridge-utils", "iptables", "libapparmor1", "libltdl7", "perl"}, + //Depends: iptables, init-system-helpers, lsb-base, libapparmor1, libc6, libdevmapper1.02.1, libltdl7, libeseccomp2, libsystemd0 + //Recommends: aufs-tools, ca-certificates, cgroupfs-mount | cgroup-lite, git, xz-utils, apparmor + }, + // 17.09.0 - Centos / Rhel7 (two packages) { DockerVersion: "17.09.0", - Name: "container-selinux-2", + Name: "container-selinux", Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, Architectures: []Architecture{ArchitectureAmd64}, - Version: "17.09.0.ce", + Version: "2.68", Source: "http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.68-1.el7.noarch.rpm", Hash: "d9f87f7f4f2e8e611f556d873a17b8c0c580fec0", Dependencies: []string{"policycoreutils-python"}, @@ -539,6 +553,20 @@ var dockerVersions = []dockerVersion{ }, // 18.03.1 - Bionic + { + DockerVersion: "18.03.1", + Name: "docker-ce", + Distros: []distros.Distribution{distros.DistributionBionic}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "18.03.1~ce~3-0~ubuntu", + Source: "https://download.docker.com/linux/ubuntu/dists/bionic/pool/stable/amd64/docker-ce_18.03.1~ce~3-0~ubuntu_amd64.deb", + Hash: "b55b32bd0e9176dd32b1e6128ad9fda10a65cc8b", + Dependencies: []string{"bridge-utils", "iptables", "libapparmor1", "libltdl7", "perl"}, + //Depends: iptables, init-system-helpers, lsb-base, libapparmor1, libc6, libdevmapper1.02.1, libltdl7, libeseccomp2, libsystemd0 + //Recommends: aufs-tools, ca-certificates, cgroupfs-mount | cgroup-lite, git, xz-utils, apparmor + }, + + // 18.06.2 - Bionic { DockerVersion: "18.06.2", Name: "docker-ce", @@ -552,6 +580,19 @@ var dockerVersions = []dockerVersion{ //Recommends: aufs-tools, ca-certificates, cgroupfs-mount | cgroup-lite, git, xz-utils, apparmor }, + // 18.06.1 - Debian Stretch + { + + DockerVersion: "18.06.1", + Name: "docker-ce", + Distros: []distros.Distribution{distros.DistributionDebian9}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "18.06.1~ce-0~debian", + Source: "https://download.docker.com/linux/debian/dists/stretch/pool/stable/amd64/docker-ce_18.06.1~ce~3-0~debian_amd64.deb", + Hash: "18473b80e61b6d4eb8b52d87313abd71261287e5", + Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, + }, + // 18.06.2 - Debian Stretch { @@ -559,31 +600,43 @@ var dockerVersions = []dockerVersion{ Name: "docker-ce", Distros: []distros.Distribution{distros.DistributionDebian9}, Architectures: []Architecture{ArchitectureAmd64}, - Version: "18.06.2~ce-0~debian", + Version: "18.06.2~ce~3-0~debian", Source: "https://download.docker.com/linux/debian/dists/stretch/pool/stable/amd64/docker-ce_18.06.2~ce~3-0~debian_amd64.deb", Hash: "aad1efd2c90725034e996c6a368ccc2bf41ca5b8", Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, }, + // 18.06.2 - Jessie + { + DockerVersion: "18.06.2", + Name: "docker-ce", + Distros: []distros.Distribution{distros.DistributionJessie}, + Architectures: []Architecture{ArchitectureAmd64}, + Version: "ce_18.06.2~ce~3-0~debian", + Source: "https://download.docker.com/linux/debian/dists/jessie/pool/stable/amd64/docker-ce_18.06.2~ce~3-0~debian_amd64.deb", + Hash: "1a2500311230aff37aa81dd1292a88302fb0a2e1", + Dependencies: []string{"bridge-utils", "libapparmor1", "libltdl7", "perl"}, + }, + // 18.06.1 - CentOS / Rhel7 (two packages) { DockerVersion: "18.06.1", - Name: "container-selinux-2", + Name: "container-selinux", Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, Architectures: []Architecture{ArchitectureAmd64}, - Version: "18.06.1.ce", + Version: "2.68", Source: "http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.68-1.el7.noarch.rpm", Hash: "d9f87f7f4f2e8e611f556d873a17b8c0c580fec0", Dependencies: []string{"policycoreutils-python"}, }, { - DockerVersion: "18.06.2", + DockerVersion: "18.06.1", Name: "docker-ce", Distros: []distros.Distribution{distros.DistributionRhel7, distros.DistributionCentos7}, Architectures: []Architecture{ArchitectureAmd64}, - Version: "18.06.2.ce", - Source: "https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-18.06.2.ce-3.el7.x86_64.rpm", - Hash: "456eb7c5bfb37fac342e9ade21b602c076c5b367", + Version: "18.06.1.ce", + Source: "https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-18.06.1.ce-3.el7.x86_64.rpm", + Hash: "0a1325e570c5e54111a79623c9fd0c0c714d3a11", Dependencies: []string{"libtool-ltdl", "libseccomp", "libcgroup"}, }, From 7d0d474cfff15d35619aeeca948a3a6426d8088c Mon Sep 17 00:00:00 2001 From: Justin SB Date: Wed, 2 Jan 2019 17:44:21 -0500 Subject: [PATCH 154/163] Update distroless As otherwise we can't build with bazel 0.21 --- WORKSPACE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/WORKSPACE b/WORKSPACE index 3e13483add90d..871ff0ddf243f 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -57,7 +57,7 @@ container_pull( git_repository( name = "distroless", remote = "https://github.com/googlecloudplatform/distroless.git", - commit = "886114394dfed219001ec3b068b139a3456e49d4", + commit = "3585653b2b0d33c3fb369b907ef68df8344fd2ad", ) load( From 765780833d7f72e569dbbd56635f7dc888f7bc55 Mon Sep 17 00:00:00 2001 From: Justin SB Date: Thu, 28 Feb 2019 23:05:50 -0500 Subject: [PATCH 155/163] Mark 1.11.1 --- version.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/version.go b/version.go index ccc3af47e4943..7bd896afee3cb 100644 --- a/version.go +++ b/version.go @@ -23,8 +23,8 @@ var Version = KOPS_RELEASE_VERSION // These constants are parsed by build tooling - be careful about changing the formats const ( - KOPS_RELEASE_VERSION = "1.11.0" - KOPS_CI_VERSION = "1.11.1-alpha.1" + KOPS_RELEASE_VERSION = "1.11.1" + KOPS_CI_VERSION = "1.11.2-alpha.1" ) // GitVersion should be replaced by the makefile From 15e76013484a657acd70657fbb430751581d461f Mon Sep 17 00:00:00 2001 From: Justin SB Date: Mon, 25 Mar 2019 23:31:05 -0400 Subject: [PATCH 156/163] Use CNI 0.7.5 Equivalent of https://github.com/kubernetes/kubernetes/pull/75455 --- upup/pkg/fi/cloudup/networking.go | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/upup/pkg/fi/cloudup/networking.go b/upup/pkg/fi/cloudup/networking.go index 96e0f3d1af912..8dc90e7d16f87 100644 --- a/upup/pkg/fi/cloudup/networking.go +++ b/upup/pkg/fi/cloudup/networking.go @@ -21,7 +21,6 @@ import ( "net/url" "os" - "github.com/blang/semver" "github.com/golang/glog" api "k8s.io/kops/pkg/apis/kops" "k8s.io/kops/pkg/apis/kops/util" @@ -123,6 +122,10 @@ const ( defaultCNIAssetK8s1_9 = "https://storage.googleapis.com/kubernetes-release/network-plugins/cni-plugins-amd64-v0.6.0.tgz" defaultCNIAssetHashStringK8s1_9 = "d595d3ded6499a64e8dac02466e2f5f2ce257c9f" + // defaultCNIAssetK8s1_11 is the CNI tarball for k8s >= 1.11 + defaultCNIAssetK8s1_11 = "https://storage.googleapis.com/kubernetes-release/network-plugins/cni-plugins-amd64-v0.7.5.tgz" + defaultCNIAssetHashStringK8s1_11 = "52e9d2de8a5f927307d9397308735658ee44ab8d" + // Environment variable for overriding CNI url ENV_VAR_CNI_VERSION_URL = "CNI_VERSION_URL" ENV_VAR_CNI_ASSET_HASH_STRING = "CNI_ASSET_HASH_STRING" @@ -153,22 +156,23 @@ func findCNIAssets(c *api.Cluster, assetBuilder *assets.AssetBuilder) (*url.URL, return nil, "", fmt.Errorf("failed to lookup kubernetes version: %v", err) } - sv.Pre = nil - sv.Build = nil - var cniAsset, cniAssetHash string - if sv.GTE(semver.Version{Major: 1, Minor: 9, Patch: 0, Pre: nil, Build: nil}) { + if util.IsKubernetesGTE("1.11", *sv) { + cniAsset = defaultCNIAssetK8s1_11 + cniAssetHash = defaultCNIAssetHashStringK8s1_11 + glog.V(2).Infof("Adding default CNI asset for k8s >= 1.11: %s", defaultCNIAssetK8s1_9) + } else if util.IsKubernetesGTE("1.9", *sv) { cniAsset = defaultCNIAssetK8s1_9 cniAssetHash = defaultCNIAssetHashStringK8s1_9 - glog.V(2).Infof("Adding default CNI asset for k8s 1.9.x and higher: %s", defaultCNIAssetK8s1_9) - } else if sv.GTE(semver.Version{Major: 1, Minor: 6, Patch: 0, Pre: nil, Build: nil}) { + glog.V(2).Infof("Adding default CNI asset for 1.11 > k8s >= 1.9: %s", defaultCNIAssetK8s1_9) + } else if util.IsKubernetesGTE("1.6", *sv) { cniAsset = defaultCNIAssetK8s1_6 cniAssetHash = defaultCNIAssetHashStringK8s1_6 - glog.V(2).Infof("Adding default CNI asset for k8s 1.6.x and higher: %s", defaultCNIAssetK8s1_6) + glog.V(2).Infof("Adding default CNI asset for 1.9 > k8s >= 1.6: %s", defaultCNIAssetK8s1_6) } else { cniAsset = defaultCNIAssetK8s1_5 cniAssetHash = defaultCNIAssetHashStringK8s1_5 - glog.V(2).Infof("Adding default CNI asset for k8s 1.5: %s", defaultCNIAssetK8s1_5) + glog.V(2).Infof("Adding default CNI asset for 1.6 > k8s >= 1.5: %s", defaultCNIAssetK8s1_5) } u, err := url.Parse(cniAsset) From 719cf2419f7f55612d95630b58d963bbd1d3caf7 Mon Sep 17 00:00:00 2001 From: Justin Santa Barbara Date: Tue, 25 Dec 2018 10:53:50 -0500 Subject: [PATCH 157/163] Fix missed error check in hasPlaceHolderIP --- pkg/validation/validate_cluster.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/validation/validate_cluster.go b/pkg/validation/validate_cluster.go index a7c9cd09a16ed..8b8ed4010e654 100644 --- a/pkg/validation/validate_cluster.go +++ b/pkg/validation/validate_cluster.go @@ -66,6 +66,9 @@ func hasPlaceHolderIP(clusterName string) (bool, error) { config, err := clientcmd.NewNonInteractiveDeferredLoadingClientConfig( clientcmd.NewDefaultClientConfigLoadingRules(), &clientcmd.ConfigOverrides{CurrentContext: clusterName}).ClientConfig() + if err != nil { + return false, fmt.Errorf("error building configuration: %v", err) + } apiAddr, err := url.Parse(config.Host) if err != nil { From bb93bdb26b861be588cd124c6e8dfb99d567dde0 Mon Sep 17 00:00:00 2001 From: Valdis Rigdon Date: Mon, 26 Mar 2018 09:36:05 -0400 Subject: [PATCH 158/163] Adds a number of additional flags/options To comply with the CIS Kubernetes Benchmark, a number of these flags need to be set different than the default value. --- docs/cluster_spec.md | 10 +++ pkg/apis/kops/componentconfig.go | 19 ++++- pkg/apis/kops/v1alpha1/componentconfig.go | 19 ++++- .../kops/v1alpha1/zz_generated.conversion.go | 25 +++++- .../kops/v1alpha1/zz_generated.deepcopy.go | 72 +++++++++++++++++ pkg/apis/kops/v1alpha2/componentconfig.go | 19 ++++- .../kops/v1alpha2/zz_generated.conversion.go | 23 ++++++ .../kops/v1alpha2/zz_generated.deepcopy.go | 72 +++++++++++++++++ pkg/apis/kops/zz_generated.deepcopy.go | 81 +++++++++++++++++++ 9 files changed, 336 insertions(+), 4 deletions(-) diff --git a/docs/cluster_spec.md b/docs/cluster_spec.md index bc9547dfce300..37d3d1116a8df 100644 --- a/docs/cluster_spec.md +++ b/docs/cluster_spec.md @@ -188,6 +188,14 @@ spec: ``` +### profiling flag + +```yaml +spec: + kubeAPIServer: + profiling: true +``` + #### audit logging Read more about this here: https://kubernetes.io/docs/admin/audit @@ -350,6 +358,7 @@ This block contains configurations for `kube-scheduler`. See https://kubernetes spec: kubeScheduler: usePolicyConfigMap: true + profiling: true ``` Will make kube-scheduler use the scheduler policy from configmap "scheduler-policy" in namespace kube-system. @@ -385,6 +394,7 @@ spec: horizontalPodAutoscalerSyncPeriod: 15s horizontalPodAutoscalerDownscaleDelay: 5m0s horizontalPodAutoscalerUpscaleDelay: 3m0s + profiling: true ``` For more details on `horizontalPodAutoscaler` flags see the [official HPA docs](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) and the [Kops guides on how to set it up](horizontal_pod_autoscaling.md). diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index 2f7bfd330024b..a62bdb33e470a 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -179,6 +179,14 @@ type KubeletConfigSpec struct { AuthenticationTokenWebhook *bool `json:"authenticationTokenWebhook,omitempty" flag:"authentication-token-webhook"` // AuthenticationTokenWebhook sets the duration to cache responses from the webhook token authenticator. Default is 2m. (default 2m0s) AuthenticationTokenWebhookCacheTTL *metav1.Duration `json:"authenticationTokenWebhookCacheTtl,omitempty" flag:"authentication-token-webhook-cache-ttl"` + // EventQps If > 0, limit event creations per second to this value. If 0, unlimited. + EventQPS *int32 `json:"eventQps,omitempty" flag:"event-qps"` + // MakeIptablesUtilChains will ensure iptables utility rules are present on host. + MakeIptablesUtilChains *bool `json:"makeIptablesUtilChains,omitempty" flag:"make-iptables-util-chains"` + // CAdvisorPort The port of the localhost cAdvisor endpoint (set to 0 to disable) (default 4194) + CAdvisorPort *int32 `json:"cadvisorPort,omitempty" flag:"cadvisor-port"` + // ProtectKernelDefaults Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults. + ProtectKernelDefaults *bool `json:"protectKernelDefaults,omitempty" flag:"protect-kernel-defaults"` } // KubeProxyConfig defines the configuration for a proxy @@ -363,13 +371,18 @@ type KubeAPIServerConfig struct { // EtcdQuorumRead configures the etcd-quorum-read flag, which forces consistent reads from etcd EtcdQuorumRead *bool `json:"etcdQuorumRead,omitempty" flag:"etcd-quorum-read"` - // MinRequestTimeout configures the minimum number of seconds a handler must keep a request open before timing it out. // Currently only honored by the watch request handler MinRequestTimeout *int32 `json:"minRequestTimeout,omitempty" flag:"min-request-timeout"` // Memory limit for apiserver in MB (used to configure sizes of caches, etc.) TargetRamMb int32 `json:"targetRamMb,omitempty" flag:"target-ram-mb" flag-empty:"0"` + // Enable profiling via web interface + Profiling *bool `json:"profiling,omitempty" flag:"profiling"` + // Verify service account token + ServiceAccountLookup *bool `json:"serviceAccountLookup,omitempty" flag:"service-account-lookup"` + // Repair malformed requests from clients + RepairMalformedUpdates *bool `json:"repairMalformedUpdates,omitempty" flag:"repair-malformed-updates"` } // KubeControllerManagerConfig is the configuration for the controller @@ -435,6 +448,8 @@ type KubeControllerManagerConfig struct { HorizontalPodAutoscalerUseRestClients *bool `json:"horizontalPodAutoscalerUseRestClients,omitempty" flag:"horizontal-pod-autoscaler-use-rest-clients"` // FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features. FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"` + // Enable profiling via web interface + Profiling *bool `json:"profiling,omitempty" flag:"profiling"` } // CloudControllerManagerConfig is the configuration of the cloud controller @@ -472,6 +487,8 @@ type KubeSchedulerConfig struct { LogLevel int32 `json:"logLevel,omitempty" flag:"v"` // Image is the docker image to use Image string `json:"image,omitempty"` + // Enable profiling via web interface + Profiling *bool `json:"profiling,omitempty" flag:"profiling"` // LeaderElection defines the configuration of leader election client. LeaderElection *LeaderElectionConfiguration `json:"leaderElection,omitempty"` // UsePolicyConfigMap enable setting the scheduler policy from a configmap diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index 8226a662695ee..2ba1e08b98d23 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -179,6 +179,14 @@ type KubeletConfigSpec struct { AuthenticationTokenWebhook *bool `json:"authenticationTokenWebhook,omitempty" flag:"authentication-token-webhook"` // AuthenticationTokenWebhook sets the duration to cache responses from the webhook token authenticator. Default is 2m. (default 2m0s) AuthenticationTokenWebhookCacheTTL *metav1.Duration `json:"authenticationTokenWebhookCacheTtl,omitempty" flag:"authentication-token-webhook-cache-ttl"` + // EventQps If > 0, limit event creations per second to this value. If 0, unlimited. + EventQPS *int32 `json:"eventQps,omitempty" flag:"event-qps"` + // MakeIptablesUtilChains will ensure iptables utility rules are present on host. + MakeIptablesUtilChains *bool `json:"makeIptablesUtilChains,omitempty" flag:"make-iptables-util-chains"` + // CAdvisorPort The port of the localhost cAdvisor endpoint (set to 0 to disable) (default 4194) + CAdvisorPort *int32 `json:"cadvisorPort,omitempty" flag:"cadvisor-port"` + // ProtectKernelDefaults Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults. + ProtectKernelDefaults *bool `json:"protectKernelDefaults,omitempty" flag:"protect-kernel-defaults"` } // KubeProxyConfig defines the configuration for a proxy @@ -363,13 +371,18 @@ type KubeAPIServerConfig struct { // EtcdQuorumRead configures the etcd-quorum-read flag, which forces consistent reads from etcd EtcdQuorumRead *bool `json:"etcdQuorumRead,omitempty" flag:"etcd-quorum-read"` - // MinRequestTimeout configures the minimum number of seconds a handler must keep a request open before timing it out. // Currently only honored by the watch request handler MinRequestTimeout *int32 `json:"minRequestTimeout,omitempty" flag:"min-request-timeout"` // Memory limit for apiserver in MB (used to configure sizes of caches, etc.) TargetRamMb int32 `json:"targetRamMb,omitempty" flag:"target-ram-mb" flag-empty:"0"` + // Enable profiling via web interface. + Profiling *bool `json:"profiling,omitempty" flag:"profiling"` + // Verify service account token + ServiceAccountLookup *bool `json:"serviceAccountLookup,omitempty" flag:"service-account-lookup"` + // Repair malformed requests from clients + RepairMalformedUpdates *bool `json:"repairMalformedUpdates,omitempty" flag:"repair-malformed-updates"` } // KubeControllerManagerConfig is the configuration for the controller @@ -435,6 +448,8 @@ type KubeControllerManagerConfig struct { HorizontalPodAutoscalerUseRestClients *bool `json:"horizontalPodAutoscalerUseRestClients,omitempty" flag:"horizontal-pod-autoscaler-use-rest-clients"` // FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features. FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"` + // Enable profiling via web interface. + Profiling *bool `json:"profiling,omitempty" flag:"profiling"` } // CloudControllerManagerConfig is the configuration of the cloud controller @@ -472,6 +487,8 @@ type KubeSchedulerConfig struct { LogLevel int32 `json:"logLevel,omitempty" flag:"v"` // Image is the docker image to use Image string `json:"image,omitempty"` + // Enable profiling via web interface + Profiling bool `json:"profiling,omitempty" flag:"profiling"` // LeaderElection defines the configuration of leader election client. LeaderElection *LeaderElectionConfiguration `json:"leaderElection,omitempty"` // UsePolicyConfigMap enable setting the scheduler policy from a configmap diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index d2c6856dab49a..7f7c240739423 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -1,4 +1,4 @@ -// +build !ignore_autogenerated +/ +build !ignore_autogenerated /* Copyright 2019 The Kubernetes Authors. @@ -21,6 +21,7 @@ limitations under the License. package v1alpha1 import ( + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" conversion "k8s.io/apimachinery/pkg/conversion" runtime "k8s.io/apimachinery/pkg/runtime" kops "k8s.io/kops/pkg/apis/kops" @@ -2233,6 +2234,9 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.EtcdQuorumRead = in.EtcdQuorumRead out.MinRequestTimeout = in.MinRequestTimeout out.TargetRamMb = in.TargetRamMb + out.Profiling = in.Profiling + out.ServiceAccountLookup = in.ServiceAccountLookup + out.RepairMalformedUpdates = in.RepairMalformedUpdates return nil } @@ -2307,6 +2311,9 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko out.EtcdQuorumRead = in.EtcdQuorumRead out.MinRequestTimeout = in.MinRequestTimeout out.TargetRamMb = in.TargetRamMb + out.Profiling = in.Profiling + out.ServiceAccountLookup = in.ServiceAccountLookup + out.RepairMalformedUpdates = in.RepairMalformedUpdates return nil } @@ -2349,6 +2356,7 @@ func autoConvert_v1alpha1_KubeControllerManagerConfig_To_kops_KubeControllerMana out.HorizontalPodAutoscalerUpscaleDelay = in.HorizontalPodAutoscalerUpscaleDelay out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.FeatureGates = in.FeatureGates + out.Profiling = in.Profiling return nil } @@ -2391,6 +2399,7 @@ func autoConvert_kops_KubeControllerManagerConfig_To_v1alpha1_KubeControllerMana out.HorizontalPodAutoscalerUpscaleDelay = in.HorizontalPodAutoscalerUpscaleDelay out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.FeatureGates = in.FeatureGates + out.Profiling = in.Profiling return nil } @@ -2495,6 +2504,9 @@ func autoConvert_v1alpha1_KubeSchedulerConfig_To_kops_KubeSchedulerConfig(in *Ku out.Master = in.Master out.LogLevel = in.LogLevel out.Image = in.Image + if err := v1.Convert_bool_To_Pointer_bool(&in.Profiling, &out.Profiling, s); err != nil { + return err + } if in.LeaderElection != nil { in, out := &in.LeaderElection, &out.LeaderElection *out = new(kops.LeaderElectionConfiguration) @@ -2518,6 +2530,9 @@ func autoConvert_kops_KubeSchedulerConfig_To_v1alpha1_KubeSchedulerConfig(in *ko out.Master = in.Master out.LogLevel = in.LogLevel out.Image = in.Image + if err := v1.Convert_Pointer_bool_To_bool(&in.Profiling, &out.Profiling, s); err != nil { + return err + } if in.LeaderElection != nil { in, out := &in.LeaderElection, &out.LeaderElection *out = new(LeaderElectionConfiguration) @@ -2606,6 +2621,10 @@ func autoConvert_v1alpha1_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele out.RootDir = in.RootDir out.AuthenticationTokenWebhook = in.AuthenticationTokenWebhook out.AuthenticationTokenWebhookCacheTTL = in.AuthenticationTokenWebhookCacheTTL + out.EventQPS = in.EventQPS + out.MakeIptablesUtilChains = in.MakeIptablesUtilChains + out.CAdvisorPort = in.CAdvisorPort + out.ProtectKernelDefaults = in.ProtectKernelDefaults return nil } @@ -2683,6 +2702,10 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha1_KubeletConfigSpec(in *kops.K out.RootDir = in.RootDir out.AuthenticationTokenWebhook = in.AuthenticationTokenWebhook out.AuthenticationTokenWebhookCacheTTL = in.AuthenticationTokenWebhookCacheTTL + out.EventQPS = in.EventQPS + out.MakeIptablesUtilChains = in.MakeIptablesUtilChains + out.CAdvisorPort = in.CAdvisorPort + out.ProtectKernelDefaults = in.ProtectKernelDefaults return nil } diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index 9772441545707..8e402e229040b 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -2181,6 +2181,33 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { **out = **in } } + if in.Profiling != nil { + in, out := &in.Profiling, &out.Profiling + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } + if in.ServiceAccountLookup != nil { + in, out := &in.ServiceAccountLookup, &out.ServiceAccountLookup + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } + if in.RepairMalformedUpdates != nil { + in, out := &in.RepairMalformedUpdates, &out.RepairMalformedUpdates + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } return } @@ -2344,6 +2371,15 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo (*out)[key] = val } } + if in.Profiling != nil { + in, out := &in.Profiling, &out.Profiling + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } return } @@ -2829,6 +2865,42 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { **out = **in } } + if in.EventQPS != nil { + in, out := &in.EventQPS, &out.EventQPS + if *in == nil { + *out = nil + } else { + *out = new(int32) + **out = **in + } + } + if in.MakeIptablesUtilChains != nil { + in, out := &in.MakeIptablesUtilChains, &out.MakeIptablesUtilChains + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } + if in.CAdvisorPort != nil { + in, out := &in.CAdvisorPort, &out.CAdvisorPort + if *in == nil { + *out = nil + } else { + *out = new(int32) + **out = **in + } + } + if in.ProtectKernelDefaults != nil { + in, out := &in.ProtectKernelDefaults, &out.ProtectKernelDefaults + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } return } diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index ff8e8ad855211..6e7bb7663944c 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -179,6 +179,14 @@ type KubeletConfigSpec struct { AuthenticationTokenWebhook *bool `json:"authenticationTokenWebhook,omitempty" flag:"authentication-token-webhook"` // AuthenticationTokenWebhook sets the duration to cache responses from the webhook token authenticator. Default is 2m. (default 2m0s) AuthenticationTokenWebhookCacheTTL *metav1.Duration `json:"authenticationTokenWebhookCacheTtl,omitempty" flag:"authentication-token-webhook-cache-ttl"` + // EventQps If > 0, limit event creations per second to this value. If 0, unlimited. + EventQPS *int32 `json:"eventQps,omitempty" flag:"event-qps"` + // MakeIptablesUtilChains will ensure iptables utility rules are present on host. + MakeIptablesUtilChains *bool `json:"makeIptablesUtilChains,omitempty" flag:"make-iptables-util-chains"` + // CAdvisorPort The port of the localhost cAdvisor endpoint (set to 0 to disable) (default 4194) + CAdvisorPort *int32 `json:"cadvisorPort,omitempty" flag:"cadvisor-port"` + // ProtectKernelDefaults Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults. + ProtectKernelDefaults *bool `json:"protectKernelDefaults,omitempty" flag:"protect-kernel-defaults"` } // KubeProxyConfig defines the configuration for a proxy @@ -363,13 +371,18 @@ type KubeAPIServerConfig struct { // EtcdQuorumRead configures the etcd-quorum-read flag, which forces consistent reads from etcd EtcdQuorumRead *bool `json:"etcdQuorumRead,omitempty" flag:"etcd-quorum-read"` - // MinRequestTimeout configures the minimum number of seconds a handler must keep a request open before timing it out. // Currently only honored by the watch request handler MinRequestTimeout *int32 `json:"minRequestTimeout,omitempty" flag:"min-request-timeout"` // Memory limit for apiserver in MB (used to configure sizes of caches, etc.) TargetRamMb int32 `json:"targetRamMb,omitempty" flag:"target-ram-mb" flag-empty:"0"` + // Enable profiling via web interface. + Profiling *bool `json:"profiling,omitempty" flag:"profiling"` + // Verify service account token + ServiceAccountLookup *bool `json:"serviceAccountLookup,omitempty" flag:"service-account-lookup"` + // Repair malformed requests from clients + RepairMalformedUpdates *bool `json:"repairMalformedUpdates,omitempty" flag:"repair-malformed-updates"` } // KubeControllerManagerConfig is the configuration for the controller @@ -435,6 +448,8 @@ type KubeControllerManagerConfig struct { HorizontalPodAutoscalerUseRestClients *bool `json:"horizontalPodAutoscalerUseRestClients,omitempty" flag:"horizontal-pod-autoscaler-use-rest-clients"` // FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features. FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"` + // Enable profiling via web interface. + Profiling *bool `json:"profiling,omitempty" flag:"profiling"` } // CloudControllerManagerConfig is the configuration of the cloud controller @@ -472,6 +487,8 @@ type KubeSchedulerConfig struct { LogLevel int32 `json:"logLevel,omitempty" flag:"v"` // Image is the docker image to use Image string `json:"image,omitempty"` + // Enable profiling via web interface + Profiling bool `json:"profiling,omitempty" flag:"profiling"` // LeaderElection defines the configuration of leader election client. LeaderElection *LeaderElectionConfiguration `json:"leaderElection,omitempty"` // UsePolicyConfigMap enable setting the scheduler policy from a configmap diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 2297f66a87155..f0952f368a6b4 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -21,6 +21,7 @@ limitations under the License. package v1alpha2 import ( + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" conversion "k8s.io/apimachinery/pkg/conversion" runtime "k8s.io/apimachinery/pkg/runtime" kops "k8s.io/kops/pkg/apis/kops" @@ -2497,6 +2498,9 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.EtcdQuorumRead = in.EtcdQuorumRead out.MinRequestTimeout = in.MinRequestTimeout out.TargetRamMb = in.TargetRamMb + out.Profiling = in.Profiling + out.ServiceAccountLookup = in.ServiceAccountLookup + out.RepairMalformedUpdates = in.RepairMalformedUpdates return nil } @@ -2571,6 +2575,9 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko out.EtcdQuorumRead = in.EtcdQuorumRead out.MinRequestTimeout = in.MinRequestTimeout out.TargetRamMb = in.TargetRamMb + out.Profiling = in.Profiling + out.ServiceAccountLookup = in.ServiceAccountLookup + out.RepairMalformedUpdates = in.RepairMalformedUpdates return nil } @@ -2613,6 +2620,7 @@ func autoConvert_v1alpha2_KubeControllerManagerConfig_To_kops_KubeControllerMana out.HorizontalPodAutoscalerUpscaleDelay = in.HorizontalPodAutoscalerUpscaleDelay out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.FeatureGates = in.FeatureGates + out.Profiling = in.Profiling return nil } @@ -2655,6 +2663,7 @@ func autoConvert_kops_KubeControllerManagerConfig_To_v1alpha2_KubeControllerMana out.HorizontalPodAutoscalerUpscaleDelay = in.HorizontalPodAutoscalerUpscaleDelay out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.FeatureGates = in.FeatureGates + out.Profiling = in.Profiling return nil } @@ -2759,6 +2768,9 @@ func autoConvert_v1alpha2_KubeSchedulerConfig_To_kops_KubeSchedulerConfig(in *Ku out.Master = in.Master out.LogLevel = in.LogLevel out.Image = in.Image + if err := v1.Convert_bool_To_Pointer_bool(&in.Profiling, &out.Profiling, s); err != nil { + return err + } if in.LeaderElection != nil { in, out := &in.LeaderElection, &out.LeaderElection *out = new(kops.LeaderElectionConfiguration) @@ -2782,6 +2794,9 @@ func autoConvert_kops_KubeSchedulerConfig_To_v1alpha2_KubeSchedulerConfig(in *ko out.Master = in.Master out.LogLevel = in.LogLevel out.Image = in.Image + if err := v1.Convert_Pointer_bool_To_bool(&in.Profiling, &out.Profiling, s); err != nil { + return err + } if in.LeaderElection != nil { in, out := &in.LeaderElection, &out.LeaderElection *out = new(LeaderElectionConfiguration) @@ -2870,6 +2885,10 @@ func autoConvert_v1alpha2_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele out.RootDir = in.RootDir out.AuthenticationTokenWebhook = in.AuthenticationTokenWebhook out.AuthenticationTokenWebhookCacheTTL = in.AuthenticationTokenWebhookCacheTTL + out.EventQPS = in.EventQPS + out.MakeIptablesUtilChains = in.MakeIptablesUtilChains + out.CAdvisorPort = in.CAdvisorPort + out.ProtectKernelDefaults = in.ProtectKernelDefaults return nil } @@ -2947,6 +2966,10 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha2_KubeletConfigSpec(in *kops.K out.RootDir = in.RootDir out.AuthenticationTokenWebhook = in.AuthenticationTokenWebhook out.AuthenticationTokenWebhookCacheTTL = in.AuthenticationTokenWebhookCacheTTL + out.EventQPS = in.EventQPS + out.MakeIptablesUtilChains = in.MakeIptablesUtilChains + out.CAdvisorPort = in.CAdvisorPort + out.ProtectKernelDefaults = in.ProtectKernelDefaults return nil } diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index 509e5db1a1c39..1d58d838df3fe 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -2262,6 +2262,33 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { **out = **in } } + if in.Profiling != nil { + in, out := &in.Profiling, &out.Profiling + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } + if in.ServiceAccountLookup != nil { + in, out := &in.ServiceAccountLookup, &out.ServiceAccountLookup + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } + if in.RepairMalformedUpdates != nil { + in, out := &in.RepairMalformedUpdates, &out.RepairMalformedUpdates + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } return } @@ -2425,6 +2452,15 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo (*out)[key] = val } } + if in.Profiling != nil { + in, out := &in.Profiling, &out.Profiling + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } return } @@ -2910,6 +2946,42 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { **out = **in } } + if in.EventQPS != nil { + in, out := &in.EventQPS, &out.EventQPS + if *in == nil { + *out = nil + } else { + *out = new(int32) + **out = **in + } + } + if in.MakeIptablesUtilChains != nil { + in, out := &in.MakeIptablesUtilChains, &out.MakeIptablesUtilChains + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } + if in.CAdvisorPort != nil { + in, out := &in.CAdvisorPort, &out.CAdvisorPort + if *in == nil { + *out = nil + } else { + *out = new(int32) + **out = **in + } + } + if in.ProtectKernelDefaults != nil { + in, out := &in.ProtectKernelDefaults, &out.ProtectKernelDefaults + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } return } diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index f074f40aeabce..a3befec653ed0 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -2450,6 +2450,33 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { **out = **in } } + if in.Profiling != nil { + in, out := &in.Profiling, &out.Profiling + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } + if in.ServiceAccountLookup != nil { + in, out := &in.ServiceAccountLookup, &out.ServiceAccountLookup + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } + if in.RepairMalformedUpdates != nil { + in, out := &in.RepairMalformedUpdates, &out.RepairMalformedUpdates + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } return } @@ -2613,6 +2640,15 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo (*out)[key] = val } } + if in.Profiling != nil { + in, out := &in.Profiling, &out.Profiling + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } return } @@ -2744,6 +2780,15 @@ func (in *KubeProxyConfig) DeepCopy() *KubeProxyConfig { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KubeSchedulerConfig) DeepCopyInto(out *KubeSchedulerConfig) { *out = *in + if in.Profiling != nil { + in, out := &in.Profiling, &out.Profiling + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } if in.LeaderElection != nil { in, out := &in.LeaderElection, &out.LeaderElection if *in == nil { @@ -3098,6 +3143,42 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { **out = **in } } + if in.EventQPS != nil { + in, out := &in.EventQPS, &out.EventQPS + if *in == nil { + *out = nil + } else { + *out = new(int32) + **out = **in + } + } + if in.MakeIptablesUtilChains != nil { + in, out := &in.MakeIptablesUtilChains, &out.MakeIptablesUtilChains + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } + if in.CAdvisorPort != nil { + in, out := &in.CAdvisorPort, &out.CAdvisorPort + if *in == nil { + *out = nil + } else { + *out = new(int32) + **out = **in + } + } + if in.ProtectKernelDefaults != nil { + in, out := &in.ProtectKernelDefaults, &out.ProtectKernelDefaults + if *in == nil { + *out = nil + } else { + *out = new(bool) + **out = **in + } + } return } From 5d73e7009f49af151c56884afa84df080d70db92 Mon Sep 17 00:00:00 2001 From: Valdis Rigdon Date: Fri, 5 Jan 2018 14:49:13 -0500 Subject: [PATCH 159/163] Adds support to disable basic auth and token auth --- docs/cluster_spec.md | 22 ++++++++++++++++++- nodeup/pkg/model/kube_apiserver.go | 7 +++++- pkg/apis/kops/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha1/componentconfig.go | 2 ++ .../kops/v1alpha1/zz_generated.conversion.go | 4 +++- pkg/apis/kops/v1alpha2/componentconfig.go | 2 ++ .../kops/v1alpha2/zz_generated.conversion.go | 2 ++ 7 files changed, 38 insertions(+), 3 deletions(-) diff --git a/docs/cluster_spec.md b/docs/cluster_spec.md index 37d3d1116a8df..eac0d166d208c 100644 --- a/docs/cluster_spec.md +++ b/docs/cluster_spec.md @@ -188,7 +188,7 @@ spec: ``` -### profiling flag +#### profiling flag ```yaml spec: @@ -296,6 +296,26 @@ spec: targetRamMb: 4096 ``` +#### Disable Basic Auth + +This will disable the passing of the `--basic-auth-file` flag. + +```yaml +spec: + kubeAPIServer: + disableBasicAuth: true +``` + +#### Disable Token Auth + +This will disable the passing of the `--token-auth-file` flag. + +```yaml +spec: + kubeAPIServer: + disableTokenAuth: true +``` + ### externalDns This block contains configuration options for your `external-DNS` provider. diff --git a/nodeup/pkg/model/kube_apiserver.go b/nodeup/pkg/model/kube_apiserver.go index 422cb8c891c46..aa2f6b8de4fb5 100644 --- a/nodeup/pkg/model/kube_apiserver.go +++ b/nodeup/pkg/model/kube_apiserver.go @@ -283,7 +283,12 @@ func (b *KubeAPIServerBuilder) buildPod() (*v1.Pod, error) { kubeAPIServer.ClientCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt") kubeAPIServer.TLSCertFile = filepath.Join(b.PathSrvKubernetes(), "server.cert") kubeAPIServer.TLSPrivateKeyFile = filepath.Join(b.PathSrvKubernetes(), "server.key") - kubeAPIServer.TokenAuthFile = filepath.Join(b.PathSrvKubernetes(), "known_tokens.csv") + if !kubeAPIServer.DisableBasicAuth { + kubeAPIServer.BasicAuthFile = filepath.Join(b.PathSrvKubernetes(), "basic_auth.csv") + } + if !kubeAPIServer.DisableTokenAuth { + kubeAPIServer.TokenAuthFile = filepath.Join(b.PathSrvKubernetes(), "known_tokens.csv") + } if !kubeAPIServer.DisableBasicAuth { kubeAPIServer.BasicAuthFile = filepath.Join(b.PathSrvKubernetes(), "basic_auth.csv") diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index a62bdb33e470a..c2704e4f75df1 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -237,6 +237,8 @@ type KubeAPIServerConfig struct { Image string `json:"image,omitempty"` // DisableBasicAuth removes the --basic-auth-file flag DisableBasicAuth bool `json:"disableBasicAuth,omitempty"` + // EnableTokenAuth removes the --token-auth-file flag + DisableTokenAuth bool `json:"disableTokenAuth,omitempty"` // LogLevel is the logging level of the api LogLevel int32 `json:"logLevel,omitempty" flag:"v" flag-empty:"0"` // CloudProvider is the name of the cloudProvider we are using, aws, gce etcd diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index 2ba1e08b98d23..484d35ca532af 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -237,6 +237,8 @@ type KubeAPIServerConfig struct { Image string `json:"image,omitempty"` // DisableBasicAuth removes the --basic-auth-file flag DisableBasicAuth bool `json:"disableBasicAuth,omitempty"` + // EnableTokenAuth removes the --token-auth-file flag + DisableTokenAuth bool `json:"disableTokenAuth,omitempty"` // LogLevel is the logging level of the api LogLevel int32 `json:"logLevel,omitempty" flag:"v" flag-empty:"0"` // CloudProvider is the name of the cloudProvider we are using, aws, gce etcd diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 7f7c240739423..ab8cb57d0bfb4 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -1,4 +1,4 @@ -/ +build !ignore_autogenerated +// +build !ignore_autogenerated /* Copyright 2019 The Kubernetes Authors. @@ -2171,6 +2171,7 @@ func Convert_kops_KopeioNetworkingSpec_To_v1alpha1_KopeioNetworkingSpec(in *kops func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAPIServerConfig, out *kops.KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image out.DisableBasicAuth = in.DisableBasicAuth + out.DisableTokenAuth = in.DisableTokenAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort @@ -2248,6 +2249,7 @@ func Convert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAP func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *kops.KubeAPIServerConfig, out *KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image out.DisableBasicAuth = in.DisableBasicAuth + out.DisableTokenAuth = in.DisableTokenAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 6e7bb7663944c..806956636f644 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -237,6 +237,8 @@ type KubeAPIServerConfig struct { Image string `json:"image,omitempty"` // DisableBasicAuth removes the --basic-auth-file flag DisableBasicAuth bool `json:"disableBasicAuth,omitempty"` + // EnableTokenAuth removes the --token-auth-file flag + DisableTokenAuth bool `json:"disableTokenAuth,omitempty"` // LogLevel is the logging level of the api LogLevel int32 `json:"logLevel,omitempty" flag:"v" flag-empty:"0"` // CloudProvider is the name of the cloudProvider we are using, aws, gce etcd diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index f0952f368a6b4..f685dbfa7778a 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -2435,6 +2435,7 @@ func Convert_kops_KopeioNetworkingSpec_To_v1alpha2_KopeioNetworkingSpec(in *kops func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAPIServerConfig, out *kops.KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image out.DisableBasicAuth = in.DisableBasicAuth + out.DisableTokenAuth = in.DisableTokenAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort @@ -2512,6 +2513,7 @@ func Convert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAP func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *kops.KubeAPIServerConfig, out *KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image out.DisableBasicAuth = in.DisableBasicAuth + out.DisableTokenAuth = in.DisableTokenAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort From d790b29655e0977a7144e42c1a7e2a4d418af74d Mon Sep 17 00:00:00 2001 From: Valdis Rigdon Date: Mon, 26 Mar 2018 09:36:05 -0400 Subject: [PATCH 160/163] Adds a number of additional flags/options To comply with the CIS Kubernetes Benchmark, a number of these flags need to be set different than the default value. --- docs/cluster_spec.md | 2 +- pkg/apis/kops/v1alpha1/zz_generated.conversion.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/cluster_spec.md b/docs/cluster_spec.md index eac0d166d208c..e3d46b91ec21f 100644 --- a/docs/cluster_spec.md +++ b/docs/cluster_spec.md @@ -188,7 +188,7 @@ spec: ``` -#### profiling flag +### profiling flag ```yaml spec: diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index ab8cb57d0bfb4..899b14e50e749 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -1,4 +1,4 @@ -// +build !ignore_autogenerated +/ +build !ignore_autogenerated /* Copyright 2019 The Kubernetes Authors. From 840754b93763bf5a2c4fb6283d618ea0ccefd49e Mon Sep 17 00:00:00 2001 From: Valdis Rigdon Date: Fri, 5 Jan 2018 14:49:13 -0500 Subject: [PATCH 161/163] Adds support to disable basic auth and token auth --- docs/cluster_spec.md | 2 +- nodeup/pkg/model/kube_apiserver.go | 4 ---- pkg/apis/kops/v1alpha1/zz_generated.conversion.go | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/docs/cluster_spec.md b/docs/cluster_spec.md index e3d46b91ec21f..eac0d166d208c 100644 --- a/docs/cluster_spec.md +++ b/docs/cluster_spec.md @@ -188,7 +188,7 @@ spec: ``` -### profiling flag +#### profiling flag ```yaml spec: diff --git a/nodeup/pkg/model/kube_apiserver.go b/nodeup/pkg/model/kube_apiserver.go index aa2f6b8de4fb5..30e68703bbec1 100644 --- a/nodeup/pkg/model/kube_apiserver.go +++ b/nodeup/pkg/model/kube_apiserver.go @@ -290,10 +290,6 @@ func (b *KubeAPIServerBuilder) buildPod() (*v1.Pod, error) { kubeAPIServer.TokenAuthFile = filepath.Join(b.PathSrvKubernetes(), "known_tokens.csv") } - if !kubeAPIServer.DisableBasicAuth { - kubeAPIServer.BasicAuthFile = filepath.Join(b.PathSrvKubernetes(), "basic_auth.csv") - } - if b.UseEtcdTLS() { kubeAPIServer.EtcdCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt") kubeAPIServer.EtcdCertFile = filepath.Join(b.PathSrvKubernetes(), "etcd-client.pem") diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 899b14e50e749..ab8cb57d0bfb4 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -1,4 +1,4 @@ -/ +build !ignore_autogenerated +// +build !ignore_autogenerated /* Copyright 2019 The Kubernetes Authors. From 41624a79f04d09daf390d4b31b8ab554dfde8d02 Mon Sep 17 00:00:00 2001 From: Adam Noll Date: Tue, 23 Oct 2018 13:12:24 -0400 Subject: [PATCH 162/163] Add tls-cipher-suites flag --- pkg/apis/kops/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha1/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha1/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go | 5 +++++ pkg/apis/kops/v1alpha2/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha2/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go | 5 +++++ pkg/apis/kops/zz_generated.deepcopy.go | 5 +++++ 8 files changed, 25 insertions(+) diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index c2704e4f75df1..44e08759c3919 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -285,6 +285,8 @@ type KubeAPIServerConfig struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites is a list of allowed TLS ciphers suites + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` // TODO: Remove unused TokenAuthFile TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"` // AllowPrivileged indicates if we can run privileged containers diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index 484d35ca532af..ac2b88b4f70b2 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -285,6 +285,8 @@ type KubeAPIServerConfig struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites is a list of allowed TLS ciphers suites + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` // TODO: Remove unused TokenAuthFile TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"` // AllowPrivileged indicates if we can run privileged containers diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index ab8cb57d0bfb4..ca8e812cc84cd 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -2195,6 +2195,7 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -2273,6 +2274,7 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index 8e402e229040b..0edffb3382c99 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -1917,6 +1917,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.AllowPrivileged != nil { in, out := &in.AllowPrivileged, &out.AllowPrivileged if *in == nil { diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 806956636f644..a920c2d8b31bf 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -285,6 +285,8 @@ type KubeAPIServerConfig struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites is a list of allowed TLS ciphers suites + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` // TODO: Remove unused TokenAuthFile TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"` // AllowPrivileged indicates if we can run privileged containers diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index f685dbfa7778a..1cf7cba72d027 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -2459,6 +2459,7 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -2537,6 +2538,7 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index 1d58d838df3fe..1d093adcaacfc 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -1998,6 +1998,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.AllowPrivileged != nil { in, out := &in.AllowPrivileged, &out.AllowPrivileged if *in == nil { diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index a3befec653ed0..1653c7f9ff2b4 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -2186,6 +2186,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.AllowPrivileged != nil { in, out := &in.AllowPrivileged, &out.AllowPrivileged if *in == nil { From 3d8a9bb3fa223f5adc21db550b539bf1220bd64e Mon Sep 17 00:00:00 2001 From: Joseph Sirak Date: Mon, 20 May 2019 13:19:00 -0400 Subject: [PATCH 163/163] CN-268: Fix a compilation error --- images/utils-builder/Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/images/utils-builder/Dockerfile b/images/utils-builder/Dockerfile index f04918c62f090..e278d928985f1 100644 --- a/images/utils-builder/Dockerfile +++ b/images/utils-builder/Dockerfile @@ -18,6 +18,8 @@ FROM k8s.gcr.io/debian-base-amd64:0.2 RUN echo "deb-src http://security.debian.org/ jessie/updates main" >> /etc/apt/sources.list RUN echo "deb-src http://ftp.us.debian.org/debian/ jessie main" >> /etc/apt/sources.list +RUN printf "deb http://archive.debian.org/debian/ jessie main\ndeb-src http://archive.debian.org/debian/ jessie main\ndeb http://security.debian.org jessie/updates main\ndeb-src http://security.debian.org jessie/updates main" > /etc/apt/sources.list + RUN apt-get update && apt-get install --yes dpkg-dev bash \ && apt-get build-dep --yes socat conntrack \ && apt-get clean