porkadot 0.21.0 → 0.23.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 839afa115dc53563a391b710c14ab686f6c45a5420a6d1f6c6eee21ebdb1e6cf
-  data.tar.gz: 8f8fbc1099bebe03b5f994050e083c385baad03536d15c14ef6ed1f412ce278c
+  metadata.gz: 8e2a062cd96fa6e9c56b2fd70f7d0dd4709265e1b5cf58057048cc19bf46868e
+  data.tar.gz: 4a18c93e458b1a822fe35b73d7af0b12804d4d4c174cbb8a3efc0daf30bbbc1e
 SHA512:
-  metadata.gz: 20194aa567e21c0e7af5caa6deb7645c617d58240c5685b0a90e477ea9331ea522618c206718b97a4218ab9d939fa6bd7b557df698703fb8c45c240dbb025e95
-  data.tar.gz: 3fdd45b9a6132bf0167c4e30c939aa42db77331a6007a850baa1adb67335731e639ccc9483435aecc7c3411d49094698846592a712205b5377adda17965ea930
+  metadata.gz: fef441fe9dc698fa5e993ae9b7d5a4e6270590aa2f8fcdbb3bca4601266faed8d6b5c96f545d3347716915bdbe0f78ebc1898caef201c1be50cc006955dec44d
+  data.tar.gz: a7bfadba85de2c3d631ebab8f74c4afaa75fcfdabeccbae6d20d4f23e2817185efc7d4174d4e901e19da8dbabcf4bdf522e12706dbc025113e6b0480d9b32826

data/lib/porkadot/assets/bootstrap/manifests/kube-apiserver.bootstrap.yaml.erb

@@ -12,6 +12,9 @@ metadata:
     <%- end -%>
 spec:
   hostNetwork: true
+  securityContext:
+    seccompProfile:
+      type: RuntimeDefault
   containers:
   - name: kube-apiserver
     resources:
@@ -23,6 +26,35 @@ spec:
     <%- k8s.apiserver.args(bootstrap: true).each do |k, v| -%>
     - <%= k %><% if v ;%>=<%= v %><%; end %>
     <%- end -%>
+    livenessProbe:
+      failureThreshold: 8
+      httpGet:
+        host: 127.0.0.1
+        path: /livez
+        port: 6443
+        scheme: HTTPS
+      initialDelaySeconds: 10
+      periodSeconds: 10
+      timeoutSeconds: 15
+    readinessProbe:
+      failureThreshold: 3
+      httpGet:
+        host: 127.0.0.1
+        path: /readyz
+        port: 6443
+        scheme: HTTPS
+      periodSeconds: 1
+      timeoutSeconds: 15
+    startupProbe:
+      failureThreshold: 24
+      httpGet:
+        host: 127.0.0.1
+        path: /livez
+        port: 6443
+        scheme: HTTPS
+      initialDelaySeconds: 10
+      periodSeconds: 10
+      timeoutSeconds: 15
     env:
     - name: POD_IP
       valueFrom:

data/lib/porkadot/assets/bootstrap/manifests/kube-controller-manager.bootstrap.yaml.erb

@@ -10,6 +10,9 @@ metadata:
     <%= k.to_s %>: <%= v %>
     <%- end -%>
 spec:
+  securityContext:
+    seccompProfile:
+      type: RuntimeDefault
   containers:
   - name: kube-controller-manager
     image: <%= k8s.image_repository %>/kube-controller-manager:<%= k8s.kubernetes_version %>
@@ -18,6 +21,26 @@ spec:
     <%- k8s.controller_manager.args(bootstrap: true).each do |k, v| -%>
     - <%= k %><% if v ;%>=<%= v %><%; end %>
     <%- end -%>
+    livenessProbe:
+      failureThreshold: 8
+      httpGet:
+        host: 127.0.0.1
+        path: /healthz
+        port: 10257
+        scheme: HTTPS
+      initialDelaySeconds: 10
+      periodSeconds: 10
+      timeoutSeconds: 15
+    startupProbe:
+      failureThreshold: 24
+      httpGet:
+        host: 127.0.0.1
+        path: /healthz
+        port: 10257
+        scheme: HTTPS
+      initialDelaySeconds: 10
+      periodSeconds: 10
+      timeoutSeconds: 15
     volumeMounts:
     - name: var-run-kubernetes
       mountPath: /var/run/kubernetes

data/lib/porkadot/assets/bootstrap/manifests/kube-scheduler.bootstrap.yaml.erb

@@ -10,6 +10,9 @@ metadata:
     <%= k.to_s %>: <%= v %>
     <%- end -%>
 spec:
+  securityContext:
+    seccompProfile:
+      type: RuntimeDefault
   containers:
   - name: kube-scheduler
     image: <%= k8s.image_repository %>/kube-scheduler:<%= k8s.kubernetes_version %>
@@ -18,6 +21,26 @@ spec:
     <%- k8s.scheduler.args(bootstrap: true).each do |k, v| -%>
     - <%= k %><% if v ;%>=<%= v %><%; end %>
     <%- end -%>
+    livenessProbe:
+      failureThreshold: 8
+      httpGet:
+        host: 127.0.0.1
+        path: /healthz
+        port: 10259
+        scheme: HTTPS
+      initialDelaySeconds: 10
+      periodSeconds: 10
+      timeoutSeconds: 15
+    startupProbe:
+      failureThreshold: 24
+      httpGet:
+        host: 127.0.0.1
+        path: /healthz
+        port: 10259
+        scheme: HTTPS
+      initialDelaySeconds: 10
+      periodSeconds: 10
+      timeoutSeconds: 15
     volumeMounts:
     - name: kubernetes
       mountPath: /etc/kubernetes

data/lib/porkadot/assets/kubelet/install-deps.sh.erb

@@ -37,3 +37,12 @@ chmod +x ${ETCD_TMP}/etcdctl
 rm -f /opt/bin/etcdctl
 mv ${ETCD_TMP}/etcdctl /opt/bin/etcdctl-${ETCD_VER}
 ln -s /opt/bin/etcdctl-${ETCD_VER} /opt/bin/etcdctl
+
+CRICTL_VER="<%= global_config.k8s.crictl_version %>"
+CRICTL_URL=https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VER}/crictl-${CRICTL_VER}-linux-${architecture}.tar.gz
+CRICTL_TMP=$(mktemp -d)
+curl -L ${CRICTL_URL} -o ${CRICTL_TMP}/crictl.tar.gz
+tar zxvf ${CRICTL_TMP}/crictl.tar.gz -C ${CRICTL_TMP}/
+rm -f /opt/bin/crictl
+mv ${CRICTL_TMP}/crictl /opt/bin/crictl-${CRICTL_VER}
+ln -s /opt/bin/crictl-${CRICTL_VER} /opt/bin/crictl

data/lib/porkadot/assets/kubelet/setup-containerd.sh.erb

@@ -5,6 +5,13 @@ ROOT=$(dirname "${BASH_SOURCE}")
 
 mkdir -p /etc/containerd
 containerd config default | tee /etc/containerd/config.toml
-sed -i -e "/containerd.runtimes.runc.options/a SystemdCgroup = true" /etc/containerd/config.toml
+
+grep SystemdCgroup /etc/containerd/config.toml && :
+
+if [[ $? == 0 ]]; then
+  sed -i -e "s/SystemdCgroup.*$/SystemdCgroup = true/" /etc/containerd/config.toml
+else
+  sed -i -e "/containerd.runtimes.runc.options/a SystemdCgroup = true" /etc/containerd/config.toml
+fi
 
 systemctl restart containerd

data/lib/porkadot/assets/kubelet-default/install.sh.erb

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -eu
+export LC_ALL=C
+ROOT=$(dirname "${BASH_SOURCE}")
+
+# Install addons
+for addon in $(ls ${ROOT}/addons/); do
+  install_sh="${ROOT}/addons/${addon}/install.sh"
+  if [[ -f ${install_sh} ]]; then
+    echo "Install: ${install_sh}"
+    bash ${install_sh}
+  fi
+done

data/lib/porkadot/assets/kubelet.rb

@@ -7,11 +7,13 @@ module Porkadot; module Assets
   class KubeletList
     attr_reader :global_config
     attr_reader :logger
+    attr_reader :kubelet_default
     attr_reader :kubelets
 
     def initialize global_config
       @global_config = global_config
       @logger = global_config.logger
+      @kubelet_default = KubeletDefault.new(global_config.kubelet_default)
       @kubelets = {}
       global_config.nodes.each do |k, config|
         @kubelets[k] = Kubelet.new(config)
@@ -19,6 +21,7 @@ module Porkadot; module Assets
     end
 
     def render
+      self.kubelet_default.render
       self.kubelets.each do |_, v|
         v.render
       end
@@ -29,6 +32,35 @@ module Porkadot; module Assets
     end
   end
 
+  class KubeletDefault
+    include Porkadot::Assets
+    TEMPLATE_DIR = File.join(File.dirname(__FILE__), "kubelet-default")
+
+    attr_reader :global_config
+    attr_reader :config
+    attr_reader :logger
+    attr_reader :certs
+
+    def initialize config
+      @config = config
+      @logger = config.logger
+      @global_config = config.config
+      @certs = Porkadot::Assets::Certs::Kubernetes.new(global_config)
+    end
+
+    def render
+      logger.info "--> Rendering Kubelet default configs"
+      unless File.directory?(config.addon_path)
+        FileUtils.mkdir_p(config.addon_path)
+      end
+      unless File.directory?(config.addon_secrets_path)
+        FileUtils.mkdir_p(config.addon_secrets_path)
+      end
+
+      render_erb 'install.sh'
+    end
+  end
+
   class Kubelet
     include Porkadot::Assets
     TEMPLATE_DIR = File.join(File.dirname(__FILE__), "kubelet")

data/lib/porkadot/assets/kubernetes/install.secrets.sh.erb

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -eu
+export LC_ALL=C
+ROOT=$(dirname "${BASH_SOURCE}")
+
+/opt/bin/kubectl apply -R -f ${ROOT}/manifests
+

data/lib/porkadot/assets/kubernetes/install.sh.erb

@@ -3,5 +3,12 @@
 set -eu
 export LC_ALL=C
 ROOT=$(dirname "${BASH_SOURCE}")
+KUBECTL_OPTS=${KUBECTL_OPTS:-""}
 
-/opt/bin/kubectl apply -f ${ROOT}/manifests/
+KUBECTL_OPTS="${KUBECTL_OPTS} --server-side --force-conflicts --prune"
+KUBECTL_OPTS="${KUBECTL_OPTS} -l kubernetes.unstable.cloud/installed-by=porkadot"
+<%- prune_allowlist.each do |a| -%>
+KUBECTL_OPTS="${KUBECTL_OPTS} --prune-whitelist=<%= a %>"
+<%- end -%>
+
+/opt/bin/kubectl apply ${KUBECTL_OPTS} -k ${ROOT}

data/lib/porkadot/assets/kubernetes/kustomization.yaml.erb

@@ -0,0 +1,7 @@
+# Modify this file if you want to kustomize generated manifests
+# This file will not be overridden by Porkadot.
+labels:
+- pairs:
+    'kubernetes.unstable.cloud/installed-by': 'porkadot'
+resources:
+- manifests

data/lib/porkadot/assets/kubernetes/manifests/{coredns.yaml.erb → addons/coredns/coredns.yaml.erb}

@@ -75,7 +75,7 @@ data:
             lameduck 5s
         }
         ready
-        kubernetes <%= k8s.networking.dns_domain %>  in-addr.arpa ip6.arpa {
+        kubernetes <%= k8s.networking.dns_domain %> <%= k8s.networking.additional_domains.join(" ") %> in-addr.arpa ip6.arpa {
             pods insecure
             fallthrough in-addr.arpa ip6.arpa
             ttl 30
@@ -193,6 +193,7 @@ metadata:
     kubernetes.io/cluster-service: "true"
     addonmanager.kubernetes.io/mode: Reconcile
     kubernetes.io/name: "CoreDNS"
+    app.kubernetes.io/name: kube-dns
 spec:
   selector:
     k8s-app: kube-dns

data/lib/porkadot/assets/kubernetes/manifests/{dns-horizontal-autoscaler.yaml.erb → addons/coredns/dns-horizontal-autoscaler.yaml.erb}

@@ -82,8 +82,6 @@ spec:
       securityContext:
         supplementalGroups: [ 65534 ]
         fsGroup: 65534
-      nodeSelector:
-        kubernetes.io/os: linux
       containers:
       - name: autoscaler
         image: k8s.gcr.io/cluster-proportional-autoscaler-amd64:1.7.1

data/lib/porkadot/assets/kubernetes/manifests/addons/coredns/kustomization.yaml.erb

@@ -0,0 +1,3 @@
+resources:
+- coredns.yaml
+- dns-horizontal-autoscaler.yaml

data/lib/porkadot/assets/kubernetes/manifests/{flannel.yaml.erb → addons/flannel/flannel.yaml.erb}

@@ -1,3 +1,5 @@
+<% cni = config.flannel -%>
+<% k8s = global_config.k8s -%>
 ---
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
@@ -125,9 +127,15 @@ data:
     }
   net-conf.json: |
     {
-      "Network": "<%= global_config.k8s.networking.pod_subnet %>",
+      <%- if k8s.networking.enable_ipv4 -%>
+      "Network": "<%= k8s.networking.pod_v4subnet %>",
+      <%- end -%>
+      <%- if k8s.networking.enable_ipv6 -%>
+      "EnableIPv6": true,
+      "IPv6Network": "<%= k8s.networking.pod_v6subnet %>",
+      <%- end -%>
       "Backend": {
-        "Type": "<%= global_config.cni.backend %>"
+        "Type": "<%= cni.backend %>"
       }
     }
 ---
@@ -165,8 +173,20 @@ spec:
         effect: NoSchedule
       serviceAccountName: flannel
       initContainers:
+      - name: install-cni-plugin
+       #image: flannelcni/flannel-cni-plugin:v1.0.1 for ppc64le and mips64le (dockerhub limitations may apply)
+        image: <%= cni.plugin_image_repository %>:<%= cni.plugin_image_tag %>
+        command:
+        - cp
+        args:
+        - -f
+        - /flannel
+        - /opt/cni/bin/flannel
+        volumeMounts:
+        - name: cni-plugin
+          mountPath: /opt/cni/bin
       - name: install-cni
-        image: quay.io/coreos/flannel:v0.14.0
+        image: <%= cni.daemon_image_repository %>:<%= cni.daemon_image_tag %>
         command:
         - cp
         args:
@@ -180,19 +200,14 @@ spec:
           mountPath: /etc/kube-flannel/
       containers:
       - name: kube-flannel
-        image: quay.io/coreos/flannel:v0.14.0
+        image: <%= cni.daemon_image_repository %>:<%= cni.daemon_image_tag %>
         command:
         - /opt/bin/flanneld
         args:
         - --ip-masq
         - --kube-subnet-mgr
         resources:
-          requests:
-            cpu: "100m"
-            memory: "50Mi"
-          limits:
-            cpu: "100m"
-            memory: "50Mi"
+<%= u.to_yaml(cni.resources, 10)%>
         securityContext:
           privileged: false
           capabilities:
@@ -211,13 +226,27 @@ spec:
           mountPath: /run/flannel
         - name: flannel-cfg
           mountPath: /etc/kube-flannel/
+        - name: ipam-data
+          mountPath: /var/lib/cni/networks
+        - name: xtables-lock
+          mountPath: /run/xtables.lock
       volumes:
       - name: run
         hostPath:
           path: /run/flannel
+      - name: cni-plugin
+        hostPath:
+          path: /opt/cni/bin
       - name: cni
         hostPath:
           path: /etc/cni/net.d
+      - name: ipam-data
+        hostPath:
+          path: /var/lib/cni/networks
       - name: flannel-cfg
         configMap:
           name: kube-flannel-cfg
+      - name: xtables-lock
+        hostPath:
+          path: /run/xtables.lock
+          type: FileOrCreate

data/lib/porkadot/assets/kubernetes/manifests/addons/flannel/kustomization.yaml.erb

@@ -0,0 +1,2 @@
+resources:
+- flannel.yaml

data/lib/porkadot/assets/kubernetes/manifests/{kubelet-rubber-stamp.yaml.erb → addons/kubelet-rubber-stamp/kubelet-rubber-stamp.yaml.erb}

@@ -24,7 +24,7 @@ spec:
         - name: kubelet-rubber-stamp
           # image: quay.io/kontena/kubelet-rubber-stamp-amd64:0.2
           # Use following image until issue is fixed
-          image: yuanying/kubelet-rubber-stamp:0.3.0.y01
+          image: ghcr.io/porkadot/kubelet-rubber-stamp:0.22.0
           args:
             - "--v=2"
           imagePullPolicy: Always

data/lib/porkadot/assets/kubernetes/manifests/addons/kubelet-rubber-stamp/kustomization.yaml.erb

@@ -0,0 +1,2 @@
+resources:
+- kubelet-rubber-stamp.yaml

data/lib/porkadot/assets/kubernetes/manifests/addons/kustomization.yaml.erb

@@ -0,0 +1,4 @@
+resources:
+<%- config.enabled.each do |a| -%>
+- <%= a %>
+<%- end %>

data/lib/porkadot/assets/kubernetes/manifests/addons/metallb/kustomization.yaml.erb

@@ -0,0 +1,6 @@
+namespace: metallb-system
+
+resources:
+- 000-metallb.yaml
+- metallb.config.yaml
+- metallb.yaml

data/lib/porkadot/assets/kubernetes/manifests/{metallb.config.yaml.erb → addons/metallb/metallb.config.yaml.erb}

@@ -1,4 +1,3 @@
-<% k8s = global_config.k8s -%>
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -9,5 +8,5 @@ metadata:
   namespace: metallb-system
 data:
   config: |
-<%= u.indent(global_config.lb.lb_config, 4) %>
+<%= u.indent(config.metallb.config, 4) %>