porkadot 0.18.0 → 0.18.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d57037f96d15fcabbd441ec706449775c89984f0b6019b1f15f863ccc970360a
-  data.tar.gz: 8c03689d67687fde6012cda7f0cea22e0f1c8b7b96a64942649d43e76560aaa2
+  metadata.gz: 9ee36f6490d8e4d8cfa07f29fae9b79a4a2eda35fe977f052f60ec7aa43ce802
+  data.tar.gz: 675c0c3679ee246844abfaaf39f0230c5b63fa2b661bcb21bb111f1ff7a0e6d5
 SHA512:
-  metadata.gz: 9a941712075f648d17b5e6a75de10ce83974945ffb7feafcd630d4695d7ba7fab501d63e4a965319957ddf6676aa893e5035b01a2b93711ce1759153e35fc0d8
-  data.tar.gz: cb9b0ff915cea06c91a8da7fcdd894bee593bda0ec2efe3593a4b9dd5030b42269e5ba1f29230a77b076629651e387995cd2b1022906a66848cd74b84585c713
+  metadata.gz: bef9c31a3f3371702948ad4c5b18df384387a42a2d363c0820a250227659b45db3c3a3260929c3821860f8eff9800c6fd983a52211bc5885b4b65af3962ece1f
+  data.tar.gz: 542e8cbeb5bd220ff9b6c12c109c55a88f1d1315cc3c17bf01ce2e8af9816293117bcf8002ab32330cf257b41285b35cfe43d30820f50ff7c2230f3027c49765

data/lib/porkadot/assets/kubelet/install-pkgs.sh.erb

@@ -4,6 +4,7 @@ export LC_ALL=C
 ROOT=$(dirname "${BASH_SOURCE}")
 
 if type apt-get > /dev/null 2>&1 ;then
+  export DEBIAN_FRONTEND=noninteractive
   apt-get update
   apt-get install -y \
       ca-certificates \

data/lib/porkadot/assets/kubernetes.rb

@@ -28,6 +28,7 @@ module Porkadot; module Assets
       render_erb 'manifests/porkadot.yaml'
       render_erb 'manifests/kubelet.yaml'
       render_erb "manifests/#{lb.type}.yaml"
+      render_secrets_erb "manifests/#{lb.type}.secrets.yaml"
       render_erb "manifests/#{cni.type}.yaml"
       render_erb "manifests/coredns.yaml"
       render_erb "manifests/dns-horizontal-autoscaler.yaml"

data/lib/porkadot/assets/kubernetes/manifests/metallb.secrets.yaml.erb

@@ -0,0 +1,13 @@
+<% require 'securerandom' -%>
+<% k8s = global_config.k8s -%>
+---
+apiVersion: v1
+stringData:
+  secretkey: <%= SecureRandom.base64(128) %>
+kind: Secret
+metadata:
+  name: memberlist
+  namespace: metallb-system
+  labels:
+    app: metallb
+type: Opaque

data/lib/porkadot/assets/kubernetes/manifests/metallb.yaml.erb

@@ -8,6 +8,48 @@ metadata:
 ---
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
+metadata:
+  labels:
+    app: metallb
+  name: controller
+  namespace: metallb-system
+spec:
+  allowPrivilegeEscalation: false
+  allowedCapabilities: []
+  allowedHostPaths: []
+  defaultAddCapabilities: []
+  defaultAllowPrivilegeEscalation: false
+  fsGroup:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  hostIPC: false
+  hostNetwork: false
+  hostPID: false
+  privileged: false
+  readOnlyRootFilesystem: true
+  requiredDropCapabilities:
+  - ALL
+  runAsUser:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  volumes:
+  - configMap
+  - secret
+  - emptyDir
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
 metadata:
   labels:
     app: metallb
@@ -19,13 +61,21 @@ spec:
   - NET_ADMIN
   - NET_RAW
   - SYS_ADMIN
+  allowedHostPaths: []
+  defaultAddCapabilities: []
+  defaultAllowPrivilegeEscalation: false
   fsGroup:
     rule: RunAsAny
+  hostIPC: false
   hostNetwork: true
+  hostPID: false
   hostPorts:
   - max: 7472
     min: 7472
   privileged: true
+  readOnlyRootFilesystem: true
+  requiredDropCapabilities:
+  - ALL
   runAsUser:
     rule: RunAsAny
   seLinux:
@@ -33,7 +83,9 @@ spec:
   supplementalGroups:
     rule: RunAsAny
   volumes:
-  - '*'
+  - configMap
+  - secret
+  - emptyDir
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -80,6 +132,14 @@ rules:
   verbs:
   - create
   - patch
+- apiGroups:
+  - policy
+  resourceNames:
+  - controller
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -106,7 +166,7 @@ rules:
   - create
   - patch
 - apiGroups:
-  - extensions
+  - policy
   resourceNames:
   - speaker
   resources:
@@ -132,6 +192,21 @@ rules:
   - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app: metallb
+  name: pod-lister
+  namespace: metallb-system
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - pods
+  verbs:
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
@@ -178,6 +253,21 @@ subjects:
 - kind: ServiceAccount
   name: speaker
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app: metallb
+  name: pod-lister
+  namespace: metallb-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pod-lister
+subjects:
+- kind: ServiceAccount
+  name: speaker
+---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -200,24 +290,6 @@ spec:
         app: metallb
         component: speaker
     spec:
-      initContainers:
-      - command:
-        - "iptables"
-        - "-P"
-        - "FORWARD"
-        - "ACCEPT"
-        image: <%= k8s.image_repository %>/kube-proxy:<%= k8s.kubernetes_version %>
-        imagePullPolicy: IfNotPresent
-        name: default-iptables
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            add:
-            - NET_ADMIN
-            - NET_RAW
-            drop:
-            - ALL
-          readOnlyRootFilesystem: true
       containers:
       - args:
         - --port=7472
@@ -231,8 +303,26 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: metallb/speaker:v0.8.2
-        imagePullPolicy: IfNotPresent
+        - name: METALLB_ML_BIND_ADDR
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        # needed when another software is also using memberlist / port 7946
+        #- name: METALLB_ML_BIND_PORT
+        #  value: "7946"
+        - name: METALLB_ML_LABELS
+          value: "app=metallb,component=speaker"
+        - name: METALLB_ML_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: METALLB_ML_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: memberlist
+              key: secretkey
+        image: metallb/speaker:v0.9.4
+        imagePullPolicy: Always
         name: speaker
         ports:
         - containerPort: 7472
@@ -253,9 +343,9 @@ spec:
           readOnlyRootFilesystem: true
       hostNetwork: true
       nodeSelector:
-        kubernetes.io/os: linux
+        beta.kubernetes.io/os: linux
       serviceAccountName: speaker
-      terminationGracePeriodSeconds: 0
+      terminationGracePeriodSeconds: 2
       tolerations:
       - effect: NoSchedule
         key: node-role.kubernetes.io/master
@@ -287,8 +377,8 @@ spec:
       - args:
         - --port=7472
         - --config=config
-        image: metallb/controller:v0.8.2
-        imagePullPolicy: IfNotPresent
+        image: metallb/controller:v0.9.4
+        imagePullPolicy: Always
         name: controller
         ports:
         - containerPort: 7472

data/lib/porkadot/version.rb

@@ -1,3 +1,3 @@
 module Porkadot
-  VERSION = "0.18.0"
+  VERSION = "0.18.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: porkadot
 version: !ruby/object:Gem::Version
-  version: 0.18.0
+  version: 0.18.1
 platform: ruby
 authors:
 - OTSUKA, Yuanying
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-29 00:00:00.000000000 Z
+date: 2020-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -151,6 +151,7 @@ files:
 - lib/porkadot/assets/kubernetes/manifests/kube-scheduler.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/kubelet-rubber-stamp.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/kubelet.yaml.erb
+- lib/porkadot/assets/kubernetes/manifests/metallb.secrets.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/metallb.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/pod-checkpointer.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/porkadot.yaml.erb