porkadot 0.20.0 → 0.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dab74c5a6f0fd112b9ec994a67fe85c2bbe02c478ab68c95dcf8c998d9ddb64f
-  data.tar.gz: 272069efcb1b5bea219c54b4a4b0ec432bc215352fa786adcfc7923fdf73ae75
+  metadata.gz: 839afa115dc53563a391b710c14ab686f6c45a5420a6d1f6c6eee21ebdb1e6cf
+  data.tar.gz: 8f8fbc1099bebe03b5f994050e083c385baad03536d15c14ef6ed1f412ce278c
 SHA512:
-  metadata.gz: eea11e276a5d6d95b231f3dce02b36eeb040533902c03202273b66ac1ad1d6dbe52349a0a5bfc6a69e0a5cf920dee49e871dcc2b8174c5e2ea3c8460fff4ec67
-  data.tar.gz: fa3c81ddc0dc1330ad4ea579b27557bd7316b3ccec0f1cd08c11a1cd107ecb4a2b472d71502811e88addd185a72f7b5b1fd0355ded8929a6a1de0299054d1778
+  metadata.gz: 20194aa567e21c0e7af5caa6deb7645c617d58240c5685b0a90e477ea9331ea522618c206718b97a4218ab9d939fa6bd7b557df698703fb8c45c240dbb025e95
+  data.tar.gz: 3fdd45b9a6132bf0167c4e30c939aa42db77331a6007a850baa1adb67335731e639ccc9483435aecc7c3411d49094698846592a712205b5377adda17965ea930

data/lib/porkadot/assets/kubernetes.rb

@@ -27,7 +27,9 @@ module Porkadot; module Assets
       cni = global_config.cni
       render_erb 'manifests/porkadot.yaml'
       render_erb 'manifests/kubelet.yaml'
+      render_erb "manifests/000-#{lb.type}.yaml"
       render_erb "manifests/#{lb.type}.yaml"
+      render_erb "manifests/#{lb.type}.config.yaml"
       render_secrets_erb "manifests/#{lb.type}.secrets.yaml"
       render_erb "manifests/#{cni.type}.yaml"
       render_erb "manifests/coredns.yaml"

data/lib/porkadot/assets/kubernetes/manifests/000-metallb.yaml.erb

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app: metallb
+  name: metallb-system
+

data/lib/porkadot/assets/kubernetes/manifests/metallb.config.yaml.erb

@@ -0,0 +1,13 @@
+<% k8s = global_config.k8s -%>
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: metallb
+  name: config
+  namespace: metallb-system
+data:
+  config: |
+<%= u.indent(global_config.lb.lb_config, 4) %>
+

data/lib/porkadot/assets/kubernetes/manifests/metallb.yaml.erb

@@ -1,11 +1,3 @@
-<% k8s = global_config.k8s -%>
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app: metallb
-  name: metallb-system
----
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
@@ -58,9 +50,7 @@ metadata:
 spec:
   allowPrivilegeEscalation: false
   allowedCapabilities:
-  - NET_ADMIN
   - NET_RAW
-  - SYS_ADMIN
   allowedHostPaths: []
   defaultAddCapabilities: []
   defaultAllowPrivilegeEscalation: false
@@ -72,6 +62,8 @@ spec:
   hostPorts:
   - max: 7472
     min: 7472
+  - max: 7946
+    min: 7946
   privileged: true
   readOnlyRootFilesystem: true
   requiredDropCapabilities:
@@ -118,7 +110,6 @@ rules:
   - get
   - list
   - watch
-  - update
 - apiGroups:
   - ''
   resources:
@@ -158,6 +149,13 @@ rules:
   - get
   - list
   - watch
+- apiGroups: ["discovery.k8s.io"]
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - ''
   resources:
@@ -207,6 +205,37 @@ rules:
   - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app: metallb
+  name: controller
+  namespace: metallb-system
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - create
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  resourceNames:
+  - memberlist
+  verbs:
+  - list
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  resourceNames:
+  - controller
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
@@ -268,6 +297,21 @@ subjects:
 - kind: ServiceAccount
   name: speaker
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app: metallb
+  name: controller
+  namespace: metallb-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: controller
+subjects:
+- kind: ServiceAccount
+  name: controller
+---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -308,47 +352,44 @@ spec:
             fieldRef:
               fieldPath: status.podIP
         # needed when another software is also using memberlist / port 7946
+        # when changing this default you also need to update the container ports definition
+        # and the PodSecurityPolicy hostPorts definition
         #- name: METALLB_ML_BIND_PORT
         #  value: "7946"
         - name: METALLB_ML_LABELS
           value: "app=metallb,component=speaker"
-        - name: METALLB_ML_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
         - name: METALLB_ML_SECRET_KEY
           valueFrom:
             secretKeyRef:
               name: memberlist
               key: secretkey
-        image: metallb/speaker:v0.9.4
-        imagePullPolicy: Always
+        image: quay.io/metallb/speaker:v0.10.2
         name: speaker
         ports:
         - containerPort: 7472
           name: monitoring
-        resources:
-          limits:
-            cpu: 100m
-            memory: 100Mi
+        - containerPort: 7946
+          name: memberlist-tcp
+        - containerPort: 7946
+          name: memberlist-udp
+          protocol: UDP
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             add:
-            - NET_ADMIN
             - NET_RAW
-            - SYS_ADMIN
             drop:
             - ALL
           readOnlyRootFilesystem: true
       hostNetwork: true
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        kubernetes.io/os: linux
       serviceAccountName: speaker
       terminationGracePeriodSeconds: 2
       tolerations:
       - effect: NoSchedule
         key: node-role.kubernetes.io/master
+        operator: Exists
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -377,16 +418,16 @@ spec:
       - args:
         - --port=7472
         - --config=config
-        image: metallb/controller:v0.9.5
-        imagePullPolicy: Always
+        env:
+        - name: METALLB_ML_SECRET_NAME
+          value: memberlist
+        - name: METALLB_DEPLOYMENT
+          value: controller
+        image: quay.io/metallb/controller:v0.10.2
         name: controller
         ports:
         - containerPort: 7472
           name: monitoring
-        resources:
-          limits:
-            cpu: 100m
-            memory: 100Mi
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -400,14 +441,3 @@ spec:
         runAsUser: 65534
       serviceAccountName: controller
       terminationGracePeriodSeconds: 0
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app: metallb
-  name: config
-  namespace: metallb-system
-data:
-  config: |
-<%= u.indent(global_config.lb.lb_config, 4) %>

data/lib/porkadot/default.yaml

@@ -31,7 +31,7 @@ etcd:
   extra_env: []
 
 kubernetes:
-  kubernetes_version: v1.20.3
+  kubernetes_version: v1.21.3
   image_repository: k8s.gcr.io
 
   networking:

data/lib/porkadot/version.rb

@@ -1,3 +1,3 @@
 module Porkadot
-  VERSION = "0.20.0"
+  VERSION = "0.21.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: porkadot
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.21.0
 platform: ruby
 authors:
 - OTSUKA, Yuanying
@@ -144,6 +144,7 @@ files:
 - lib/porkadot/assets/kubernetes.rb
 - lib/porkadot/assets/kubernetes/install.sh.erb
 - lib/porkadot/assets/kubernetes/kubeconfig.yaml.erb
+- lib/porkadot/assets/kubernetes/manifests/000-metallb.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/coredns.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/dns-horizontal-autoscaler.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/flannel.yaml.erb
@@ -155,6 +156,7 @@ files:
 - lib/porkadot/assets/kubernetes/manifests/kube-scheduler.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/kubelet-rubber-stamp.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/kubelet.yaml.erb
+- lib/porkadot/assets/kubernetes/manifests/metallb.config.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/metallb.secrets.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/metallb.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/porkadot.yaml.erb