Commit Graph

11 Commits

Author SHA1 Message Date
Kubernetes Submit Queue
35e5197eca Merge pull request #50173 from luxas/kubeadm_constants
Automatic merge from submit-queue

kubeadm: Centralize commonly used paths/constants to the constants pkg

**What this PR does / why we need it**:
Before there were constants defined for the control plane components in three different places:
 - images
 - phases/controlplane
 - phases/selfhosting

Now they are in one centralized place. I also moved funcs for building common paths to that lib.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Dependency for: https://github.com/kubernetes/kubernetes/pull/48899

**Special notes for your reviewer**:

Most of this PR really is autogenerated with a replace tool. I tested this and things work just normally as well.

**Release note**:

```release-note
NONE
```
@timothysc @dmmcquay @pipejakob @kubernetes/sig-cluster-lifecycle-pr-reviews
2017-08-09 01:41:19 -07:00
Lucas Käldström
9a6ef9677a
kubeadm: Centralize commonly used paths/constants to the constants pkg 2017-08-08 15:07:21 +03:00
Lucas Käldström
a69697e607
kubeadm: Add back labels for the Static Pod control plane 2017-08-05 15:45:09 +03:00
Kubernetes Submit Queue
75b3a0f3de Merge pull request #48607 from luxas/kubeadm_cleanup_selfhosting
Automatic merge from submit-queue (batch tested with PRs 46210, 48607, 46874, 46598, 49240)

kubeadm: Make the hostPath volume mount code more secure

**What this PR does / why we need it**:

 - Refactors the hostpath volume mounting code for the Static Pods
 - Splits out the functionality that was in a big function to something testable
 - Unit test a lot
 - Adds support for mounting external etcd CA/cert/key files in an other path than `/etc/ssl/certs`. Before this you **had** to have your files in there or the apiserver would crashloop
 - Significantly improves comment coverage
 - Now only mounts the bare essentials instead of nearly everything. For example, don't mount full `/etc/kubernetes` when the only thing you need is `/etc/kubernetes/scheduler.conf`
 - Make everything but the etcd datadir read-only for components.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes: https://github.com/kubernetes/kubeadm/issues/341

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
cc @kubernetes/sig-cluster-lifecycle-pr-reviews
2017-07-21 17:00:15 -07:00
Euan Kemp
644aef100b kubeadm: don't customize etcd selinux label
The original change that added the unconfined label included a comment
indicating it won't be needed in the future.
See: https://github.com/kubernetes/kubernetes/pull/33555#issuecomment-251126908

That time is now. https://github.com/kubernetes/kubernetes/pull/33663
has landed and means we no longer have to go out of our way to make that
work.

Removing the label also increases security since there wasn't really a
good reason for etcd to be run with such broad selinux privileges.

This also will allow kubeadm to avoid errors on distros without an spc_t
type, such as Gentoo and Container Linux (at the time of writing at
least).

Fixes https://github.com/kubernetes/kubeadm/issues/269
2017-07-20 13:36:06 -07:00
Lucas Käldström
e65d0bd514
kubeadm: Make the hostPath volume mount code more secure 2017-07-20 20:17:28 +03:00
Lucas Käldström
66328996f2
kubeadm: Remove the old KubernetesDir envparam 2017-07-17 14:40:53 +03:00
Lucas Käldström
fb2e6575aa
kubeadm: Start to remove old envparams 2017-07-12 23:15:28 +03:00
Lucas Käldström
d14478f27a
kubeadm: Make self-hosting work and split out to a phase 2017-07-06 20:54:15 +03:00
Lucas Käldström
4bab0e9b54
kubeadm: Harmonize import names in the controlplane phase with all the other code 2017-07-04 12:31:46 +03:00
Lucas Käldström
8046bafca5
kubeadm: Move app/master into a separate phase directory 2017-07-04 12:30:42 +03:00