Commit Graph

1111 Commits

Author SHA1 Message Date
Kubernetes Prow Robot
19f0a54d6b
Merge pull request #92183 from wallrj/2163-csr-only-external-ca-mode-2
kubeadm alpha certs generate-csr
2020-07-13 07:18:32 -07:00
Sandeep Rajan
04038fc791 update coredns version to 1.7.0 2020-07-09 11:01:45 -04:00
Richard Wall
57712220a1 Add new helper functions for creating keys, kubeconfig and CSR files
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
2020-07-09 06:16:22 +01:00
Kubernetes Prow Robot
bf94f27e76
Merge pull request #92716 from rajansandeep/removefederation
[kubeadm]: Remove kube-dns translation for federation
2020-07-07 19:55:06 -07:00
Kubernetes Prow Robot
046ac5100e
Merge pull request #92720 from neolit123/1.19-add-kcm-port
kubeadm: add --port=0 for kube-controller-manager and kube-scheduler
2020-07-03 05:03:25 -07:00
Kubernetes Prow Robot
d71a09271c
Merge pull request #92017 from neolit123/1.19-patches
kubeadm: introduce --experimental-patches and deprecate --experimental-kustomize
2020-07-02 04:17:01 -07:00
Lubomir I. Ivanov
f66513d98a kubeadm: add --port=0 for kube-controller-manager and kube-scheduler
Kubeadm setup of kube-controller-manager and kube-scheduler is
lacking the --port=0 option which caused the component to enable
the insecure port by default and serve insecurely on the default
node interface.

Add --port=0 by default to both components. Users are still allowed
the explicitly set the flag (via extraArgs), which allows them
to override this default kubeadm behavior and enable the insecure port.

NOTE: the flag is deprecated and should be removed from kubeadm manifests
once it's removed from core.
2020-07-01 22:23:21 +03:00
Sandeep Rajan
4dc635d542 remove kube-dns translation for federation 2020-07-01 14:34:23 -04:00
Lubomir I. Ivanov
ceb768ccbd kubeadm: apply patches to static Pods
Add PatchStaticPod() in staticpod/utils.go

Apply patches to static Pods in:
- phases/controlplane/CreateStaticPodFiles()
- phases/etcd/CreateLocalEtcdStaticPodManifestFile() and
CreateStackedEtcdStaticPodManifestFile()

Add unit tests and update Bazel.
2020-06-26 02:14:47 +03:00
Lubomir I. Ivanov
144778db83 kubeadm: plumb the patches option trough init/join/upgrade
This changes adds the "patches" option in all places where
the "kustomize" option is already present.
2020-06-26 02:14:47 +03:00
Lubomir I. Ivanov
bcc16b9c1e kubeadm: remove negative test cases from TestUploadConfiguration
UploadConfiguration() now always retries the underling API calls,
which can make TestUploadConfiguration run for a long time.

Remove the negative test cases, where errors are expected.
Negative test cases should be tested in app/util/apiclient,
where a short timeout / retry count should be possible for unit tests.
2020-06-22 22:14:11 +03:00
Lubomir I. Ivanov
94af045324 kubeadm: don't re-add an etcd member if it already exists for "join"
If an etcd member with the same address already exists, don't re-add it.
Instead, use the existing member list for creating the "initial cluster"
that is written for this etcd server instance static Pod.
2020-06-15 20:22:13 +03:00
Kubernetes Prow Robot
b8b4186a14
Merge pull request #90143 from neolit123/1.19-remove-cert-renew-api
kubeadm: remove usage of the "certificates" API for cert renewal
2020-06-05 11:35:43 -07:00
Kubernetes Prow Robot
b607c7cd52
Merge pull request #86070 from rosti/kubeadm-cc-user-configs-checksum-a
kubeadm: distinguish between generated and user supplied component configs
2020-06-03 05:44:18 -07:00
Kubernetes Prow Robot
40076c856e
Merge pull request #91179 from SataQiu/startup-probe-20200517
kubeadm: add startup probes for static Pods to protect slow starting containers
2020-06-02 18:10:31 -07:00
Rostislav M. Georgiev
5d6cf8ecd4 kubeadm: Distinguish between user supplied and generated component configs
Until now, users were always asked to manually convert a component config to a
version supported by kubeadm, if kubeadm is not supporting its version.
This is true even for configs generated with older kubeadm versions, hence
getting users to make manual conversions on kubeadm generated configs.
This is not appropriate and user friendly, although, it tends to be the most
common case. Hence, we sign kubeadm generated component configs stored in
config maps with a SHA256 checksum. If a configs is loaded by kubeadm from a
config map and has a valid signature it's considered "kubeadm generated" and if
a version migration is required, this config is automatically discarded and a
new one is generated.
If there is no checksum or the checksum is not matching, the config is
considered as "user supplied" and, if a version migration is required, kubeadm
will bail out with an error, requiring manual config migration (as it's today).
The behavior when supplying component configs on the kubeadm command line
does not change. Kubeadm would still bail out with an error requiring migration
if it can recognize their groups but not versions.

Signed-off-by: Rostislav M. Georgiev <rostislavg@vmware.com>
2020-06-01 17:57:53 +03:00
Kubernetes Prow Robot
02637bb250
Merge pull request #91145 from tnqn/kubeadm-reset-error
kubeadm: skip removing last etcd member in reset phase
2020-05-27 15:04:01 -07:00
SataQiu
e04a2b3b26 kubeadm: add startup probes for static Pods to protect slow starting containers
Signed-off-by: SataQiu <1527062125@qq.com>
2020-05-21 11:12:36 +08:00
Prasad Katti
d7f769be3e Update kubeadm test TestMarkControlPlane
- Use a dummy nodename instead of OS hostname
- Inline toString() function
- Use backticks to wrap expected patch
- Remove redundant test name from error logs
2020-05-20 12:43:18 -07:00
Quan Tian
9cc416e7df kubeadm: do not remove the only remaining etcd member during reset
If this is the only remaining stacked etcd member in the cluster,
calling RemoveMember() is not needed.
2020-05-21 02:12:36 +08:00
Rostislav M. Georgiev
543f29be4e kubeadm: Reduce kubelet.DownloadConfig usage
kubelet.DownloadConfig is an old utility function which takes a client set and
a kubelet version, uses them to fetch the kubelet component config from a
config map, and places it in a local file. This function is simple to use, but
it is dangerous and unnecessary. Practically, in all cases the kubelet
configuration is present locally and does not need to be fetched from a config
map on the cluster (it just needs to be stored in a file).
Furthermore, kubelet.DownloadConfig does not use the kubeadm component configs
module in any way. Hence, a kubelet configuration fetched using it may not be
patched, validated, or otherwise, processed in any way by kubeadm other than
piping it to a file.

This patch replaces all but a single kubelet.DownloadConfig invocation with
equivalents that get the local copy of the kubelet component config and just
store it in a file. The sole remaining invocation covers the
`kubeadm upgrade node --kubelet-version` case.

In addition to that, a possible panic is fixed in kubelet.DownloadConfig and
it now takes the kubelet version parameter as string.

Signed-off-by: Rostislav M. Georgiev <rostislavg@vmware.com>
2020-05-19 13:30:45 +03:00
Prasad Katti
21a1d1d179 [kubeadm] add tests for patchnode 2020-05-18 10:06:06 -07:00
Kubernetes Prow Robot
b170451caa
Merge pull request #90183 from dims/update-kubernetes-to-klog-v2
Update kubernetes to klog v2
2020-05-16 18:59:51 -07:00
Kubernetes Prow Robot
694a9c242e
Merge pull request #90970 from johscheuer/add-readiness-to-controlplane
kubeadm: use two separate checks on /livez and /readyz for the kube-apiserver
2020-05-16 07:36:49 -07:00
Davanum Srinivas
07d88617e5
Run hack/update-vendor.sh
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2020-05-16 07:54:33 -04:00
Davanum Srinivas
442a69c3bd
switch over k/k to use klog v2
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2020-05-16 07:54:27 -04:00
Johannes M. Scheuermann
9a1cbc2711 Use livez and readyz endpoint for API server probes 2020-05-14 17:41:05 +02:00
Kubernetes Prow Robot
89ba90573f
Merge pull request #90788 from xlgao-zju/delete-prepull-ds
kubeadm: delete pre-pull ds and add pull images check in upgrade apply and upgrade node
2020-05-12 12:08:22 -07:00
Rostislav M. Georgiev
b46259b7af kubeadm: Move IPv6DualStack feature gate to component config
kubeadm is setting the IPv6DualStack feature gate in the command line of the kubelet.
However, the kubelet is gradually moving away from command line flags towards component config use.
Hence, we should set the IPv6DualStack feature gate in the component config instead.

Signed-off-by: Rostislav M. Georgiev <rostislavg@vmware.com>
2020-05-07 14:28:07 +03:00
Xianglin Gao
6c6a702a99 kubeadm: delete prepull ds
Signed-off-by: Xianglin Gao <xianglin.gxl@alibaba-inc.com>
2020-05-06 15:52:19 +08:00
SataQiu
afb1ea44b9 kubeadm: do not set deprecated '--cgroup-driver' flag in kubeadm-flags.env, this value will be set in config.yaml 2020-04-27 15:32:10 +08:00
Kubernetes Prow Robot
0acf2f0983
Merge pull request #90320 from neolit123/1.19-kubeadm-dont-use-sleep-on-upgrade
kubeadm: do not use /bin/sleep during upgrade pre-pull
2020-04-23 12:32:21 -07:00
Kubernetes Prow Robot
613cd04d8c
Merge pull request #90064 from neolit123/1.19-fix-authz-warning
kubeadm: fix misleading warning for authz modes
2020-04-23 12:32:06 -07:00
SataQiu
28b9a4e0d6 kubeadm: set resolv-conf via the kubelet config file rather than cli flag 2020-04-23 15:07:48 +08:00
Lubomir I. Ivanov
425552f2c9 kubeadm: do not use /bin/sleep during upgrade pre-pull
Use an init container that performs the pre-pull of a component
and then start an instance of "pause" as a regular container to
get the DaemonSet Pod in a Running state.

More details on this change in the code comments.
2020-04-23 04:17:49 +03:00
Kubernetes Prow Robot
7f1d09f439
Merge pull request #89593 from neolit123/1.19-skip-kube-proxy-on-upgrade
kubeadm: skip kube-proxy/dns upgrades on missing ConfigMaps
2020-04-15 11:36:00 -07:00
Lubomir I. Ivanov
44638a10e8 kubeadm: remove usage of the "certificates" API for cert renewal
The flag "--use-api" for "alpha certs renew" was deprecated in 1.18.
Remove the flag and related logic that executes certificate renewal
using "api/certificates/v1beta1". kubeadm continues to be able
to create CSR files and renew using the local CA on disk.
2020-04-14 21:57:37 +03:00
SataQiu
35f3f82029 kubeadm: remove the dependence on /pkg/features
Signed-off-by: SataQiu <1527062125@qq.com>
2020-04-12 15:05:44 +08:00
Lubomir I. Ivanov
6cfd772401 kubeadm: fix misleading warning for authz modes
kubeadm init prints:
  W0410 23:02:10.119723   13040 manifests.go:225] the default kube-apiserver
  authorization-mode is "Node,RBAC"; using "Node,RBAC"

Add a new function compareAuthzModes() and a unit test for it.
Make sure the warning is printed only if the user modes don't match
the defaults.
2020-04-10 23:45:40 +03:00
Lubomir I. Ivanov
d4de1a571a kubeadm: skip kube-proxy and DNS upgrades on missing ConfigMaps
If the kube-proxy/dns ConfigMap are missing, show warnings and assume
that these addons were skipped during "kubeadm init",
and that their redeployment on upgrade is not desired.

TODO: remove this once "kubeadm upgrade apply" phases are supported:
https://github.com/kubernetes/kubeadm/issues/1318
2020-04-08 22:58:42 +03:00
Rostislav M. Georgiev
c8b7e5739c kubeadm: Use image tag as version of stacked etcd
kubeadm uses image tags (such as `v3.4.3-0`) to specify the version of
etcd. However, the upgrade code in kubeadm uses the etcd client API to
fetch the currently deployed version. The result contains only the etcd
version without the additional information (such as image revision) that
is normally found in the tag. As a result it would refuse an upgrade
where the etcd versions match and the only difference is the image
revision number (`v3.4.3-0` to `v3.4.3-1`).

To fix the above issue, the following changes are done:
- Replace the existing etcd version querying code, that uses the etcd
  client library, with code that returns the etcd image tag from the
  local static pod manifest file.
- If an etcd `imageTag` is specified in the ClusterConfiguration during
  upgrade, use that tag instead. This is done regardless if the tag was
  specified in the configuration stored in the cluster or with a new
  configuration supplied by the `--config` command line parameter.
  If no custom tag is specified, kubeadm will select one depending on
  the desired Kubernetes version.
- `kubeadm upgrade plan` no longer prints upgrade information about
  external etcd. It's the user's responsibility to manage it in that
  case.

Signed-off-by: Rostislav M. Georgiev <rostislavg@vmware.com>
2020-03-30 16:28:45 +03:00
Kubernetes Prow Robot
903f1e63f9
Merge pull request #89537 from neolit123/1.19-kubeadm-add-get-node-rbac
kubeadm: add missing RBAC for getting nodes on "upgrade apply"
2020-03-26 20:06:23 -07:00
Lubomir I. Ivanov
6f99791021 kubeadm: add missing RBAC for getting nodes on "upgrade apply"
b117a928 added a new check during "join" whether a Node with
the same name exists in the cluster.

When upgrading from 1.17 to 1.18 make sure the required RBAC
by this check is added. Otherwise "kubeadm join" will complain that
it lacks permissions to GET a Node.
2020-03-26 22:02:55 +02:00
Rostislav M. Georgiev
fbfd44f337 kubeadm: Fix panic in isCoreDNSVersionSupported
A narrow assumption of what is contained in the `imageID` fields for the
CoreDNS pods causes a panic upon upgrade.
Fix this by using a proper regex to match a trailing SHA256 image digest
in `imageID` or return an error if it cannot find it.

Signed-off-by: Rostislav M. Georgiev <rostislavg@vmware.com>
2020-03-26 20:26:32 +02:00
Kubernetes Prow Robot
be2f9e74bf
Merge pull request #88811 from rajansandeep/invalidmigrationfail
Ensure CoreDNS running when Corefile migration doesn't support current version
2020-03-17 19:27:18 -07:00
Sandeep Rajan
fcd229e4bd ensure coredns running when migration fails
add an additional check for coredns image sha

add a check to see if migration is required
2020-03-11 11:32:32 -04:00
Mike Danese
76f8594378 more artisanal fixes
Most of these could have been refactored automatically but it wouldn't
have been uglier. The unsophisticated tooling left lots of unnecessary
struct -> pointer -> struct transitions.
2020-03-05 14:59:47 -08:00
Kubernetes Prow Robot
5c5faed39b
Merge pull request #88287 from gab-satchi/master
Windows specific kubelet flags in kubeadm-flags.env
2020-03-04 13:18:52 -08:00
Gab Satch
9fabafdbb1 Windows specific kubelet flags in kubeadm-flags.env
- Uses correct pause image for Windows
- Omits systemd specific flags
- Common build flags function to be used by Linux and Windows
- Uses user configured image repository for Windows pause image
2020-03-04 11:05:53 -05:00
Sandeep Rajan
da8453af6e fix unsupported bug 2020-02-27 10:39:47 -05:00