9044177bb6
Tested on GCE. Includes untested modifications for AWS and Vagrant. No changes for any other distros. Probably will work on other up-to-date providers but beware. Symptom would be that service proxying stops working. 1. Generates a token kube-proxy in AWS, GCE, and Vagrant setup scripts. 1. Distributes the token via salt-overlay, and salt to /var/lib/kube-proxy/kubeconfig 1. Changes kube-proxy args: - use the --kubeconfig argument - changes --master argument from http://MASTER:7080 to https://MASTER - http -> https - explicit port 7080 -> implied 443 Possible ways this might break other distros: Mitigation: there is an default empty kubeconfig file. If the distro does not populate the salt-overlay, then it should get the empty, which parses to an empty object, which, combined with the --master argument, should still work. Mitigation: - azure: Special case to use 7080 in - rackspace: way out of date, so don't care. - vsphere: way out of date, so don't care. - other distros: not using salt.
67 lines
1.4 KiB
Plaintext
67 lines
1.4 KiB
Plaintext
{% if grains['os_family'] == 'RedHat' %}
|
|
{% set environment_file = '/etc/sysconfig/kube-proxy' %}
|
|
{% else %}
|
|
{% set environment_file = '/etc/default/kube-proxy' %}
|
|
{% endif %}
|
|
|
|
/usr/local/bin/kube-proxy:
|
|
file.managed:
|
|
- source: salt://kube-bins/kube-proxy
|
|
- user: root
|
|
- group: root
|
|
- mode: 755
|
|
|
|
{% if grains['os_family'] == 'RedHat' %}
|
|
|
|
/usr/lib/systemd/system/kube-proxy.service:
|
|
file.managed:
|
|
- source: salt://kube-proxy/kube-proxy.service
|
|
- user: root
|
|
- group: root
|
|
|
|
{% else %}
|
|
|
|
/etc/init.d/kube-proxy:
|
|
file.managed:
|
|
- source: salt://kube-proxy/initd
|
|
- user: root
|
|
- group: root
|
|
- mode: 755
|
|
|
|
{% endif %}
|
|
|
|
{{ environment_file }}:
|
|
file.managed:
|
|
- source: salt://kube-proxy/default
|
|
- template: jinja
|
|
- user: root
|
|
- group: root
|
|
- mode: 644
|
|
|
|
kube-proxy:
|
|
group.present:
|
|
- system: True
|
|
user.present:
|
|
- system: True
|
|
- gid_from_name: True
|
|
- shell: /sbin/nologin
|
|
- home: /var/kube-proxy
|
|
- require:
|
|
- group: kube-proxy
|
|
service.running:
|
|
- enable: True
|
|
- watch:
|
|
- file: {{ environment_file }}
|
|
{% if grains['os_family'] != 'RedHat' %}
|
|
- file: /etc/init.d/kube-proxy
|
|
{% endif %}
|
|
- file: /var/lib/kube-proxy/kubeconfig
|
|
|
|
/var/lib/kube-proxy/kubeconfig:
|
|
file.managed:
|
|
- source: salt://kube-proxy/kubeconfig
|
|
- user: root
|
|
- group: root
|
|
- mode: 400
|
|
- makedirs: true
|