ea4764bf47
Automatic merge from submit-queue (batch tested with PRs 46897, 46899, 46864, 46854, 46875) Write audit policy file for GCE/GKE configuration Setup the audit policy configuration for GCE & GKE. Here is the high level summary of the policy: - Default logging everything at `Metadata` - Known write APIs default to `RequestResponse` - Known read-only APIs default to `Request` - Except secrets & configmaps are logged at `Metadata` - Don't log events - Don't log `/version`, swagger or healthchecks In addition to the above, I spent time analyzing the noisiest lines in the audit log from a cluster that soaked for 24 hours (and ran a batch of e2e tests). Of those top requests, those that were identified as low-risk (all read-only, except update kube-system endpoints by controllers) are dropped. I suspect we'll want to tweak this a bit more once we've had a time to soak it on some real clusters. For kubernetes/features#22 /cc @sttts @ericchiang
Cluster Configuration
Deprecation Notice: This directory has entered maintenance mode and will not be accepting new providers. Please submit new automation deployments to kube-deploy. Deployments in this directory will continue to be maintained and supported at their current level of support.
The scripts and data in this directory automate creation and configuration of a Kubernetes cluster, including networking, DNS, nodes, and master components.
See the getting-started guides for examples of how to use the scripts.
cloudprovider/config-default.sh contains a set of tweakable definitions/parameters for the cluster.
The heavy lifting of configuring the VMs is done by SaltStack.