mirror of https://github.com/kubernetes/kops.git
Remove support for the Lyft CNI
This commit is contained in:
John Gardiner Myers
parent
97f6282323
commit
6655022ce1
|
|
@ -280,7 +280,7 @@ func NewCmdCreateCluster(f *util.Factory, out io.Writer) *cobra.Command {
|
|||
cmd.Flags().StringVar(&options.EtcdStorageType, "etcd-storage-type", options.EtcdStorageType, "The default storage type for etcd members")
|
||||
cmd.RegisterFlagCompletionFunc("etcd-storage-type", completeStorageType)
|
||||
|
||||
cmd.Flags().StringVar(&options.Networking, "networking", options.Networking, "Networking mode. kubenet, external, weave, flannel-vxlan (or flannel), flannel-udp, calico, canal, kube-router, amazonvpc, cilium, cilium-etcd, cni, lyftvpc.")
|
||||
cmd.Flags().StringVar(&options.Networking, "networking", options.Networking, "Networking mode. kubenet, external, weave, flannel-vxlan (or flannel), flannel-udp, calico, canal, kube-router, amazonvpc, cilium, cilium-etcd, cni.")
|
||||
cmd.RegisterFlagCompletionFunc("networking", completeNetworking(options))
|
||||
|
||||
cmd.Flags().StringVar(&options.DNSZone, "dns-zone", options.DNSZone, "DNS hosted zone (defaults to longest matching zone)")
|
||||
|
|
@ -927,7 +927,7 @@ func completeNetworking(options *CreateClusterOptions) func(cmd *cobra.Command,
|
|||
)
|
||||
|
||||
if options.CloudProvider == "aws" || options.CloudProvider == "" {
|
||||
completions = append(completions, "amazonvpc", "lyftvpc")
|
||||
completions = append(completions, "amazonvpc")
|
||||
}
|
||||
|
||||
if featureflag.AlphaAllowGCE.Enabled() && (options.CloudProvider == "gce" || options.CloudProvider == "") {
|
||||
|
|
|
|||
|
|
@ -95,7 +95,7 @@ kops create cluster [CLUSTER] [flags]
|
|||
--master-volume-size int32 Instance volume size (in GB) for masters
|
||||
--master-zones strings Zones in which to run masters (must be an odd number)
|
||||
--network-cidr string Network CIDR to use
|
||||
--networking string Networking mode. kubenet, external, weave, flannel-vxlan (or flannel), flannel-udp, calico, canal, kube-router, amazonvpc, cilium, cilium-etcd, cni, lyftvpc. (default "kubenet")
|
||||
--networking string Networking mode. kubenet, external, weave, flannel-vxlan (or flannel), flannel-udp, calico, canal, kube-router, amazonvpc, cilium, cilium-etcd, cni. (default "kubenet")
|
||||
--node-count int32 Total number of worker nodes. Defaults to one node per zone
|
||||
--node-image string Machine image for worker nodes. Takes precedence over --image
|
||||
--node-security-groups strings Additional precreated security groups to add to worker nodes.
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ The following table provides the support status for various networking providers
|
|||
| Kopeio | 1.5 | - | - | - |
|
||||
| Kube-router | 1.6.2 | - | - | - |
|
||||
| Kubenet | 1.5 | 1.5 | - | - |
|
||||
| Lyft VPC | 1.11 | - | 1.22 | - |
|
||||
| Lyft VPC | 1.11 | - | 1.22 | 1.23 |
|
||||
| Romana | 1.8 | - | 1.18 | 1.19 |
|
||||
| Weave | 1.5 | - | - | - |
|
||||
|
||||
|
|
@ -76,7 +76,6 @@ Several CNI providers are currently built into kOps:
|
|||
* [Cilium](networking/cilium.md)
|
||||
* [Flannel](networking/flannel.md)
|
||||
* [Kube-router](networking/kube-router.md)
|
||||
* [Lyft VPC](networking/lyft-vpc.md)
|
||||
* [Weave](networking/weave.md)
|
||||
|
||||
kOps makes it easy for cluster operators to choose one of these options. The manifests for the providers
|
||||
|
|
|
|||
|
|
@ -114,7 +114,7 @@ kops rolling-update cluster --yes
|
|||
|
||||
This feature is in beta state.
|
||||
|
||||
You can have Cilium provision AWS managed addresses and attach them directly to Pods much like Lyft VPC and AWS VPC. See [the Cilium docs for more information](https://docs.cilium.io/en/v1.6/concepts/ipam/eni/)
|
||||
You can have Cilium provision AWS managed addresses and attach them directly to Pods much like AWS VPC. See [the Cilium docs for more information](https://docs.cilium.io/en/v1.6/concepts/ipam/eni/)
|
||||
|
||||
```yaml
|
||||
networking:
|
||||
|
|
|
|||
|
|
@ -1,60 +0,0 @@
|
|||
# Lyft CNI
|
||||
|
||||
The [lyft cni-ipvlan-vpc-k8s](https://github.com/lyft/cni-ipvlan-vpc-k8s) plugin uses Amazon Elastic Network Interfaces (ENI) to assign AWS-managed IPs to Pods using the Linux kernel's IPvlan driver in L2 mode.
|
||||
|
||||
Support for the Lyft CNI is deprecated in kOps 1.22 and will be removed in kOps 1.23.
|
||||
|
||||
## Installing
|
||||
|
||||
Read the [prerequisites](https://github.com/lyft/cni-ipvlan-vpc-k8s#prerequisites) before starting. In addition to that, you need to specify the VPC ID as `spec.networkID` in the cluster spec file.
|
||||
|
||||
To use the Lyft CNI, specify the following in the cluster spec.
|
||||
|
||||
```yaml
|
||||
networking:
|
||||
lyftvpc: {}
|
||||
```
|
||||
|
||||
in the cluster spec file or pass the `--networking lyftvpc` option on the command line to kOps:
|
||||
|
||||
```console
|
||||
$ export ZONES=mylistofzones
|
||||
$ kops create cluster \
|
||||
--zones $ZONES \
|
||||
--master-zones $ZONES \
|
||||
--master-size m4.large \
|
||||
--node-size m4.large \
|
||||
--networking lyftvpc \
|
||||
--yes \
|
||||
--name myclustername.mydns.io
|
||||
```
|
||||
|
||||
## Configuring
|
||||
|
||||
### Specify subnet selector
|
||||
|
||||
You can specify which subnets to use for allocating Pod IPs by specifying
|
||||
|
||||
```yaml
|
||||
networking:
|
||||
lyftvpc:
|
||||
subnetTags:
|
||||
KubernetesCluster: myclustername.mydns.io
|
||||
```
|
||||
|
||||
In this example, new interfaces will be attached to subnets tagged with `KubernetesCluster = myclustername.mydns.io`.
|
||||
|
||||
### Change the download location
|
||||
|
||||
By default the plugin is downloaded from Github at node startup. This location can be changed using environment variables
|
||||
|
||||
```bash
|
||||
export LYFT_VPC_DOWNLOAD_URL="https://example.com/cni-ipvlan-vpc-k8s-amd64-v0.6.0.tar.gz"
|
||||
export LYFT_VPC_DOWNLOAD_HASH="3aadcb32ffda53990153790203eb72898e55a985207aa5b4451357f9862286f0"
|
||||
```
|
||||
|
||||
The hash can be MD5, SHA1 or SHA256.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
In case of any issues the directory `/var/log/aws-routed-eni` contains the log files of the CNI plugin. This directory is located in all the nodes in the cluster.
|
||||
|
|
@ -12,7 +12,7 @@ This is a document to gather the release notes prior to the release.
|
|||
|
||||
* Support for Kubernetes version 1.17 has been removed.
|
||||
|
||||
* TODO Support for the Lyft CNI has been removed.
|
||||
* Support for the Lyft CNI has been removed.
|
||||
|
||||
# Required actions
|
||||
|
||||
|
|
|
|||
|
|
@ -3964,7 +3964,8 @@ spec:
|
|||
type: object
|
||||
lyftvpc:
|
||||
description: LyftVPCNetworkingSpec declares that we want to use
|
||||
the cni-ipvlan-vpc-k8s CNI networking.
|
||||
the cni-ipvlan-vpc-k8s CNI networking. Lyft VPC is deprecated
|
||||
as of kOps 1.22 and removed as of kOps 1.23.
|
||||
properties:
|
||||
subnetTags:
|
||||
additionalProperties:
|
||||
|
|
|
|||
|
|
@ -104,7 +104,6 @@ nav:
|
|||
- Cilium: "networking/cilium.md"
|
||||
- Flannel: "networking/flannel.md"
|
||||
- Kube-Router: "networking/kube-router.md"
|
||||
- Lyft VPC: "networking/lyft-vpc.md"
|
||||
- Weave: "networking/weave.md"
|
||||
- Run kOps in an existing VPC: "run_in_existing_vpc.md"
|
||||
- Supported network topologies: "topology.md"
|
||||
|
|
|
|||
|
|
@ -410,7 +410,7 @@ func (c *NodeupModelContext) UseKopsControllerForNodeBootstrap() bool {
|
|||
|
||||
// UsesSecondaryIP checks if the CNI in use attaches secondary interfaces to the host.
|
||||
func (c *NodeupModelContext) UsesSecondaryIP() bool {
|
||||
return (c.Cluster.Spec.Networking.CNI != nil && c.Cluster.Spec.Networking.CNI.UsesSecondaryIP) || c.Cluster.Spec.Networking.AmazonVPC != nil || c.Cluster.Spec.Networking.LyftVPC != nil ||
|
||||
return (c.Cluster.Spec.Networking.CNI != nil && c.Cluster.Spec.Networking.CNI.UsesSecondaryIP) || c.Cluster.Spec.Networking.AmazonVPC != nil ||
|
||||
(c.Cluster.Spec.Networking.Cilium != nil && c.Cluster.Spec.Networking.Cilium.Ipam == kops.CiliumIpamEni)
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -7,23 +7,15 @@ go_library(
|
|||
"cilium.go",
|
||||
"common.go",
|
||||
"kube_router.go",
|
||||
"lyft.go",
|
||||
],
|
||||
importpath = "k8s.io/kops/nodeup/pkg/model/networking",
|
||||
visibility = ["//visibility:public"],
|
||||
deps = [
|
||||
"//nodeup/pkg/model:go_default_library",
|
||||
"//pkg/apis/kops:go_default_library",
|
||||
"//pkg/apis/kops/model:go_default_library",
|
||||
"//pkg/rbac:go_default_library",
|
||||
"//upup/pkg/fi:go_default_library",
|
||||
"//upup/pkg/fi/nodeup/nodetasks:go_default_library",
|
||||
"//vendor/github.com/aws/aws-sdk-go/aws:go_default_library",
|
||||
"//vendor/github.com/aws/aws-sdk-go/aws/ec2metadata:go_default_library",
|
||||
"//vendor/github.com/aws/aws-sdk-go/aws/request:go_default_library",
|
||||
"//vendor/github.com/aws/aws-sdk-go/aws/session:go_default_library",
|
||||
"//vendor/github.com/aws/aws-sdk-go/service/ec2:go_default_library",
|
||||
"//vendor/golang.org/x/sys/unix:go_default_library",
|
||||
"//vendor/k8s.io/klog/v2:go_default_library",
|
||||
],
|
||||
)
|
||||
|
|
|
|||
|
|
@ -1,174 +0,0 @@
|
|||
/*
|
||||
Copyright 2020 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package networking
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/aws/aws-sdk-go/aws"
|
||||
"github.com/aws/aws-sdk-go/aws/ec2metadata"
|
||||
"github.com/aws/aws-sdk-go/aws/request"
|
||||
"github.com/aws/aws-sdk-go/aws/session"
|
||||
"github.com/aws/aws-sdk-go/service/ec2"
|
||||
"k8s.io/kops/upup/pkg/fi/nodeup/nodetasks"
|
||||
|
||||
"k8s.io/klog/v2"
|
||||
"k8s.io/kops/nodeup/pkg/model"
|
||||
api "k8s.io/kops/pkg/apis/kops"
|
||||
"k8s.io/kops/upup/pkg/fi"
|
||||
)
|
||||
|
||||
type LyftVPCBuilder struct {
|
||||
*model.NodeupModelContext
|
||||
}
|
||||
|
||||
var _ fi.ModelBuilder = &LyftVPCBuilder{}
|
||||
|
||||
// Build is responsible for configuring the network cni
|
||||
func (b *LyftVPCBuilder) Build(c *fi.ModelBuilderContext) error {
|
||||
networking := b.Cluster.Spec.Networking
|
||||
|
||||
if networking.LyftVPC == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
assets := []string{
|
||||
"cni-ipvlan-vpc-k8s-ipam",
|
||||
"cni-ipvlan-vpc-k8s-ipvlan",
|
||||
"cni-ipvlan-vpc-k8s-tool",
|
||||
"cni-ipvlan-vpc-k8s-unnumbered-ptp",
|
||||
}
|
||||
|
||||
if err := b.AddCNIBinAssets(c, assets); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
securityGroups, err := evaluateSecurityGroups(b.Cluster.Spec.NetworkID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
conflist := map[string]interface{}{
|
||||
"cniVersion": "0.3.1",
|
||||
"name": "cni-ipvlan-vpc-k8s",
|
||||
"plugins": []map[string]interface{}{
|
||||
{
|
||||
"cniVersion": "0.3.1",
|
||||
"type": "cni-ipvlan-vpc-k8s-ipam",
|
||||
"interfaceIndex": 1,
|
||||
"skipDeallocation": true,
|
||||
"subnetTags": getSubnetTags(b.Cluster),
|
||||
"secGroupIds": securityGroups,
|
||||
},
|
||||
{
|
||||
"cniVersion": "0.3.1",
|
||||
"type": "cni-ipvlan-vpc-k8s-ipvlan",
|
||||
"mode": "l2",
|
||||
},
|
||||
{
|
||||
"cniVersion": "0.3.1",
|
||||
"type": "cni-ipvlan-vpc-k8s-unnumbered-ptp",
|
||||
"hostInterface": "eth0",
|
||||
"containerInterface": "veth0",
|
||||
"ipMasq": true,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
bytes, err := json.Marshal(conflist)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
c.AddTask(&nodetasks.File{
|
||||
Contents: fi.NewBytesResource(bytes),
|
||||
Path: "/etc/cni/net.d/10-cni-ipvlan-vpc-k8s.conflist",
|
||||
Type: nodetasks.FileType_File,
|
||||
})
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func getSubnetTags(cluster *api.Cluster) interface{} {
|
||||
var tags map[string]string
|
||||
if cluster.IsKubernetesGTE("1.18") {
|
||||
tags = map[string]string{
|
||||
"KubernetesCluster": cluster.Name,
|
||||
}
|
||||
} else {
|
||||
tags = map[string]string{
|
||||
"Type": "pod",
|
||||
}
|
||||
}
|
||||
if len(cluster.Spec.Networking.LyftVPC.SubnetTags) > 0 {
|
||||
tags = cluster.Spec.Networking.LyftVPC.SubnetTags
|
||||
}
|
||||
return tags
|
||||
}
|
||||
|
||||
func evaluateSecurityGroups(vpcId string) ([]string, error) {
|
||||
config := aws.NewConfig()
|
||||
config = config.WithCredentialsChainVerboseErrors(true)
|
||||
|
||||
s, err := session.NewSession(config)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("error starting new AWS session: %v", err)
|
||||
}
|
||||
s.Handlers.Send.PushFront(func(r *request.Request) {
|
||||
// Log requests
|
||||
klog.V(4).Infof("AWS API Request: %s/%s", r.ClientInfo.ServiceName, r.Operation.Name)
|
||||
})
|
||||
|
||||
metadata := ec2metadata.New(s, config)
|
||||
|
||||
region, err := metadata.Region()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("error querying ec2 metadata service (for az/region): %v", err)
|
||||
}
|
||||
|
||||
sgNames, err := metadata.GetMetadata("security-groups")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("error querying ec2 metadata service (for security-groups): %v", err)
|
||||
}
|
||||
svc := ec2.New(s, config.WithRegion(region))
|
||||
|
||||
result, err := svc.DescribeSecurityGroups(&ec2.DescribeSecurityGroupsInput{
|
||||
Filters: []*ec2.Filter{
|
||||
{
|
||||
Name: aws.String("group-name"),
|
||||
Values: aws.StringSlice(strings.Fields(sgNames)),
|
||||
},
|
||||
{
|
||||
Name: aws.String("vpc-id"),
|
||||
Values: []*string{aws.String(vpcId)},
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("error looking up instance security group ids: %v", err)
|
||||
}
|
||||
var sgIds []string
|
||||
for _, group := range result.SecurityGroups {
|
||||
sgIds = append(sgIds, *group.GroupId)
|
||||
}
|
||||
|
||||
return sgIds, nil
|
||||
|
||||
}
|
||||
|
|
@ -761,8 +761,6 @@ func (c *Cluster) fillClusterSpecNetworkingSpec() {
|
|||
// OK
|
||||
} else if c.Spec.Networking.Cilium != nil {
|
||||
// OK
|
||||
} else if c.Spec.Networking.LyftVPC != nil {
|
||||
// OK
|
||||
} else if c.Spec.Networking.GCE != nil {
|
||||
// OK
|
||||
} else {
|
||||
|
|
|
|||
|
|
@ -572,6 +572,7 @@ type HubbleSpec struct {
|
|||
}
|
||||
|
||||
// LyftVPCNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking.
|
||||
// Lyft VPC is deprecated as of kOps 1.22 and removed as of kOps 1.23.
|
||||
type LyftVPCNetworkingSpec struct {
|
||||
SubnetTags map[string]string `json:"subnetTags,omitempty"`
|
||||
}
|
||||
|
|
|
|||
|
|
@ -572,6 +572,7 @@ type HubbleSpec struct {
|
|||
}
|
||||
|
||||
// LyftVPCNetworkingSpec declares that we want to use the cni-ipvlan-vpc-k8s CNI networking.
|
||||
// Lyft VPC is deprecated as of kOps 1.22 and removed as of kOps 1.23.
|
||||
type LyftVPCNetworkingSpec struct {
|
||||
SubnetTags map[string]string `json:"subnetTags,omitempty"`
|
||||
}
|
||||
|
|
|
|||
|
|
@ -179,7 +179,7 @@ func ValidateCluster(c *kops.Cluster, strict bool) field.ErrorList {
|
|||
allErrs = append(allErrs, field.Invalid(fieldSpec.Child("nonMasqueradeCIDR"), nonMasqueradeCIDRString, "Cluster had an invalid nonMasqueradeCIDR"))
|
||||
}
|
||||
|
||||
if networkCIDR != nil && subnet.Overlap(nonMasqueradeCIDR, networkCIDR) && c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC == nil && c.Spec.Networking.LyftVPC == nil && (c.Spec.Networking.Cilium == nil || c.Spec.Networking.Cilium.Ipam != kops.CiliumIpamEni) {
|
||||
if networkCIDR != nil && subnet.Overlap(nonMasqueradeCIDR, networkCIDR) && c.Spec.Networking != nil && c.Spec.Networking.AmazonVPC == nil && (c.Spec.Networking.Cilium == nil || c.Spec.Networking.Cilium.Ipam != kops.CiliumIpamEni) {
|
||||
allErrs = append(allErrs, field.Forbidden(fieldSpec.Child("nonMasqueradeCIDR"), fmt.Sprintf("nonMasqueradeCIDR %q cannot overlap with networkCIDR %q", nonMasqueradeCIDRString, c.Spec.NetworkCIDR)))
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -756,14 +756,7 @@ func validateNetworking(cluster *kops.Cluster, v *kops.NetworkingSpec, fldPath *
|
|||
}
|
||||
|
||||
if v.LyftVPC != nil {
|
||||
if optionTaken {
|
||||
allErrs = append(allErrs, field.Forbidden(fldPath.Child("lyftvpc"), "only one networking option permitted"))
|
||||
}
|
||||
optionTaken = true
|
||||
|
||||
if c.CloudProvider != "aws" {
|
||||
allErrs = append(allErrs, field.Forbidden(fldPath.Child("lyftvpc"), "amazon-vpc-routed-eni networking is supported only in AWS"))
|
||||
}
|
||||
allErrs = append(allErrs, field.Forbidden(fldPath.Child("lyftvp"), "support for LyftVPC has been removed"))
|
||||
}
|
||||
|
||||
if v.GCE != nil {
|
||||
|
|
|
|||
|
|
@ -306,10 +306,6 @@ func (r *NodeRoleAPIServer) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {
|
|||
addAmazonVPCCNIPermissions(p, b.IAMPrefix())
|
||||
}
|
||||
|
||||
if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.LyftVPC != nil {
|
||||
addLyftVPCPermissions(p)
|
||||
}
|
||||
|
||||
if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.Cilium != nil && b.Cluster.Spec.Networking.Cilium.Ipam == kops.CiliumIpamEni {
|
||||
addCiliumEniPermissions(p)
|
||||
}
|
||||
|
|
@ -377,10 +373,6 @@ func (r *NodeRoleMaster) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {
|
|||
addAmazonVPCCNIPermissions(p, b.IAMPrefix())
|
||||
}
|
||||
|
||||
if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.LyftVPC != nil {
|
||||
addLyftVPCPermissions(p)
|
||||
}
|
||||
|
||||
if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.Cilium != nil && b.Cluster.Spec.Networking.Cilium.Ipam == kops.CiliumIpamEni {
|
||||
addCiliumEniPermissions(p)
|
||||
}
|
||||
|
|
@ -411,10 +403,6 @@ func (r *NodeRoleNode) BuildAWSPolicy(b *PolicyBuilder) (*Policy, error) {
|
|||
addAmazonVPCCNIPermissions(p, b.IAMPrefix())
|
||||
}
|
||||
|
||||
if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.LyftVPC != nil {
|
||||
addLyftVPCPermissions(p)
|
||||
}
|
||||
|
||||
if b.Cluster.Spec.Networking != nil && b.Cluster.Spec.Networking.Calico != nil && b.Cluster.Spec.Networking.Calico.AWSSrcDstCheck != "DoNothing" {
|
||||
addCalicoSrcDstCheckPermissions(p)
|
||||
}
|
||||
|
|
@ -1104,24 +1092,6 @@ func addCertIAMPolicies(p *Policy) {
|
|||
)
|
||||
}
|
||||
|
||||
func addLyftVPCPermissions(p *Policy) {
|
||||
p.unconditionalAction.Insert(
|
||||
"ec2:AssignPrivateIpAddresses",
|
||||
"ec2:AttachNetworkInterface",
|
||||
"ec2:CreateNetworkInterface",
|
||||
"ec2:DeleteNetworkInterface",
|
||||
"ec2:DescribeInstanceTypes",
|
||||
"ec2:DescribeNetworkInterfaces",
|
||||
"ec2:DescribeSecurityGroups",
|
||||
"ec2:DescribeSubnets",
|
||||
"ec2:DescribeVpcPeeringConnections",
|
||||
"ec2:DescribeVpcs",
|
||||
"ec2:DetachNetworkInterface",
|
||||
"ec2:ModifyNetworkInterfaceAttribute",
|
||||
"ec2:UnassignPrivateIpAddresses",
|
||||
)
|
||||
}
|
||||
|
||||
func addCiliumEniPermissions(p *Policy) {
|
||||
p.unconditionalAction.Insert(
|
||||
"ec2:DescribeSubnets",
|
||||
|
|
|
|||
|
|
@ -1048,14 +1048,6 @@ func (c *ApplyClusterCmd) addFileAssets(assetBuilder *assets.AssetBuilder) error
|
|||
}
|
||||
c.Assets[arch] = append(c.Assets[arch], mirrors.BuildMirroredAsset(cniAsset, cniAssetHash))
|
||||
|
||||
if c.Cluster.Spec.Networking.LyftVPC != nil {
|
||||
lyftAsset, lyftAssetHash, err := findLyftVPCAssets(c.Cluster, assetBuilder, arch)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
c.Assets[arch] = append(c.Assets[arch], mirrors.BuildMirroredAsset(lyftAsset, lyftAssetHash))
|
||||
}
|
||||
|
||||
var containerRuntimeAssetUrl *url.URL
|
||||
var containerRuntimeAssetHash *hashing.Hash
|
||||
switch c.Cluster.Spec.ContainerRuntime {
|
||||
|
|
|
|||
|
|
@ -44,16 +44,6 @@ const (
|
|||
// Environment variable for overriding CNI url
|
||||
ENV_VAR_CNI_ASSET_URL = "CNI_VERSION_URL"
|
||||
ENV_VAR_CNI_ASSET_HASH = "CNI_ASSET_HASH_STRING"
|
||||
|
||||
// Default LyftVPC packages
|
||||
defaultLyftVPCAssetAmd64 = "https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.6.0/cni-ipvlan-vpc-k8s-amd64-v0.6.0.tar.gz"
|
||||
defaultLyftVPCAssetAmd64SHA256 = "871757d381035f64020a523e7a3e139b6177b98eb7a61b547813ff25957fc566"
|
||||
defaultLyftVPCAssetArm64 = "https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.6.0/cni-ipvlan-vpc-k8s-arm64-v0.6.0.tar.gz"
|
||||
defaultLyftVPCAssetArm64SHA256 = "3aadcb32ffda53990153790203eb72898e55a985207aa5b4451357f9862286f0"
|
||||
|
||||
// Environment variable for overriding LyftVPC url
|
||||
ENV_VAR_LYFT_VPC_ASSET_URL = "LYFT_VPC_DOWNLOAD_URL"
|
||||
ENV_VAR_LYFT_VPC_ASSET_HASH = "LYFT_VPC_DOWNLOAD_HASH"
|
||||
)
|
||||
|
||||
func findCNIAssets(c *kopsapi.Cluster, assetBuilder *assets.AssetBuilder, arch architectures.Architecture) (*url.URL, *hashing.Hash, error) {
|
||||
|
|
@ -114,42 +104,3 @@ func findCNIAssets(c *kopsapi.Cluster, assetBuilder *assets.AssetBuilder, arch a
|
|||
|
||||
return u, h, nil
|
||||
}
|
||||
|
||||
func findLyftVPCAssets(c *kopsapi.Cluster, assetBuilder *assets.AssetBuilder, arch architectures.Architecture) (*url.URL, *hashing.Hash, error) {
|
||||
// Override LyftVPC packages from env vars
|
||||
lyftAssetURL := os.Getenv(ENV_VAR_LYFT_VPC_ASSET_URL)
|
||||
lyftAssetHash := os.Getenv(ENV_VAR_LYFT_VPC_ASSET_HASH)
|
||||
|
||||
if lyftAssetURL != "" && lyftAssetHash != "" {
|
||||
klog.V(2).Infof("Using LyftVPC package URL %q, as set in %s", lyftAssetURL, ENV_VAR_LYFT_VPC_ASSET_URL)
|
||||
klog.V(2).Infof("Using LyftVPC package hash %q, as set in %s", lyftAssetHash, ENV_VAR_LYFT_VPC_ASSET_HASH)
|
||||
} else {
|
||||
switch arch {
|
||||
case architectures.ArchitectureAmd64:
|
||||
lyftAssetURL = defaultLyftVPCAssetAmd64
|
||||
lyftAssetHash = defaultLyftVPCAssetAmd64SHA256
|
||||
case architectures.ArchitectureArm64:
|
||||
lyftAssetURL = defaultLyftVPCAssetArm64
|
||||
lyftAssetHash = defaultLyftVPCAssetArm64SHA256
|
||||
default:
|
||||
return nil, nil, fmt.Errorf("unknown arch for LyftVPC asset: %s", arch)
|
||||
}
|
||||
}
|
||||
|
||||
u, err := url.Parse(lyftAssetURL)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("unable to parse LyftVPC asset URL %q: %v", lyftAssetURL, err)
|
||||
}
|
||||
|
||||
h, err := hashing.FromString(lyftAssetHash)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("unable to parse LyftVPC asset hash %q: %v", lyftAssetHash, err)
|
||||
}
|
||||
|
||||
u, err = assetBuilder.RemapFileAndSHAValue(u, lyftAssetHash)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("unable to remap LyftVPC asset: %v", err)
|
||||
}
|
||||
|
||||
return u, h, nil
|
||||
}
|
||||
|
|
|
|||
|
|
@ -103,58 +103,3 @@ func Test_FindCNIAssetFromDefaults122(t *testing.T) {
|
|||
t.Errorf("Expected default CNI version hash %q, but got %q instead", desiredCNIVersionHash, cniAssetHash)
|
||||
}
|
||||
}
|
||||
|
||||
func Test_FindLyftAssetFromEnvironmentVariable(t *testing.T) {
|
||||
|
||||
desiredLyftVersion := "https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/TEST-VERSION/cni-TEST-VERSION.tar.gz"
|
||||
desiredLyftVersionHash := "sha256:0000000000000000000000000000000000000000000000000000000000000000"
|
||||
|
||||
os.Setenv(ENV_VAR_LYFT_VPC_ASSET_URL, desiredLyftVersion)
|
||||
os.Setenv(ENV_VAR_LYFT_VPC_ASSET_HASH, desiredLyftVersionHash)
|
||||
defer func() {
|
||||
os.Unsetenv(ENV_VAR_LYFT_VPC_ASSET_URL)
|
||||
os.Unsetenv(ENV_VAR_LYFT_VPC_ASSET_HASH)
|
||||
}()
|
||||
|
||||
cluster := &api.Cluster{}
|
||||
cluster.Spec.KubernetesVersion = "v1.18.0"
|
||||
|
||||
assetBuilder := assets.NewAssetBuilder(cluster, false)
|
||||
lyftAsset, lyftAssetHash, err := findLyftVPCAssets(cluster, assetBuilder, architectures.ArchitectureAmd64)
|
||||
|
||||
if err != nil {
|
||||
t.Errorf("Unable to parse Lyft version %s", err)
|
||||
}
|
||||
|
||||
if lyftAsset.String() != desiredLyftVersion {
|
||||
t.Errorf("Expected Lyft version from env var %q, but got %q instead", desiredLyftVersion, lyftAsset)
|
||||
}
|
||||
|
||||
if lyftAssetHash.String() != desiredLyftVersionHash {
|
||||
t.Errorf("Expected Lyft version hash from env var %q, but got %q instead", desiredLyftVersionHash, lyftAssetHash)
|
||||
}
|
||||
}
|
||||
|
||||
func Test_FindLyftAssetFromDefaults(t *testing.T) {
|
||||
|
||||
desiredLyftVersion := "https://github.com/lyft/cni-ipvlan-vpc-k8s/releases/download/v0.6.0/cni-ipvlan-vpc-k8s-amd64-v0.6.0.tar.gz"
|
||||
desiredLyftVersionHash := "sha256:871757d381035f64020a523e7a3e139b6177b98eb7a61b547813ff25957fc566"
|
||||
|
||||
cluster := &api.Cluster{}
|
||||
cluster.Spec.KubernetesVersion = "v1.18.0"
|
||||
|
||||
assetBuilder := assets.NewAssetBuilder(cluster, false)
|
||||
lyftAsset, lyftAssetHash, err := findLyftVPCAssets(cluster, assetBuilder, architectures.ArchitectureAmd64)
|
||||
|
||||
if err != nil {
|
||||
t.Errorf("Unable to parse Lyft version %s", err)
|
||||
}
|
||||
|
||||
if lyftAsset.String() != desiredLyftVersion {
|
||||
t.Errorf("Expected default Lyft version %q, but got %q instead", desiredLyftVersion, lyftAsset)
|
||||
}
|
||||
|
||||
if lyftAssetHash.String() != desiredLyftVersionHash {
|
||||
t.Errorf("Expected default Lyft version hash %q, but got %q instead", desiredLyftVersionHash, lyftAssetHash)
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -913,8 +913,6 @@ func setupNetworking(opt *NewClusterOptions, cluster *api.Cluster) error {
|
|||
case "cilium-etcd":
|
||||
addCiliumNetwork(cluster)
|
||||
cluster.Spec.Networking.Cilium.EtcdManaged = true
|
||||
case "lyftvpc":
|
||||
cluster.Spec.Networking.LyftVPC = &api.LyftVPCNetworkingSpec{}
|
||||
case "gce":
|
||||
cluster.Spec.Networking.GCE = &api.GCENetworkingSpec{}
|
||||
default:
|
||||
|
|
|
|||
|
|
@ -301,18 +301,6 @@ func TestSetupNetworking(t *testing.T) {
|
|||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
options: NewClusterOptions{
|
||||
Networking: "lyftvpc",
|
||||
},
|
||||
expected: api.Cluster{
|
||||
Spec: api.ClusterSpec{
|
||||
Networking: &api.NetworkingSpec{
|
||||
LyftVPC: &api.LyftVPCNetworkingSpec{},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
options: NewClusterOptions{
|
||||
Networking: "gce",
|
||||
|
|
|
|||
|
|
@ -308,7 +308,6 @@ func (c *NodeUpCommand) Run(out io.Writer) error {
|
|||
loader.Builders = append(loader.Builders, &networking.CalicoBuilder{NodeupModelContext: modelContext})
|
||||
loader.Builders = append(loader.Builders, &networking.CiliumBuilder{NodeupModelContext: modelContext})
|
||||
loader.Builders = append(loader.Builders, &networking.KuberouterBuilder{NodeupModelContext: modelContext})
|
||||
loader.Builders = append(loader.Builders, &networking.LyftVPCBuilder{NodeupModelContext: modelContext})
|
||||
|
||||
loader.Builders = append(loader.Builders, &model.BootstrapClientBuilder{NodeupModelContext: modelContext})
|
||||
taskMap, err := loader.Build()
|
||||
|
|
|
|||
Loading…
Reference in New Issue