Merge pull request #8322 from justinsb/dont_map_etcd_manager_hosts

Don't share /etc/hosts when using etcd-manager

pkg/model/components/etcdmanager/model.go

@@ -202,9 +202,6 @@ spec:
     # TODO: Would be nice to scope this more tightly, but needed for volume mounting
     - mountPath: /rootfs
       name: rootfs
-    # We write artificial hostnames into etc hosts for the etcd nodes, so they have stable names
-    - mountPath: /etc/hosts
-      name: hosts
     - mountPath: /etc/kubernetes/pki/etcd-manager
       name: pki
   hostNetwork: true
@@ -214,10 +211,6 @@ spec:
       path: /
       type: Directory
     name: rootfs
-  - hostPath:
-      path: /etc/hosts
-      type: File
-    name: hosts
   - hostPath:
       path: /etc/kubernetes/pki/etcd-manager
       type: DirectoryOrCreate
@@ -260,6 +253,18 @@ func (b *EtcdManagerBuilder) buildPod(etcdCluster *kops.EtcdClusterSpec) (*v1.Po
 		}
 	}
 
+	// With etcd-manager the hosts changes are self-contained, so
+	// we don't need to share /etc/hosts.  By not sharing we avoid
+	// (1) the temptation to address etcd directly and (2)
+	// problems of concurrent updates to /etc/hosts being hard
+	// from within a container (because locking is very difficult
+	// across bind mounts).
+	//
+	// Introduced with 1.17 to avoid changing existing versions.
+	if b.IsKubernetesLT("1.17") {
+		kubemanifest.MapEtcHosts(pod, container, false)
+	}
+
 	// Remap image via AssetBuilder
 	{
 		remapped, err := b.AssetBuilder.RemapImage(container.Image)

pkg/model/components/etcdmanager/model_test.go

@@ -27,7 +27,12 @@ import (
 )
 
 func Test_RunEtcdManagerBuilder(t *testing.T) {
-	for _, basedir := range []string{"tests/minimal", "tests/proxy"} {
+	tests := []string{
+		"tests/minimal",
+		"tests/proxy",
+		"tests/old_versions_mount_hosts",
+	}
+	for _, basedir := range tests {
 		basedir := basedir
 
 		t.Run(fmt.Sprintf("basedir=%s", basedir), func(t *testing.T) {

pkg/model/components/etcdmanager/tests/minimal/cluster.yaml

@@ -28,7 +28,7 @@ spec:
     provider: Manager
     backups:
       backupStore: memfs://clusters.example.com/minimal.example.com/backups/etcd-events
-  kubernetesVersion: v1.12.0
+  kubernetesVersion: v1.17.0
   masterInternalName: api.internal.minimal.example.com
   masterPublicName: api.minimal.example.com
   networkCIDR: 172.20.0.0/16

pkg/model/components/etcdmanager/tests/minimal/tasks.yaml

@@ -100,8 +100,6 @@ Contents:
         volumeMounts:
         - mountPath: /rootfs
           name: rootfs
-        - mountPath: /etc/hosts
-          name: hosts
         - mountPath: /etc/kubernetes/pki/etcd-manager
           name: pki
         - mountPath: /var/log/etcd.log
@@ -117,10 +115,6 @@ Contents:
           path: /
           type: Directory
         name: rootfs
-      - hostPath:
-          path: /etc/hosts
-          type: File
-        name: hosts
       - hostPath:
           path: /etc/kubernetes/pki/etcd-manager-events
           type: DirectoryOrCreate
@@ -171,8 +165,6 @@ Contents:
         volumeMounts:
         - mountPath: /rootfs
           name: rootfs
-        - mountPath: /etc/hosts
-          name: hosts
         - mountPath: /etc/kubernetes/pki/etcd-manager
           name: pki
         - mountPath: /var/log/etcd.log
@@ -188,10 +180,6 @@ Contents:
           path: /
           type: Directory
         name: rootfs
-      - hostPath:
-          path: /etc/hosts
-          type: File
-        name: hosts
       - hostPath:
           path: /etc/kubernetes/pki/etcd-manager-main
           type: DirectoryOrCreate

pkg/model/components/etcdmanager/tests/old_versions_mount_hosts/cluster.yaml

@@ -0,0 +1,85 @@
+apiVersion: kops.k8s.io/v1alpha2
+kind: Cluster
+metadata:
+  creationTimestamp: "2016-12-10T22:42:27Z"
+  name: minimal.example.com
+spec:
+  kubernetesApiAccess:
+  - 0.0.0.0/0
+  channel: stable
+  cloudProvider: aws
+  configBase: memfs://clusters.example.com/minimal.example.com
+  etcdClusters:
+  - cpuRequest: 200m
+    etcdMembers:
+    - instanceGroup: master-us-test-1a
+      name: us-test-1a
+    memoryRequest: 100Mi
+    name: main
+    provider: Manager
+    backups:
+      backupStore: memfs://clusters.example.com/minimal.example.com/backups/etcd-main
+  - cpuRequest: 100m
+    etcdMembers:
+    - instanceGroup: master-us-test-1a
+      name: us-test-1a
+    memoryRequest: 100Mi
+    name: events
+    provider: Manager
+    backups:
+      backupStore: memfs://clusters.example.com/minimal.example.com/backups/etcd-events
+  kubernetesVersion: v1.12.0
+  masterInternalName: api.internal.minimal.example.com
+  masterPublicName: api.minimal.example.com
+  networkCIDR: 172.20.0.0/16
+  networking:
+    kubenet: {}
+  nonMasqueradeCIDR: 100.64.0.0/10
+  sshAccess:
+    - 0.0.0.0/0
+  topology:
+    masters: public
+    nodes: public
+  subnets:
+  - cidr: 172.20.32.0/19
+    name: us-test-1a
+    type: Public
+    zone: us-test-1a
+
+---
+
+apiVersion: kops.k8s.io/v1alpha2
+kind: InstanceGroup
+metadata:
+  creationTimestamp: "2016-12-10T22:42:28Z"
+  name: nodes
+  labels:
+    kops.k8s.io/cluster: minimal.example.com
+spec:
+  associatePublicIp: true
+  image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2016-10-21
+  machineType: t2.medium
+  maxSize: 2
+  minSize: 2
+  role: Node
+  subnets:
+  - us-test-1a
+
+---
+
+apiVersion: kops.k8s.io/v1alpha2
+kind: InstanceGroup
+metadata:
+  creationTimestamp: "2016-12-10T22:42:28Z"
+  name: master-us-test-1a
+  labels:
+    kops.k8s.io/cluster: minimal.example.com
+spec:
+  associatePublicIp: true
+  image: kope.io/k8s-1.4-debian-jessie-amd64-hvm-ebs-2016-10-21
+  machineType: m3.medium
+  maxSize: 1
+  minSize: 1
+  role: Master
+  subnets:
+  - us-test-1a

pkg/model/components/etcdmanager/tests/old_versions_mount_hosts/tasks.yaml

@@ -0,0 +1,206 @@
+Lifecycle: null
+Name: etcd-clients-ca
+Signer: null
+alternateNameTasks: null
+alternateNames: null
+format: v1alpha2
+subject: cn=etcd-clients-ca
+type: ca
+---
+Lifecycle: null
+Name: etcd-manager-ca-events
+Signer: null
+alternateNameTasks: null
+alternateNames: null
+format: v1alpha2
+subject: cn=etcd-manager-ca-events
+type: ca
+---
+Lifecycle: null
+Name: etcd-manager-ca-main
+Signer: null
+alternateNameTasks: null
+alternateNames: null
+format: v1alpha2
+subject: cn=etcd-manager-ca-main
+type: ca
+---
+Lifecycle: null
+Name: etcd-peers-ca-events
+Signer: null
+alternateNameTasks: null
+alternateNames: null
+format: v1alpha2
+subject: cn=etcd-peers-ca-events
+type: ca
+---
+Lifecycle: null
+Name: etcd-peers-ca-main
+Signer: null
+alternateNameTasks: null
+alternateNames: null
+format: v1alpha2
+subject: cn=etcd-peers-ca-main
+type: ca
+---
+Contents:
+  Name: ""
+  Resource: |-
+    {
+      "memberCount": 1
+    }
+Lifecycle: null
+Location: backups/etcd/events/control/etcd-cluster-spec
+Name: etcd-cluster-spec-events
+---
+Contents:
+  Name: ""
+  Resource: |-
+    {
+      "memberCount": 1
+    }
+Lifecycle: null
+Location: backups/etcd/main/control/etcd-cluster-spec
+Name: etcd-cluster-spec-main
+---
+Contents:
+  Name: ""
+  Resource: |
+    apiVersion: v1
+    kind: Pod
+    metadata:
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ""
+      creationTimestamp: null
+      labels:
+        k8s-app: etcd-manager-events
+      name: etcd-manager-events
+      namespace: kube-system
+    spec:
+      containers:
+      - command:
+        - /bin/sh
+        - -c
+        - mkfifo /tmp/pipe; (tee -a /var/log/etcd.log < /tmp/pipe & ) ; exec /etcd-manager
+          --backup-store=memfs://clusters.example.com/minimal.example.com/backups/etcd-events
+          --client-urls=https://__name__:4002 --cluster-name=etcd-events --containerized=true
+          --dns-suffix=.internal.minimal.example.com --etcd-insecure=true --grpc-port=3997
+          --insecure=false --peer-urls=https://__name__:2381 --quarantine-client-urls=https://__name__:3995
+          --v=6 --volume-name-tag=k8s.io/etcd/events --volume-provider=aws --volume-tag=k8s.io/etcd/events
+          --volume-tag=k8s.io/role/master=1 --volume-tag=kubernetes.io/cluster/minimal.example.com=owned
+          > /tmp/pipe 2>&1
+        image: kopeio/etcd-manager:3.0.20191025
+        name: etcd-manager
+        resources:
+          requests:
+            cpu: 100m
+            memory: 100Mi
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - mountPath: /rootfs
+          name: rootfs
+        - mountPath: /etc/kubernetes/pki/etcd-manager
+          name: pki
+        - mountPath: /etc/hosts
+          name: hosts
+        - mountPath: /var/log/etcd.log
+          name: varlogetcd
+      hostNetwork: true
+      hostPID: true
+      priorityClassName: system-cluster-critical
+      tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      volumes:
+      - hostPath:
+          path: /
+          type: Directory
+        name: rootfs
+      - hostPath:
+          path: /etc/kubernetes/pki/etcd-manager-events
+          type: DirectoryOrCreate
+        name: pki
+      - hostPath:
+          path: /etc/hosts
+          type: File
+        name: hosts
+      - hostPath:
+          path: /var/log/etcd-events.log
+          type: FileOrCreate
+        name: varlogetcd
+    status: {}
+Lifecycle: null
+Location: manifests/etcd/events.yaml
+Name: manifests-etcdmanager-events
+---
+Contents:
+  Name: ""
+  Resource: |
+    apiVersion: v1
+    kind: Pod
+    metadata:
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ""
+      creationTimestamp: null
+      labels:
+        k8s-app: etcd-manager-main
+      name: etcd-manager-main
+      namespace: kube-system
+    spec:
+      containers:
+      - command:
+        - /bin/sh
+        - -c
+        - mkfifo /tmp/pipe; (tee -a /var/log/etcd.log < /tmp/pipe & ) ; exec /etcd-manager
+          --backup-store=memfs://clusters.example.com/minimal.example.com/backups/etcd-main
+          --client-urls=https://__name__:4001 --cluster-name=etcd --containerized=true
+          --dns-suffix=.internal.minimal.example.com --etcd-insecure=true --grpc-port=3996
+          --insecure=false --peer-urls=https://__name__:2380 --quarantine-client-urls=https://__name__:3994
+          --v=6 --volume-name-tag=k8s.io/etcd/main --volume-provider=aws --volume-tag=k8s.io/etcd/main
+          --volume-tag=k8s.io/role/master=1 --volume-tag=kubernetes.io/cluster/minimal.example.com=owned
+          > /tmp/pipe 2>&1
+        image: kopeio/etcd-manager:3.0.20191025
+        name: etcd-manager
+        resources:
+          requests:
+            cpu: 200m
+            memory: 100Mi
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - mountPath: /rootfs
+          name: rootfs
+        - mountPath: /etc/kubernetes/pki/etcd-manager
+          name: pki
+        - mountPath: /etc/hosts
+          name: hosts
+        - mountPath: /var/log/etcd.log
+          name: varlogetcd
+      hostNetwork: true
+      hostPID: true
+      priorityClassName: system-cluster-critical
+      tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      volumes:
+      - hostPath:
+          path: /
+          type: Directory
+        name: rootfs
+      - hostPath:
+          path: /etc/kubernetes/pki/etcd-manager-main
+          type: DirectoryOrCreate
+        name: pki
+      - hostPath:
+          path: /etc/hosts
+          type: File
+        name: hosts
+      - hostPath:
+          path: /var/log/etcd.log
+          type: FileOrCreate
+        name: varlogetcd
+    status: {}
+Lifecycle: null
+Location: manifests/etcd/main.yaml
+Name: manifests-etcdmanager-main

pkg/model/components/etcdmanager/tests/proxy/tasks.yaml

@@ -109,10 +109,10 @@ Contents:
         volumeMounts:
         - mountPath: /rootfs
           name: rootfs
-        - mountPath: /etc/hosts
-          name: hosts
         - mountPath: /etc/kubernetes/pki/etcd-manager
           name: pki
+        - mountPath: /etc/hosts
+          name: hosts
         - mountPath: /var/log/etcd.log
           name: varlogetcd
       hostNetwork: true
@@ -126,14 +126,14 @@ Contents:
           path: /
           type: Directory
         name: rootfs
-      - hostPath:
-          path: /etc/hosts
-          type: File
-        name: hosts
       - hostPath:
           path: /etc/kubernetes/pki/etcd-manager-events
           type: DirectoryOrCreate
         name: pki
+      - hostPath:
+          path: /etc/hosts
+          type: File
+        name: hosts
       - hostPath:
           path: /var/log/etcd-events.log
           type: FileOrCreate
@@ -189,10 +189,10 @@ Contents:
         volumeMounts:
         - mountPath: /rootfs
           name: rootfs
-        - mountPath: /etc/hosts
-          name: hosts
         - mountPath: /etc/kubernetes/pki/etcd-manager
           name: pki
+        - mountPath: /etc/hosts
+          name: hosts
         - mountPath: /var/log/etcd.log
           name: varlogetcd
       hostNetwork: true
@@ -206,14 +206,14 @@ Contents:
           path: /
           type: Directory
         name: rootfs
-      - hostPath:
-          path: /etc/hosts
-          type: File
-        name: hosts
       - hostPath:
           path: /etc/kubernetes/pki/etcd-manager-main
           type: DirectoryOrCreate
         name: pki
+      - hostPath:
+          path: /etc/hosts
+          type: File
+        name: hosts
       - hostPath:
           path: /var/log/etcd.log
           type: FileOrCreate

pkg/model/context.go

@@ -374,6 +374,11 @@ func (m *KopsModelContext) IsKubernetesGTE(version string) bool {
 	return util.IsKubernetesGTE(version, m.KubernetesVersion())
 }
 
+// IsKubernetesLT checks if the kubernetes version is before the specified version, ignoring prereleases / patches
+func (m *KopsModelContext) IsKubernetesLT(version string) bool {
+	return !m.IsKubernetesGTE(version)
+}
+
 // WellKnownServiceIP returns a service ip with the service cidr
 func (m *KopsModelContext) WellKnownServiceIP(id int) (net.IP, error) {
 	return components.WellKnownServiceIP(&m.Cluster.Spec, id)