Add cluster.Spec.Containerd.SELinuxEnabled field that enables SELinux in
containerd.
With SELinux enabled, all pods that use HostPath volumes must run with
SELinux label `spc_t`, otherwise SELinux denies the pods to touch the host
filesystem.
This means that the object is not mutated after construction, making
it easier to do validity checks (such as whether we have mounted the
same path twice).
We identify the external manifests by checking for our labels.
Currently that label is kOps specific, and we'll likely have to evolve
that to something ecosystem-netural.
We only support the GCE CCM addon and the kopeio-networking addon at
first.
For the GCE CCM addon, we need to replace the arguments, in particular
we likely need the Pod CIDR. Here we need to work with the GCE CCM to
find a mechanism that can allow some of these flags to be communicated
via a more extensible mechanism (env vars or config maps, likely,
though possibly CRDs).
This is all behind the ClusterAddons feature flag at the moment, so we
can figure this out with other projects safely.
Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
A number of projects need a library for applying objects. While we
are figuring out exactly what functionality is needed, we are using a
copy-and-paste approach.
Introduce applylib here also, and add the create-or-update
functionality that we want here.
We generate a kube-scheduler configuration file in the kops CLI, and
nodeup will use it if provided (instead of generating one).
We put the configuration file into the fileAssets.
Users can provide a kube-scheduler configuration in additional
objects, and this will be used as the base configuration (we add the
kubeconfig path).
Issue #13352
Co-authored-by: Ciprian Hacman <ciprian@hakman.dev>
Adding support for the kopeio-networking addon.
We load the operator manifest (which changes rarely) from the channels
directory for now. We follow the same structure as operators
themselves use so that we can support other backends in future.
The channels file includes the current versions of the operators.
During cluster creation, we create these additional objects.
We let the addon specify exactly what should be pruned; this approach
is a little more verbose but we're likely generating this
automatically in the common case anyway.
In return for the verbosity, we can likely handle more future cases
and edge cases (for example removing objects that aren't labelled or
are in the wrong namespace).
Hidden behind a feature-flag, but when the UseAddonOperators feature
flag is set, we now use the cluster-addons CoreDNS operator instead of
our built-in manifests.
This should be much easier to start and to get under testing; it only
works with a load balancer, it sets the apiserver into anonymous-auth
allowed, it grants the anonymous auth user permission to read our jwks
tokens. But it shouldn't need a second bucket or anything of that
nature.
Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
We will be managing cluster addons using CRDs, and so we want to be
able to apply arbitrary objects as part of cluster bringup.
Start by allowing (behind a feature-flag) for arbitrary objects to be
specified.
Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
In our kube-dns manifest for 1.6 we often had an empty section,
normalization converted this to `{}` which causes `kubectl apply` to
fail.
We can simply skip empty objects when outputing.
We don't call klog.InitFlags yet, because that will cause a flag
redefinition error until we get everyone to stop using glog. That
will happen when we update to k8s 1.13.
When try `make govet` on `go1.11beta1`. It complains many things
related to invalid string formatting:
```
pkg/kubemanifest/visitor.go:35: Verbose.Infof format %s has arg v of wrong type bool
pkg/kubemanifest/visitor.go:40: Verbose.Infof format %s has arg v of wrong type float64
upup/pkg/fi/cloudup/alitasks/disk.go:76: Verbose.Info call has possible formatting directive %q
upup/pkg/fi/cloudup/alitasks/disk.go:91: Verbose.Info call has possible formatting directive %q
upup/pkg/fi/cloudup/alitasks/launchconfiguration.go:89: Verbose.Info call has possible formatting directive %q
upup/pkg/fi/cloudup/alitasks/loadbalancer.go:71: Verbose.Info call has possible formatting directive %q
upup/pkg/fi/cloudup/alitasks/loadbalancer.go:125: Verbose.Info call has possible formatting directive %q
upup/pkg/fi/cloudup/alitasks/scalinggroup.go:71: Verbose.Info call has possible formatting directive %q
dns-controller/pkg/dns/dnscontroller.go:603: Verbose.Infof format %s has arg records of wrong type []dns.Record
dns-controller/cmd/dns-controller/main.go:184: Verbose.Info call has possible formatting directive %q
pkg/acls/s3/storage.go:62: Verbose.Infof format %q arg u.String is a func value, not called
pkg/apis/kops/validation/validation_test.go:199: T.Fatalf format %q has arg config of wrong type *k8s.io/kops/pkg/apis/kops.DockerConfig
pkg/resources/aws/aws.go:1306: Warning call has possible formatting directive %q
pkg/resources/aws/aws.go:1313: Warning call has possible formatting directive %v
upup/pkg/fi/cloudup/aliup/ali_cloud.go:218: Verbose.Info call has possible formatting directive %q
upup/pkg/fi/cloudup/aliup/ali_cloud.go:290: Verbose.Info call has possible formatting directive %q
upup/pkg/fi/fitasks/keypair.go:266: Errorf format %q has arg e.Name of wrong type *string
upup/pkg/fi/files_owner.go:56: Infof format %s has arg group of wrong type *fi.Group
upup/pkg/fi/users.go:57: Warning call has possible formatting directive %q
upup/pkg/fi/users.go:63: Warning call has possible formatting directive %q
upup/pkg/fi/users.go:68: Warning call has possible formatting directive %q
upup/pkg/fi/users.go:129: Warning call has possible formatting directive %q
upup/pkg/fi/users.go:135: Warning call has possible formatting directive %q
upup/pkg/fi/nodeup/nodetasks/file.go:313: Errorf format %q has arg e.Mode of wrong type *string
upup/pkg/fi/cloudup/awsup/aws_cloud.go:1021: Warningf format %q reads arg #2, but call has 1 arg
upup/pkg/fi/cloudup/awsup/aws_cloud.go:1025: Warningf format %q reads arg #2, but call has 1 arg
```
Ciprian Hacman