Automatic merge from submit-queue.
Remove world read permissions on sensitive key files.
The key files pulled from S3 had world read permissions by default (644). This PR sets the permissions to 600 on `.key` and `.pem` files.
Docker 1.13 changed how it set up iptables in a way that broke
forwarding.
We previously got away with it because we set the ip_forward sysctl,
which meant that docker wouldn't change the rule. But if we're using an
image that preinstalled docker, docker might have already reconfigured
iptables before we run, and we didn't set it back.
We now set it back.
https://github.com/kubernetes/kubernetes/issues/40182
Recent versions of systemd (version 229 at least) included in Ubuntu
16.04 and Debian 9 require the systemd unit files to have a .service
extension.
Signed-off-by: Ali Rizwan <ari@hellofresh.com>
This lets us configure cross-project permissions while ourselves needing
minimal permissions, but also gives us a nice hook for future lockdown
of object-level permissions.
Automatic merge from submit-queue.
Allow disabling kube-proxy
This adds the ability to turn off kube-proxy.
My specific use case is the usage of a custom CNI.
Automatic merge from submit-queue.
Initial aggregation work
Create the keypairs, which are supposed to be signed by a different CA.
Set the `--requestheader-...` flags on apiserver.
Fix#3152Fix#2691
Automatic merge from submit-queue.
mounting kubectl from the host instead to installing in protokube
So this will fix our protokube kubectl versioning issue. Kubectl is in on host, if we are on a master, and is always the right version, so let's use it! Refactored a bit to get the distro path for kubectl. Need to test on gossip. Set the path on protokube and mounted kubectl in `/opt/kops/bin`.
/approve
TODO
- [ ] test gossip
Fixes https://github.com/kubernetes/kops/issues/3518
Automatic merge from submit-queue.
Enable logrotate for Kubernetes configs on CoreOS
Addresses #2710.
Also, remove logrotate crontab because logrotate ships with a systemd timer, `logrotate.timer`, to run logrotate daily.
Automatic merge from submit-queue.
Map docker 1.13.1 & 17.03.1, default 1.8 to 1.13.1
Kubernetes 1.8 adds validation for 1.13.1 and 17.03.1 (17.03.1 being
essentially the same as 1.13.1).
For 1.8, the default should be 1.13.1
Kubernetes Submit Queue