Commit Graph

702 Commits

Author SHA1 Message Date
justinsb 0c696d41d3 Create supporting services in kops-controller for gossip-mode
The intent is that we can then expose these via CoreDNS, so that
internal name resolution will work.
2021-11-19 11:02:10 -05:00
Kubernetes Prow Robot ec9c277259
Merge pull request #12783 from olemarkus/bump-nodelocaldns-23
Bump node local dns cache
2021-11-18 16:58:51 -08:00
Ole Markus With 3983017ac6 Bump node local dns cache 2021-11-18 20:51:37 +01:00
justinsb 7995e8cc28 Update test data for etcd-manager bump 2021-11-18 11:49:14 -05:00
justinsb e2922a257d Bump etcd-manager version 2021-11-18 11:49:14 -05:00
Ciprian Hacman 6a60823b34 Update containerd to v1.4.12 2021-11-18 07:56:26 +02:00
Ciprian Hacman 1620e6a8e1 Update containerd to v1.6.0-beta.2 2021-11-14 09:39:36 +02:00
John Gardiner Myers 46e226d1ee Revert "Migrate to AWS CCM in k8s 1.24"
This reverts commit 56c054cda7.
2021-11-12 22:07:18 -08:00
John Gardiner Myers 56c054cda7 Migrate to AWS CCM in k8s 1.24 2021-11-02 23:08:03 -07:00
Ciprian Hacman 6ca361355d Set cloud provider for external CCM 2021-11-01 16:31:20 +02:00
John Gardiner Myers 3a97dbaa8d Release 1.23.0-alpha.2 2021-10-31 13:46:07 -07:00
Ciprian Hacman 76898881cb Use prefixes for IPv6 with Calico 2021-10-30 20:57:40 +03:00
Peter Rifel c734f5c08d
Update IAMBuilder to include the current partition in ARNs 2021-10-29 23:07:31 -05:00
John Gardiner Myers 7cb4fbe91e Never masquerade IPv6 with Cilium 2021-10-27 23:40:02 -07:00
John Gardiner Myers fdc128fda4 Remove vestigial Cilium ContainerRuntimeLabels code 2021-10-26 16:10:21 -07:00
Kubernetes Prow Robot f8ba8b11f7
Merge pull request #12437 from olemarkus/cas-delay
Make it possible to set CAS max-node-provision-time
2021-10-22 09:34:38 -07:00
Ole Markus With 11e68308d1 Disable CNP status updates by default 2021-10-20 14:01:48 +02:00
Ole Markus With 258fd4f9d9 Make it possible to set CAS max-node-provision-time 2021-10-20 13:53:37 +02:00
Peter Rifel 99c0778106
Upgrade EBS CSI driver to v1.4.0 2021-10-12 14:44:02 -07:00
Ciprian Hacman efe21a8d1b Run hack/update-expected.sh 2021-10-07 13:25:37 +03:00
Ciprian Hacman 78f136705e Update etcd-manager to 3.0.20211007 2021-10-07 13:25:37 +03:00
Ciprian Hacman 4c8f887547 Update Docker to v20.10.9 2021-10-04 22:25:15 +03:00
Ciprian Hacman af861a8e61 Update containerd to v1.4.11 2021-10-04 20:20:29 +03:00
John Gardiner Myers 3a346cdc37 Remove unnecessary code 2021-10-02 21:46:17 -07:00
John Gardiner Myers 0fd4dca30e Remove dead code 2021-10-02 20:58:55 -07:00
Ole Markus With 8eef72d8e8 Bump CAS images 2021-10-02 09:13:22 +02:00
Ciprian Hacman 1ddc11f0a6 Update containerd to v1.4.10 2021-10-02 07:03:59 +03:00
Peter Rifel 88ddff3baf
Use separate cloud.config files for in-tree vs out-of-tree components 2021-09-30 09:20:33 -05:00
Kubernetes Prow Robot ef22270b3f
Merge pull request #12394 from ReillyBrogan/reilly/ciliumBidirectionalMount
Add bidirectional BPF mount for Cilium >= 1.9.10 or >= 1.10.4
2021-09-25 09:42:21 -07:00
Reilly Brogan 9c6bf83c93 Update Cilium to 1.10.4
- Release notes available [here](https://github.com/cilium/cilium/releases/tag/v1.10.4)
2021-09-23 13:08:57 -05:00
Peter Rifel ca044455a3
Remove critical-pod scheduler annotation.
This is no longer recognized in all supported k8s versions (1.16+)

ea07644522/CHANGELOG/CHANGELOG-1.16.md (deprecations-and-removals)
2021-09-22 21:14:50 -05:00
justinsb 345f3d85f1 Fix controller defaults for both bootstrap tokens and ipv6
The previous logic would override the controller slice in each
condition, instead of building it up.
2021-09-18 13:12:26 -04:00
Ole Markus With dc4c559d41 Set some needed defaults for cloud ipam 2021-09-16 21:11:09 +02:00
Ole Markus With 384b9796f7 Don't set cluster ip if we use cloud ipam 2021-09-16 19:26:48 +02:00
Kubernetes Prow Robot 3fd7b446c0
Merge pull request #12305 from hakman/node_ip_families
Make AWS CCM NodeIPFamilies configurable
2021-09-12 06:26:14 -07:00
Kubernetes Prow Robot 2e3ca721a5
Merge pull request #12291 from hakman/aws-ccm-1.22.0-alpha.0
Default to latest staging image for AWS CCM
2021-09-12 06:26:07 -07:00
Kubernetes Prow Robot 1b431b4c9c
Merge pull request #11628 from olemarkus/gpu-runtime
Pre-install nvidia container runtime + drivers on GPU instances
2021-09-11 13:00:07 -07:00
Ciprian Hacman cf8b11b0d4 Default to latest staging image for AWS CCM 2021-09-11 18:38:24 +03:00
Ole Markus With bba3c3abfe Bump aws ebs csi driver to 1.2.1 2021-09-11 14:15:31 +02:00
Ciprian Hacman dde08e839d Make AWS CCM NodeIPFamilies configurable 2021-09-11 13:09:08 +03:00
Peter Rifel 0d13da839a
Use MasterInternalName for gossip cluster SA issuer
This reverts a change introduced earlier in 1.22 that resulted in existing service account tokens becoming invalid after a kops upgrade.
2021-09-10 14:40:07 -04:00
Kubernetes Prow Robot 5a917b5186
Merge pull request #12104 from rifelpet/ccm-tag
Update AWS CCM tags
2021-09-09 02:54:11 -07:00
Peter Rifel 6a53285ffe
Move AWS CCM image logic into pkg/model and add 1.21 and 1.22 images 2021-09-08 20:56:39 -05:00
Simone Sciarrati 6773fdf495 option to omit --cluster-cidr from kubeproxy config 2021-09-08 14:46:06 +02:00
Ole Markus With f5fed2a08d Move nvidia config under containerd 2021-09-05 20:28:07 +02:00
Ole Markus With 2d013e460c Install nvidia container runtime 2021-09-05 20:09:04 +02:00
Ole Markus With c390d45f76 Set ipv6 nameservers on aws
AWS now provides ipv6 DNS server endpoint at a fixed address (rather than ipv4, which depends on the VPC CIDR block). This isn't provided in dhcp, and anyways we want to ensure we use this endpoint in ipv6 mode and not have ipv4 in the mix.
2021-09-03 09:47:37 +02:00
Kubernetes Prow Robot c7eb08c76f
Merge pull request #12193 from olemarkus/protect-kernel-defaults
Enable protect-kernel-defaults by default and set the correct sysctls in nodeup
2021-09-02 04:42:09 -07:00
dntosas f558f2441a
[addons/nodelocaldns] Bump image to latest stable v1.20.0
As per
 3b17e06879,
 node-local-dns addon is now builded with latest coreDNS base v1.8 and
 that brings great consistency between cache and upstream servers in a
 manner of configuration, metrics name convention, etc.

 So in this commit, we bump node-local-dns image to latest v1.20.0 which
 is build upon latest coreDNS and also add support for overriding this
 field.

Signed-off-by: dntosas <ntosas@gmail.com>
2021-08-31 14:07:19 +03:00
John Gardiner Myers be8933b577 Remove code for unsupported features 2021-08-28 13:49:55 -07:00
John Gardiner Myers f041bdafdc More kops 1.23 updates 2021-08-28 11:54:39 -07:00
John Gardiner Myers 1ea4168cab Release 1.23.0-alpha.1 2021-08-27 21:12:45 -07:00
Ole Markus With b3982e1033 Apply suggestions from code review
Co-authored-by: Peter Rifel <rifelpet@users.noreply.github.com>
2021-08-27 06:45:50 +02:00
Ole Markus With 0152c23c1e Remove externaldns feature flag 2021-08-27 06:30:01 +02:00
Ole Markus With 41c3ff2aac Make external dns provider configurable 2021-08-27 06:28:02 +02:00
Ole Markus With 4ef0172ee9 Enable protect-kernel-defaults by default and set the correct sysctls in nodeup 2021-08-23 11:48:20 +02:00
Amit Prasad 48fa73f3bb Add option in Cluster Autoscaler AddOn for AWS EC2 Static instance list 2021-08-21 22:44:31 +05:30
Ole Markus With 83d818705e Don't set encryption type if encryption is disabled 2021-08-16 14:08:59 +02:00
Ole Markus With 7534890b3a Use enum for cilium encryption types 2021-08-16 14:08:59 +02:00
dntosas 0e8d189aee [cilium] Add support for encryption via WireGuard
In this commit, we enable users to choose WireGuard as their prefered
encryption type, leveraging this new feature from Cilium.

Ref: https://cilium.io/blog/2021/05/20/cilium-110#wireguard

Signed-off-by: dntosas <ntosas@gmail.com>
2021-08-16 14:08:59 +02:00
Ole Markus With caf46fef6a Bump AWS CSI Driver to 1.2.0 2021-08-13 11:14:05 +02:00
Ole Markus With 133eb1f7ba Bump cilium to 1.10.3 2021-08-12 21:12:25 +02:00
Ole Markus With 4e589431d5 Bump CAS for 1.22 2021-08-11 09:55:03 +02:00
Ole Markus With 0439bb0d76 Remove UseServiceAccountIAM feature flag and rename feature to UseServiceAccountExternalPermissions 2021-08-07 21:20:03 +02:00
Ole Markus With ce86d851aa IRSA support for CCM
Update pkg/model/components/addonmanifests/awscloudcontroller/iam.go

Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
2021-08-07 10:27:36 +02:00
Ole Markus With 2042912a5b Remap IRSA for DaemonSets too 2021-08-07 07:41:47 +02:00
Kubernetes Prow Robot 3a293781a6
Merge pull request #11784 from ederst/add-os-config-drive
Launch Openstack instances with config drive
2021-08-04 00:49:24 -07:00
Kubernetes Prow Robot 3ee3e30267
Merge pull request #12096 from hakman/docker-20.10.8
Update Docker to v20.10.8
2021-08-03 21:39:24 -07:00
Ciprian Hacman 92ab49cdfb Update Docker to v20.10.8 2021-08-04 06:19:43 +03:00
Cheyi Lin 408bb7dfbe Add nth rebalance recommendation configs 2021-08-02 16:20:17 +08:00
Ciprian Hacman 541d328812 Update containerd to v1.4.9 2021-07-30 07:30:42 +03:00
Ciprian Hacman b6464658d4 Update containerd to v1.4.8 2021-07-29 05:27:10 +03:00
Ole Markus With 28bd45a8fa Add irsa support for nth 2021-07-19 15:12:35 +02:00
Ciprian Hacman 4d7ebd343c
Release 1.22.0-alpha.2 (#12012) 2021-07-17 21:42:51 -07:00
Ole Markus With f0390eda29 Dedicated function for ccm permissons
Update pkg/model/iam/iam_builder.go

Co-authored-by: Peter Rifel <rifelpet@users.noreply.github.com>
2021-07-16 19:39:57 +02:00
John Gardiner Myers d58a19e1bd Refactor service-account signing key 2021-07-10 17:31:59 -07:00
Ciprian Hacman fd08e2b047 Run hack/update-expected.sh 2021-07-08 22:12:12 +03:00
Ciprian Hacman 1e41439e36 Use etcd v3.5.0 for Kubernetes 1.22+ 2021-07-08 22:09:22 +03:00
Kubernetes Prow Robot cf834ce5fc
Merge pull request #11843 from olemarkus/reduce-policy-size-further
Reduce policy size further
2021-07-03 17:58:18 -07:00
Peter Rifel c5fbcccfa6
Update pause image to 3.5 2021-07-02 06:40:27 -04:00
John Gardiner Myers 186aaf6d96 hack/update-expected.sh 2021-07-01 14:45:32 -07:00
John Gardiner Myers 7162a7473a Remove dead code 2021-07-01 13:58:51 -07:00
Kubernetes Prow Robot 19ffc06d3d
Merge pull request #11853 from johngmyers/override-issuer
Allow overriding the ServiceAccountIssuer for IRSA
2021-07-01 04:43:54 -07:00
Ole Markus With aad2912710 Add sets for the remaining addons 2021-07-01 10:37:57 +02:00
Ole Markus With df5b58b1b3 Add sets for the typical default role perms 2021-07-01 10:28:01 +02:00
Ole Markus With 37271998e1 Use sets for aws lbc permissions 2021-07-01 10:19:40 +02:00
Ole Markus With 19833e6b73 Use sets for ebscsidriver permissions 2021-07-01 09:02:04 +02:00
Ole Markus With d8bf4dcae1 NewPolicy function for instantiating policy struct 2021-07-01 08:39:43 +02:00
John Gardiner Myers 2faf28379a Refactor etcd-client-cilium secrets 2021-06-25 23:57:23 -07:00
John Gardiner Myers 24d1706848 Allow overriding the ServiceAccountIssuer for IRSA 2021-06-25 18:33:07 -07:00
Ciprian Hacman 2f3bad686a Remove version from addons 2021-06-25 19:25:01 +03:00
Kubernetes Prow Robot 89ad2bc453
Merge pull request #11810 from hakman/ipv6_disable_calico_awssrcdstcheck
Enable cross-subnet mode with Calico by default
2021-06-25 01:08:45 -07:00
Ciprian Hacman a12b3145ee Enable cross-subnet mode with Calico by default 2021-06-25 07:13:20 +03:00
Ole Markus With 14fb35d0d0 Bump EBS Driver to 1.1.0 2021-06-21 08:56:11 +02:00
Ole Markus With b37bc7578e Reduce master policy size for lb controller 2021-06-19 10:12:22 +02:00
Ole Markus With 33a7de60a7 Enable IRSA for EBS CSI Driver 2021-06-18 08:05:59 +02:00
Ole Markus With 7b850555eb Don't add volume multiple times to a pod 2021-06-18 07:31:33 +02:00
Kubernetes Prow Robot 7ec956dd00
Merge pull request #11748 from olemarkus/irsa-cas
Enable ability to use IRSA for cluster autoscaler
2021-06-17 21:00:05 -07:00
Kubernetes Prow Robot 559b57ea4c
Merge pull request #11381 from dntosas/addons-add-npd
[addons] Introduce NodeProblemDetector
2021-06-17 00:58:19 -07:00
Kubernetes Prow Robot d35bce0ff8
Merge pull request #11764 from olemarkus/cilium-etcd-fix
Don't try to build etcd-manager secrets for cilium twice
2021-06-17 00:14:20 -07:00
dntosas 20124d3ba9
[addons] Introduce NodeProblemDetector
Node Problem Detector aims to make various node problems visible to
the upstream layers in the cluster management stack. It is a daemon
that runs on each node, detects node problems and reports them to apiserver
so to avoid scheduling new pods on bad nodes and also easily identify
which are the problems on underlying nodes.

Project Home: https://github.com/kubernetes/node-problem-detector

Signed-off-by: dntosas <ntosas@gmail.com>
2021-06-16 21:00:22 +03:00
Ole Markus With 6e8e027aff Enable IRSA for Cluster Autoscaler 2021-06-16 18:03:11 +02:00
ederst bb59f762a1 Add config drive option for Openstack instances
This enables to use config drives instead of the metadata service as a
source for the user data (cloudinit).
2021-06-16 13:32:50 +02:00
Kubernetes Prow Robot 84a730c9d6
Merge pull request #11678 from dntosas/safe-cilium
[cni/cilium] Add support for additional config options
2021-06-16 02:47:58 -07:00
dntosas 7bf65ff7ef
[cni/cilium] Add support for additional config options
In this commit, we enable users define their setup with following
additional fields:

- DisableEndpointCRD
- EnableEndpointHealthChecking
- IdentityAllocationMode
- IdentityChangeGracePeriod
- BPFLBAlgorithm
- BPFLBMaglevTableSize
- BPFNATGlobalMax
- BPFNeighGlobalMax
- BPFPolicyMapMax
- EnableBPFMasquerade
- EnableL7Proxy

Added also validation tests to prevent conflicting value combinations to
reach actual cluster state.

Signed-off-by: dntosas <ntosas@gmail.com>
Co-authored-by: hwoarang <markos@chandras.me>
Signed-off-by: dntosas <ntosas@gmail.com>
2021-06-16 09:35:42 +03:00
Ole Markus With f80b550c7a Use internal name for cilium etcd if we do not enable api server nodes 2021-06-16 08:27:26 +02:00
Kubernetes Prow Robot 847040de53
Merge pull request #11750 from olemarkus/containerd-per-ig
Set containerd config on nodeup.Config instead of clusterspec
2021-06-15 15:13:43 -07:00
Ole Markus With e7fa3fa82c Set containerd config on nodeup.Config instead of clusterspec
This allows us to set a default containerd config per IG (e.g add a different config for GPU IGs)

Can also be considered a cleanup as we no longer use containerd.overrideConfig as a mechanism for bringing the default containerd config from cloudup to nodeup.
2021-06-15 11:08:22 +02:00
John Gardiner Myers 2f71fb2cf4 Default the NodeCIDRMaskSize appropriately for IPv6 2021-06-14 20:43:09 -07:00
Kubernetes Prow Robot 392b517fda
Merge pull request #11756 from johngmyers/pod-cidr
Set default ClusterCIDR through the PodCIDR
2021-06-14 02:37:04 -07:00
John Gardiner Myers 51d0697dc3 Set default ClusterCIDR through the PodCIDR 2021-06-13 22:46:32 -07:00
John Gardiner Myers 0b7f6e3082 Remove dead code 2021-06-13 21:37:01 -07:00
John Gardiner Myers 3cf8234d01 Cilium: disable masquerade by default when in ENI IPAM mode 2021-06-13 21:36:56 -07:00
John Gardiner Myers fc9ec13bb7 Set BindAddress appropriately when in IPv6-only mode 2021-06-13 09:41:19 -07:00
Ole Markus With 6582235312 Make AWS EBS CSI Driver default as of k8s 1.22 2021-06-08 22:29:16 +02:00
Ciprian Hacman 47bb825061 Generate AWSEBSCSIDriver model only when using AWS 2021-06-08 08:20:21 +03:00
John Gardiner Myers e0915887ed Move asset copying out of apply_cluster 2021-06-05 21:17:50 -07:00
John Gardiner Myers fc4f0888ac hack/update-expected.sh 2021-06-02 23:02:17 -07:00
John Gardiner Myers 7c9e7e9286 Make Lifecycle field non-pointer 2021-06-02 23:02:16 -07:00
Ole Markus With 553fdd5840 Bump default cilium to 1.10 2021-06-01 08:12:20 +02:00
Ole Markus With 2d643fff11 Don't set the master address for aws ccm
Use the kubernetes.default service for now. Ideally we would not rely on this as this in turn relies on CNI. But fixing this means also fixing PKI, so we have to revisit this later
2021-05-23 22:24:31 +02:00
Ole Markus With 3d90769e1c Set flags on AWS CCM mimicking KCM 2021-05-22 14:15:53 +02:00
Ole Markus With 5869d4e6d4 Bump default cilium to 1.9.7 2021-05-21 18:54:03 +02:00
Ole Markus With 46e13c0009 Bump snapshot-controller version
Update upup/models/cloudup/resources/addons/storage-aws.addons.k8s.io/v1.15.0.yaml.template

Co-authored-by: Peter Rifel <rifelpet@users.noreply.github.com>

Update upup/models/cloudup/resources/addons/storage-aws.addons.k8s.io/v1.15.0.yaml.template

Co-authored-by: Peter Rifel <rifelpet@users.noreply.github.com>
2021-05-21 15:40:40 +02:00
Alexander Block bb52334222 Make the events etcd cluster optional 2021-05-20 08:05:42 +02:00
Ciprian Hacman 6e6a224f9d Update containerd to v1.4.6 2021-05-19 20:27:28 +03:00
Ole Markus With 103e3f3b7e Add support for CAS 1.21.0 2021-05-12 08:10:36 +02:00
Kubernetes Prow Robot 7db45cb5fa
Merge pull request #11418 from dntosas/aws-csi-ga-release
[addons/awscsidriver] Bump to GA release
2021-05-08 02:46:47 -07:00
dntosas f8ece50a96
[addons/awscsidriver] Bump to GA release
Bump version and manifests of AWS EBS CSI Driver to the first GA
release.

Signed-off-by: dntosas <ntosas@gmail.com>
2021-05-08 11:47:43 +03:00
John Gardiner Myers 36f93d0069 hack/update-expected.sh 2021-05-07 23:40:03 -07:00
John Gardiner Myers d3469d6ec2 Remove code for no-longer-supported k8s versions 2021-05-07 23:40:03 -07:00
Ciprian Hacman 305e4bbe99 Use etcd-backup built from etcdadm repo 2021-05-08 07:11:21 +03:00
Justin SB c1dd7e7698 Use etcd-manager built from etcdadm repo
We can now use etcd-manager as built from the kubernetes-sigs/etcdadm
repo.
2021-05-08 07:11:21 +03:00
John Gardiner Myers 3aa8d40052 Release 1.22.0-alpha.1 2021-05-07 13:45:35 -07:00
John Gardiner Myers 8823f30ad7 Recognize the ServiceAccountIssuerDiscovery featue gate 2021-05-06 08:57:37 -07:00
Kubernetes Prow Robot a04d787d81
Merge pull request #11392 from olemarkus/guard-sa-remap
Don't add IRSA env vars if feature flag is not enabled
2021-05-06 03:57:16 -07:00
Ole Markus With 5d4f6e6dee Don't add IRSA env vars if feature flag is not enabled 2021-05-06 11:18:07 +02:00
John Gardiner Myers d21cb0f306 Use consistent ServiceAccountJWKSURI default for PublicJWKS 2021-05-06 00:15:15 -07:00
Ole Markus With aadcd9d448 Add more support for cilium 1.10 2021-05-03 16:10:56 +02:00
Ciprian Hacman 689b76d0ff Mark control-plane node for update when etcd manager config changes 2021-05-02 08:50:42 +03:00
dntosas 7e20f87822
[addons/nth] Add capability to define resources
Node termination handler as all daemonSets may play a critical role in
capacity planning, define resource policy for chosing instanceType etc.

In this commit, we enable users to define resources themselves to meet
their needs and also removed limits to convey with the chosen strategy
to avoid limits on such components.

Signed-off-by: dntosas <ntosas@gmail.com>
2021-04-30 14:13:11 +03:00
Ciprian Hacman 75047c6513 Mount /run inside etcd-manager pods for systemd mounts 2021-04-29 10:15:58 +03:00
Ole Markus With 01ccf4590f Bump cilium to 1.9.6 2021-04-28 10:06:13 +02:00
dntosas af6d4d585f
[csi/aws] Bump templates to latest stable version …
- Update manifests
- Bump components version
- Add API capability of setting Version + VolumeLimit
- Remove snapshot-controller resources as it should be independent from
any CSI driver

Signed-off-by: dntosas <ntosas@gmail.com>
2021-04-25 16:45:15 +03:00
Jason Haugen 36722afb0f change casing Asg->ASG 2021-04-22 13:07:01 -05:00
Jason Haugen 7e48dad4d2 add ManagedAsgTag, merge templates, improve docs 2021-04-19 16:51:08 -05:00
Jason Haugen 10df4a9a14 integ tests 2021-04-19 15:43:05 -05:00
Jason Haugen d07b067249 Add NTH queue-processor mode 2021-04-19 15:43:05 -05:00
Kubernetes Prow Robot 146f9b4cbb
Merge pull request #11248 from dntosas/cilium-resources
[cilium] Add support for choosing resources
2021-04-19 10:23:45 -07:00
dntosas 55524935d7
[cilium] Add support for choosing resources
Cilium as a CNI is a critical component for the cluster so it would be safe
to have some guaranteed resources as well as allowing the users to
define them based on their needs.

In this commit, we init default requested resources and add the
capability of user-defined values.

Signed-off-by: dntosas <ntosas@gmail.com>
2021-04-19 11:30:02 +03:00