kube-apiserver doesn't expose the healthcheck via a dedicated
endpoint, instead relying on anonyomous-access being enabled. That
has previously forced us to enable the unauthenticated endpoint on
127.0.0.1:8080.
Instead we now run a small sidecar container, which
proxies /healthz and /readyz requests (only) adding appropriate
authentication using a client certificate.
This will also enable better load balancer checks in future, as these
have previously been hampered by the custom CA certificate.
Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
The rpm containerd 1.2.10 package depends on container-selinux, which
isn't available on amazonlinux2. We can't just skip it, because we
can't install the package without its dependencies.
Instead, install from a binary package (tar.gz).
We do the same for dockker 18.09.9 and 19.03.4, as these would
otherwise depend on containerd 1.2.10.
Co-authored-by: Ciprian Hacman <ciprianhacman@gmail.com>
This will automatically label PRs that touch these directories.
This makes it easier to query GitHub for PRs that affect certain areas of the code.
I mostly used existing labels but created some new ones as well.
0xCAFE4A11 is bigger than the max of int32, so doing int32(uint32(0xCAFE4A11))
(will not compile directly unless done over two lines) will result in 0x-3501b5ef.
For linux/amd64 "fsdata.Type" is an int64, while on darwin/amd64 it is
an uint32. This code is however not supposed to be compiled for darwin,
since it is linux spesific.
Due to some strange errors[0] in the types in "unix.Statfs_t" for 32 bits
systems on linux, we have to explicitly convert to uint to support those (eg.
armv7). If we only need support for 64 bit systems, we can remove the
uint conversion.
[0]: For 32bits systems "fsdata.Type" should be uint32 instead of the
current int32, as it is in the linux kernel. This is due to the types in
glibc that the go types are generated from. For 64 bit systems the type
is correctly set to int64.