Commit Graph

4712 Commits

Author SHA1 Message Date
Kubernetes Prow Robot 446aea1d62
Merge pull request #12188 from olemarkus/kubelet-ip-altnames
Add ip addresses into kubelet certs
2021-08-26 21:09:00 -07:00
Ole Markus With ad16042a1f Add IPs to kubelet server cert
Since AWS does not resolve instance hostnames to ipv6, ipv6-only pods that talk to kubelet API has to use node IP, not hostname. Thus we need to add IPs to kubelet server cert.
2021-08-26 20:54:02 +02:00
Kubernetes Prow Robot bb38a3e52e
Merge pull request #12067 from h3poteto/iss-11608
Support AWS LB access log configuration in cluster spec
2021-08-25 16:51:23 -07:00
AkiraFukushima 73f7307844
Add AccessLog attribute to CloudFormation and Terraform renderer 2021-08-25 22:55:53 +09:00
dntosas 075fd29f20
[addons/metrics-server] Bump minor version
Updating image and manifest to latest stable version.

Signed-off-by: dntosas <ntosas@gmail.com>
2021-08-24 11:00:29 +03:00
Peter Rifel bf20cef86f
Add terraform outputs OIDC provider ARN and issuer
These fields are valuable because their fields are used in the assume role policies of service account IAM roles, based on the docs here:

https://docs.aws.amazon.com/eks/latest/userguide/create-service-account-iam-policy-and-role.html#aws-cli
2021-08-23 21:48:59 -05:00
Justin SB 0722124e8e Initial IPv6 support for GCE
Supporting IPv6 values where they can be set by the user, and ensuring
that IPv4 and IPv6 firewall rules are split because on GCP they cannot
be in the same rule.
2021-08-21 20:09:31 -04:00
Kubernetes Prow Robot 022452a61b
Merge pull request #12189 from olemarkus/bump-cm-2211
Bump cert-manager to 1.5.2
2021-08-21 13:49:59 -07:00
Ole Markus With 11ffa653cb Bump cert-manager to 1.5.2 2021-08-21 21:12:23 +02:00
Amit Prasad 48fa73f3bb Add option in Cluster Autoscaler AddOn for AWS EC2 Static instance list 2021-08-21 22:44:31 +05:30
Kubernetes Prow Robot ecb85a207a
Merge pull request #12173 from srikiz/DO-Fix-DNSProvider-Interface-Package
[DigitalOcean] Code refactor to use the existing dnsprovider package
2021-08-18 22:53:24 -07:00
Kubernetes Prow Robot 181f278218
Merge pull request #12176 from olemarkus/bump-snapshot-controller-22
Bump snapshot-controller
2021-08-18 14:19:45 -07:00
Ole Markus With 7f4066a909 Bump snapshot-controller 2021-08-18 20:39:16 +02:00
Ole Markus With 2288900ae6 Bump cert-manager to 1.5.1 2021-08-18 20:34:05 +02:00
Kubernetes Prow Robot be493f1788
Merge pull request #12158 from olemarkus/cilium-wireguard-support
Cilium wireguard support
2021-08-16 23:18:00 -07:00
Reilly Brogan 1b59233c8e Debian 11: Release AMIs use same AWS Owner ID as Buster 2021-08-16 12:06:36 -05:00
Ole Markus With 890187d822 Only ipsec requires ciliumpassword 2021-08-16 14:08:59 +02:00
dntosas 0e8d189aee [cilium] Add support for encryption via WireGuard
In this commit, we enable users to choose WireGuard as their prefered
encryption type, leveraging this new feature from Cilium.

Ref: https://cilium.io/blog/2021/05/20/cilium-110#wireguard

Signed-off-by: dntosas <ntosas@gmail.com>
2021-08-16 14:08:59 +02:00
Kubernetes Prow Robot 3afe121a29
Merge pull request #12148 from olemarkus/reconcile-public
Reconcile if managedFile is public or not
2021-08-13 12:15:32 -07:00
Ole Markus With 67b4024694 Reconcile if managedFile is public or not 2021-08-13 20:20:44 +02:00
Antonio Ojea f61a5d79ab leverage proxy env variables 2021-08-13 19:27:17 +02:00
Ole Markus With caf46fef6a Bump AWS CSI Driver to 1.2.0 2021-08-13 11:14:05 +02:00
Kubernetes Prow Robot b1e6064501
Merge pull request #12141 from olemarkus/cilium-bump-211
Bump cilium to 1.10.3
2021-08-12 13:11:50 -07:00
Ole Markus With 133eb1f7ba Bump cilium to 1.10.3 2021-08-12 21:12:25 +02:00
Ole Markus With 57bd06b281 Bump Cert Manager for 1.22 2021-08-12 08:36:22 +02:00
srikiz 41439109a8 Fix DNS Provider package for DO 2021-08-12 00:01:50 +05:30
Kubernetes Prow Robot 4a0fa2d108
Merge pull request #12122 from mitch000001/openstack-port-metadata
Openstack: add port metadata
2021-08-10 12:48:39 -07:00
Mike Splain 03a2557252 Fix cases when the VPC doesn't exist yet 2021-08-09 15:42:41 -04:00
Michael Wagner 99330549e4 feat(openstack): enrich ports with more metadata
The overall goal is to get rid of the specific port names and replace
them with hashed ones. This in turn allows us to introduce rolling
updates for Openstack in a later stage.
2021-08-09 08:49:12 +02:00
Kubernetes Prow Robot e7b52981ab
Merge pull request #12119 from rifelpet/dns-controller-api
Update dns-controller to use networking.k8s.io/v1 Ingress API
2021-08-08 15:11:30 -07:00
Peter Rifel 95aa8953a2
./hack/update-expected.sh 2021-08-08 16:24:49 -04:00
Peter Rifel b193d2d583
Update addon manifests referencing RBAC v1beta1 2021-08-08 16:12:39 -04:00
Peter Rifel 0789a5ad9c
./hack/update-expected.sh 2021-08-08 15:54:27 -04:00
Peter Rifel 7c2112b32d
Update dns-controller to use networking.k8s.io/v1 for watching Ingresses 2021-08-08 15:54:27 -04:00
Kubernetes Prow Robot b858297fa4
Merge pull request #12114 from olemarkus/metrics-server-secure-not-insecure
Make metrics-server insecure if insecure is true
2021-08-07 15:13:36 -07:00
Kubernetes Prow Robot 64f00d71ae
Merge pull request #12109 from olemarkus/useserviceaccountexternalpermissions
Remove UseServiceAccountIAM feature flag and rename feature to UseServiceAccountExternalPermissions
2021-08-07 15:13:30 -07:00
Kubernetes Prow Robot a9a5865032
Merge pull request #12111 from rifelpet/os-lb-vipacl
In-line openstack loadbalancer feature detection
2021-08-07 12:31:29 -07:00
Ole Markus With 0439bb0d76 Remove UseServiceAccountIAM feature flag and rename feature to UseServiceAccountExternalPermissions 2021-08-07 21:20:03 +02:00
Ole Markus With 612be4b1fc Make metrics-server insecure if insecure is true
Also add tests for each variation to make sure this sticks
2021-08-07 20:44:50 +02:00
Ole Markus With ce86d851aa IRSA support for CCM
Update pkg/model/components/addonmanifests/awscloudcontroller/iam.go

Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
2021-08-07 10:27:36 +02:00
Kubernetes Prow Robot 76727cb4a0
Merge pull request #12108 from ReillyBrogan/debian11
Support Debian 11 Bullseye
2021-08-06 15:45:29 -07:00
Reilly Brogan 850bca8db6 Support Debian 11 Bullseye 2021-08-06 12:52:16 -05:00
Peter Rifel ce821a614f
In-line openstack loadbalancer feature detection
This was our only reliance on cloud-provider-openstack which depends on k8s.io/kubernetes.

With the logic in-lined, kops no longer has any indirect dependencies of k/k
2021-08-06 08:19:53 -04:00
Kubernetes Prow Robot c382408684
Merge pull request #12107 from olemarkus/fix-albc
Revert most of #12023 and keep awslbc on CP nodes
2021-08-05 11:23:19 -07:00
Ole Markus With 1839b1ac47 Revert most of #12023 and keep awslbc on CP nodes 2021-08-05 19:30:27 +02:00
John Gardiner Myers 832e773324 Update Kubernetes dependencies to 1.22.0 2021-08-04 16:54:07 -07:00
Kubernetes Prow Robot d148cbed8d
Merge pull request #12049 from iGene/octavia_provider_option
Add Option to Specify OpenStack Octavia Provider
2021-08-04 01:33:24 -07:00
Kubernetes Prow Robot 3a293781a6
Merge pull request #11784 from ederst/add-os-config-drive
Launch Openstack instances with config drive
2021-08-04 00:49:24 -07:00
Kubernetes Prow Robot 3ee3e30267
Merge pull request #12096 from hakman/docker-20.10.8
Update Docker to v20.10.8
2021-08-03 21:39:24 -07:00
Ciprian Hacman 92ab49cdfb Update Docker to v20.10.8 2021-08-04 06:19:43 +03:00
AkiraFukushima 2fd69ba3a3
Remove access log attributes when the spec is removed from cluster spec 2021-08-03 17:45:20 +09:00
Kubernetes Prow Robot 283080bc30
Merge pull request #12083 from CheyiLin/nth
Add nth rebalance recommendation configs
2021-08-02 21:40:48 -07:00
AkiraFukushima 226cbe5561
Support AWS LB access log configuration for NetworkLoadBalancer 2021-08-03 12:12:16 +09:00
Cheyi Lin 408bb7dfbe Add nth rebalance recommendation configs 2021-08-02 16:20:17 +08:00
Ciprian Hacman 966d2d6308 Update Calico to v3.20.0 2021-08-02 08:51:37 +03:00
Kubernetes Prow Robot a9207f4a6c
Merge pull request #12087 from johngmyers/sha256-manifest
Use SHA-256 for manifest hashes
2021-08-01 21:55:23 -07:00
John Gardiner Myers d6a159a258 hack/update-expected.sh 2021-08-01 16:42:14 -07:00
John Gardiner Myers 03434509e2 Use SHA-256 for manifest hashes 2021-08-01 16:37:01 -07:00
Justin SB 912e28d95a GCE: TargetPool should ignore Lifecycle field
It's an internal field, it shouldn't be detected as a change to apply.
2021-07-30 14:57:14 +00:00
Ciprian Hacman 541d328812 Update containerd to v1.4.9 2021-07-30 07:30:42 +03:00
Kubernetes Prow Robot 5bd6a49b26
Merge pull request #12062 from hakman/coredns-1.8.4
Update core-dns to v1.8.4
2021-07-29 11:14:57 -07:00
AkiraFukushima 50ab82ed04
Support AWS LB access log configuration in cluster spec 2021-07-29 22:39:23 +09:00
Kubernetes Prow Robot 8c5c8018db
Merge pull request #12065 from MoShitrit/aws-cni-1.9.0
Update AWS CNI to v1.9.0
2021-07-28 23:04:19 -07:00
Ciprian Hacman fc3a103baf Update core-dns to v1.8.4 2021-07-29 08:23:35 +03:00
Kubernetes Prow Robot 05964b9375
Merge pull request #12059 from hakman/containerd-1.4.8
Update containerd to v1.4.8
2021-07-28 22:20:19 -07:00
Moshe Shitrit 13a489571b update auto-generated files after update-expected and verify-apimachinery 2021-07-29 00:19:44 -04:00
Moshe Shitrit f0f15df565 update aws-cni version to 1.9.0 2021-07-29 00:05:20 -04:00
Ciprian Hacman b6464658d4 Update containerd to v1.4.8 2021-07-29 05:27:10 +03:00
Kubernetes Prow Robot 81432c6d2f
Merge pull request #12043 from johngmyers/sts-region
Use regional STS endpoint
2021-07-28 01:39:35 -07:00
John Gardiner Myers 085b43e420 Clean up "kops get secrets" 2021-07-27 21:33:52 -07:00
Ching Kuo 7fba614a3c Add Option to Specify OpenStack Octavia Provider
In newer version of OpenStack, there are multiple octavia provider to
choose from instead of only "octavia" as provider. This commit added a
command line option "os-octavia-provider", enabling user to specify the
octavia provider that will be use to create load balancers.
2021-07-27 15:15:17 +08:00
John Gardiner Myers babf07136e Use regional STS endpoint 2021-07-24 22:33:30 -07:00
John Gardiner Myers cd1aa1ab53 Simplify FindSSHPublicKeys() interface 2021-07-24 09:01:22 -07:00
John Gardiner Myers cddefc0a1f Simplify DeleteSSHCredential() interface 2021-07-24 09:01:21 -07:00
John Gardiner Myers 4bbed0339a Split out "delete sshpublickey" command 2021-07-24 09:01:21 -07:00
John Gardiner Myers d935a419f8 Simplify AddSSHPublicKey() interface 2021-07-24 08:59:57 -07:00
Kubernetes Prow Robot 34ce86adf2
Merge pull request #12019 from johngmyers/catasks-nobootstrap
Fix certificate bootstrap for non-kops-controller-bootstrap cloud providers
2021-07-19 15:56:15 -07:00
Kubernetes Prow Robot be63d4f1a7
Merge pull request #11953 from rifelpet/tf-cp
Return a clearer error when terraform is used on an unsupported provider
2021-07-19 10:52:52 -07:00
Kubernetes Prow Robot 14d58a4e87
Merge pull request #12024 from olemarkus/irsa-nth
Add irsa support for node termination handler
2021-07-19 10:06:52 -07:00
Ole Markus With d31c682506 Set vpc-id on aws lbc 2021-07-19 15:14:15 +02:00
Ole Markus With 28bd45a8fa Add irsa support for nth 2021-07-19 15:12:35 +02:00
Peter Rifel 5b62e73726
Add shell completion for `--target` 2021-07-19 08:35:36 -04:00
Peter Rifel ce0d8955ef
Return a clearer error when terraform is used on an unsupported provider 2021-07-19 08:29:05 -04:00
Kubernetes Prow Robot 147b0be4f9
Merge pull request #12020 from johngmyers/refactor-featureflag
Report unknown feature flags as such
2021-07-18 18:04:52 -07:00
John Gardiner Myers f244790d51 Make version boundaries const 2021-07-18 16:29:41 -07:00
John Gardiner Myers f6b053de9d Report unknown feature flags as such 2021-07-18 16:24:04 -07:00
John Gardiner Myers e9fc12b4f3 Fix certificate bootstrap for non-kops-controller-bootstrap cloud providers 2021-07-18 13:37:19 -07:00
Peter Rifel 4d872b85d2
Add azure support for specifying a shared vpc
This allows the `create cluster --vpc` flag to specify the vnet ID for using shared vnets.
2021-07-18 10:46:58 -07:00
Ciprian Hacman 4d7ebd343c
Release 1.22.0-alpha.2 (#12012) 2021-07-17 21:42:51 -07:00
John Gardiner Myers e6ede8f4a9 Don't provision SSH key by default on AWS 2021-07-17 16:33:26 -07:00
John Gardiner Myers 3ae5413f63 Use keypair IDs for non-kops-controller-issued worker node certs 2021-07-15 14:04:48 -07:00
Kubernetes Prow Robot f24f12f84c
Merge pull request #11982 from johngmyers/bootstrap-keypairid
Verify CA keypair IDs for kops-controller-issued certs
2021-07-15 12:31:03 -07:00
Kubernetes Prow Robot e187359069
Merge pull request #11962 from rifelpet/azure-vmss-zone
Azure - support VMSS availability zones
2021-07-15 05:58:48 -07:00
Peter Rifel affbeb3c5b
Fix Azure zone number format passed to VMSS API 2021-07-14 19:06:28 -04:00
John Gardiner Myers 191df58267 Verify CA keypair IDs for kops-controller-issued certs 2021-07-14 08:15:28 -07:00
Kubernetes Prow Robot 2526a35962
Merge pull request #11986 from olemarkus/nodeup-containerd
Move containerd config from cloudup to nodeup
2021-07-14 02:10:27 -07:00
Ole Markus With c17ec3a7e7 Move containerd config from cloudup to nodeup 2021-07-14 10:28:37 +02:00
Ole Markus With a13cdb38f3 Add region to aws lbc 2021-07-14 08:23:53 +02:00
liranp 786244aa9b
feat(spot/addon): bump ocean-controller to v1.0.77 2021-07-12 12:45:15 +03:00
John Gardiner Myers 9dbf3479d6 Stop writing the certificate-only keyset.yaml 2021-07-11 11:16:11 -07:00
Kubernetes Prow Robot 73b1bce020
Merge pull request #11975 from johngmyers/refactor-legacy
Issue certs using CA KeypairID in NodeupConfig
2021-07-11 01:56:47 -07:00
Kubernetes Prow Robot a3daff9343
Merge pull request #11971 from johngmyers/rotate-all
Add "all" variants of key rotation commands
2021-07-11 00:30:46 -07:00
John Gardiner Myers 68041a4f73 Issue certs using CA KeypairID in NodeupConfig 2021-07-10 23:23:12 -07:00
John Gardiner Myers a33a30a859 Refactor out some legacy interfaces 2021-07-10 23:23:12 -07:00
Kubernetes Prow Robot a397a881a1
Merge pull request #11974 from johngmyers/refactor-sakey
Refactor service-account signing key
2021-07-10 23:18:46 -07:00
John Gardiner Myers d58a19e1bd Refactor service-account signing key 2021-07-10 17:31:59 -07:00
Kubernetes Prow Robot edf278d382
Merge pull request #11961 from olemarkus/cilium-etcd-fixes
Cilium etcd fixes
2021-07-10 14:20:46 -07:00
John Gardiner Myers 5a2aac4cfd Add "all" variants of key rotation commands 2021-07-10 05:51:31 -07:00
Ole Markus With a536929fec Add auto compaction to new cilium etcd clusters and to docs 2021-07-09 15:47:46 +02:00
Ole Markus With 97a41c66f4 Enable k8s event handover when kvstore is used 2021-07-09 15:46:43 +02:00
John Gardiner Myers 9f2c7fe55c Don't (disruptively) reissue CAs just because Subject or SAN changed 2021-07-08 22:09:26 -07:00
Peter Rifel 9552b25050
Azure - support VMSS availability zones
Azure's subnets are regional so we use similar functionality to GCE where we reference the InstanceGroup's zones rather than a subnet's zone.
IG Zones are already populated on cluster creation here: b358037896/upup/pkg/fi/cloudup/new_cluster.go (L682-L684)
2021-07-08 23:10:23 -04:00
John Gardiner Myers c35d101a89 Refactor keysets for etcd-manager 2021-07-08 18:46:03 -07:00
Kubernetes Prow Robot 098a4a91ee
Merge pull request #11958 from olivierpilotte/fix-instance-not-under-asg
check if the instance is under an asg
2021-07-08 09:14:54 -07:00
Olivier Pilotte 3db2c0d443 check if the instance is under an asg
add a comment, remove log
2021-07-08 11:01:13 -04:00
Kubernetes Prow Robot 53c7849d97
Merge pull request #11940 from johngmyers/complete-create
Implement some completion for "kops create cluster"
2021-07-08 05:22:53 -07:00
srikiz 27058c3f69 Incorporate review comments 2021-07-07 20:53:38 +05:30
srikiz bdc67e4282 Modify error message when multiple zones are specified 2021-07-07 19:56:41 +05:30
Kubernetes Prow Robot 7f93801afd
Merge pull request #11939 from olemarkus/ccm-issues
Fix various CCM issues
2021-07-06 10:12:19 -07:00
John Gardiner Myers 6d16c13f24 Implement some completion for "kops create cluster" 2021-07-06 08:16:44 -07:00
Kubernetes Prow Robot 82c3bfa393
Merge pull request #11938 from olemarkus/cm-ca-cp
Run cert-manager cainjector on CP nodes as well
2021-07-06 07:46:18 -07:00
Ole Markus With 2d56558efe Run cert-manager cainjector on CP nodes as well 2021-07-06 16:05:41 +02:00
Ole Markus With af0aefd2e7 Use localhost as API address for CCM 2021-07-06 16:01:20 +02:00
Ole Markus With bedfb409ca Don't always pull the CCM image 2021-07-06 15:50:30 +02:00
Ole Markus With bb367f22ea Add aws- prefix to CCM SA 2021-07-06 15:46:59 +02:00
Kubernetes Prow Robot 33755be3a3
Merge pull request #11936 from srikiz/DO-Remove-Deprecated-PrivateNetworking
[Digital Ocean] Remove PrivateNetworking option in droplet since it's deprecated
2021-07-06 03:12:18 -07:00
srikiz ea6e6c9856 Remove PrivateNetworking option in droplet since it's deprecated 2021-07-06 14:04:40 +05:30
Ole Markus With 561161291f Schedule certmanager webhook on control plane 2021-07-06 08:45:12 +02:00
John Gardiner Myers 5834fc2690 hack/update-expected.sh 2021-07-03 17:33:13 -07:00
John Gardiner Myers 921d09523e Rename the "ca" keyset to "kubernetes-ca" 2021-07-03 17:33:13 -07:00
Kubernetes Prow Robot 090b525566
Merge pull request #11907 from hakman/ipv6_dns-controller
Add support for IPv6 addresses to dns-controller
2021-07-02 00:30:12 -07:00
Ciprian Hacman 65f18c3946 Add support for IPv6 addresses to dns-controller 2021-07-02 09:34:05 +03:00
John Gardiner Myers 1e0c6cb1aa Refactor apiserver-aggregator-ca 2021-07-01 22:25:47 -07:00
Kubernetes Prow Robot b8aa684bb5
Merge pull request #11901 from rifelpet/tf-project
Include GCP Project in terraform HCL2 output
2021-07-01 07:05:55 -07:00
Peter Rifel 13f4305b9c
Include GCP Project in terraform HCL2 output
This has been included in the JSON output but was missing from HCL2
2021-07-01 09:23:37 -04:00
Peter Rifel 32c6c0db02
Remove unnecessary parameters from terraform finish methods 2021-07-01 07:55:31 -04:00
Kubernetes Prow Robot 19ffc06d3d
Merge pull request #11853 from johngmyers/override-issuer
Allow overriding the ServiceAccountIssuer for IRSA
2021-07-01 04:43:54 -07:00
Kubernetes Prow Robot 39b67210f8
Merge pull request #11897 from johngmyers/refactor-etcd-ca
Refactor etcd-clients-ca keyset for api-server
2021-06-30 23:37:55 -07:00
John Gardiner Myers 3de05a500e Refactor etcd-clients-ca keyset for api-server 2021-06-30 18:55:30 -07:00
John Gardiner Myers f9e4f3493a Fix nil-pointer dereference on dryrun 2021-06-29 22:52:48 -07:00
Kubernetes Prow Robot 52afacd05c
Merge pull request #9621 from johngmyers/tf-managed
Render managed files with Terraform
2021-06-29 19:27:03 -07:00
Ciprian Hacman b011d5abb5 Set download timeout to 3 minutes 2021-06-29 07:12:47 +03:00
John Gardiner Myers f76c9559bc Create feature flag to disable Terraform managed files 2021-06-28 13:48:35 -07:00
John Gardiner Myers eb076e3713 Render managed files with Terraform 2021-06-28 12:15:15 -07:00
Kubernetes Prow Robot ee048e89e7
Merge pull request #11872 from johngmyers/refactor-serviceaccount
Refactor nodeup APIServer builder, part one
2021-06-28 10:42:01 -07:00
Kubernetes Prow Robot bbe9a1a127
Merge pull request #11884 from aojea/download_timeout
support large/slow downloads
2021-06-28 06:49:25 -07:00
liranp 289a75b5e7
feat(spot/addon): bump ocean-controller to v1.0.76 2021-06-28 14:29:13 +03:00
Antonio Ojea 19f47d4998 support large/slow downloads
current download code was using http.client timeout, that will
interrupt reading of the response body, breaking slow downloads
or very large files.

This patch modified the http client to detect idle downloads, and
fail after 30 seconds of innactivity. It still keeps a global
timeout of 5 minutes.
2021-06-28 12:26:35 +02:00
Kubernetes Prow Robot 917c965c8f
Merge pull request #11873 from hakman/avoid_spurious_changes
Avoid spurious changes for ASG InstanceProtection and LT InstanceMonitoring
2021-06-27 19:59:24 -07:00
Kubernetes Prow Robot dd8d2d92d8
Merge pull request #11796 from johngmyers/fullcluster-managedfile
Write config as ManagedFile
2021-06-27 10:57:24 -07:00