-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Per-node configuration overrides (v2) #22656
Merged
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/test |
This needs cilium/cilium-cli#1286 to merge for CI to be green (I'm not sure why the previous PR worked). |
sayboras
added a commit
to sayboras/cilium
that referenced
this pull request
Dec 22, 2022
This is to make sure that cilium operator is having update permission for the newly added CiliumNodeConfigs CRD, otherwise, we will have the below issue: ``` 2022-12-21T05:29:34.477230831Z level=fatal msg="Unable to register CRDs" error="Unable to create custom resource definition: customresourcedefinitions.apiextensions.k8s.io \"ciliumnodeconfigs.cilium.io\" is forbidden: User \"system:serviceaccount:kube-system:cilium-operator\" cannot update resource \"customresourcedefinitions\" in API group \"apiextensions.k8s.io\" at the cluster scope" subsys=cilium-operator-generic ``` Relates: cilium#22656 Signed-off-by: Tam Mach <tam.mach@cilium.io>
joamaki
pushed a commit
that referenced
this pull request
Dec 23, 2022
This is to make sure that cilium operator is having update permission for the newly added CiliumNodeConfigs CRD, otherwise, we will have the below issue: ``` 2022-12-21T05:29:34.477230831Z level=fatal msg="Unable to register CRDs" error="Unable to create custom resource definition: customresourcedefinitions.apiextensions.k8s.io \"ciliumnodeconfigs.cilium.io\" is forbidden: User \"system:serviceaccount:kube-system:cilium-operator\" cannot update resource \"customresourcedefinitions\" in API group \"apiextensions.k8s.io\" at the cluster scope" subsys=cilium-operator-generic ``` Relates: #22656 Signed-off-by: Tam Mach <tam.mach@cilium.io>
aditighag
pushed a commit
to aditighag/cilium
that referenced
this pull request
Jan 9, 2023
[ upstream commit c46eb0b ] This is to make sure that cilium operator is having update permission for the newly added CiliumNodeConfigs CRD, otherwise, we will have the below issue: ``` 2022-12-21T05:29:34.477230831Z level=fatal msg="Unable to register CRDs" error="Unable to create custom resource definition: customresourcedefinitions.apiextensions.k8s.io \"ciliumnodeconfigs.cilium.io\" is forbidden: User \"system:serviceaccount:kube-system:cilium-operator\" cannot update resource \"customresourcedefinitions\" in API group \"apiextensions.k8s.io\" at the cluster scope" subsys=cilium-operator-generic ``` Relates: cilium#22656 Signed-off-by: Tam Mach <tam.mach@cilium.io> Signed-off-by: Aditi Ghag <aditi@cilium.io>
aditighag
pushed a commit
that referenced
this pull request
Jan 10, 2023
[ upstream commit c46eb0b ] This is to make sure that cilium operator is having update permission for the newly added CiliumNodeConfigs CRD, otherwise, we will have the below issue: ``` 2022-12-21T05:29:34.477230831Z level=fatal msg="Unable to register CRDs" error="Unable to create custom resource definition: customresourcedefinitions.apiextensions.k8s.io \"ciliumnodeconfigs.cilium.io\" is forbidden: User \"system:serviceaccount:kube-system:cilium-operator\" cannot update resource \"customresourcedefinitions\" in API group \"apiextensions.k8s.io\" at the cluster scope" subsys=cilium-operator-generic ``` Relates: #22656 Signed-off-by: Tam Mach <tam.mach@cilium.io> Signed-off-by: Aditi Ghag <aditi@cilium.io>
qmonnet
pushed a commit
that referenced
this pull request
Jan 31, 2023
[ upstream commit d67aed5 ] Introduced in #22656, now that cilium-cli install can handle this case, we can remove this workaround. [ Backport note: Fixed conflict related to most touched filed being removed in branch v1.13 with commit e845e1d ("Prepare v1.13 stable branch"). ] Fixes: #22517 Reverts: 43cb8e9 Signed-off-by: Casey Callendrello <cdc@isovalent.com> Signed-off-by: Quentin Monnet <quentin@isovalent.com>
qmonnet
pushed a commit
that referenced
this pull request
Feb 1, 2023
[ upstream commit d67aed5 ] Introduced in #22656, now that cilium-cli install can handle this case, we can remove this workaround. [ Backport note: Fixed conflict related to most touched filed being removed in branch v1.13 with commit e845e1d ("Prepare v1.13 stable branch"). ] Fixes: #22517 Reverts: 43cb8e9 Signed-off-by: Casey Callendrello <cdc@isovalent.com> Signed-off-by: Quentin Monnet <quentin@isovalent.com>
giorio94
added a commit
to giorio94/cilium-cli
that referenced
this pull request
Feb 10, 2023
This commit adds the removal of the cilium-config-agent role and rolebinding (introduced in cilium/cilium#22656) during the uninstallation process, to ensure that the status of the cluster is properly restored. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
giorio94
added a commit
to giorio94/cilium-cli
that referenced
this pull request
Feb 10, 2023
This commit adds the removal of the cilium-config-agent role and rolebinding (introduced in cilium/cilium#22656) during the uninstallation process, to ensure that the status of the cluster is properly restored. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
tklauser
pushed a commit
to cilium/cilium-cli
that referenced
this pull request
Feb 10, 2023
This commit adds the removal of the cilium-config-agent role and rolebinding (introduced in cilium/cilium#22656) during the uninstallation process, to ensure that the status of the cluster is properly restored. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
YutaroHayakawa
pushed a commit
to YutaroHayakawa/cilium
that referenced
this pull request
Mar 17, 2023
[ upstream commit c46eb0b ] This is to make sure that cilium operator is having update permission for the newly added CiliumNodeConfigs CRD, otherwise, we will have the below issue: ``` 2022-12-21T05:29:34.477230831Z level=fatal msg="Unable to register CRDs" error="Unable to create custom resource definition: customresourcedefinitions.apiextensions.k8s.io \"ciliumnodeconfigs.cilium.io\" is forbidden: User \"system:serviceaccount:kube-system:cilium-operator\" cannot update resource \"customresourcedefinitions\" in API group \"apiextensions.k8s.io\" at the cluster scope" subsys=cilium-operator-generic ``` Relates: cilium#22656 Signed-off-by: Tam Mach <tam.mach@cilium.io> Signed-off-by: Aditi Ghag <aditi@cilium.io> Signed-off-by: Michi Mutsuzaki <michi@isovalent.com>
YutaroHayakawa
pushed a commit
to YutaroHayakawa/cilium
that referenced
this pull request
Mar 17, 2023
[ upstream commit d67aed5 ] Introduced in cilium#22656, now that cilium-cli install can handle this case, we can remove this workaround. [ Backport note: Fixed conflict related to most touched filed being removed in branch v1.13 with commit e845e1d ("Prepare v1.13 stable branch"). ] Fixes: cilium#22517 Reverts: 43cb8e9 Signed-off-by: Casey Callendrello <cdc@isovalent.com> Signed-off-by: Quentin Monnet <quentin@isovalent.com> Signed-off-by: Michi Mutsuzaki <michi@isovalent.com>
michi-covalent
pushed a commit
to michi-covalent/cilium
that referenced
this pull request
May 30, 2023
This commit adds the removal of the cilium-config-agent role and rolebinding (introduced in cilium#22656) during the uninstallation process, to ensure that the status of the cluster is properly restored. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
8 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
backport-done/1.13
The backport for Cilium 1.13.x for this PR is done.
ready-to-merge
This PR has passed all tests and received consensus from code owners to merge.
release-blocker/1.13
This issue will prevent the release of the next version of Cilium.
release-note/major
This PR introduces major new functionality to Cilium.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This un-reverts #22163, which was reverted in #22630. The only difference
The message from 22163 is included below.
This adds the ability to tweak configuration on a per-node basis, as designed in #22036. Specifically, there is an InitContainer that implements the configuration resolution logic. It writes a directory that imitates ConfigMaps, so there are no code changes in the agent itself.
This adds a new type, ClilumNodeConfig, that allows for tweaking configuration flags on a fine-grained basis. For example, you could create
then add a NodeAntiAffinity to the kube-proxy daemonset. Then, one by one, label nodes with
io.cilium.kube-proxy-replacement: ""
. This will cause that node to begin using this particular configuration override.Fixes: #22036
(Note: This also includes a CI workaround for the extra roles; I'll fix that in cilium-cli and remove it shortly).