Merge branch 'master' into nft2

go.mod

@@ -7,11 +7,12 @@ require (
 	github.com/alessio/shellescape v1.2.2
 	github.com/evanphx/json-patch/v5 v5.0.0
 	github.com/mattn/go-isatty v0.0.12
-	github.com/pelletier/go-toml v1.7.0
+	github.com/pelletier/go-toml v1.8.0
 	github.com/pkg/errors v0.9.1
 	github.com/spf13/cobra v1.0.0
 	github.com/spf13/pflag v1.0.5
-	gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71
-	k8s.io/apimachinery v0.18.2
+	golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776
+	k8s.io/apimachinery v0.18.4
 	sigs.k8s.io/yaml v1.2.0
 )

go.sum

@@ -111,8 +111,8 @@ github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGV
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.7.0 h1:7utD74fnzVc/cpcyy8sjrlFr5vYpypUixARcHIMIGuI=
-github.com/pelletier/go-toml v1.7.0/go.mod h1:vwGMzjaWMwyfHwgIBhI2YUM4fB6nL6lVAvS1LBMMhTE=
+github.com/pelletier/go-toml v1.8.0 h1:Keo9qb7iRJs2voHvunFtuuYFsbWeOBh8/P9v/kVMFtw=
+github.com/pelletier/go-toml v1.8.0/go.mod h1:D6yutnOGMveHEPV7VQOuvI/gXY61bv+9bAOTRnLElKs=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -182,6 +182,8 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42 h1:vEOn+mP2zCOVzKckCZy6YsCtDblrpj/w7B9nxGNELpg=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 h1:ogLJMz+qpzav7lGMh10LMvAkM/fAoGlaiiHYiFYdm80=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
@@ -209,15 +211,17 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71 h1:Xe2gvTZUJpsvOWUnvmL/tmhVBZUmHSvLbMjRj6NUUKo=
-gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776 h1:tQIYjPdBoyREyB9XMu+nnTclpTYkz2zFM+lzLJFO4gQ=
+gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/apimachinery v0.18.2 h1:44CmtbmkzVDAhCpRVSiP2R5PPrC2RtlIv/MoB8xpdRA=
-k8s.io/apimachinery v0.18.2/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftcA=
+k8s.io/apimachinery v0.18.4 h1:ST2beySjhqwJoIFk6p7Hp5v5O0hYY6Gngq/gUYXTPIA=
+k8s.io/apimachinery v0.18.4/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
 k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
-k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
+k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
 sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
 sigs.k8s.io/structured-merge-diff/v3 v3.0.0/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
 sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=

hack/ci/e2e-k8s.sh

@@ -110,8 +110,7 @@ create_cluster() {
       echo "GA_ONLY=true is only supported on versions >= v1.18, got ${KUBE_VERSION}"
       exit 1
       ;;
-    v1.1[8-9].*)
-      # TODO(liggitt): drop this exception for 1.19 once the CSR API and feature are promoted to GA in 1.19
+    v1.18.*)
       echo "Limiting to GA APIs and features (plus certificates.k8s.io/v1beta1 and RotateKubeletClientCertificate) for ${KUBE_VERSION}"
       feature_gates='{"AllAlpha":false,"AllBeta":false,"RotateKubeletClientCertificate":true}'
       runtime_config='api/alpha=false,api/beta=false,certificates.k8s.io/v1beta1=true'

hack/release/build/cross.sh

@@ -47,7 +47,6 @@ fi < <(cat <<EOF | tr '\n' '\0'
 export GOOS=windows GOARCH=amd64
 export GOOS=darwin GOARCH=amd64
 export GOOS=linux GOARCH=amd64
-export GOOS=linux GOARCH=arm
 export GOOS=linux GOARCH=arm64
 export GOOS=linux GOARCH=ppc64le
 EOF

images/Makefile.common.in

@@ -0,0 +1,38 @@
+# shared makefile for all images
+
+# get image name from directory we're building
+IMAGE_NAME=$(notdir $(CURDIR))
+# docker image registry, default to upstream
+REGISTRY?=kindest
+# tag based on date-sha
+TAG?=$(shell echo "$$(date +v%Y%m%d)-$$(git describe --always --dirty)")
+# the full image tag
+IMAGE?=$(REGISTRY)/$(IMAGE_NAME):$(TAG)
+
+# required to enable buildx
+export DOCKER_CLI_EXPERIMENTAL=enabled
+
+# build with buildx
+PLATFORMS?=linux/amd64,linux/arm64,linux/ppc64le
+OUTPUT=
+PROGRESS=auto
+build: ensure-buildx
+	docker buildx build --platform=${PLATFORMS} $(OUTPUT) --progress=$(PROGRESS) -t ${IMAGE} --pull .
+
+# push the cross built image
+push: OUTPUT=--push
+push: build
+
+# quick can be used to do a build that will be imported into the local docker 
+# for sanity checking before doing a cross build push
+# cross builds cannot be imported locally at the moment
+# https://github.com/docker/buildx/issues/59
+quick: PLATFORMS=linux/amd64
+quick: OUTPUT=--load
+quick: build
+
+# enable buildx
+ensure-buildx:
+	./../../hack/build/init-buildx.sh
+
+.PHONY: push build quick ensure-buildx

images/base/Dockerfile

@@ -23,7 +23,7 @@ FROM ubuntu:20.04
 
 # Configure containerd and runc binaries from kind-ci/containerd-nightlies repository
 # The repository contains latest stable releases and nightlies built for multiple architectures
-ARG CONTAINERD_VERSION="v1.3.3-14-g449e9269"
+ARG CONTAINERD_VERSION="v1.4.0-beta.1-34-g49b0743c"
 # Configure CNI binaries from upstream
 ARG CNI_VERSION="v0.8.6"
 # Configure crictl binary from upstream
@@ -67,7 +67,7 @@ RUN echo "Ensuring scripts are executable ..." \
     && DEBIAN_FRONTEND=noninteractive clean-install \
       systemd \
       conntrack iptables iproute2 ethtool socat util-linux mount ebtables udev kmod \
-      libseccomp2 \
+      libseccomp2 pigz \
       bash ca-certificates curl rsync \
       nfs-common \
     && find /lib/systemd/system/sysinit.target.wants/ -name "systemd-tmpfiles-setup.service" -delete \
@@ -89,6 +89,7 @@ RUN echo "Ensuring scripts are executable ..." \
     && curl -sSL --retry 5 --output /usr/local/sbin/runc "${CONTAINERD_BASE_URL}/runc.${ARCH}" \
     && chmod 755 /usr/local/sbin/runc \
     && containerd --version \
+    && runc --version \
     && systemctl enable containerd \
  && echo "Installing crictl ..." \
     && curl -fSL "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz" | tar xzC /usr/local/bin \

images/base/Makefile

@@ -1,28 +1 @@
-TAG?=$(shell echo "$$(date +v%Y%m%d)-$$(git describe --always --dirty)")
-IMAGE?=kindest/base:$(TAG)
-# required for buildx
-export DOCKER_CLI_EXPERIMENTAL=enabled
-
-# build with buildx
-PLATFORMS?=linux/amd64,linux/arm64
-OUTPUT=
-build: ensure-buildx
-	docker buildx build --platform=${PLATFORMS} $(OUTPUT) -t ${IMAGE} --pull .
-
-# push the cross built image
-push: OUTPUT=--push
-push: build
-
-# quick can be used to do a build that will be imported into the local docker 
-# for sanity checking before doing a cross build push
-# cross builds cannot be imported locally at the moment
-# https://github.com/docker/buildx/issues/59
-quick: PLATFORMS=linux/amd64
-quick: OUTPUT=--load
-quick: build
-
-# enable buildx
-ensure-buildx:
-	./../../hack/build/init-buildx.sh
-
-.PHONY: push build quick ensure-buildx
+include $(CURDIR)/../Makefile.common.in

images/base/files/usr/local/bin/entrypoint

@@ -19,11 +19,11 @@ set -o nounset
 set -o pipefail
 
 fix_mount() {
-  echo 'INFO: ensuring we can execute /bin/mount even with userns-remap' 
+  echo 'INFO: ensuring we can execute mount/umount even with userns-remap' 
   # necessary only when userns-remap is enabled on the host, but harmless
   # The binary /bin/mount should be owned by root and have the setuid bit
-  chown root:root /bin/mount
-  chmod -s /bin/mount
+  chown root:root "$(which mount)" "$(which umount)"
+  chmod -s "$(which mount)" "$(which umount)"
 
   # This is a workaround to an AUFS bug that might cause `Text file
   # busy` on `mount` command below. See more details in

images/haproxy/Dockerfile

@@ -13,7 +13,6 @@
 # limitations under the License.
 
 # standard haproxy image + minimal config so the container will not exit
-ARG ARCH="amd64"
-ARG BASE="haproxy:2.1.1-alpine"
-FROM ${ARCH}/${BASE}
+ARG BASE="haproxy:2.1.7-alpine"
+FROM ${BASE}
 COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg

images/haproxy/Makefile

@@ -0,0 +1 @@
+include $(CURDIR)/../Makefile.common.in

images/kindnetd/Dockerfile

@@ -12,7 +12,18 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-ARG GOARCH=amd64
-FROM gcr.io/google-containers/debian-iptables-${GOARCH}:v12.0.1
-COPY --chown=root:root kindnetd /bin/kindnetd
+# first stage build kindnetd binary
+# NOTE: tentatively follow upstream kubernetes go version based on k8s in go.mod
+FROM golang:1.13
+WORKDIR /go/src
+# make deps fetching cachable
+COPY go.mod go.sum .
+RUN go mod download
+# build
+COPY . .
+RUN CGO_ENABLED=0 go build -o ./kindnetd ./cmd/kindnetd
+
+# build real kindnetd image
+FROM gcr.io/google-containers/debian-iptables:v12.0.1
+COPY --from=0 --chown=root:root ./go/src/kindnetd /bin/kindnetd
 CMD ["/bin/kindnetd"]

images/kindnetd/Makefile

@@ -0,0 +1 @@
+include $(CURDIR)/../Makefile.common.in

images/kindnetd/cmd/kindnetd/main.go

@@ -17,6 +17,7 @@ limitations under the License.
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
 	"os"
@@ -97,7 +98,7 @@ func main() {
 		var nodes *corev1.NodeList
 		var err error
 		for i := 0; i < 5; i++ {
-			nodes, err = clientset.CoreV1().Nodes().List(metav1.ListOptions{})
+			nodes, err = clientset.CoreV1().Nodes().List(context.TODO(), metav1.ListOptions{})
 			if err == nil {
 				break
 			}