From 220a641d9b37ec7a7982960e7fa85cdb29b3b5c9 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Thu, 4 Jun 2020 12:16:22 -0400 Subject: [PATCH 01/42] Tighten GA_ONLY configuration to drop CSR exception for 1.19 --- hack/ci/e2e-k8s.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/hack/ci/e2e-k8s.sh b/hack/ci/e2e-k8s.sh index 113d35acaa..4431a2b073 100755 --- a/hack/ci/e2e-k8s.sh +++ b/hack/ci/e2e-k8s.sh @@ -110,8 +110,7 @@ create_cluster() { echo "GA_ONLY=true is only supported on versions >= v1.18, got ${KUBE_VERSION}" exit 1 ;; - v1.1[8-9].*) - # TODO(liggitt): drop this exception for 1.19 once the CSR API and feature are promoted to GA in 1.19 + v1.18.*) echo "Limiting to GA APIs and features (plus certificates.k8s.io/v1beta1 and RotateKubeletClientCertificate) for ${KUBE_VERSION}" feature_gates='{"AllAlpha":false,"AllBeta":false,"RotateKubeletClientCertificate":true}' runtime_config='api/alpha=false,api/beta=false,certificates.k8s.io/v1beta1=true' From d212ac19b27940543996af89c378920d7d50e4ef Mon Sep 17 00:00:00 2001 From: Amit Watve Date: Tue, 9 Jun 2020 17:14:39 -0700 Subject: [PATCH 02/42] Add .svc to no_proxy. --- pkg/cluster/internal/providers/docker/provision.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/cluster/internal/providers/docker/provision.go b/pkg/cluster/internal/providers/docker/provision.go index 4d98face51..e54ff2812c 100644 --- a/pkg/cluster/internal/providers/docker/provision.go +++ b/pkg/cluster/internal/providers/docker/provision.go @@ -294,6 +294,9 @@ func getProxyEnv(cfg *config.Cluster, networkName string, nodeNames []string) (m noProxyList := append(subnets, envs[common.NOProxy]) noProxyList = append(noProxyList, nodeNames...) + // Add .svc explicitly to no_proxy to allow in cluster + // pod and service dns resolution + noProxyList = append(noProxyList, ".svc") noProxyJoined := strings.Join(noProxyList, ",") envs[common.NOProxy] = noProxyJoined envs[strings.ToLower(common.NOProxy)] = noProxyJoined From 2395dc2c3000cf77e89e1e5bcc4a4946ed03e0cb Mon Sep 17 00:00:00 2001 From: Amit Watve Date: Tue, 9 Jun 2020 17:16:47 -0700 Subject: [PATCH 03/42] Use tagged image instead of latest for ingress guide. --- site/static/examples/ingress/usage.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/site/static/examples/ingress/usage.yaml b/site/static/examples/ingress/usage.yaml index 5f3e45dbd2..797df01e35 100644 --- a/site/static/examples/ingress/usage.yaml +++ b/site/static/examples/ingress/usage.yaml @@ -7,7 +7,7 @@ metadata: spec: containers: - name: foo-app - image: hashicorp/http-echo + image: hashicorp/http-echo:0.2.3 args: - "-text=foo" --- @@ -31,7 +31,7 @@ metadata: spec: containers: - name: bar-app - image: hashicorp/http-echo + image: hashicorp/http-echo:0.2.3 args: - "-text=bar" --- From 276ff7f3375f7950422bab1d2a8069813f214256 Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Wed, 10 Jun 2020 10:11:29 -0700 Subject: [PATCH 04/42] upgrade to latest containerd --- images/base/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/base/Dockerfile b/images/base/Dockerfile index 067b8147fa..733f8d96a6 100644 --- a/images/base/Dockerfile +++ b/images/base/Dockerfile @@ -23,7 +23,7 @@ FROM ubuntu:20.04 # Configure containerd and runc binaries from kind-ci/containerd-nightlies repository # The repository contains latest stable releases and nightlies built for multiple architectures -ARG CONTAINERD_VERSION="v1.3.3-14-g449e9269" +ARG CONTAINERD_VERSION="v1.4.0-beta.1-26-g834665d9" # Configure CNI binaries from upstream ARG CNI_VERSION="v0.8.6" # Configure crictl binary from upstream From ee1089c01cc63cdf76d95a12f3e1b3b8e1b06c96 Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Wed, 10 Jun 2020 11:05:50 -0700 Subject: [PATCH 05/42] print runc version during build --- images/base/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/images/base/Dockerfile b/images/base/Dockerfile index 733f8d96a6..be9ee77231 100644 --- a/images/base/Dockerfile +++ b/images/base/Dockerfile @@ -89,6 +89,7 @@ RUN echo "Ensuring scripts are executable ..." \ && curl -sSL --retry 5 --output /usr/local/sbin/runc "${CONTAINERD_BASE_URL}/runc.${ARCH}" \ && chmod 755 /usr/local/sbin/runc \ && containerd --version \ + && runc --version \ && systemctl enable containerd \ && echo "Installing crictl ..." \ && curl -fSL "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz" | tar xzC /usr/local/bin \ From 7c2fef2d957a53fdd04d4c4e1c451b3d3bd322fb Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Wed, 10 Jun 2020 11:35:56 -0700 Subject: [PATCH 06/42] allow configurable progress output --- images/base/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/images/base/Makefile b/images/base/Makefile index 203a42cd91..b9fc4d36b7 100644 --- a/images/base/Makefile +++ b/images/base/Makefile @@ -6,8 +6,9 @@ export DOCKER_CLI_EXPERIMENTAL=enabled # build with buildx PLATFORMS?=linux/amd64,linux/arm64 OUTPUT= +PROGRESS=auto build: ensure-buildx - docker buildx build --platform=${PLATFORMS} $(OUTPUT) -t ${IMAGE} --pull . + docker buildx build --platform=${PLATFORMS} $(OUTPUT) --progress=$(PROGRESS) -t ${IMAGE} --pull . # push the cross built image push: OUTPUT=--push From 8102d3eed5a9187f0359393b3f278601a293a22e Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Wed, 10 Jun 2020 11:47:10 -0700 Subject: [PATCH 07/42] add pigz for parallel decompression --- images/base/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/base/Dockerfile b/images/base/Dockerfile index be9ee77231..0cfa9ca4b5 100644 --- a/images/base/Dockerfile +++ b/images/base/Dockerfile @@ -67,7 +67,7 @@ RUN echo "Ensuring scripts are executable ..." \ && DEBIAN_FRONTEND=noninteractive clean-install \ systemd \ conntrack iptables iproute2 ethtool socat util-linux mount ebtables udev kmod \ - libseccomp2 \ + libseccomp2 pigz \ bash ca-certificates curl rsync \ nfs-common \ && find /lib/systemd/system/sysinit.target.wants/ -name "systemd-tmpfiles-setup.service" -delete \ From 4640dbb5723374230a62f7a44c682f5c2f819848 Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Wed, 10 Jun 2020 11:53:49 -0700 Subject: [PATCH 08/42] bump base image --- pkg/build/nodeimage/defaults.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/build/nodeimage/defaults.go b/pkg/build/nodeimage/defaults.go index d21267a491..f005195caa 100644 --- a/pkg/build/nodeimage/defaults.go +++ b/pkg/build/nodeimage/defaults.go @@ -20,7 +20,7 @@ package nodeimage const DefaultImage = "kindest/node:latest" // DefaultBaseImage is the default base image used -const DefaultBaseImage = "kindest/base:v20200602-f5196892" +const DefaultBaseImage = "kindest/base:v20200610-8102d3ee" // DefaultMode is the default kubernetes build mode for the built image // see pkg/build/kube.Bits From 99eb061705bc449184ba09cd855652578352e534 Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Wed, 10 Jun 2020 12:23:21 -0700 Subject: [PATCH 09/42] also fix umount --- images/base/files/usr/local/bin/entrypoint | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/images/base/files/usr/local/bin/entrypoint b/images/base/files/usr/local/bin/entrypoint index e2cba5a5ca..327040fb1b 100755 --- a/images/base/files/usr/local/bin/entrypoint +++ b/images/base/files/usr/local/bin/entrypoint @@ -19,11 +19,11 @@ set -o nounset set -o pipefail fix_mount() { - echo 'INFO: ensuring we can execute /bin/mount even with userns-remap' + echo 'INFO: ensuring we can execute mount/umount even with userns-remap' # necessary only when userns-remap is enabled on the host, but harmless # The binary /bin/mount should be owned by root and have the setuid bit - chown root:root /bin/mount - chmod -s /bin/mount + chown root:root "$(which mount)" "$(which umount)" + chmod -s "$(which mount)" "$(which umount)" # This is a workaround to an AUFS bug that might cause `Text file # busy` on `mount` command below. See more details in From b314bcf3b704190d6e2df42a29f2841bfff3c1f5 Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Wed, 10 Jun 2020 12:28:18 -0700 Subject: [PATCH 10/42] bump base --- pkg/build/nodeimage/defaults.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/build/nodeimage/defaults.go b/pkg/build/nodeimage/defaults.go index f005195caa..724de555da 100644 --- a/pkg/build/nodeimage/defaults.go +++ b/pkg/build/nodeimage/defaults.go @@ -20,7 +20,7 @@ package nodeimage const DefaultImage = "kindest/node:latest" // DefaultBaseImage is the default base image used -const DefaultBaseImage = "kindest/base:v20200610-8102d3ee" +const DefaultBaseImage = "kindest/base:v20200610-99eb0617" // DefaultMode is the default kubernetes build mode for the built image // see pkg/build/kube.Bits From a7b408bca966b487bed318e5038685274d00c21b Mon Sep 17 00:00:00 2001 From: Amit Watve Date: Wed, 10 Jun 2020 15:09:43 -0700 Subject: [PATCH 11/42] Add default cluster.local domains to no proxy. --- pkg/cluster/internal/providers/docker/provision.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/pkg/cluster/internal/providers/docker/provision.go b/pkg/cluster/internal/providers/docker/provision.go index e54ff2812c..93926568e0 100644 --- a/pkg/cluster/internal/providers/docker/provision.go +++ b/pkg/cluster/internal/providers/docker/provision.go @@ -294,9 +294,12 @@ func getProxyEnv(cfg *config.Cluster, networkName string, nodeNames []string) (m noProxyList := append(subnets, envs[common.NOProxy]) noProxyList = append(noProxyList, nodeNames...) - // Add .svc explicitly to no_proxy to allow in cluster - // pod and service dns resolution - noProxyList = append(noProxyList, ".svc") + // Add pod and service dns names to no_proxy to allow in cluster + // Note: this is best effort based on the default CoreDNS spec + // https://github.com/kubernetes/dns/blob/master/docs/specification.md + // Any user created pod/service hostnames, namespaces, custom DNS services + // are expected to be no-proxied by the user explicitly. + noProxyList = append(noProxyList, ".svc", ".svc.cluster", ".svc.cluster.local") noProxyJoined := strings.Join(noProxyList, ",") envs[common.NOProxy] = noProxyJoined envs[strings.ToLower(common.NOProxy)] = noProxyJoined From 747b6d211fc770c5f688666b7946d251e4e5b980 Mon Sep 17 00:00:00 2001 From: Amit Watve Date: Wed, 10 Jun 2020 15:10:07 -0700 Subject: [PATCH 12/42] Update podman with the no proxy settings. --- pkg/cluster/internal/providers/podman/provision.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/pkg/cluster/internal/providers/podman/provision.go b/pkg/cluster/internal/providers/podman/provision.go index 766d5b2db5..2eeee8108d 100644 --- a/pkg/cluster/internal/providers/podman/provision.go +++ b/pkg/cluster/internal/providers/podman/provision.go @@ -251,9 +251,16 @@ func getProxyEnv(cfg *config.Cluster) (map[string]string, error) { if err != nil { return nil, err } - noProxyList := strings.Join(append(subnets, envs[common.NOProxy]), ",") - envs[common.NOProxy] = noProxyList - envs[strings.ToLower(common.NOProxy)] = noProxyList + noProxyList := append(subnets, envs[common.NOProxy]) + // Add pod and service dns names to no_proxy to allow in cluster + // Note: this is best effort based on the default CoreDNS spec + // https://github.com/kubernetes/dns/blob/master/docs/specification.md + // Any user created pod/service hostnames, namespaces, custom DNS services + // are expected to be no-proxied by the user explicitly. + noProxyList = append(noProxyList, ".svc", ".svc.cluster", ".svc.cluster.local") + noProxyJoined := strings.Join(noProxyList, ",") + envs[common.NOProxy] = noProxyJoined + envs[strings.ToLower(common.NOProxy)] = noProxyJoined } return envs, nil } From e6c913bfd84dc226c06a69b68351df79e67884e9 Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Tue, 16 Jun 2020 13:05:05 -0700 Subject: [PATCH 13/42] bump containerd to latest nightly --- images/base/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/base/Dockerfile b/images/base/Dockerfile index 0cfa9ca4b5..264019212c 100644 --- a/images/base/Dockerfile +++ b/images/base/Dockerfile @@ -23,7 +23,7 @@ FROM ubuntu:20.04 # Configure containerd and runc binaries from kind-ci/containerd-nightlies repository # The repository contains latest stable releases and nightlies built for multiple architectures -ARG CONTAINERD_VERSION="v1.4.0-beta.1-26-g834665d9" +ARG CONTAINERD_VERSION="v1.4.0-beta.1-34-g49b0743c" # Configure CNI binaries from upstream ARG CNI_VERSION="v0.8.6" # Configure crictl binary from upstream From ad0abb8eccb32b7b0db30ce58427f984b4e2cde5 Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Tue, 16 Jun 2020 13:54:46 -0700 Subject: [PATCH 14/42] bump base image --- pkg/build/nodeimage/defaults.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/build/nodeimage/defaults.go b/pkg/build/nodeimage/defaults.go index 724de555da..4629d43116 100644 --- a/pkg/build/nodeimage/defaults.go +++ b/pkg/build/nodeimage/defaults.go @@ -20,7 +20,7 @@ package nodeimage const DefaultImage = "kindest/node:latest" // DefaultBaseImage is the default base image used -const DefaultBaseImage = "kindest/base:v20200610-99eb0617" +const DefaultBaseImage = "kindest/base:v20200616-e6c913bf" // DefaultMode is the default kubernetes build mode for the built image // see pkg/build/kube.Bits From e9677bf76cdf4a60be7de3b0e9259aaab43c1c4f Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Wed, 17 Jun 2020 12:12:35 -0700 Subject: [PATCH 15/42] add notice from kubernetes.io to site --- site/assets/css/inline.css | 29 +++++++++++++++++++++++++++++ site/layouts/partials/navbar.html | 9 ++++++++- 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/site/assets/css/inline.css b/site/assets/css/inline.css index 51d7d7fee2..f7376a9f0d 100644 --- a/site/assets/css/inline.css +++ b/site/assets/css/inline.css @@ -101,6 +101,35 @@ body { vertical-align: middle; } +#noticebar{ + padding: 2em; +} +#noticebar>* { + max-width: 50em; + margin-left: auto; + margin-right: auto; + margin-block-end: 0; + margin-block-start: 0; +} + +#noticebar.black { + color: white; + background: black; +} +#noticebar.black a { + color: white; +} +#navbar.black { + color: white; + background: black; +} +#navbar.black>#sidebar-toggle { + color: white; +} +#navbar.black>#github { + filter: invert(1); +} + #sidebar { height: 100%; position: fixed; diff --git a/site/layouts/partials/navbar.html b/site/layouts/partials/navbar.html index a4d4173452..821e1a326e 100644 --- a/site/layouts/partials/navbar.html +++ b/site/layouts/partials/navbar.html @@ -1,3 +1,10 @@ -