Add RBAC, healthchecks, autoscalers and update Calico to v2.5.1 #51237

gunjan5 · 2017-08-24T01:23:38Z

What this PR does / why we need it:

Updates Calico to v2.5
- Calico/node to v2.5.1
- Calico CNI to v1.10.0
- Typha to v0.4.1
Enable health check endpoints
- Add Readiness probe for calico-node and Typha
- Add Liveness probe for calico-node and Typha
Add RBAC manifest
- With calico ClusterRole, ServiceAccount and ClusterRoleBinding
Add Calico CRDs in the Calico manifest (only works for k8s v1.7+)
Add vertical autoscaler for calico-node and Typha
Add horizontal autoscaler for Typha

Release note:

Calico has been updated to v2.5, RBAC added, and is now automatically scaled when GCE clusters are resized.

k8s-ci-robot · 2017-08-24T01:23:46Z

Hi @gunjan5. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

xilabao · 2017-08-24T01:42:43Z

cluster/addons/calico-policy-controller/rbac.yaml

@@ -0,0 +1,87 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1


rbac has updated to v1

@xilabao we're planning to port this with k8s 1.7.x, so keeping it v1beta1 for this PR

caseydavenport · 2017-08-24T14:37:32Z

cluster/addons/calico-policy-controller/calico-node-daemonset.yaml

@@ -136,3 +151,68 @@ spec:
      tolerations:
        - key: "CriticalAddonsOnly"
          operator: "Exists"
+
+# Create all the required CustomResourceDefinitions needed


Each CRD should be in its own yaml file in order to work with the add-on manager.

dims · 2017-08-25T12:36:11Z

/ok-to-test
/release-note-none

gunjan5 · 2017-08-28T23:27:50Z

/test pull-kubernetes-e2e-gce-gpu

gunjan5 · 2017-08-29T04:13:19Z

/test pull-kubernetes-e2e-gce-gpu
/test pull-kubernetes-federation-e2e-gce

gunjan5 · 2017-09-01T17:24:03Z

/assign dnardo
/assign wojtek-t

dnardo · 2017-09-01T17:45:28Z

cluster/addons/calico-policy-controller/calico-node-daemonset.yaml

@@ -103,7 +115,7 @@ spec:
                    {
                      "type": "portmap",
                      "capabilities": {"portMappings": true},
-                      "snat": false
+                      "snat": true


false right - ip-masq-agent will be used?

that's because "snat": true only applies to local host traffic. See https://github.com/containernetworking/plugins/tree/master/plugins/meta/portmap#snat

@caseydavenport spotted that if we try to reach hostport from the same node as the hostport pod with localhost:<hostport> it won't work without snat: true

This shouldn't affect ip-masq-agent since this is only for the localhost traffic

Yep, this is just for the hostport plugin, not general masquerade (which will still be done by the ip-masq-agent).

The hostport plugin needs this setting in order to allow users to do curl localhost:hostport successfully.

dnardo · 2017-09-01T17:49:27Z

cluster/gce/gci/configure-helper.sh

@@ -1796,20 +1748,9 @@ function start-kube-addons {
  if [[ "${NETWORK_POLICY_PROVIDER:-}" == "calico" ]]; then
    setup-addon-manifests "addons" "calico-policy-controller"


should ENABLE_IP_MASQ_AGENT=true be added where network policy provider is set?

we are thinking of doing that in a separate PR later, since it might need more changes for example node labels, etc.

ok, I think I was confusing that with "ipMasq": true

dnardo · 2017-09-01T17:49:55Z

/lgtm except for the comments on SNAT and ip-masq-agent

caseydavenport · 2017-09-01T19:31:00Z

cluster/addons/calico-policy-controller/typha-deployment.yaml

      containers:
-      - image: calico/typha:v0.2.3
+      - image: calico/typha:v0.4.0


@gunjan5 this should be v0.4.1

caseydavenport · 2017-09-01T19:33:10Z

/lgtm

@gunjan5 one comment re: the typha verison

caseydavenport · 2017-09-01T19:57:14Z

/lgtm

caseydavenport · 2017-09-01T19:57:42Z

@dnardo @wojtek-t can we get this approved for cherry-pick into v1.7?

caseydavenport · 2017-09-01T22:33:22Z

/lgtm
/approve no-issue

thockin · 2017-09-01T23:09:07Z

/approve no-issue

k8s-github-robot · 2017-09-01T23:49:10Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: caseydavenport, dnardo, gunjan5, thockin

Associated issue requirement bypassed by: caseydavenport, thockin

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~cluster/addons/calico-policy-controller/OWNERS~~ [caseydavenport,dnardo,thockin]
~~cluster/gce/OWNERS~~ [thockin]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

k8s-github-robot · 2017-09-03T20:13:26Z

/test all [submit-queue is verifying that this PR is safe to merge]

k8s-ci-robot · 2017-09-03T20:51:49Z

@gunjan5: The following tests failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
pull-kubernetes-e2e-kops-aws	`05661b6`	link	`/test pull-kubernetes-e2e-kops-aws`
pull-kubernetes-e2e-gce-bazel	`05661b6`	link	`/test pull-kubernetes-e2e-gce-bazel`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-github-robot · 2017-09-03T21:01:04Z

Automatic merge from submit-queue

wojtek-t · 2017-09-04T10:26:10Z

@dnardo @wojtek-t can we get this approved for cherry-pick into v1.7?

@caseydavenport - it seems like bug-fixes, which I think should be fine to cherrypick. But I would like to see a user-friendly release-note on this PR first.

gunjan5 · 2017-09-04T21:44:03Z

@wojtek-t @caseydavenport I've added the release note, someone needs to add the label release-note to the PR

wojtek-t · 2017-09-05T13:50:32Z

@gunjan5 @caseydavenport - I changed the label. I tried doing automated cherrypick, but this generated conflict. Can one of you prepare the cherrypick then?

gunjan5 · 2017-09-05T18:33:30Z

@wojtek-t I've created this cherrypick PR #51967
PTAL

…7-upstream-release-1.7 Automatic merge from submit-queue Automated cherry pick of #51237 Cherry pick of #51237 on release-1.7. #51237: Add RBAC, healthchecks, autoscaler and update Calico to

k8s-cherrypick-bot · 2017-09-06T09:17:25Z

Commit found in the "release-1.7" branch appears to be this PR. Removing the "cherrypick-candidate" label. If this is an error find help to get your PR picked.

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Aug 24, 2017

k8s-github-robot assigned caseydavenport and fasaxc Aug 24, 2017

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 24, 2017

k8s-github-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. release-note-none Denotes a PR that doesn't merit a release note. labels Aug 24, 2017

xilabao reviewed Aug 24, 2017

View reviewed changes

caseydavenport reviewed Aug 24, 2017

View reviewed changes

gunjan5 force-pushed the calico-2.5-rbac branch from 7c5ba70 to f2ed269 Compare August 25, 2017 02:45

k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 25, 2017

gunjan5 mentioned this pull request Aug 29, 2017

Update calico to v2.4 and enable health checks #49986

Closed

gunjan5 force-pushed the calico-2.5-rbac branch from 4bbdd66 to 96cc364 Compare August 30, 2017 22:44

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 30, 2017

gunjan5 force-pushed the calico-2.5-rbac branch 2 times, most recently from 5533dfe to 16dc434 Compare September 1, 2017 17:12

gunjan5 changed the title ~~Add RBAC, healthchecks, and update Calico to v2.5.0~~ Add RBAC, healthchecks, autoscalers and update Calico to v2.5.0 Sep 1, 2017

k8s-ci-robot assigned dnardo and wojtek-t Sep 1, 2017

dnardo reviewed Sep 1, 2017

View reviewed changes

caseydavenport reviewed Sep 1, 2017

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 1, 2017

gunjan5 force-pushed the calico-2.5-rbac branch from 16dc434 to 05661b6 Compare September 1, 2017 19:53

k8s-github-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 1, 2017

gunjan5 changed the title ~~Add RBAC, healthchecks, autoscalers and update Calico to v2.5.0~~ Add RBAC, healthchecks, autoscalers and update Calico to v2.5.1 Sep 1, 2017

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 1, 2017

thockin added this to the v1.8 milestone Sep 1, 2017

k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 1, 2017

k8s-github-robot merged commit 47d0db0 into kubernetes:master Sep 3, 2017

wojtek-t added the cherrypick-candidate label Sep 4, 2017

wojtek-t modified the milestones: v1.7, v1.8 Sep 4, 2017

wojtek-t added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Sep 5, 2017

This was referenced Sep 5, 2017

Automated cherry pick of #51237 #51960

Closed

Automated cherry pick of #51237 #51967

Merged

wojtek-t added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Sep 6, 2017

k8s-cherrypick-bot removed the cherrypick-candidate label Sep 6, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add RBAC, healthchecks, autoscalers and update Calico to v2.5.1 #51237

Add RBAC, healthchecks, autoscalers and update Calico to v2.5.1 #51237

gunjan5 commented Aug 24, 2017 •

edited

k8s-ci-robot commented Aug 24, 2017

xilabao Aug 24, 2017

gunjan5 Aug 25, 2017

caseydavenport Aug 24, 2017

dims commented Aug 25, 2017

gunjan5 commented Aug 28, 2017

gunjan5 commented Aug 29, 2017

gunjan5 commented Sep 1, 2017

dnardo Sep 1, 2017

gunjan5 Sep 1, 2017

caseydavenport Sep 1, 2017

dnardo Sep 1, 2017

gunjan5 Sep 1, 2017

dnardo Sep 1, 2017

dnardo commented Sep 1, 2017

caseydavenport Sep 1, 2017

caseydavenport commented Sep 1, 2017

caseydavenport commented Sep 1, 2017

caseydavenport commented Sep 1, 2017

caseydavenport commented Sep 1, 2017

thockin commented Sep 1, 2017

k8s-github-robot commented Sep 1, 2017

k8s-github-robot commented Sep 3, 2017

k8s-ci-robot commented Sep 3, 2017 •

edited

k8s-github-robot commented Sep 3, 2017

wojtek-t commented Sep 4, 2017

gunjan5 commented Sep 4, 2017

wojtek-t commented Sep 5, 2017

gunjan5 commented Sep 5, 2017

k8s-cherrypick-bot commented Sep 6, 2017

		@@ -0,0 +1,87 @@
		kind: ClusterRole
		apiVersion: rbac.authorization.k8s.io/v1beta1

		@@ -1796,20 +1748,9 @@ function start-kube-addons {
		if [[ "${NETWORK_POLICY_PROVIDER:-}" == "calico" ]]; then
		setup-addon-manifests "addons" "calico-policy-controller"

Add RBAC, healthchecks, autoscalers and update Calico to v2.5.1 #51237

Add RBAC, healthchecks, autoscalers and update Calico to v2.5.1 #51237

Conversation

gunjan5 commented Aug 24, 2017 • edited

k8s-ci-robot commented Aug 24, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dims commented Aug 25, 2017

gunjan5 commented Aug 28, 2017

gunjan5 commented Aug 29, 2017

gunjan5 commented Sep 1, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dnardo commented Sep 1, 2017

Choose a reason for hiding this comment

caseydavenport commented Sep 1, 2017

caseydavenport commented Sep 1, 2017

caseydavenport commented Sep 1, 2017

caseydavenport commented Sep 1, 2017

thockin commented Sep 1, 2017

k8s-github-robot commented Sep 1, 2017

k8s-github-robot commented Sep 3, 2017

k8s-ci-robot commented Sep 3, 2017 • edited

k8s-github-robot commented Sep 3, 2017

wojtek-t commented Sep 4, 2017

gunjan5 commented Sep 4, 2017

wojtek-t commented Sep 5, 2017

gunjan5 commented Sep 5, 2017

k8s-cherrypick-bot commented Sep 6, 2017

gunjan5 commented Aug 24, 2017 •

edited

k8s-ci-robot commented Sep 3, 2017 •

edited