Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Run etcd on localhost for all providers. #6422

Merged
merged 1 commit into from
Apr 3, 2015
Merged

Run etcd on localhost for all providers. #6422

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion cluster/libvirt-coreos/user_data_master.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ coreos:
ExecStart=/opt/kubernetes/bin/kube-apiserver \
--address=0.0.0.0 \
--port=8080 \
--etcd_servers=${etcd_servers} \
--etcd_servers=http://127.0.0.1:4001 \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Salt ones I'm comfortable with. Do you know if libvirt-coreos is launching the etcd pod yet? I suppose this shouldn't matter anyways, though, since it's running regardless, but in true Core style, it looks like libvirt-coreos is setting up an etcd cluster, too? https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/libvirt-coreos/util.sh#L194

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should lock down etcd on localhost and have it be a single instance only.

In the etcd cluster scenario, etcd is obviously bound on host ips.
This leaves etcd exposed since it is unsecured.

Hence, For the libvrt/vireos case too , I think we should have it be a single etcd instance.

Once we have our etcd cluster story with proper access controls, we can enable it for all providers.

Sent from my iPhone

On Apr 3, 2015, at 2:18 PM, Zach Loafman notifications@github.com wrote:

In cluster/libvirt-coreos/user_data_master.yml:

@@ -16,7 +16,7 @@ coreos:
ExecStart=/opt/kubernetes/bin/kube-apiserver
--address=0.0.0.0
--port=8080 \

—
Reply to this email directly or view it on GitHub.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair enough.

--kubelet_port=10250 \
--portal_net=${PORTAL_NET}
Restart=always
Expand Down
6 changes: 0 additions & 6 deletions cluster/libvirt-coreos/util.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,12 +191,6 @@ function kube-up {

readonly machines=$(join , "${KUBE_MINION_IP_ADDRESSES[@]}")

etcd_servers=( $MASTER_IP ${MINION_IPS[@]} )
for (( i=0; i<${#etcd_servers[@]}; i++ )); do
etcd_servers[$i]=http://${etcd_servers[$i]}:4001
done
etcd_servers=$(join , ${etcd_servers[@]})

local i
for (( i = 0 ; i <= $NUM_MINIONS ; i++ )); do
if [[ $i -eq $NUM_MINIONS ]]; then
Expand Down
10 changes: 2 additions & 8 deletions cluster/saltbase/salt/etcd/etcd.manifest
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,3 @@
{% if grains.cloud is defined and grains.cloud == 'gce' -%}
{% set etcd_addr = "127.0.0.1" -%}
{% else -%}
{% set etcd_addr = salt['grains.get']('fqdn_ip4')[0] -%}
{% endif -%}

{
"apiVersion": "v1beta3",
"kind": "Pod",
Expand All @@ -17,9 +11,9 @@
"command": [
"/usr/local/bin/etcd",
"--addr",
"{{etcd_addr}}:4001",
"127.0.0.1:4001",
"--bind-addr",
"{{etcd_addr}}:4001",
"127.0.0.1:4001",
"--data-dir",
"/var/etcd/data"
],
Expand Down
9 changes: 1 addition & 8 deletions cluster/saltbase/salt/kube-apiserver/default
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,14 +31,7 @@
{% set publicAddressOverride = "--public_address_override=" + grains.publicAddressOverride -%}
{% endif -%}

{% if grains.cloud is defined and grains.cloud == 'gce' -%}
{% set etcd_servers = "--etcd_servers=http://127.0.0.1:4001" -%}
{% elif grains.etcd_servers is defined -%}
{% set etcd_servers = "--etcd_servers=http://" + grains.etcd_servers + ":4001" -%}
{% else -%}
{% set ips = salt['mine.get']('roles:kubernetes-master', 'network.ip_addrs', 'grain').values() -%}
{% set etcd_servers = "--etcd_servers=http://" + ips[0][0] + ":4001" -%}
{% endif -%}
{% set etcd_servers = "--etcd_servers=http://127.0.0.1:4001" -%}

{% if pillar['portal_net'] is defined -%}
{% set portal_net = "--portal_net=" + pillar['portal_net'] -%}
Expand Down
1 change: 0 additions & 1 deletion cluster/vagrant/provision-master.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,6 @@ grains:
publicAddressOverride: '$(echo "$MASTER_IP" | sed -e "s/'/''/g")'
network_mode: openvswitch
networkInterfaceName: eth1
etcd_servers: '$(echo "$MASTER_IP" | sed -e "s/'/''/g")'
api_servers: '$(echo "$MASTER_IP" | sed -e "s/'/''/g")'
cloud: vagrant
roles:
Expand Down
1 change: 0 additions & 1 deletion cluster/vagrant/provision-minion.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,6 @@ grains:
cloud: vagrant
network_mode: openvswitch
node_ip: '$(echo "$MINION_IP" | sed -e "s/'/''/g")'
etcd_servers: '$(echo "$MASTER_IP" | sed -e "s/'/''/g")'
api_servers: '$(echo "$MASTER_IP" | sed -e "s/'/''/g")'
networkInterfaceName: eth1
roles:
Expand Down