Merge pull request #4258 from openshift-cherrypick-robot/cherry-pick-…

…4252-to-release-4.14 [release-4.14] OCPBUGS-30872: add static pods for rbacproxy
openshift · Mar 13, 2024 · 0a2da4e · 0a2da4e
2 parents 1c8361d + ee49927
commit 0a2da4e
Show file tree

Hide file tree

Showing 7 changed files with 185 additions and 9 deletions.
diff --git a/pkg/controller/template/constants.go b/pkg/controller/template/constants.go
@@ -21,4 +21,7 @@ const (
 
 	// BaremetalRuntimeCfgKey is the key that references the baremetal-runtimecfg image in the controller
 	BaremetalRuntimeCfgKey string = "baremetalRuntimeCfgImage"
+
+	// KubeRbacProxyKey the key that references the kubeRbacProxy image
+	KubeRbacProxyKey string = "kubeRbacProxyImage"
 )
diff --git a/pkg/operator/bootstrap.go b/pkg/operator/bootstrap.go
@@ -151,6 +151,7 @@ func RenderBootstrap(
 		templatectrl.CorednsKey:             imgs.Coredns,
 		templatectrl.HaproxyKey:             imgs.Haproxy,
 		templatectrl.BaremetalRuntimeCfgKey: imgs.BaremetalRuntimeCfg,
+		templatectrl.KubeRbacProxyKey:       imgs.KubeRbacProxy,
 	}
 
 	config := getRenderConfig("", string(filesData[kubeAPIServerServingCA]), spec, &imgs.RenderConfigImages, infra.Status.APIServerInternalURL, nil)
@@ -177,7 +178,8 @@ func RenderBootstrap(
 		}, {
 			name:     "manifests/machineconfigserver/kube-apiserver-serving-ca-configmap.yaml",
 			filename: "manifests/kube-apiserver-serving-ca-configmap.yaml",
-		}}
+		},
+	}
 
 	manifests = appendManifestsByPlatform(manifests, *infra)
 

diff --git a/pkg/operator/sync.go b/pkg/operator/sync.go
@@ -53,13 +53,11 @@ const (
 	requiredForUpgradeMachineConfigPoolLabelKey = "operator.machineconfiguration.openshift.io/required-for-upgrade"
 )
 
-var (
-	platformsRequiringCloudConf = sets.NewString(
-		string(configv1.AzurePlatformType),
-		string(configv1.GCPPlatformType),
-		string(configv1.OpenStackPlatformType),
-		string(configv1.VSpherePlatformType),
-	)
+var platformsRequiringCloudConf = sets.NewString(
+	string(configv1.AzurePlatformType),
+	string(configv1.GCPPlatformType),
+	string(configv1.OpenStackPlatformType),
+	string(configv1.VSpherePlatformType),
 )
 
 type manifestPaths struct {
@@ -567,6 +565,7 @@ func (optr *Operator) syncRenderConfig(_ *renderConfig) error {
 		templatectrl.CorednsKey:               imgs.Coredns,
 		templatectrl.HaproxyKey:               imgs.Haproxy,
 		templatectrl.BaremetalRuntimeCfgKey:   imgs.BaremetalRuntimeCfg,
+		templatectrl.KubeRbacProxyKey:         imgs.KubeRbacProxy,
 	}
 
 	ignitionHost, err := getIgnitionHost(&infra.Status)
@@ -1562,7 +1561,6 @@ func isPoolStatusConditionTrue(pool *mcfgv1.MachineConfigPool, conditionType mcf
 // global pull secret. It also adds a default route to the registry for the firstboot scenario.
 
 func (optr *Operator) getImageRegistryPullSecrets() ([]byte, error) {
-
 	// Check if image registry exists, if it doesn't we no-op
 	co, err := optr.mcoCOLister.Get("image-registry")
 

diff --git a/templates/master/01-master-kubelet/_base/files/criometricsproxy-config.yaml b/templates/master/01-master-kubelet/_base/files/criometricsproxy-config.yaml
@@ -0,0 +1,11 @@
+mode: 0644
+path: "/etc/kubernetes/crio-metrics-proxy.cfg"
+contents:
+  inline: |-
+    authorization:
+      static:
+        - resourceRequest: false
+          path: /metrics
+          verb: get
+          user:
+            name: system:serviceaccount:openshift-monitoring:prometheus-k8s
diff --git a/templates/master/01-master-kubelet/_base/files/criometricsproxy.yaml b/templates/master/01-master-kubelet/_base/files/criometricsproxy.yaml
@@ -0,0 +1,75 @@
+mode: 0644
+path: "/etc/kubernetes/manifests/criometricsproxy.yaml"
+contents:
+  inline: |-
+    apiVersion: v1
+    kind: Pod
+    metadata:
+      name: kube-rbac-proxy-crio
+      namespace: openshift-machine-config-operator
+    spec:
+      volumes:
+      - name: etc-kube
+        hostPath:
+          path: "/etc/kubernetes"
+      - name: var-lib-kubelet
+        hostPath:
+          path: "/var/lib/kubelet"
+      hostNetwork: true
+      priorityClassName: system-cluster-critical
+      initContainers:
+      - name: setup
+        terminationMessagePolicy: FallbackToLogsOnError
+        image: {{.Images.kubeRbacProxyImage}}
+        imagePullPolicy: IfNotPresent
+        volumeMounts:
+        - name: var-lib-kubelet
+          mountPath: "/var"
+          mountPropagation: HostToContainer
+        command: ['/bin/bash', '-ec']
+        args:
+        - |
+          echo -n "Waiting for kubelet key and certificate to be available"
+          while [ -n "$(test -e /var/lib/kubelet/pki/kubelet-server-current.pem)" ] ; do
+            echo -n "."
+            sleep 1
+            (( tries += 1 ))
+            if [[ "${tries}" -gt 10 ]]; then
+              echo "Timed out waiting for kubelet key and cert."
+              exit 1
+            fi
+          done
+        securityContext:
+          privileged: true
+      resources:
+        requests:
+          memory: 50Mi
+          cpu: 5m
+      containers:
+      - name: kube-rbac-proxy-crio
+        image: {{.Images.kubeRbacProxyImage}}
+        securityContext:
+          privileged: true
+        ports:
+        - containerPort: 9637
+        args:
+        - --secure-listen-address=:9637
+        - --config-file=/etc/kubernetes/crio-metrics-proxy.cfg
+        - --client-ca-file=/etc/kubernetes/kubelet-ca.crt
+        - --logtostderr=true
+        - --kubeconfig=/var/lib/kubelet/kubeconfig
+        - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+        - --upstream=http://127.0.0.1:9537
+        - --tls-cert-file=/var/lib/kubelet/pki/kubelet-server-current.pem
+        - --tls-private-key-file=/var/lib/kubelet/pki/kubelet-server-current.pem
+        resources:
+          requests:
+            cpu: 20m
+            memory: 50Mi
+        volumeMounts:
+        - name: etc-kube
+          mountPath: "/etc/kubernetes"
+          mountPropagation: HostToContainer
+        - name: var-lib-kubelet
+          mountPath: "/var/lib/kubelet"
+          mountPropagation: HostToContainer
diff --git a/templates/worker/01-worker-kubelet/_base/files/criometricsproxy-config.yaml b/templates/worker/01-worker-kubelet/_base/files/criometricsproxy-config.yaml
@@ -0,0 +1,12 @@
+mode: 0644
+mode: 0644
+path: "/etc/kubernetes/crio-metrics-proxy.cfg"
+contents:
+  inline: |-
+    authorization:
+      static:
+        - resourceRequest: false
+          path: /metrics
+          verb: get
+          user:
+            name: system:serviceaccount:openshift-monitoring:prometheus-k8s
diff --git a/templates/worker/01-worker-kubelet/_base/files/criometricsproxy.yaml b/templates/worker/01-worker-kubelet/_base/files/criometricsproxy.yaml
@@ -0,0 +1,75 @@
+mode: 0644
+path: "/etc/kubernetes/manifests/criometricsproxy.yaml"
+contents:
+  inline: |-
+    apiVersion: v1
+    kind: Pod
+    metadata:
+      name: kube-rbac-proxy-crio
+      namespace: openshift-machine-config-operator
+    spec:
+      volumes:
+      - name: etc-kube
+        hostPath:
+          path: "/etc/kubernetes"
+      - name: var-lib-kubelet
+        hostPath:
+          path: "/var/lib/kubelet"
+      hostNetwork: true
+      priorityClassName: system-cluster-critical
+      initContainers:
+      - name: setup
+        terminationMessagePolicy: FallbackToLogsOnError
+        image: {{.Images.kubeRbacProxyImage}}
+        imagePullPolicy: IfNotPresent
+        volumeMounts:
+        - name: var-lib-kubelet
+          mountPath: "/var"
+          mountPropagation: HostToContainer
+        command: ['/bin/bash', '-ec']
+        args:
+        - |
+          echo -n "Waiting for kubelet key and certificate to be available"
+          while [ -n "$(test -e /var/lib/kubelet/pki/kubelet-server-current.pem)" ] ; do
+            echo -n "."
+            sleep 1
+            (( tries += 1 ))
+            if [[ "${tries}" -gt 10 ]]; then
+              echo "Timed out waiting for kubelet key and cert."
+              exit 1
+            fi
+          done
+        securityContext:
+          privileged: true
+      resources:
+        requests:
+          memory: 50Mi
+          cpu: 5m
+      containers:
+      - name: kube-rbac-proxy-crio
+        image: {{.Images.kubeRbacProxyImage}}
+        securityContext:
+          privileged: true
+        ports:
+        - containerPort: 9637
+        args:
+        - --secure-listen-address=:9637
+        - --config-file=/etc/kubernetes/crio-metrics-proxy.cfg
+        - --client-ca-file=/etc/kubernetes/kubelet-ca.crt
+        - --logtostderr=true
+        - --kubeconfig=/var/lib/kubelet/kubeconfig
+        - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+        - --upstream=http://127.0.0.1:9537
+        - --tls-cert-file=/var/lib/kubelet/pki/kubelet-server-current.pem
+        - --tls-private-key-file=/var/lib/kubelet/pki/kubelet-server-current.pem
+        resources:
+          requests:
+            cpu: 20m
+            memory: 50Mi
+        volumeMounts:
+        - name: etc-kube
+          mountPath: "/etc/kubernetes"
+          mountPropagation: HostToContainer
+        - name: var-lib-kubelet
+          mountPath: "/var/lib/kubelet"
+          mountPropagation: HostToContainer