Skip to content

battery-operator v0.3.1: links into /var where Kubernetes writes, and Calico on a Host

Choose a tag to compare

View all tags
@phoban01 phoban01 released this 05 Oct 19:12
· 10 commits to main since this release
v0.3.1
This tag was signed with the committer’s verified signature.
phoban01 Piaras Hoban
SSH Key Fingerprint: GMtua20zVpR+S2kIasX5Bx0MbK0YUrDoEqqSw6rRqbE
Verified
Learn about vigilant mode.
382b4fb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The Host Image now gives Kubernetes somewhere to write, and pod networking with Calico is proven on a Host.

  • /opt, /usr/local and /usr/libexec/kubernetes are links into /var (HI-082): /var/opt, /var/usrlocal and /var/libexec/kubernetes. On bootc these paths are read-only, so charts that write under /opt (such as local-path-provisioner), DaemonSets that install into /usr/local/bin, and the kubelet's flex-volume and credential-provider plugins failed before. Each target carries the label SELinux gives the path that links to it. /usr/lib/modules stays read-only. See "Where Kubernetes writes" in hostimage/README.md.
  • Calico v3.32.2 runs on a Host with SELinux enforcing and no changes to the image. A normal pod on a Host gets a pod IP, reaches pods and Services on other Nodes, and resolves cluster DNS. MicroVMs still reach the internet, and still cannot reach pod, Service or API server addresses.
  • hack/kubeadm-host now runs Calico and checks pod networking and guest isolation in its smoke steps.
  • The Hosts page covers Calico on AWS: CAPA's default security group admits Calico's BGP and IP-in-IP, and IP_AUTODETECTION_METHOD=kubernetes-internal-ip pins a Host's address, since a Host also has the guest bridge flbr0.

Not yet proven: Calico on a real AWS Host, and MicroVMs on Cloud Hypervisor (#202).

The Operator and the Exec Agent have not changed since v0.2.1. The Host Image keeps Kubernetes v1.36.3, containerd v2.2.9, flintlock v0.16.0, Firecracker v1.16.1 and Cloud Hypervisor v48.0.

Manifests artifact:

ghcr.io/phoban01/battery-operator/manifests:v0.3.1@sha256:440a7b08a05ebc234aa4d6db13078caba6dc4500484e60dec68943990631edb3
flux pull artifact oci://ghcr.io/phoban01/battery-operator/manifests:v0.3.1 --output ./battery-operator

Images, for linux/amd64 and linux/arm64:

  • ghcr.io/phoban01/battery-operator:v0.3.1
  • ghcr.io/phoban01/battery-operator/exec-agent:v0.3.1
  • ghcr.io/phoban01/battery-operator/host-image:v0.3.1
Assets 2
Loading