kubeadm system container #96

jasonbrooks · 2017-07-28T22:04:30Z

A system container for kubeadm, as blogged about at http://www.projectatomic.io/blog/2017/05/testing-system-containerized-kubeadm/, but with fedora containers.

atomic install --system --system-package=no --name kubelet docker.io/jasonbrooks/kubeadm
systemctl start kubelet
kubeadm init

ashcrow

Good stuff, but a few updates are needed.

ashcrow · 2017-07-31T13:53:26Z

kubeadm/Dockerfile

+ENV container=docker
+
+ENV NAME=kubeadm VERSION=0 RELEASE=0 ARCH=x86_64
+LABEL BZComponent="$NAME" \


Labels should be lower case.

ashcrow · 2017-07-31T13:54:00Z

kubeadm/Dockerfile

+        Architecture="$ARCH" \
+        atomic.type='system'
+
+RUN dnf install -y docker iproute kubernetes-kubeadm kubernetes-node kubernetes-client containernetworking-cni ethtool ebtables && dnf clean all 


--setopt=tsflags=nodocs should be used to help keep the size down.

ashcrow · 2017-07-31T13:56:43Z

kubeadm/Dockerfile

+FROM registry.fedoraproject.org/fedora:rawhide
+MAINTAINER "Jason Brooks" <jbrooks@redhat.com>
+
+ENV container=docker


I don't see a reference to this used in the system container itself. It may be worth putting a comment above it explaining what it's used for.

giuseppe · 2017-07-31T14:06:14Z

kubeadm/launch.sh

+export KUBELET_KUBECONFIG_ARGS="--kubeconfig=/etc/kubernetes/kubelet.conf --require-kubeconfig=true"
+export KUBELET_SYSTEM_PODS_ARGS='--pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true --cgroup-driver=systemd --cgroups-per-qos=false --enforce-node-allocatable='
+export KUBELET_NETWORK_ARGS="--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/usr/libexec/cni"
+export KUBELET_DNS_ARGS="--cluster-dns=10.96.0.10 --cluster-domain=cluster.local"


should this value be hardcoded?

get env values from config file if there's a crio drop-in, use it add back temp_kubelet_args place kubelet vars in an editable location, look for crio env vars if available fix dockerfile tweaks

ashcrow · 2017-10-18T19:33:26Z

<snip>
Testing container kubeadm
<snip>
config.json.template: linux/selinuxProcessLabel not valid.  Use process/selinuxLabel

ashcrow · 2017-10-18T19:33:51Z

kubeadm/config.json.template

+        ],
+        "devices": null,
+        "apparmorProfile": "",
+        "selinuxProcessLabel": ""


This line doesn't look valid.

ashcrow · 2017-10-18T19:40:47Z

kubeadm/config.json.template

+             ]
+          },
+          {
+            "type": "bind",


Just checking, is this mount used?

I'm not sure if it's strictly needed. The service part of this container is the kubelet, and I based the container on the kubelet system container. That one includes this mount.

I won't block on it, but if it isn't needed it would be nice to remove it later.

I'll do some tests

ashcrow

Looks much better. A few questions and one thing that needs to be fixed.

ashcrow · 2017-10-18T20:06:28Z

@jasonbrooks

Testing file ./kubeadm/config.json.template
parse error: invalid object key (must be a string)
                                        {     "ociVersion": "1.0.0",  
                     (right here) ------^
JSON is invalid

I think it's really the extra coma:

        "devices": null,
        "apparmorProfile": "", <--------------
    }
}

jasonbrooks · 2017-10-18T20:12:41Z

@ashcrow I amended 7a4e0e5 to remove that comma

ashcrow · 2017-10-18T20:38:50Z

@rh-atomic-bot r+ 7a4e0e5

rh-atomic-bot · 2017-10-18T20:38:56Z

⚡ Test exempted: merge already tested.

Closes: #96 Approved by: ashcrow

ashcrow requested changes Jul 31, 2017

View reviewed changes

giuseppe reviewed Jul 31, 2017

View reviewed changes

ashcrow changed the title ~~kubeadm system container~~ WIP: kubeadm system container Oct 17, 2017

jasonbrooks force-pushed the kubeadm-rawhide branch from 038b680 to 59e8819 Compare October 18, 2017 18:03

kubeadm system container

8aff4d5

get env values from config file if there's a crio drop-in, use it add back temp_kubelet_args place kubelet vars in an editable location, look for crio env vars if available fix dockerfile tweaks

jasonbrooks force-pushed the kubeadm-rawhide branch from 852da79 to 8aff4d5 Compare October 18, 2017 18:45

ashcrow reviewed Oct 18, 2017

View reviewed changes

ashcrow changed the title ~~WIP: kubeadm system container~~ kubeadm system container Oct 18, 2017

ashcrow requested changes Oct 18, 2017

View reviewed changes

drop empty selinuxProcessLabel

7a4e0e5

jasonbrooks force-pushed the kubeadm-rawhide branch from fabc528 to 7a4e0e5 Compare October 18, 2017 20:09

ashcrow approved these changes Oct 18, 2017

View reviewed changes

rh-atomic-bot closed this in 7c13803 Oct 18, 2017

rh-atomic-bot pushed a commit that referenced this pull request Oct 18, 2017

drop empty selinuxProcessLabel

56a01b7

Closes: #96 Approved by: ashcrow

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

kubeadm system container #96

kubeadm system container #96

jasonbrooks commented Jul 28, 2017 •

edited

ashcrow left a comment

ashcrow Jul 31, 2017

ashcrow Jul 31, 2017

ashcrow Jul 31, 2017

giuseppe Jul 31, 2017

ashcrow commented Oct 18, 2017

ashcrow Oct 18, 2017

ashcrow Oct 18, 2017

jasonbrooks Oct 18, 2017

ashcrow Oct 18, 2017

jasonbrooks Oct 18, 2017

ashcrow left a comment

ashcrow commented Oct 18, 2017 •

edited

jasonbrooks commented Oct 18, 2017

ashcrow commented Oct 18, 2017

rh-atomic-bot commented Oct 18, 2017

kubeadm system container #96

kubeadm system container #96

Conversation

jasonbrooks commented Jul 28, 2017 • edited

ashcrow left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ashcrow commented Oct 18, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ashcrow left a comment

Choose a reason for hiding this comment

ashcrow commented Oct 18, 2017 • edited

jasonbrooks commented Oct 18, 2017

ashcrow commented Oct 18, 2017

rh-atomic-bot commented Oct 18, 2017

jasonbrooks commented Jul 28, 2017 •

edited

ashcrow commented Oct 18, 2017 •

edited