Delegated PKI and adapt to k8s 1.15.3+ #412
Conversation
Merge from upstream repository
# Este es el mensaje del 1er commit: Add extra etcd configuration settings # Este es el mensaje del commit #2: Adapt generic etcd configuration file too # Este es el mensaje del commit puppetlabs#3: Add delegated_pki variable # Este es el mensaje del commit puppetlabs#4: Optional for certs # Este es el mensaje del commit puppetlabs#5: More optionals and some checking # Este es el mensaje del commit puppetlabs#6: || to or # Este es el mensaje del commit puppetlabs#7: Print docker/daemon.json , conditionally in debian # Este es el mensaje del commit puppetlabs#8: Add etcd_max_wals var to proper place # Este es el mensaje del commit puppetlabs#9: Actually fix docker/daemon.json # Este es el mensaje del commit puppetlabs#10: Use hostname in initial advertise if SRV discovery # Este es el mensaje del commit puppetlabs#11: Add more missing etcd vars to config/kubeadm.pp # Este es el mensaje del commit puppetlabs#12: Add more missing etcd vars to config/kubeadm.pp, use variant # Este es el mensaje del commit puppetlabs#13: Forward cgroup driver to docker daemon too # Este es el mensaje del commit puppetlabs#14: Forward cgroup driver to docker daemon too, fix redhat docker.json template # Este es el mensaje del commit puppetlabs#15: parametrize kube_api_bind_port
Make sa_* optionals Escape version dot Use v1beta2 on 1.15.3 and more Add resourceContainer: / to kube-proxy config Manage kubeadm join discovery file Manage kubeadm join discovery file Don't add --config if --discovery-file is present Test that docker/daemon.json is a valid JSON when generated, small fixes to template Adjust comment in init.pp and add test for kube_api_bind_port Add some test to kubeadm_* resources
Codecov Report
@@ Coverage Diff @@
## master #412 +/- ##
======================================
Coverage 0.00% 0.00%
======================================
Files 2 2
Lines 44 44
======================================
Misses 44 44
Continue to review full report at Codecov.
|
|
Hi @Wiston999, This PR looks awesome. Can you just add in one more small change to https://github.com/puppetlabs/puppetlabs-kubernetes/pull/412/files#diff-c02a38238e7c64b900f10d4e5ae14800R40 as etcd versions prior to 3.3.0 do not have the auto-compaction-mode parameter ? Bumping the default etcd version of the module to 3.4.0 resulted in having all acceptance test green as you can see here: Once you add a condition in the etcd template for the older versions of etcd we can get this merged. |
…reater than 3.3.0. Adapt some specs to verify templates
|
Hi @Wiston999, great job! Thank you for all your work! |
This PR is the result of adapting the module to be used to replace a kubespray based deployment for a k8s 1.15.3 version.
The main relevant changes in the PR are the following:
delegated_pkioption. If set totrue, all the required x509 certificates under/etc/kubernetes/pki/must be provided externally by the module user by other means. We added that option as we are providing all certificates (includingsa.pubandsa.key) from a Hashicorp Vault server dinamically instead of the ones generated bykubetool.daemon.jsontemplates.docker_cgroup_drivervariable for/etc/docker/daemon.jsongenerated file.,whendocker_storage_optsis empty.,whendocker_extra_daemon_configis an empty stringdaemon.jsonfile is actually a JSON valid file.etcd:discovery_srvmethod (https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/clustering.md#dns-discovery). Ifetcd_discovery_srvvariable is set and not empty then take precedence overetcd_initial_clustersetting.etcd_compaction_method,etcd_compaction_retentionandetcd_max_walssettings for etcd servers.join_discovery_filevariable tokubernetesclass.kubeadm jointo use a--discovery-fileinstead of--configparameters. This is needed when certificates are provided externally.kube_api_bind_portvariablekubernetesclass. Used to override default port forbindPortforInitConfigurationin/etc/kubernetes/config.yamlv1beta2kubeadm configuration version for kubernetes 1.15.3+. (Probably can be used for all 1.15 versions).