From a637b09d6b5591253763492964a96a39d43da439 Mon Sep 17 00:00:00 2001 From: Daniel Quinlan Date: Sun, 17 Jul 2022 15:05:19 -0700 Subject: [PATCH 1/3] move install-cni.sh to an initContainer --- doc/crds/daemonset-install.yaml | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/doc/crds/daemonset-install.yaml b/doc/crds/daemonset-install.yaml index 5783fc81a..c2fe2f0fc 100644 --- a/doc/crds/daemonset-install.yaml +++ b/doc/crds/daemonset-install.yaml @@ -93,14 +93,33 @@ spec: tolerations: - operator: Exists effect: NoSchedule + initContainers: + - name: install-cin-bin + command: [ "/bin/sh" ] + args: + - "-c" + - "SLEEP=false /install-cni.sh" + image: ghcr.io/k8snetworkplumbingwg/whereabouts:latest-amd64 + env: + - name: WHEREABOUTS_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + resources: + requests: + cpu: "100m" + memory: "50Mi" + limits: + cpu: "100m" + memory: "50Mi" + securityContext: + privileged: true + volumeMounts: + - name: cnibin + mountPath: /host/opt/cni/bin containers: - name: whereabouts - command: [ "/bin/sh" ] - args: - - -c - - > - SLEEP=false /install-cni.sh && - /ip-control-loop -log-level debug + command: [ "/ip-control-loop -log-level debug" ] image: ghcr.io/k8snetworkplumbingwg/whereabouts:latest-amd64 env: - name: WHEREABOUTS_NAMESPACE From c545a96201751dc0d542826df60c961f606830d4 Mon Sep 17 00:00:00 2001 From: Daniel Quinlan Date: Mon, 18 Jul 2022 07:35:09 -0700 Subject: [PATCH 2/3] remove unneeded SLEEP var, fix command: --- doc/crds/daemonset-install.yaml | 5 +---- script/install-cni.sh | 8 -------- 2 files changed, 1 insertion(+), 12 deletions(-) diff --git a/doc/crds/daemonset-install.yaml b/doc/crds/daemonset-install.yaml index c2fe2f0fc..39b52ab54 100644 --- a/doc/crds/daemonset-install.yaml +++ b/doc/crds/daemonset-install.yaml @@ -95,10 +95,7 @@ spec: effect: NoSchedule initContainers: - name: install-cin-bin - command: [ "/bin/sh" ] - args: - - "-c" - - "SLEEP=false /install-cni.sh" + command: [ "/install-bin.sh" ] image: ghcr.io/k8snetworkplumbingwg/whereabouts:latest-amd64 env: - name: WHEREABOUTS_NAMESPACE diff --git a/script/install-cni.sh b/script/install-cni.sh index 6eab0ff56..ce9ede849 100755 --- a/script/install-cni.sh +++ b/script/install-cni.sh @@ -115,11 +115,3 @@ fi cp -f /whereabouts $CNI_BIN_DIR # ---------------------- end Generate a "kube-config". - -# Unless told otherwise, sleep forever. -# This prevents Kubernetes from restarting the pod repeatedly. -should_sleep=${SLEEP:-"true"} -echo "Done configuring CNI. Sleep=$should_sleep" -while [ "$should_sleep" == "true" ]; do - sleep 1000000000000 -done From 69c48c593153be366dc7f85d2190fe98a28c6c63 Mon Sep 17 00:00:00 2001 From: Daniel Quinlan Date: Mon, 18 Jul 2022 09:10:54 -0700 Subject: [PATCH 3/3] make script shellcheck clean - quote all the things - remove some bits that aren't POSIX but busybox sh supports, to make shellcheck happy - make chown modes absolute --- script/install-cni.sh | 54 +++++++++++++++++++++---------------------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/script/install-cni.sh b/script/install-cni.sh index ce9ede849..d710dd03a 100755 --- a/script/install-cni.sh +++ b/script/install-cni.sh @@ -10,36 +10,36 @@ set -u -e # #SPDX-License-Identifier: Apache-2.0 -CNI_BIN_DIR=${CNI_BIN_DIR:-"/host/opt/cni/bin/"} -WHEREABOUTS_KUBECONFIG_FILE_HOST=${WHEREABOUTS_KUBECONFIG_FILE_HOST:-"/etc/cni/net.d/whereabouts.d/whereabouts.kubeconfig"} -CNI_CONF_DIR=${CNI_CONF_DIR:-"/host/etc/cni/net.d"} +CNI_BIN_DIR="${CNI_BIN_DIR:-"/host/opt/cni/bin/"}" +WHEREABOUTS_KUBECONFIG_FILE_HOST="${WHEREABOUTS_KUBECONFIG_FILE_HOST:-"/etc/cni/net.d/whereabouts.d/whereabouts.kubeconfig"}" +CNI_CONF_DIR="${CNI_CONF_DIR:-"/host/etc/cni/net.d"}" # Make a whereabouts.d directory (for our kubeconfig) -mkdir -p $CNI_CONF_DIR/whereabouts.d -WHEREABOUTS_KUBECONFIG=$CNI_CONF_DIR/whereabouts.d/whereabouts.kubeconfig -WHEREABOUTS_FLATFILE=$CNI_CONF_DIR/whereabouts.d/whereabouts.conf -WHEREABOUTS_KUBECONFIG_LITERAL=$(echo "$WHEREABOUTS_KUBECONFIG" | sed -e s'|/host||') +mkdir -p "$CNI_CONF_DIR/whereabouts.d" +WHEREABOUTS_KUBECONFIG="$CNI_CONF_DIR/whereabouts.d/whereabouts.kubeconfig" +WHEREABOUTS_FLATFILE="$CNI_CONF_DIR/whereabouts.d/whereabouts.conf" +WHEREABOUTS_KUBECONFIG_LITERAL="${WHEREABOUTS_KUBECONFIG##/host}" # ------------------------------- Generate a "kube-config" -SERVICE_ACCOUNT_PATH=/var/run/secrets/kubernetes.io/serviceaccount -KUBE_CA_FILE=${KUBE_CA_FILE:-$SERVICE_ACCOUNT_PATH/ca.crt} -SERVICEACCOUNT_TOKEN=$(cat $SERVICE_ACCOUNT_PATH/token) -SKIP_TLS_VERIFY=${SKIP_TLS_VERIFY:-false} +SERVICE_ACCOUNT_PATH="/var/run/secrets/kubernetes.io/serviceaccount" +KUBE_CA_FILE="${KUBE_CA_FILE:-$SERVICE_ACCOUNT_PATH/ca.crt}" +SERVICEACCOUNT_TOKEN="$(cat $SERVICE_ACCOUNT_PATH/token)" +SKIP_TLS_VERIFY="${SKIP_TLS_VERIFY:-false}" # Setup our logging routines -function log() +log() { echo "$(date --iso-8601=seconds) ${1}" } -function error() +error() { log "ERR: {$1}" } -function warn() +warn() { log "WARN: {$1}" } @@ -48,32 +48,32 @@ function warn() # Check if we're running as a k8s pod. if [ -f "$SERVICE_ACCOUNT_PATH/token" ]; then # We're running as a k8d pod - expect some variables. - if [ -z ${KUBERNETES_SERVICE_HOST} ]; then + if [ -z "${KUBERNETES_SERVICE_HOST}" ]; then error "KUBERNETES_SERVICE_HOST not set"; exit 1; fi - if [ -z ${KUBERNETES_SERVICE_PORT} ]; then + if [ -z "${KUBERNETES_SERVICE_PORT}" ]; then error "KUBERNETES_SERVICE_PORT not set"; exit 1; fi - if [ "$SKIP_TLS_VERIFY" == "true" ]; then + if [ "$SKIP_TLS_VERIFY" = "true" ]; then TLS_CFG="insecure-skip-tls-verify: true" elif [ -f "$KUBE_CA_FILE" ]; then - TLS_CFG="certificate-authority-data: $(cat $KUBE_CA_FILE | base64 | tr -d '\n')" + TLS_CFG="certificate-authority-data: $(base64 < "$KUBE_CA_FILE" | tr -d '\n')" fi # Kubernetes service address must be wrapped if it is IPv6 address - KUBERNETES_SERVICE_HOST_WRAP=$KUBERNETES_SERVICE_HOST + KUBERNETES_SERVICE_HOST_WRAP="$KUBERNETES_SERVICE_HOST" if [ "$KUBERNETES_SERVICE_HOST_WRAP" != "${KUBERNETES_SERVICE_HOST_WRAP#*:[0-9a-fA-F]}" ]; then - KUBERNETES_SERVICE_HOST_WRAP=\[$KUBERNETES_SERVICE_HOST_WRAP\] + KUBERNETES_SERVICE_HOST_WRAP="[$KUBERNETES_SERVICE_HOST_WRAP]" fi # Write a kubeconfig file for the CNI plugin. Do this # to skip TLS verification for now. We should eventually support # writing more complete kubeconfig files. This is only used # if the provided CNI network config references it. - touch $WHEREABOUTS_KUBECONFIG - chmod ${KUBECONFIG_MODE:-600} $WHEREABOUTS_KUBECONFIG - cat > $WHEREABOUTS_KUBECONFIG < "$WHEREABOUTS_KUBECONFIG" < $WHEREABOUTS_FLATFILE < "$WHEREABOUTS_FLATFILE" <