This repository has been archived by the owner on Sep 30, 2020. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 294
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Create a new kiam plugin with IAMPolicy Remove Experimental Kiam Support Code Allow plugins to create ca's and use them to sign other certs. Note, the CA must be created first. Improve logging around plugin extensions. * Undo changes to cloud-config-controller * no need for or with one value * remove go modules files
- Loading branch information
1 parent
eeb3f4e
commit 90c55fb
Showing
31 changed files
with
646 additions
and
724 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
103 changes: 103 additions & 0 deletions
103
builtin/files/plugins/kiam/manifests/agent-daemonset.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| apiVersion: extensions/v1beta1 | ||
| kind: DaemonSet | ||
| metadata: | ||
| namespace: kube-system | ||
| name: kiam-agent | ||
| spec: | ||
| updateStrategy: | ||
| rollingUpdate: | ||
| maxUnavailable: 100% | ||
| type: RollingUpdate | ||
| template: | ||
| metadata: | ||
| annotations: | ||
| prometheus.io/scrape: "true" | ||
| prometheus.io/port: "9620" | ||
| labels: | ||
| app: kiam | ||
| role: agent | ||
| spec: | ||
| priorityClassName: system-node-critical | ||
| tolerations: | ||
| - operator: Exists | ||
| effect: NoSchedule | ||
| - operator: Exists | ||
| effect: NoExecute | ||
| - operator: Exists | ||
| key: CriticalAddonsOnly | ||
| hostNetwork: true | ||
| dnsPolicy: ClusterFirstWithHostNet | ||
| affinity: | ||
| nodeAffinity: | ||
| requiredDuringSchedulingIgnoredDuringExecution: | ||
| nodeSelectorTerms: | ||
| - matchExpressions: | ||
| - key: node.kubernetes.io/role | ||
| operator: NotIn | ||
| values: | ||
| - master | ||
| volumes: | ||
| - name: ssl-certs | ||
| hostPath: | ||
| path: /usr/share/ca-certificates | ||
| - name: tls | ||
| secret: | ||
| secretName: kiam-agent-tls | ||
| - name: xtables | ||
| hostPath: | ||
| path: /run/xtables.lock | ||
| containers: | ||
| - name: kiam | ||
| securityContext: | ||
| capabilities: | ||
| add: ["NET_ADMIN"] | ||
| image: {{ .Values.image }}:{{ .Values.tag }} | ||
| command: | ||
| - {{ if checkVersion ">= 3.0" .Values.tag }}/kiam{{ else }}/agent{{ end }} | ||
| args: | ||
| {{if checkVersion ">= 3.0" .Values.tag -}} | ||
| - agent | ||
| - --whitelist-route-regexp=.* | ||
| - --gateway-timeout-creation=1s | ||
| {{ end -}} | ||
| - --iptables | ||
| {{- if .Config.Cluster.Kubernetes.Networking.AmazonVPC.Enabled }} | ||
| - --host-interface=!eni0 | ||
| {{- else if eq .Config.Cluster.Kubernetes.Networking.SelfHosting.Type "canal" }} | ||
| - --host-interface=cali+ | ||
| {{- else}} | ||
| - --host-interface=cni0 | ||
| {{- end }} | ||
| - --json-log | ||
| - --port=8181 | ||
| - --cert=/etc/kiam/tls/tls.crt | ||
| - --key=/etc/kiam/tls/tls.key | ||
| - --ca=/etc/kiam/tls/ca.crt | ||
| - --server-address={{ .Values.agent.address }} | ||
| - --prometheus-listen-addr=0.0.0.0:9620 | ||
| - --prometheus-sync-interval=5s | ||
| env: | ||
| - name: HOST_IP | ||
| valueFrom: | ||
| fieldRef: | ||
| fieldPath: status.podIP | ||
| volumeMounts: | ||
| - mountPath: /etc/ssl/certs | ||
| name: ssl-certs | ||
| - mountPath: /etc/kiam/tls | ||
| name: tls | ||
| - mountPath: /var/run/xtables.lock | ||
| name: xtables | ||
| livenessProbe: | ||
| httpGet: | ||
| path: /ping | ||
| port: 8181 | ||
| initialDelaySeconds: 3 | ||
| periodSeconds: 3 | ||
| resources: | ||
| requests: | ||
| cpu: {{ .Values.agent.resources.requests.cpu }} | ||
| memory: {{ .Values.agent.resources.requests.memory }} | ||
| limits: | ||
| cpu: {{ .Values.agent.resources.limits.cpu }} | ||
| memory: {{ .Values.agent.resources.limits.memory }} |
10 changes: 10 additions & 0 deletions
10
builtin/files/plugins/kiam/manifests/agent-tls-secret.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: kiam-agent-tls | ||
| namespace: kube-system | ||
| type: kubernetes.io/tls | ||
| data: | ||
| tls.crt: {{ insertTemplateFile "credentials/kiam-agent.pem" . | b64enc }} | ||
| tls.key: {{ insertTemplateFile "credentials/kiam-agent-key.pem" . | b64enc }} | ||
| ca.crt: {{ insertTemplateFile "credentials/kiam-ca.pem" . | b64enc }} |
12 changes: 12 additions & 0 deletions
12
builtin/files/plugins/kiam/manifests/server-cluster-role-binding.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: kiam-server | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: kiam-server | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: kiam-server | ||
| namespace: kube-system |
21 changes: 21 additions & 0 deletions
21
builtin/files/plugins/kiam/manifests/server-cluster-role.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1beta1 | ||
| kind: ClusterRole | ||
| metadata: | ||
| name: kiam-server | ||
| rules: | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - namespaces | ||
| - pods | ||
| verbs: | ||
| - watch | ||
| - get | ||
| - list | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - events | ||
| verbs: | ||
| - create | ||
| - patch |
106 changes: 106 additions & 0 deletions
106
builtin/files/plugins/kiam/manifests/server-daemonset.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,106 @@ | ||
| apiVersion: extensions/v1beta1 | ||
| kind: DaemonSet | ||
| metadata: | ||
| namespace: kube-system | ||
| name: kiam-server | ||
| spec: | ||
| updateStrategy: | ||
| rollingUpdate: | ||
| maxUnavailable: 100% | ||
| type: RollingUpdate | ||
| template: | ||
| metadata: | ||
| annotations: | ||
| prometheus.io/scrape: "true" | ||
| prometheus.io/port: "9620" | ||
| labels: | ||
| app: kiam | ||
| role: server | ||
| spec: | ||
| priorityClassName: system-node-critical | ||
| tolerations: | ||
| - operator: Exists | ||
| effect: NoSchedule | ||
| - operator: Exists | ||
| effect: NoExecute | ||
| - operator: Exists | ||
| key: CriticalAddonsOnly | ||
| serviceAccountName: kiam-server | ||
| nodeSelector: | ||
| node.kubernetes.io/role: "master" | ||
| volumes: | ||
| - name: ssl-certs | ||
| hostPath: | ||
| path: /usr/share/ca-certificates | ||
| - name: tls | ||
| secret: | ||
| secretName: kiam-server-tls | ||
| containers: | ||
| - name: kiam | ||
| image: {{ .Values.image }}:{{ .Values.tag }} | ||
| command: | ||
| - {{ if checkVersion ">= 3.0" .Values.tag }}/kiam{{ else }}/server{{ end }} | ||
| args: | ||
| {{ if checkVersion ">= 3.0" .Values.tag -}} | ||
| - server | ||
| {{ end -}} | ||
| - --json-log | ||
| - --bind=0.0.0.0:443 | ||
| - --cert=/etc/kiam/tls/tls.crt | ||
| - --key=/etc/kiam/tls/tls.key | ||
| - --ca=/etc/kiam/tls/ca.crt | ||
| - --role-base-arn-autodetect | ||
| - --sync=1m | ||
| - --prometheus-listen-addr=0.0.0.0:9620 | ||
| - --prometheus-sync-interval=5s | ||
| - --session-duration={{ .Values.sessionDuration }} | ||
| volumeMounts: | ||
| - mountPath: /etc/ssl/certs | ||
| name: ssl-certs | ||
| - mountPath: /etc/kiam/tls | ||
| name: tls | ||
| livenessProbe: | ||
| exec: | ||
| command: | ||
| {{ if checkVersion ">= 3.0" .Values.tag -}} | ||
| - /kiam | ||
| - health | ||
| - --gateway-timeout-creation=1s | ||
| {{ else -}} | ||
| - /health | ||
| - --server-address-refresh=2s | ||
| {{ end -}} | ||
| - --cert=/etc/kiam/tls/tls.crt | ||
| - --key=/etc/kiam/tls/tls.key | ||
| - --ca=/etc/kiam/tls/ca.crt | ||
| - --server-address={{ .Values.server.address }} | ||
| - --timeout=5s | ||
| initialDelaySeconds: 10 | ||
| periodSeconds: 10 | ||
| timeoutSeconds: 10 | ||
| readinessProbe: | ||
| exec: | ||
| command: | ||
| {{ if checkVersion ">= 3.0" .Values.tag -}} | ||
| - /kiam | ||
| - health | ||
| - --gateway-timeout-creation=1s | ||
| {{ else -}} | ||
| - /health | ||
| - --server-address-refresh=2s | ||
| {{ end -}} | ||
| - --cert=/etc/kiam/tls/tls.crt | ||
| - --key=/etc/kiam/tls/tls.key | ||
| - --ca=/etc/kiam/tls/ca.crt | ||
| - --server-address={{ .Values.server.address }} | ||
| - --timeout=5s | ||
| initialDelaySeconds: 3 | ||
| periodSeconds: 10 | ||
| timeoutSeconds: 10 | ||
| resources: | ||
| requests: | ||
| cpu: {{ .Values.server.resources.requests.cpu }} | ||
| memory: {{ .Values.server.resources.requests.memory }} | ||
| limits: | ||
| cpu: {{ .Values.server.resources.limits.cpu }} | ||
| memory: {{ .Values.server.resources.limits.memory }} |
10 changes: 10 additions & 0 deletions
10
builtin/files/plugins/kiam/manifests/server-tls-secret.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: kiam-server-tls | ||
| namespace: kube-system | ||
| type: kubernetes.io/tls | ||
| data: | ||
| tls.crt: {{ insertTemplateFile "credentials/kiam-server.pem" . | b64enc }} | ||
| tls.key: {{ insertTemplateFile "credentials/kiam-server-key.pem" . | b64enc }} | ||
| ca.crt: {{ insertTemplateFile "credentials/kiam-ca.pem" . | b64enc }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| kind: ServiceAccount | ||
| apiVersion: v1 | ||
| metadata: | ||
| name: kiam-server | ||
| namespace: kube-system |
Oops, something went wrong.