replace kube-core rendering with openshift operators render #420
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -31,7 +31,7 @@ var ( | |
| BootkubeShFileTemplate = template.Must(template.New("bootkube.sh").Parse(`#!/usr/bin/env bash | ||
| set -e | ||
|
|
||
| mkdir --parents /etc/kubernetes/{manifests,bootstrap-configs,bootstrap-manifests} | ||
|
|
||
| MACHINE_CONFIG_OPERATOR_IMAGE=$(podman run --rm {{.ReleaseImage}} image machine-config-operator) | ||
| MACHINE_CONFIG_CONTROLLER_IMAGE=$(podman run --rm {{.ReleaseImage}} image machine-config-controller) | ||
|
|
@@ -42,6 +42,9 @@ KUBE_APISERVER_OPERATOR_IMAGE=$(podman run --rm {{.ReleaseImage}} image cluster- | |
| KUBE_CONTROLLER_MANAGER_OPERATOR_IMAGE=$(podman run --rm {{.ReleaseImage}} image cluster-kube-controller-manager-operator) | ||
| KUBE_SCHEDULER_OPERATOR_IMAGE=$(podman run --rm {{.ReleaseImage}} image cluster-kube-scheduler-operator) | ||
|
|
||
| OPENSHIFT_HYPERSHIFT_IMAGE=$(podman run --rm {{.ReleaseImage}} image hypershift) | ||
| OPENSHIFT_HYPERKUBE_IMAGE=$(podman run --rm {{.ReleaseImage}} image hyperkube) | ||
|
|
||
| if [ ! -d cvo-bootstrap ] | ||
| then | ||
| echo "Rendering Cluster Version Operator Manifests..." | ||
|
|
@@ -57,22 +60,7 @@ then | |
| cp --recursive cvo-bootstrap/manifests . | ||
| fi | ||
|
|
||
| mkdir --parents ./{bootstrap-manifests,manifests} | ||
|
|
||
| if [ ! -d kube-apiserver-bootstrap ] | ||
| then | ||
|
|
@@ -84,14 +72,16 @@ then | |
| "${KUBE_APISERVER_OPERATOR_IMAGE}" \ | ||
| /usr/bin/cluster-kube-apiserver-operator render \ | ||
| --manifest-etcd-serving-ca=etcd-client-ca.crt \ | ||
| --manifest-etcd-server-urls={{.EtcdCluster}} \ | ||
| --manifest-image=${OPENSHIFT_HYPERSHIFT_IMAGE} \ | ||
| --asset-input-dir=/assets/tls \ | ||
| --asset-output-dir=/assets/kube-apiserver-bootstrap \ | ||
| --config-output-file=/assets/kube-apiserver-bootstrap/config \ | ||
| --config-override-files=/assets/bootkube-config-overrides/kube-apiserver-config-overrides.yaml | ||
|
|
||
| cp kube-apiserver-bootstrap/config /etc/kubernetes/bootstrap-configs/kube-apiserver-config.yaml | ||
| cp kube-apiserver-bootstrap/bootstrap-manifests/* bootstrap-manifests/ | ||
| cp kube-apiserver-bootstrap/manifests/* manifests/ | ||
| fi | ||
|
|
||
| if [ ! -d kube-controller-manager-bootstrap ] | ||
|
|
@@ -103,13 +93,15 @@ then | |
| --volume "$PWD:/assets:z" \ | ||
| "${KUBE_CONTROLLER_MANAGER_OPERATOR_IMAGE}" \ | ||
| /usr/bin/cluster-kube-controller-manager-operator render \ | ||
| --manifest-image=${OPENSHIFT_HYPERKUBE_IMAGE} \ | ||
| --asset-input-dir=/assets/tls \ | ||
| --asset-output-dir=/assets/kube-controller-manager-bootstrap \ | ||
| --config-output-file=/assets/kube-controller-manager-bootstrap/config \ | ||
| --config-override-files=/assets/bootkube-config-overrides/kube-controller-manager-config-overrides.yaml | ||
|
|
||
| cp kube-controller-manager-bootstrap/config /etc/kubernetes/bootstrap-configs/kube-controller-manager-config.yaml | ||
| cp kube-controller-manager-bootstrap/bootstrap-manifests/* bootstrap-manifests/ | ||
| cp kube-controller-manager-bootstrap/manifests/* manifests/ | ||
| fi | ||
|
|
||
| if [ ! -d kube-scheduler-bootstrap ] | ||
|
|
@@ -121,15 +113,22 @@ then | |
| --volume "$PWD:/assets:z" \ | ||
| "${KUBE_SCHEDULER_OPERATOR_IMAGE}" \ | ||
| /usr/bin/cluster-kube-scheduler-operator render \ | ||
| --manifest-image=${OPENSHIFT_HYPERKUBE_IMAGE} \ | ||
| --asset-input-dir=/assets/tls \ | ||
| --asset-output-dir=/assets/kube-scheduler-bootstrap \ | ||
| --config-output-file=/assets/kube-scheduler-bootstrap/config | ||
|
|
||
| cp kube-scheduler-bootstrap/config /etc/kubernetes/bootstrap-configs/kube-scheduler-config.yaml | ||
| cp kube-scheduler-bootstrap/bootstrap-manifests/* bootstrap-manifests/ | ||
| cp kube-scheduler-bootstrap/manifests/* manifests/ | ||
| fi | ||
|
|
||
| # TODO: Remove this when checkpointer, kube-proxy and kube-dns are properly rendered by corresponding operators. | ||
| echo "Installing temporary bootstrap manifests..." | ||
| cp pod-checkpointer-operator-bootstrap/* manifests/ | ||
| cp kube-proxy-operator-bootstrap/* manifests/ | ||
| cp kube-dns-operator-bootstrap/* manifests/ | ||
|
|
||
| if [ ! -d mco-bootstrap ] | ||
| then | ||
| echo "Rendering MCO manifests..." | ||
|
|
@@ -152,8 +151,8 @@ then | |
| # 1. read the controller config rendered by MachineConfigOperator | ||
| # 2. read the default MachineConfigPools rendered by MachineConfigOperator | ||
| # 3. read any additional MachineConfigs that are needed for the default MachineConfigPools. | ||
| mkdir --parents /etc/mcc/bootstrap/manifests /etc/kubernetes/manifests/ | ||
| cp mco-bootstrap/manifests/* /etc/mcc/bootstrap/manifests/ | ||
| cp mco-bootstrap/machineconfigoperator-bootstrap-pod.yaml /etc/kubernetes/manifests/ | ||
|
|
||
| # /etc/ssl/mcs/tls.{crt, key} are locations for MachineConfigServer's tls assets. | ||
|
|
@@ -232,3 +231,30 @@ podman run \ | |
| start --asset-dir=/assets | ||
| `)) | ||
| ) | ||
|
|
||
| var ( | ||
| // BootkubeConfigOverrides contains the configuration override files passed to the render commands of the components. | ||
| // These are supposed to be customized by the installer where the config differs from the operator render default. | ||
| BootkubeConfigOverrides = []*template.Template{ | ||
| KubeApiserverConfigOverridesTemplate, | ||
| KubeControllerManagerConfigOverridesTemplate, | ||
| } | ||
| ) | ||
|
|
||
| var ( | ||
| // KubeApiserverConfigOverridesTemplate are overrides that the installer passes to the default config of the | ||
| // kube-apiserver rendered by the cluster-kube-apiserver-operator. | ||
| KubeApiserverConfigOverridesTemplate = template.Must(template.New("kube-apiserver-config-overrides.yaml").Parse(` | ||
| apiVersion: kubecontrolplane.config.openshift.io/v1 | ||
| kind: KubeAPIServerConfig | ||
| kubeletClientInfo: | ||
| ca: "" # kubelet uses self-signed serving certs. TODO: fix kubelet pki | ||
|
There was a problem hiding this comment. @sjenning this is for you. We have self-signed kubelet serving certs right now. I.e. the kube-apiserver->kubelet communication is insecure because the kubelet identity is not checked. There was a problem hiding this comment. This is the old kube-core behaviour btw. So we are just copying that here, but should do better. I read @LiGgit commenting somewhere that up to kube 1.10 we don't support CSRs for properly signed kubelet serving certs. Has this changed upstream in 1.11 or 1.12? |
||
| `)) | ||
|
|
||
| // KubeControllerManagerConfigOverridesTemplate are overrides that the installer passes to the default config of the | ||
| // kube-controller-manager rendered by the cluster-kube-controller-manager-operator. | ||
| KubeControllerManagerConfigOverridesTemplate = template.Must(template.New("kube-controller-manager-config-overrides.yaml").Parse(` | ||
| apiVersion: kubecontrolplane.config.openshift.io/v1 | ||
| kind: KubeControllerManagerConfig | ||
| `)) | ||
|
There was a problem hiding this comment. @squeed this file is also for you. You can override any setting related to networking here, like cluster CIDR for example. |
||
| ) | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@openshift/sig-pod @openshift/sig-networking this one is on you :-)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/cc @derekwaynecarr