Skip to content

Commit a073953

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #4175 from rphillips/rbac_crio_metrics_static_pod
OCPNODE-2098: Add static pod for kube-rbac-proxy-crio
2 parents 53bbe70 + 757befb commit a073953

File tree

7 files changed

+185
-10
lines changed

7 files changed

+185
-10
lines changed

‎pkg/controller/template/constants.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,7 @@ const (
2121

2222
// BaremetalRuntimeCfgKey is the key that references the baremetal-runtimecfg image in the controller
2323
BaremetalRuntimeCfgKey string = "baremetalRuntimeCfgImage"
24+
25+
// KubeRbacProxyKey the key that references the kubeRbacProxy image
26+
KubeRbacProxyKey string = "kubeRbacProxyImage"
2427
)

‎pkg/operator/bootstrap.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,7 @@ func RenderBootstrap(
150150
templatectrl.CorednsKey: imgs.Coredns,
151151
templatectrl.HaproxyKey: imgs.Haproxy,
152152
templatectrl.BaremetalRuntimeCfgKey: imgs.BaremetalRuntimeCfg,
153+
templatectrl.KubeRbacProxyKey: imgs.KubeRbacProxy,
153154
}
154155

155156
config := getRenderConfig("", string(filesData[kubeAPIServerServingCA]), spec, &imgs.RenderConfigImages, infra.Status.APIServerInternalURL, nil)
@@ -176,7 +177,8 @@ func RenderBootstrap(
176177
}, {
177178
name: "manifests/machineconfigserver/kube-apiserver-serving-ca-configmap.yaml",
178179
filename: "manifests/kube-apiserver-serving-ca-configmap.yaml",
179-
}}
180+
},
181+
}
180182

181183
manifests = appendManifestsByPlatform(manifests, *infra)
182184

‎pkg/operator/sync.go‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,11 @@ const (
5757
requiredForUpgradeMachineConfigPoolLabelKey = "operator.machineconfiguration.openshift.io/required-for-upgrade"
5858
)
5959

60-
var (
61-
platformsRequiringCloudConf = sets.NewString(
62-
string(configv1.AzurePlatformType),
63-
string(configv1.GCPPlatformType),
64-
string(configv1.OpenStackPlatformType),
65-
string(configv1.VSpherePlatformType),
66-
)
60+
var platformsRequiringCloudConf = sets.NewString(
61+
string(configv1.AzurePlatformType),
62+
string(configv1.GCPPlatformType),
63+
string(configv1.OpenStackPlatformType),
64+
string(configv1.VSpherePlatformType),
6765
)
6866

6967
type manifestPaths struct {
@@ -569,6 +567,7 @@ func (optr *Operator) syncRenderConfig(_ *renderConfig) error {
569567
templatectrl.CorednsKey: imgs.Coredns,
570568
templatectrl.HaproxyKey: imgs.Haproxy,
571569
templatectrl.BaremetalRuntimeCfgKey: imgs.BaremetalRuntimeCfg,
570+
templatectrl.KubeRbacProxyKey: imgs.KubeRbacProxy,
572571
}
573572

574573
ignitionHost, err := getIgnitionHost(&infra.Status)
@@ -1647,7 +1646,6 @@ func (optr *Operator) getCAsFromConfigMap(namespace, name, key string) ([]byte,
16471646
// it updates boot images.
16481647

16491648
func (optr *Operator) stampBootImagesCM(pool *mcfgv1.MachineConfigPool) error {
1650-
16511649
// Ensure the targeted MC for this pool was generated by the current MCO
16521650
renderedMC, err := optr.mcLister.Get(pool.Spec.Configuration.Name)
16531651
if err != nil {
@@ -1833,7 +1831,6 @@ func isPoolStatusConditionTrue(pool *mcfgv1.MachineConfigPool, conditionType mcf
18331831
// global pull secret. It also adds a default route to the registry for the firstboot scenario.
18341832

18351833
func (optr *Operator) getImageRegistryPullSecrets() ([]byte, error) {
1836-
18371834
// Check if image registry exists, if it doesn't we no-op
18381835
co, err := optr.mcoCOLister.Get("image-registry")
18391836

‎templates/master/01-master-kubelet/_base/files/criometricsproxy-config.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
mode: 0644
2+
path: "/etc/kubernetes/crio-metrics-proxy.cfg"
3+
contents:
4+
inline: |-
5+
authorization:
6+
static:
7+
- resourceRequest: false
8+
path: /metrics
9+
verb: get
10+
user:
11+
name: system:serviceaccount:openshift-monitoring:prometheus-k8s

‎templates/master/01-master-kubelet/_base/files/criometricsproxy.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
mode: 0644
2+
path: "/etc/kubernetes/manifests/criometricsproxy.yaml"
3+
contents:
4+
inline: |-
5+
apiVersion: v1
6+
kind: Pod
7+
metadata:
8+
name: kube-rbac-proxy-crio
9+
namespace: openshift-machine-config-operator
10+
spec:
11+
volumes:
12+
- name: etc-kube
13+
hostPath:
14+
path: "/etc/kubernetes"
15+
- name: var-lib-kubelet
16+
hostPath:
17+
path: "/var/lib/kubelet"
18+
hostNetwork: true
19+
priorityClassName: system-cluster-critical
20+
initContainers:
21+
- name: setup
22+
terminationMessagePolicy: FallbackToLogsOnError
23+
image: {{.Images.kubeRbacProxyImage}}
24+
imagePullPolicy: IfNotPresent
25+
volumeMounts:
26+
- name: var-lib-kubelet
27+
mountPath: "/var"
28+
mountPropagation: HostToContainer
29+
command: ['/bin/bash', '-ec']
30+
args:
31+
- |
32+
echo -n "Waiting for kubelet key and certificate to be available"
33+
while [ -n "$(test -e /var/lib/kubelet/pki/kubelet-server-current.pem)" ] ; do
34+
echo -n "."
35+
sleep 1
36+
(( tries += 1 ))
37+
if [[ "${tries}" -gt 10 ]]; then
38+
echo "Timed out waiting for kubelet key and cert."
39+
exit 1
40+
fi
41+
done
42+
securityContext:
43+
privileged: true
44+
resources:
45+
requests:
46+
memory: 50Mi
47+
cpu: 5m
48+
containers:
49+
- name: kube-rbac-proxy-crio
50+
image: {{.Images.kubeRbacProxyImage}}
51+
securityContext:
52+
privileged: true
53+
ports:
54+
- containerPort: 9637
55+
args:
56+
- --secure-listen-address=:9637
57+
- --config-file=/etc/kubernetes/crio-metrics-proxy.cfg
58+
- --client-ca-file=/etc/kubernetes/kubelet-ca.crt
59+
- --logtostderr=true
60+
- --kubeconfig=/var/lib/kubelet/kubeconfig
61+
- --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
62+
- --upstream=http://127.0.0.1:9537
63+
- --tls-cert-file=/var/lib/kubelet/pki/kubelet-server-current.pem
64+
- --tls-private-key-file=/var/lib/kubelet/pki/kubelet-server-current.pem
65+
resources:
66+
requests:
67+
cpu: 20m
68+
memory: 50Mi
69+
volumeMounts:
70+
- name: etc-kube
71+
mountPath: "/etc/kubernetes"
72+
mountPropagation: HostToContainer
73+
- name: var-lib-kubelet
74+
mountPath: "/var/lib/kubelet"
75+
mountPropagation: HostToContainer

‎templates/worker/01-worker-kubelet/_base/files/criometricsproxy-config.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
mode: 0644
2+
mode: 0644
3+
path: "/etc/kubernetes/crio-metrics-proxy.cfg"
4+
contents:
5+
inline: |-
6+
authorization:
7+
static:
8+
- resourceRequest: false
9+
path: /metrics
10+
verb: get
11+
user:
12+
name: system:serviceaccount:openshift-monitoring:prometheus-k8s

‎templates/worker/01-worker-kubelet/_base/files/criometricsproxy.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
mode: 0644
2+
path: "/etc/kubernetes/manifests/criometricsproxy.yaml"
3+
contents:
4+
inline: |-
5+
apiVersion: v1
6+
kind: Pod
7+
metadata:
8+
name: kube-rbac-proxy-crio
9+
namespace: openshift-machine-config-operator
10+
spec:
11+
volumes:
12+
- name: etc-kube
13+
hostPath:
14+
path: "/etc/kubernetes"
15+
- name: var-lib-kubelet
16+
hostPath:
17+
path: "/var/lib/kubelet"
18+
hostNetwork: true
19+
priorityClassName: system-cluster-critical
20+
initContainers:
21+
- name: setup
22+
terminationMessagePolicy: FallbackToLogsOnError
23+
image: {{.Images.kubeRbacProxyImage}}
24+
imagePullPolicy: IfNotPresent
25+
volumeMounts:
26+
- name: var-lib-kubelet
27+
mountPath: "/var"
28+
mountPropagation: HostToContainer
29+
command: ['/bin/bash', '-ec']
30+
args:
31+
- |
32+
echo -n "Waiting for kubelet key and certificate to be available"
33+
while [ -n "$(test -e /var/lib/kubelet/pki/kubelet-server-current.pem)" ] ; do
34+
echo -n "."
35+
sleep 1
36+
(( tries += 1 ))
37+
if [[ "${tries}" -gt 10 ]]; then
38+
echo "Timed out waiting for kubelet key and cert."
39+
exit 1
40+
fi
41+
done
42+
securityContext:
43+
privileged: true
44+
resources:
45+
requests:
46+
memory: 50Mi
47+
cpu: 5m
48+
containers:
49+
- name: kube-rbac-proxy-crio
50+
image: {{.Images.kubeRbacProxyImage}}
51+
securityContext:
52+
privileged: true
53+
ports:
54+
- containerPort: 9637
55+
args:
56+
- --secure-listen-address=:9637
57+
- --config-file=/etc/kubernetes/crio-metrics-proxy.cfg
58+
- --client-ca-file=/etc/kubernetes/kubelet-ca.crt
59+
- --logtostderr=true
60+
- --kubeconfig=/var/lib/kubelet/kubeconfig
61+
- --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
62+
- --upstream=http://127.0.0.1:9537
63+
- --tls-cert-file=/var/lib/kubelet/pki/kubelet-server-current.pem
64+
- --tls-private-key-file=/var/lib/kubelet/pki/kubelet-server-current.pem
65+
resources:
66+
requests:
67+
cpu: 20m
68+
memory: 50Mi
69+
volumeMounts:
70+
- name: etc-kube
71+
mountPath: "/etc/kubernetes"
72+
mountPropagation: HostToContainer
73+
- name: var-lib-kubelet
74+
mountPath: "/var/lib/kubelet"
75+
mountPropagation: HostToContainer

0 commit comments

Comments
 (0)