Patching v3

manifests/init.pp

@@ -1,5 +1,5 @@
 # @summary Sets up a Kubernetes instance - either as a node or as a server
-# 
+#
 # @param manage_kernel_modules
 # A flag to manage required Kernel modules.
 #
@@ -52,6 +52,7 @@
  Stdlib::Fqdn $cluster_domain = 'cluster.local',
 
  Enum['node','server','none'] $role = 'none',
+ K8s::Firewall $firewall_type = 'firewalld',
 ) {
  if $manage_container_manager {
  if $container_manager == 'docker' {

manifests/install/kubeadm.pp

@@ -0,0 +1,11 @@
+# @summary Installs the kubeadm binary
+#
+# @param ensure set ensure for installation or deinstallation
+#
+class k8s::install::kubeadm (
+ K8s::Ensure $ensure = $k8s::ensure,
+) {
+ k8s::binary { 'kubeadm':
+ ensure => $ensure,
+ }
+}

manifests/install/kubectl.pp

@@ -0,0 +1,11 @@
+# @summary Installs the kubectl binary
+#
+# @param ensure set ensure for installation or deinstallation
+#
+class k8s::install::kubectl (
+ K8s::Ensure $ensure = $k8s::ensure,
+) {
+ k8s::binary { 'kubectl':
+ ensure => $ensure,
+ }
+}

manifests/node.pp

@@ -26,6 +26,8 @@
  # For token and bootstrap auth
  Optional[String[1]] $node_token = undef,
  Optional[String[1]] $proxy_token = undef,
+
+ K8s::Firewall $firewall_type = $k8s::firewall_type,
 ) {
  if $manage_kubelet {
  include k8s::node::kubelet

manifests/node/kubelet.pp

@@ -27,6 +27,8 @@
 
  # For token and bootstrap auth
  Optional[String[1]] $token = $k8s::node::node_token,
+
+ K8s::Firewall $firewall_type = $k8s::node::firewall_type,
 ) {
  k8s::binary { 'kubelet':
  ensure => $ensure,
@@ -160,6 +162,14 @@
  'net.ipv4.ip_forward':;
  'net.ipv6.conf.all.forwarding':;
  }
+
+ if $manage_kernel_modules {
+ Kmod::Load['br_netfilter']
+ -> [
+ Sysctl['net.bridge.bridge-nf-call-iptables'],
+ Sysctl['net.bridge.bridge-nf-call-ip6tables']
+ ]
+ }
  }
 
  file { '/etc/kubernetes/kubelet.conf':
@@ -228,21 +238,31 @@
  Package <| title == 'containernetworking-plugins' |> -> Service['kubelet']
 
  if $manage_firewall {
- firewalld_custom_service { 'kubelet':
- ensure => $ensure,
- short => 'kubelet',
- description => 'Kubernetes kubelet daemon',
- ports => [
- {
- port => '10250',
- protocol => 'tcp',
- },
- ],
- }
- firewalld_service { 'Allow k8s kubelet access':
- ensure => $ensure,
- zone => 'public',
- service => 'kubelet',
+ if $facts['firewalld_version'] and $firewall_type == 'firewalld' {
+ firewalld_custom_service { 'kubelet':
+ ensure => $ensure,
+ short => 'kubelet',
+ description => 'Kubernetes kubelet daemon',
+ ports => [
+ {
+ port => '10250',
+ protocol => 'tcp',
+ },
+ ],
+ }
+ firewalld_service { 'Allow k8s kubelet access':
+ ensure => $ensure,
+ zone => 'public',
+ service => 'kubelet',
+ }
+ } else {
+ include firewall
+
+ firewall { '100 allow kubelet access':
+ dport => 10250,
+ proto => 'tcp',
+ action => 'accept',
+ }
  }
  }
 }

manifests/repo.pp

@@ -1,4 +1,8 @@
 # @summary Handles repositories for the container runtime
+#
+# @param manage_container_manager whether to add cri-o repository or not
+# @param crio_version version o cri-o
+#
 class k8s::repo (
  Boolean $manage_container_manager = $k8s::manage_container_manager,
  String[1] $crio_version = $k8s::version.split('\.')[0, 2].join('.'),

manifests/server.pp

@@ -1,4 +1,30 @@
 # @summary Sets up a Kubernetes server instance
+#
+# @param aggregator_ca_cert
+# @param aggregator_ca_key
+# @param api_port Cluster API port
+# @param ca_cert path to the ca cert
+# @param ca_key path to the ca key
+# @param cert_path path to cert files
+# @param cluster_cidr cluster cidr
+# @param cluster_domain cluster domain name
+# @param direct_master direct clust API connection
+# @param dns_service_address cluster dns service address
+# @param ensure set ensure for installation or deinstallation
+# @param etcd_servers list etcd servers if no puppetdb is used
+# @param firewall_type define the type of firewall to use
+# @param generate_ca initially generate ca
+# @param manage_certs whether to manage certs or not
+# @param manage_components whether to manage components or not
+# @param manage_etcd whether to manage etcd or not
+# @param manage_firewall whether to manage firewall or not
+# @param manage_kubeadm whether to install kubeadm or not
+# @param manage_resources whether to manage cluster internal resources or not
+# @param manage_signing whether to manage cert signing or not
+# @param master cluster API connection
+# @param node_on_server whether to use controller also as nodes or not
+# @param puppetdb_discovery_tag enable puppetdb resource searching
+#
 class k8s::server (
  K8s::Ensure $ensure = $k8s::ensure,
  Integer[1] $api_port = 6443,
@@ -23,9 +49,11 @@
  Boolean $manage_components = true,
  Boolean $manage_resources = true,
  Boolean $node_on_server = true,
+ Boolean $manage_kubeadm = false,
  String[1] $puppetdb_discovery_tag = $k8s::puppetdb_discovery_tag,
 
  Optional[Array[Stdlib::HTTPUrl]] $etcd_servers = undef,
+ K8s::Firewall $firewall_type = $k8s::firewall_type,
 ) {
  if $manage_etcd {
  class { 'k8s::server::etcd':
@@ -74,7 +102,12 @@
  $cluster_nodes.each |$node| { k8s::server::tls::k8s_sign { $node['certname']: } }
  }
 
- include k8s::node::kubectl
+ include k8s::install::kubectl
+
+ if $manage_kubeadm {
+ include k8s::install::kubeadm
+ }
+
  kubeconfig { '/root/.kube/config':
  ensure => $ensure,
  server => "https://localhost:${api_port}",

manifests/server/apiserver.pp

@@ -10,7 +10,6 @@
  Boolean $discover_etcd_servers = $k8s::puppetdb_discovery,
  Boolean $manage_firewall = $k8s::server::manage_firewall,
  String $puppetdb_discovery_tag = $k8s::server::puppetdb_discovery_tag,
-
  Stdlib::Unixpath $cert_path = $k8s::server::tls::cert_path,
  Stdlib::Unixpath $ca_cert = $k8s::server::tls::ca_cert,
  Stdlib::Unixpath $aggregator_ca_cert = $k8s::server::tls::aggregator_ca_cert,
@@ -25,6 +24,9 @@
  Stdlib::Unixpath $etcd_ca = "${cert_path}/etcd-ca.pem",
  Stdlib::Unixpath $etcd_cert = "${cert_path}/etcd.pem",
  Stdlib::Unixpath $etcd_key = "${cert_path}/etcd.key",
+
+ Stdlib::IP::Address::Nosubnet $advertise_address = fact('networking.ip'),
+ K8s::Firewall $firewall_type = $k8s::server::firewall_type
 ) {
  assert_private()
 
@@ -93,7 +95,7 @@
  'Priority',
  'NodeRestriction',
  ],
- advertise_address => fact('networking.ip'),
+ advertise_address => $advertise_address,
  allow_privileged => true,
  anonymous_auth => true,
  authorization_mode => ['Node', 'RBAC'],
@@ -267,10 +269,20 @@
  }
 
  if $manage_firewall {
- firewalld_service { 'Allow k8s apiserver access':
- ensure => $ensure,
- zone => 'public',
- service => 'kube-apiserver',
+ if $facts['firewalld_version'] and $firewall_type == 'firewalld' {
+ firewalld_service { 'Allow k8s apiserver access':
+ ensure => $ensure,
+ zone => 'public',
+ service => 'kube-apiserver',
+ }
+ } else {
+ include firewall
+
+ firewall { '100 allow k8s apiserver access':
+ dport => 6443,
+ proto => 'tcp',
+ action => 'accept',
+ }
  }
  }
 }

manifests/server/etcd.pp

@@ -18,6 +18,8 @@
  Stdlib::Unixpath $peer_ca_cert = "${cert_path}/peer-ca.pem",
  Stdlib::Unixpath $client_ca_key = "${cert_path}/client-ca.key",
  Stdlib::Unixpath $client_ca_cert = "${cert_path}/client-ca.pem",
+
+ K8s::Firewall $firewall_type = $k8s::server::firewall_type,
 ) {
  if (!$self_signed_tls and $manage_certs) or $ensure == 'absent' {
  if !defined(File[$cert_path]) {
@@ -139,16 +141,31 @@
  }
 
  if $manage_firewall {
- firewalld_service {
- default:
- ensure => $ensure,
- zone => 'public';
+ if $facts['firewalld_version'] and $firewall_type == 'firewalld' {
+ firewalld_service {
+ default:
+ ensure => $ensure,
+ zone => 'public';
+
+ 'Allow etcd server access':
+ service => 'etcd-server';
 
- 'Allow etcd server access':
- service => 'etcd-server';
+ 'Allow etcd client access':
+ service => 'etcd-client';
+ }
+ } else {
+ include firewall
 
- 'Allow etcd client access':
- service => 'etcd-client';
+ firewall { '100 allow etcd server access':
+ dport => 2379,
+ proto => 'tcp',
+ action => 'accept',
+ }
+ firewall { '100 allow etcd client access':
+ dport => 2380,
+ proto => 'tcp',
+ action => 'accept',
+ }
  }
  }
 }

manifests/server/tls/k8s_sign.pp

@@ -13,8 +13,9 @@
  ].join(' | ')
 
  exec { "Sign ${name} cert":
- path => ['/usr/local/bin','/usr/bin','/bin'],
+ path => $facts['path'],
  command => $exec_command,
  onlyif => "kubectl --kubeconfig='${kubeconfig}' get csr | grep 'system:node:${name}' | grep Pending",
+ require => 'File[/usr/bin/kubectl]',
  }
 }

metadata.json

@@ -20,13 +20,25 @@
  "name": "puppet-kmod",
  "version_requirement": ">= 3.2.0 < 4.0.0"
  },
+ {
+ "name": "puppet-augeasproviders_core",
+ "version_requirement": ">= 2.4.0 < 4.0.0"
+ },
  {
  "name": "herculesteam-augeasproviders_sysctl",
  "version_requirement": ">= 2.6.2 < 3.0.0"
  },
  {
  "name": "puppet-systemd",
  "version_requirement": ">= 2.0.0 < 4.0.0"
+ },
+ {
+ "name": "puppetlabs-firewall",
+ "version_requirement": ">= 4.0.0 < 6.0.0"
+ },
+ {
+ "name": "puppet-firewalld",
+ "version_requirement": ">= 4.5.0 < 6.0.0"
  }
  ],
  "operatingsystem_support": [
@@ -48,7 +60,8 @@
  "operatingsystemrelease": [
  "18.04",
  "20.04",
- "20.10"
+ "20.10",
+ "22.04"
  ]
  }
  ],

spec/classes/install/kubeadm_spec.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'k8s::install::kubeadm' do
+ let(:pre_condition) do
+ <<~PUPPET
+ include k8s
+ PUPPET
+ end
+
+ on_supported_os.each do |os, os_facts|
+ context "on #{os}" do
+ let(:facts) { os_facts }
+
+ it { is_expected.to compile }
+ end
+ end
+end

spec/classes/node/kubectl_spec.rb → spec/classes/install/kubectl_spec.rb

@@ -2,16 +2,10 @@
 
 require 'spec_helper'
 
-describe 'k8s::node::kubectl' do
+describe 'k8s::install::kubectl' do
  let(:pre_condition) do
  <<~PUPPET
- function assert_private() {}
-
- include ::k8s
- class { '::k8s::node':
- manage_kubelet => false,
- manage_proxy => false,
- }
+ include k8s
  PUPPET
  end