github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #64104 from CalvinHartwell/kubelet-allow-privileged-true 

Automatic merge from submit-queue (batch tested with PRs 65032, 63471, 64104, 64672, 64427). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

changed the default value for allow-privileged for the kubelet (kuber…

**What this PR does / why we need it**:

This PR modifies the default value for the kubernetes-worker: it sets the allow-privileged kubelet value to true, based on this issue:[https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/579](https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/579). 

The original PR was here: [https://github.com/kubernetes/kubernetes/pull/63442](https://github.com/kubernetes/kubernetes/pull/63442) which included this change for the k8s 1.10 release. This PR incorporates this fix into the Canonical distribution of Kubernetes. 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

This change fixes two issues: 

[https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/579](https://github.com/juju-solutions/bundle-canonical-kubernetes/issues/579)
[https://github.com/rancher/rancher/issues/13612](https://github.com/rancher/rancher/issues/13612)

**Special notes for your reviewer**:

Waiting review from Canonical Kubernetes charm tea. 

**Release note**:

```release-note
The new default value for the --allow-privileged parameter of the Kubernetes-worker charm has been set to true based on changes which went into the Kubernetes 1.10 release. Before this change the default value was set to false. If you're installing Canonical Kubernetes you should expect this value to now be true by default and you should now look to use PSP (pod security policies). 
```
pull/8/head
Kubernetes Submit Queue 2018-06-20 04:23:17 -07:00 committed by GitHub
parent 06ea14a5d6 41cb9ed02c
commit 2fb7af790d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cluster/juju/layers/kubernetes-master/config.yaml
View File

@ -30,7 +30,7 @@ options:
privileged mode by default. If "false", kube-apiserver will never run in
privileged mode. If "auto", kube-apiserver will not run in privileged
mode by default, but will switch to privileged mode if gpu hardware is
detected on a worker node.
detected on a worker node.
enable-nvidia-plugin:
type: string
default: "auto"

5
cluster/juju/layers/kubernetes-worker/config.yaml
View File

@ -13,13 +13,14 @@ options:
cluster. Declare node labels in key=value format, separated by spaces.
allow-privileged:
type: string
default: "auto"
default: "true"
description: |
Allow privileged containers to run on worker nodes. Supported values are
"true", "false", and "auto". If "true", kubelet will run in privileged
mode by default. If "false", kubelet will never run in privileged mode.
If "auto", kubelet will not run in privileged mode by default, but will
switch to privileged mode if gpu hardware is detected.
switch to privileged mode if gpu hardware is detected. Pod security
policies (PSP) should be used to restrict container privileges.
channel:
type: string
default: "1.10/stable"