github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Enable metadata concealment for tests

pull/6/head
Isaac Hollander McCreery 2017-10-12 14:36:38 -07:00
parent f1b17e8896
commit 3ee03fd033
5 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
cluster/common.sh
View File

@ -752,14 +752,9 @@ EOF
ENABLE_CUSTOM_METRICS: $(yaml-quote ${ENABLE_CUSTOM_METRICS})
EOF
fi
if [ -n "${ENABLE_METADATA_PROXY:-}" ]; then
if [ -n "${ENABLE_METADATA_CONCEALMENT:-}" ]; then
cat >>$file <<EOF
ENABLE_METADATA_PROXY: $(yaml-quote ${ENABLE_METADATA_PROXY})
EOF
fi
if [ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]; then
cat >>$file <<EOF
KUBE_FIREWALL_METADATA_SERVER: $(yaml-quote ${KUBE_FIREWALL_METADATA_SERVER})
ENABLE_METADATA_CONCEALMENT: $(yaml-quote ${ENABLE_METADATA_CONCEALMENT})
EOF
fi
if [ -n "${FEATURE_GATES:-}" ]; then

12
cluster/gce/config-default.sh
View File

@ -153,11 +153,13 @@ if [[ ${NETWORK_POLICY_PROVIDER:-} == "calico" ]]; then
NODE_LABELS="${NODE_LABELS},projectcalico.org/ds-ready=true"
fi
# Currently, ENABLE_METADATA_PROXY supports only "simple". In the future, we
# may add other options.
ENABLE_METADATA_PROXY="${ENABLE_METADATA_PROXY:-}"
# Apply the right node label if metadata proxy is on.
if [[ ${ENABLE_METADATA_PROXY:-} == "simple" ]]; then
# Enable metadata concealment by firewalling pod traffic to the metadata server
# and run a proxy daemonset on nodes.
#
# TODO(#8867) Enable by default.
ENABLE_METADATA_CONCEALMENT="${ENABLE_METADATA_CONCEALMENT:-false}" # true, false
# Apply the right node label if metadata concealment is on.
if [[ ${ENABLE_METADATA_CONCEALMENT:-} == "true" ]]; then
NODE_LABELS="${NODE_LABELS},beta.kubernetes.io/metadata-proxy-ready=true"
fi

7
cluster/gce/config-test.sh
View File

@ -204,8 +204,11 @@ if [[ ${NETWORK_POLICY_PROVIDER:-} == "calico" ]]; then
NODE_LABELS="$NODE_LABELS,projectcalico.org/ds-ready=true"
fi
# Apply the right node label if metadata proxy is on.
if [[ ${ENABLE_METADATA_PROXY:-} == "simple" ]]; then
# Enable metadata concealment by firewalling pod traffic to the metadata server
# and run a proxy daemonset on nodes.
ENABLE_METADATA_CONCEALMENT="${ENABLE_METADATA_CONCEALMENT:-true}" # true, false
# Apply the right node label if metadata concealment is on.
if [[ ${ENABLE_METADATA_CONCEALMENT:-} == "true" ]]; then
NODE_LABELS="${NODE_LABELS},beta.kubernetes.io/metadata-proxy-ready=true"
fi

4
cluster/gce/configure-vm.sh
View File

@ -93,7 +93,7 @@ function config-ip-firewall {
iptables -N KUBE-METADATA-SERVER
iptables -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER
if [[ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]]; then
if [[ -n "${ENABLE_METADATA_CONCEALMENT:-}" ]]; then
iptables -A KUBE-METADATA-SERVER -j DROP
fi
}
@ -419,7 +419,7 @@ enable_cluster_ui: '$(echo "$ENABLE_CLUSTER_UI" | sed -e "s/'/''/g")'
enable_node_problem_detector: '$(echo "$ENABLE_NODE_PROBLEM_DETECTOR" | sed -e "s/'/''/g")'
enable_l7_loadbalancing: '$(echo "$ENABLE_L7_LOADBALANCING" | sed -e "s/'/''/g")'
enable_node_logging: '$(echo "$ENABLE_NODE_LOGGING" | sed -e "s/'/''/g")'
enable_metadata_proxy: '$(echo "$ENABLE_METADATA_PROXY" | sed -e "s/'/''/g")'
enable_metadata_proxy: '$(echo "$ENABLE_METADATA_CONCEALMENT" | sed -e "s/'/''/g")'
enable_metrics_server: '$(echo "$ENABLE_METRICS_SERVER" | sed -e "s/'/''/g")'
enable_rescheduler: '$(echo "$ENABLE_RESCHEDULER" | sed -e "s/'/''/g")'
logging_destination: '$(echo "$LOGGING_DESTINATION" | sed -e "s/'/''/g")'

4
cluster/gce/gci/configure-helper.sh
View File

@ -52,7 +52,7 @@ function config-ip-firewall {
iptables -N KUBE-METADATA-SERVER
iptables -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER
if [[ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]]; then
if [[ -n "${ENABLE_METADATA_CONCEALMENT:-}" ]]; then
iptables -A KUBE-METADATA-SERVER -j DROP
fi
}
@ -1851,7 +1851,7 @@ function start-kube-addons {
if [[ "${ENABLE_IP_MASQ_AGENT:-}" == "true" ]]; then
setup-addon-manifests "addons" "ip-masq-agent"
fi
if [[ "${ENABLE_METADATA_PROXY:-}" == "simple" ]]; then
if [[ "${ENABLE_METADATA_CONCEALMENT:-}" == "true" ]]; then
setup-addon-manifests "addons" "metadata-proxy/gce"
fi