de293b2d7d
Ensure the bootstrap rotation code is tested by forcing rotation
...
Expose both a Stop() method (for cleanup) and a method to force
cert rotation, but only expose Stop() on the interface.
Verify that we choose the correct client.
2018-11-16 21:50:52 -05:00
0af19875ad
Make bootstrap client cert loading part of rotation
...
Ensure that bootstrap+clientcert-rotation in the Kubelet can:
1. happen in the background so that static pods aren't blocked by bootstrap
2. collapse down to a single call path for requesting a CSR
3. reorganize the code to allow future flexibility in retrieving bootstrap creds
Fetching the first certificate and later certificates when the kubelet
is using client rotation and bootstrapping should share the same code
path. We also want to start the Kubelet static pod loop before
bootstrapping completes. Finally, we want to take an incremental step
towards improving how the bootstrap credentials are loaded from disk
(potentially allowing for a CLI call to get credentials, or a remote
plugin that better integrates with cloud providers or KSMs).
Reorganize how the kubelet client config is determined. If rotation is
off, simplify the code path. If rotation is on, load the config
from disk, and then pass that into the cert manager. The cert manager
creates a client each time it tries to request a new cert.
Preserve existing behavior where:
1. bootstrap kubeconfig is used if the current kubeconfig is invalid/expired
2. we create the kubeconfig file based on the bootstrap kubeconfig, pointing to
the location that new client certs will be placed
3. the newest client cert is used once it has been loaded
2018-11-16 21:50:26 -05:00
440a5ad7cb
Don't allow --csr-only for CA certs or all
2018-11-16 15:22:37 -08:00
f4fd7b0b2b
Merge pull request #71069 from fabriziopandini/kubeadm-phases-add-all-subcommands
...
Kubeadm - add all subcommands to phases
2018-11-16 15:17:03 -08:00
5ec9349276
Merge pull request #70917 from dims/add-log-file-option-to-kubelet-flags
...
add log_file option to kubelet flags
2018-11-16 15:16:53 -08:00
fab7009997
Merge pull request #71135 from luxas/kubeadm_repo_flag
...
kubeadm: Allow customizing the image repository via flags
2018-11-16 13:20:16 -08:00
7ff49c99d3
Merge pull request #71126 from rosti/warn-api-bind-override
...
kubeadm: Warn on API server bind address override
2018-11-16 12:04:10 -08:00
a666003b36
kubeadm: Allow customizing the image repository via flags
2018-11-16 23:52:56 +08:00
1308c7d2f5
kubeadm phases add all subcommands
2018-11-16 16:39:04 +01:00
e94a9f9321
Merge pull request #71085 from bsalamat/leader-election-fix
...
Report kube-scheduler unhealthy if leader election is wedged
2018-11-16 05:13:28 -08:00
a5f06fdd16
Merge pull request #71066 from fabriziopandini/kubeadm-fix-validateMixedArgs
...
Kubeadm - Fix validateMixedArgs for phases
2018-11-16 03:57:01 -08:00
0908af5e09
Merge pull request #71061 from yagonobre/init-todo
...
Remove todo from init phase
2018-11-16 03:56:52 -08:00
b46fbbc4e6
kubeadm: Warn on API server bind address override
...
ChooseAPIServerBindAddress is silently overriding the requested bind IP
address for the API server if that address is deemed unsuitable. This is
currently done only if the IP is a loopback one (127.0.0.0/8; ::1/128).
It's best to at least issue a warning if such override occurs, so that there
are no surprised users by this.
Signed-off-by: Rostislav M. Georgiev <rostislavg@vmware.com>
2018-11-16 13:00:52 +02:00
973b5d291d
Merge pull request #71053 from yagonobre/upload-config-fix
...
Fix `kubeadm upload-config kubeadm` example
2018-11-16 01:53:50 -08:00
dc6632ad4c
Merge pull request #71046 from liztio/certs-renew-use-api-fix
...
Certs renew use api fix
2018-11-16 01:53:40 -08:00
4b98060f4e
Merge pull request #70901 from neolit123/kubeadm-strict-config
...
kubeadm: enable strict config unmarhaling
2018-11-15 23:52:36 -08:00
8797db339d
Merge pull request #69827 from tomkukral/kadm-etcd
...
use etcd endpoints from advertise-client-urls
2018-11-15 17:25:17 -08:00
2473bba9e5
kubeadm: update autogenerated bazel
2018-11-16 02:22:04 +02:00
cc60625930
kubeadm: handle strict config unmarshaling
2018-11-16 02:21:31 +02:00
3d3cc63cc8
Merge pull request #70809 from liztio/csr
...
Generate CSRs for kubeadm
2018-11-15 15:00:02 -08:00
6afb9a117b
Fix renewing certificates via the API
...
Poll for events, print CSR name, and parse PEM instead of CSR
2018-11-15 14:02:47 -08:00
7b4d4bc8ac
Merge pull request #70508 from dashpole/pod_resources_socket
...
Add socket-based kubelet pod resources API.
2018-11-15 13:43:44 -08:00
504466c4e6
Merge pull request #68267 from liggitt/node-label-update
...
Limit kubelets from updating their own labels when NodeRestriction is enabled
2018-11-15 11:11:02 -08:00
34b4a5bbee
Add watchdog for leader election logic getting wedged
2018-11-15 11:02:14 -08:00
5fc1a9a87c
Option to generate CSRs instead of issued certificates
2018-11-15 10:47:54 -08:00
630cb53f82
add kubelet grpc server for pod-resources service
2018-11-15 09:43:20 -08:00
b1a52a38e9
Merge pull request #67257 from pbarker/audit
...
dynamic audit configuration
2018-11-15 02:42:59 -08:00
807338e96a
Fix validateMixedArgs for phases
2018-11-15 11:38:18 +01:00
f48e18faa4
Merge pull request #70971 from cheftako/leaseCheck
...
Report KCM as unhealthy if leader election is wedged.
2018-11-15 01:30:59 -08:00
4fdac19603
Merge pull request #71059 from timothysc/kubeadmmsg
...
Minor update to the comment block characters for kubeadm
2018-11-14 23:20:07 -08:00
8b110e27fc
Remove todo from init phase
2018-11-15 01:43:56 -02:00
aea4a4e0fb
Minor update to the comment block characters for kubeadm
2018-11-14 20:31:11 -06:00
e3ddaaad1d
Merge pull request #71045 from neolit123/kubeadm-go-docs-1.13
...
kubeadm: fix godocs indentation for v1beta1
2018-11-14 17:25:50 -08:00
2965d24547
Merge pull request #71043 from chuckha/etcd-doc
...
kubeadm: document required etcd configuration
2018-11-14 17:25:40 -08:00
bb2fcd90f3
Merge pull request #71040 from fabriziopandini/kubeadm-phases-local-flags
...
Kubeadm phases - add local flags
2018-11-14 17:25:30 -08:00
9c43ee6d6e
Report KCM as unhealthy if leader election is wedged.
...
Feedback from lavalamp and deads2k.
Changed Check() logic to be central to LeaderElector.
Further changes, especially cleaning up the test code.
2018-11-14 16:57:37 -08:00
eb89d3dddd
adds dynamic audit configuration
2018-11-14 17:54:06 -07:00
606bbc0457
Fix kubeadm upload-config kubeadm example
2018-11-14 22:28:51 -02:00
1240274204
Merge pull request #71037 from rdodev/reset-iptables
...
Reset helptext alignment
2018-11-14 15:39:46 -08:00
da49adb52f
kubeadm: fix godocs indentation for v1beta1
2018-11-15 00:13:58 +02:00
02ec1e84b0
kubeadm: document required etcd configuration
...
Signed-off-by: Chuck Ha <ha.chuck@gmail.com>
2018-11-14 17:05:24 -05:00
0df79e4daa
Merge pull request #71008 from neolit123/kubeadm-go-docs-1.13
...
kubeadm: update notes and example config in v1beta1 godocs
2018-11-14 13:16:54 -08:00
1a9fd268a9
Merge pull request #71005 from mikedanese/certpubfix
...
rootcacertpublisher: trigger resync on namespace add and update
2018-11-14 11:38:07 -08:00
1b9986b219
Kubeadm phases - add local flags
2018-11-14 20:29:52 +01:00
ba7d3c3ba8
Merge pull request #71009 from timothysc/phaseflow
...
Fixup language on help message to denote phases
2018-11-14 09:26:20 -08:00
d5cd412ae0
reset helptext alignment
...
Signed-off-by: Ruben Orduz <rubenoz@gmail.com>
2018-11-14 09:59:48 -05:00
3e6d414b55
Merge pull request #70967 from mikedanese/fixtropts
...
Fix broken defaulting and validation in TokenRequest enablement
2018-11-13 22:03:42 -08:00
9fb2dcad5e
Limit kubelets from updating their own labels
2018-11-13 23:48:47 -05:00
ef3380b42d
Fixup language on help message to denote phases
...
Signed-off-by: Timothy St. Clair <timothysc@gmail.com>
2018-11-13 20:16:15 -06:00
90295640ef
Merge pull request #71010 from neolit123/revert-68890-dnspolicy
...
Revert "kubeadm: Create control plane with ClusterFirstWithHostNet dns policy"
2018-11-13 18:07:33 -08:00
Clayton Coleman