mirror of https://github.com/k3s-io/k3s
d50c027d0c
Automatic merge from submit-queue (batch tested with PRs 39803, 39698, 39537, 39478) include bootstrap admin in super-user group, ensure tokens file is correct on upgrades Fixes https://github.com/kubernetes/kubernetes/issues/39532 Possible issues with cluster bring-up scripts: - [x] known_tokens.csv and basic_auth.csv is not rewritten if the file already exists * new users (like the controller manager) are not available on upgrade * changed users (like the kubelet username change) are not reflected * group additions (like the addition of admin to the superuser group) don't take effect on upgrade * this PR updates the token and basicauth files line-by-line to preserve user additions, but also ensure new data is persisted - [x] existing 1.5 clusters may depend on more permissive ABAC permissions (or customized ABAC policies). This PR adds an option to enable existing ABAC policy files for clusters that are upgrading Follow-ups: - [ ] both scripts are loading e2e role-bindings, which only be loaded in e2e tests, not in normal kube-up scenarios - [ ] when upgrading, set the option to use existing ABAC policy files - [ ] update bootstrap superuser client certs to add superuser group? ("We also have a certificate that "used to be" a super-user. On GCE, it has CN "kubecfg", on GKE it's "client"") - [ ] define (but do not load by default) a relaxed set of RBAC roles/rolebindings matching legacy ABAC, and document how to load that for new clusters that do not want to isolate user permissions |
||
|---|---|---|
| .. | ||
| boilerplate | ||
| cmd/teststale | ||
| e2e-internal | ||
| gen-swagger-doc | ||
| jenkins | ||
| lib | ||
| make-rules | ||
| testdata | ||
| verify-flags | ||
| .linted_packages | ||
| BUILD | ||
| OWNERS | ||
| autogenerated_placeholder.txt | ||
| benchmark-go.sh | ||
| benchmark-integration.sh | ||
| build-cross.sh | ||
| build-go.sh | ||
| build-ui.sh | ||
| cherry_pick_pull.sh | ||
| dev-build-and-push.sh | ||
| dev-build-and-up.sh | ||
| dev-push-hyperkube.sh | ||
| e2e-node-test.sh | ||
| e2e.go | ||
| federated-ginkgo-e2e.sh | ||
| generate-bindata.sh | ||
| generate-docs.sh | ||
| get-build.sh | ||
| ginkgo-e2e.sh | ||
| godep-save.sh | ||
| grab-profiles.sh | ||
| install-etcd.sh | ||
| list-feature-tests.sh | ||
| local-up-cluster.sh | ||
| local-up-discovery.sh | ||
| lookup_pull.py | ||
| run-in-gopath.sh | ||
| test-cmd.sh | ||
| test-go.sh | ||
| test-integration.sh | ||
| test-update-storage-objects.sh | ||
| update-all.sh | ||
| update-api-reference-docs.sh | ||
| update-bazel.sh | ||
| update-codecgen.sh | ||
| update-codegen.sh | ||
| update-federation-api-reference-docs.sh | ||
| update-federation-generated-swagger-docs.sh | ||
| update-federation-openapi-spec.sh | ||
| update-federation-swagger-spec.sh | ||
| update-generated-docs.sh | ||
| update-generated-protobuf-dockerized.sh | ||
| update-generated-protobuf.sh | ||
| update-generated-runtime-dockerized.sh | ||
| update-generated-runtime.sh | ||
| update-generated-swagger-docs.sh | ||
| update-godep-licenses.sh | ||
| update-gofmt.sh | ||
| update-munge-docs.sh | ||
| update-openapi-spec.sh | ||
| update-staging-client-go.sh | ||
| update-swagger-spec.sh | ||
| update_owners.py | ||
| verify-all.sh | ||
| verify-api-groups.sh | ||
| verify-api-reference-docs.sh | ||
| verify-bazel.sh | ||
| verify-boilerplate.sh | ||
| verify-cli-conventions.sh | ||
| verify-codecgen.sh | ||
| verify-codegen.sh | ||
| verify-description.sh | ||
| verify-federation-openapi-spec.sh | ||
| verify-flags-underscore.py | ||
| verify-generated-docs.sh | ||
| verify-generated-protobuf.sh | ||
| verify-generated-runtime.sh | ||
| verify-generated-swagger-docs.sh | ||
| verify-godep-licenses.sh | ||
| verify-godeps.sh | ||
| verify-gofmt.sh | ||
| verify-golint.sh | ||
| verify-govet.sh | ||
| verify-import-boss.sh | ||
| verify-linkcheck.sh | ||
| verify-openapi-spec.sh | ||
| verify-pkg-names.sh | ||
| verify-readonly-packages.sh | ||
| verify-staging-client-go.sh | ||
| verify-staging-imports.sh | ||
| verify-swagger-spec.sh | ||
| verify-symbols.sh | ||
| verify-test-images.sh | ||
| verify-test-owners.sh | ||