github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
k3s/cluster/addons
History
Kubernetes Submit Queue 7265908e7f Merge pull request #41998 from timstclair/fluentd-debian-base 
Automatic merge from submit-queue

Cleanup fluentd-gcp image, rebase on debian-base

**Why we need this PR**:

There are several problems with our current fluentd-gcp image:

- It pulls in lots of unused packages, which expose unnecessary risk and create noise in CVE scans (and scare customers). The most notable example is the fluent-ui, which pulls in rails.
- `curl | sh ` is not a good practice for a Dockerfile. First, the script is not checked in the same source control branch, so builds are not reproducible. Second, the actions it is taking are opaque. Third, in this case, using non-standard packages means they're harder to manage with CVE scans & upstream fixes.

**What is changed by this PR?**

- Rather than relying on td-agent (which includes fluent-ui), use standard upstream packages. This is largely based off the [official fluentd debian-based image](https://github.com/fluent/fluentd-docker-image/blob/master/v0.12/debian/Dockerfile).
- Rebases the image on debian-base (depends on https://github.com/kubernetes/kubernetes/pull/41915). We would like to move towards a single full-distro base image we can maintain. This change should be relatively minor.

As a result of these changes, the image size is reduced from 360.6 MB to 185.8 MB (nearly half). Many packages were removed, and the full diff (focus on the unversioned files) is listed here: 3fb704f977

**Which issue this PR fixes** https://github.com/kubernetes/kubernetes/issues/40248

**Special notes for your reviewer**:

This change both addresses security concerns, and is expected to greatly reduce the maintenance burden of the fluentd-gcp image. I'd *really* like to get this into 1.6, so please prioritize this review if possible.

I tested this by running the default e2e suite on a private e2e cluster using the new image. If there are other tests you'd like me to run, please let me know ASAP.

**Release note**:
```release-note
Cleanup fluentd-gcp image: rebase on debian-base, switch to upstream packages, remove fluent-ui & rails
```
 		2017-02-26 19:15:11 -08:00
..
addon-manager Bumps addon-manager to v6.4-alpha.3 and updates template files 2017-02-24 16:52:31 -08:00
calico-policy-controller Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
cluster-loadbalancing Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
cluster-monitoring bump version numbers for heapster/influxdb/grafana images 2017-02-25 15:33:04 +01:00
dashboard Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
dns Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
dns-horizontal-autoscaler Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
e2e-rbac-bindings Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
etcd-empty-dir-cleanup Bump etcd-empty-dir-cleanup to 3.0.14.0 2017-02-22 13:22:04 -08:00
fluentd-elasticsearch Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
fluentd-gcp Merge pull request #41998 from timstclair/fluentd-debian-base 2017-02-26 19:15:11 -08:00
node-problem-detector Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
podsecuritypolicies default policy 2016-05-11 18:07:36 -04:00
python-image Always --pull in docker build to ensure recent base images 2017-01-10 16:21:05 -08:00
rbac Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
registry Adds the new addon-manager labels on cluster addon templates 2017-02-24 16:53:12 -08:00
storage-class Merge pull request #41854 from vmware/default-storage-class.kerneltime 2017-02-25 05:02:52 -08:00
BUILD Build release tarballs in bazel and add `make bazel-release` rule 2017-01-13 16:17:44 -08:00
README.md Updates READMEs regarding the new behavior of addon-manager 2017-02-24 16:42:41 -08:00

README.md

Cluster add-ons

Overview

Cluster add-ons are resources like Services and Deployments (with pods) that are shipped with the Kubernetes binaries and are considered an inherent part of the Kubernetes clusters.

There are currently two classes of add-ons:

  • Add-ons that will be reconciled.
  • Add-ons that will be created if they don't exist.

More details could be found in addon-manager/README.md.

Cooperating Horizontal / Vertical Auto-Scaling with "reconcile class addons"

"Reconcile" class addons will be periodically reconciled to the original state given by the initial config. In order to make Horizontal / Vertical Auto-scaling functional, the related fields in config should be left unset. More specifically, leave replicas in ReplicationController / Deployment / ReplicaSet unset for Horizontal Scaling, leave resources for container unset for Vertical Scaling. The periodic reconcile won't clobbered these fields, hence they could be managed by Horizontal / Vertical Auto-scaler.

Add-on naming

The suggested naming for most of the resources is <basename> (with no version number). Though resources like Pod, ReplicationController and DaemonSet are exceptional. It would be hard to update Pod because many fields in Pod are immutable. For ReplicationController and DaemonSet, in-place update may not trigger the underlying pods to be re-created. You probably need to change their names during update to trigger a complete deletion and creation.

Analytics