github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
k3s/cluster/addons
History
Kubernetes Submit Queue ec434662bd
Merge pull request #64503 from kgolab/kg-ca-rbac 
Automatic merge from submit-queue (batch tested with PRs 64503, 64903, 64643, 64987). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create system:cluster-autoscaler account & role and introduce it to C…

**What this PR does / why we need it**:

This PR adds cluster-autoscaler ClusterRole & binding, to be used by the Cluster Autoscaler (kubernetes/autoscaler repository).
It also updates GCE scripts to make CA use the cluster-autoscaler user account.

User account instead of Service account is chosen to be more in line with kube-scheduler.

**Which issue(s) this PR fixes**:

Fixes [issue 383](https://github.com/kubernetes/autoscaler/issues/383) from kubernetes/autoscaler.

**Special notes for your reviewer**:

This PR might be treated as a security fix since prior to it CA on GCE was using system:cluster-admin account, assumed due to default handling of unsecured & unauthenticated traffic over plain HTTP.

**Release note**:

```release-note
A cluster-autoscaler ClusterRole is added to cover only the functionality required by Cluster Autoscaler and avoid abusing system:cluster-admin role.

action required: Cloud providers other than GCE might want to update their deployments or sample yaml files to reuse the role created via add-on.
```
 		2018-06-11 17:29:13 -07:00
..
addon-manager Update all script to use /usr/bin/env bash in shebang 2018-04-19 13:20:13 +02:00
calico-policy-controller Don't specify a description for Calico CRDs 2018-06-07 15:00:29 -07:00
cluster-loadbalancing Use default seccomp profile for addons 2018-05-02 22:50:29 -07:00
cluster-monitoring Merge pull request #62756 from wangzhen127/seccomp-in-addon 2018-05-23 17:29:16 -07:00
dashboard Use default seccomp profile for addons 2018-05-02 22:50:29 -07:00
device-plugins/nvidia-gpu Update nvidia-gpu-device-plugin to apps/v1 and use RollingUpdate updateStrategy. 2018-05-24 17:53:13 -07:00
dns Merge pull request #64473 from nberlee/master 2018-06-05 10:23:19 -07:00
dns-horizontal-autoscaler Use default seccomp profile for addons 2018-05-02 22:50:29 -07:00
fluentd-elasticsearch Revert "Remove rescheduler and corresponding tests from master" 2018-05-31 22:18:49 -04:00
fluentd-gcp Revert "Remove rescheduler and corresponding tests from master" 2018-05-31 22:18:49 -04:00
ip-masq-agent Merge pull request #59237 from tanshanshan/addons1 2018-02-12 15:44:36 -08:00
istio Modify security profile for proxy 2018-06-04 14:06:22 -07:00
kube-proxy Add wildcard tolerations to kube-proxy. 2017-11-29 12:36:58 -08:00
metadata-agent Use default seccomp profile for addons 2018-05-02 22:50:29 -07:00
metadata-proxy Added network-unavailable tolerations for hostNetwork=true. 2018-03-19 23:57:26 +08:00
metrics-server Use default seccomp profile for addons 2018-05-02 22:50:29 -07:00
node-problem-detector `exec` away the shell for node-problem-detector 2018-03-09 16:07:30 -08:00
prometheus [prometheus addon] Fix missing storage class in alertmanager PVC 2018-04-30 12:30:20 +02:00
python-image remove gcloud docker -- since it's deprecated 2018-02-28 00:24:27 -08:00
rbac Limit access to configmaps 2018-06-08 18:02:37 +02:00
storage-class [addon/storage-class] update storageclass groupversion in storage-class 2017-10-22 19:50:47 +08:00
BUILD Use the pkg_tar wrapper from kubernetes/repo-infra 2018-01-18 17:10:16 -08:00
README.md Updated cluster/addons readme to match and point to docs 2017-10-18 10:36:24 -04:00

README.md

Legacy Cluster add-ons

For more information on add-ons see the documentation.

Overview

Cluster add-ons are resources like Services and Deployments (with pods) that are shipped with the Kubernetes binaries and are considered an inherent part of the Kubernetes clusters.

There are currently two classes of add-ons:

  • Add-ons that will be reconciled.
  • Add-ons that will be created if they don't exist.

More details could be found in addon-manager/README.md.

Cooperating Horizontal / Vertical Auto-Scaling with "reconcile class addons"

"Reconcile" class addons will be periodically reconciled to the original state given by the initial config. In order to make Horizontal / Vertical Auto-scaling functional, the related fields in config should be left unset. More specifically, leave replicas in ReplicationController / Deployment / ReplicaSet unset for Horizontal Scaling, leave resources for container unset for Vertical Scaling. The periodic reconcile won't clobbered these fields, hence they could be managed by Horizontal / Vertical Auto-scaler.

Add-on naming

The suggested naming for most of the resources is <basename> (with no version number). Though resources like Pod, ReplicationController and DaemonSet are exceptional. It would be hard to update Pod because many fields in Pod are immutable. For ReplicationController and DaemonSet, in-place update may not trigger the underlying pods to be re-created. You probably need to change their names during update to trigger a complete deletion and creation.

Analytics