mirror of https://github.com/k3s-io/k3s
2d1f42e0b1
Automatic merge from submit-queue (batch tested with PRs 63969, 63902, 63689, 63973, 63978). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Adds a mechanism in vSphere Cloud Provider to get credentials from Kubernetes secrets **What this PR does / why we need it**: Currently, vCenter credentials are stored in plain text in vsphere.conf. This PR adds a mechanism in vSphere Cloud Provider to get vCenter credentials from Kubernetes secrets. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes # **Special notes for your reviewer**: Internally review here: https://github.com/vmware/kubernetes/pull/484 **Workflow:** 1. Create vsphere.conf file with ```secret-name``` and ```secret-namespace```. ``` [Global] insecure-flag = 1 secret-name = "vcconf" secret-namespace = "kube-system" [VirtualCenter "10.160.45.119"] port = 443 datacenters = k8s-dc-1 [Workspace] server = 10.160.45.119 datacenter = k8s-dc-1 default-datastore = sharedVMFS-0 folder = Discovered virtual machine ``` 2. Launch Kubernetes cluster with vSphere Cloud Provider Configured. 3. Create secret with vCenter credentials. a. Create base64 encoding for username and password: username: ``` > echo -n 'admin' | base64 YWRtaW4= ``` password: ``` > echo -n 'vsphere' | base64 dnNwaGVyZQ== ``` b. kubectl create -f vccredentials.yaml ``` #vccredentials.yaml apiVersion: v1 kind: Secret metadata: name: vcconf type: Opaque data: 10.192.44.199.username: YWRtaW4= 10.192.44.199.password: dnNwaGVyZQ== ``` 4. vSphere Cloud Provider can be used now. **Note:** Secrets info can be provided with both (old and new) vSphere Cloud provider configuration formats. **Tests Done:** - [x] vSphere Cloud Provider unit test. - [x] Volume lifecyle with Username and Password in vsphere.conf (for backward compability) - [x] Volume lifecyle with secrets information in vsphere.conf. - [x] Update secrets workflow **Release note**: ```release-note Adds a mechanism in vSphere Cloud Provider to get credentials from Kubernetes secrets ``` |
||
|---|---|---|
| .. | ||
| providers | ||
| BUILD | ||
| OWNERS | ||
| README.md | ||
| cloud.go | ||
| doc.go | ||
| plugins.go | ||
README.md
Deprecation Notice: This directory has entered maintenance mode and will not be accepting new providers. Cloud Providers in this directory will continue to be actively developed or maintained and supported at their current level of support as a longer-term solution evolves.
Overview:
The mechanism for supporting cloud providers is currently in transition: the original method of implementing cloud provider-specific functionality within the main kubernetes tree (here) is no longer advised; however, the proposed solution is still in development.
Guidance for potential cloud providers:
- Support for cloud providers is currently in a state of flux. Background information on motivation and the proposal for improving is in the github proposal.
- In support of this plan, a new cloud-controller-manager binary was added in 1.6. This was the first of several steps (see the proposal for more information).
- Attempts to contribute new cloud providers or (to a lesser extent) persistent volumes to the core repo will likely meet with some pushback from reviewers/approvers.
- It is understood that this is an unfortunate situation in which 'the old way is no longer supported but the new way is not ready yet', but the initial path is unsustainable, and contributors are encouraged to participate in the implementation of the proposed long-term solution, as there is risk that PRs for new cloud providers here will not be approved.
- Though the fully productized support envisioned in the proposal is still 2 - 3 releases out, the foundational work is underway, and a motivated cloud provider could accomplish the work in a forward-looking way. Contributors are encouraged to assist with the implementation of the design outlined in the proposal.
Some additional context on status / direction:
- 1.6 added a new cloud-controller-manager binary that may be used for testing the new out-of-core cloudprovider flow.
- Setting cloud-provider=external allows for creation of a separate controller-manager binary
- 1.7 adds extensible admission control, further enabling topology customization.