basic RBAC support #1351

jwfang · 2017-06-15T13:24:49Z

some of the works are from @rajiteh

changes summary:

system components use their own certs, identified as user/group document here:
https://kubernetes.io/docs/admin/authorization/rbac/#default-roles-and-role-bindings

changed components: kubelet/kube-proxy/controller-manager/scheduler
addon run as ServiceAccount and changed related ClusterRole/ClusterRoleBinding,
patch existing Binding if necessary.

changed addons: kube-dns/helm
add an authorization_modes var to control authorization modes

By default we do not test reset.yml now.

1298.6.0 fixes some sporadic network issues. It also includes docker 1.12.6 which includes several stability fixes for kubernetes. Signed-off-by: Sergii Golovatiuk <[email protected]>

etcd is crucial part of kubernetes cluster. Ansible restarts etcd on reconfiguration. Backup helps operator to restore cluster manually in case of any issues. Signed-off-by: Sergii Golovatiuk <[email protected]>

Add helm deployment

Make reset check on idempotency check optional

Bump CoreOS stable to latest version

Backup etcd

This adds time to deployment, so we should only test it sparingly during daily master.

Also changed unnecessary delay to a max timeout (now defaulting to 1s sleep between tries) Also rename play_hosts to ansible_play_hosts

Optional Ansible playbook for preparing a host for running Kargo. This includes creation of a user account, some basic packages, and sysctl values required to allow CNI networking on a libvirt network.

The docker-network environment file masks the new values put into /etc/systemd/system/docker.service.d/flannel-options.conf to renumber the docker0 to work correctly with flannel.

Disable download_run_once and download_localhost for most CI scenarios

Add KVM hypervisor playbook to contrib

Allows config changes made by Ansible to restart dnsmasq deployment

Change wait for dnsmasq to skip if there are no kube-nodes in play

Use checksum of dnsmasq config to trigger updates of dnsmasq

Non-brekable space is 0xc2 0xa0 byte sequence in UTF-8. To find one: $ git grep -I -P '\xc2\xa0' To replace with regular space: $ git grep -l -I -P '\xc2\xa0' | xargs sed -i 's/\xc2\xa0/ /g' This commit doesn't include changes that will overlap with commit f1c59a9.

Fixes for AWS Terraform Deployment

Add missing defaults

replace non-breakable space with regular space

Update roadmap.md

Latest released version of kube-policy-controller contains important bug fixes and should be used by default.

- Run docker run from script rather than directly from systemd target - Refactoring styling/templates Signed-off-by: Sergii Golovatiuk <[email protected]>

Fix markdown of heading in README

bradbeam · 2017-06-23T16:26:35Z

Can you rebase off current master to get the necessary CI fixes

…ube-proxy

…es NOT work

* Add a flag "authorization_method", when set to "RBAC" enables role based access control. * Add required cluster roles and bindings for kube-dns * Patch tiller deployment to use a service account with proper credentials. * Add a flag to regenerate kubernetes certs on the nodes.

…-masters

* Consolidate variable definitions to `kargo-defaults`. * Set `AlwaysAllow` as the default authorization mode. * Ability to set multiple authorization modes. * Various style fixes and typos

k8s-ci-robot · 2017-06-26T09:11:44Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://github.com/kubernetes/kubernetes/wiki/CLA-FAQ to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please email the CNCF helpdesk: [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

mattymo and others added 30 commits March 20, 2017 13:16

Make reset check on idempotency check optional

b47e4da

By default we do not test reset.yml now.

Fixes for AWS Terraform Deployment

ba9f171

Bump CoreOS stable to latest version

6ebe3ab

1298.6.0 fixes some sporadic network issues. It also includes docker 1.12.6 which includes several stability fixes for kubernetes. Signed-off-by: Sergii Golovatiuk <[email protected]>

Backup etcd data before restarting etcd

e635fec

etcd is crucial part of kubernetes cluster. Ansible restarts etcd on reconfiguration. Backup helps operator to restore cluster manually in case of any issues. Signed-off-by: Sergii Golovatiuk <[email protected]>

Merge pull request #1155 from mattymo/helm

b68e545

Add helm deployment

Merge pull request #1160 from mattymo/simpler_idempotency

db7a4f3

Make reset check on idempotency check optional

Merge pull request #1162 from holser/bump_coreos_ci

b7fbf19

Bump CoreOS stable to latest version

Merge pull request #1159 from holser/etcd_backup_restore

df09b8d

Backup etcd

Disable download_run_once and download_localhost for most CI scenarios

7d42334

This adds time to deployment, so we should only test it sparingly during daily master.

Change wait for dnsmasq to skip if there are no kube-nodes in play

51985ab

Also changed unnecessary delay to a max timeout (now defaulting to 1s sleep between tries) Also rename play_hosts to ansible_play_hosts

Add KVM hypervisor playbook to contrib

bf5ad43

Optional Ansible playbook for preparing a host for running Kargo. This includes creation of a user account, some basic packages, and sysctl values required to allow CNI networking on a libvirt network.

1169 - fix docker systemd unit

18404db

The docker-network environment file masks the new values put into /etc/systemd/system/docker.service.d/flannel-options.conf to renumber the docker0 to work correctly with flannel.

Merge pull request #1168 from mattymo/disable_download_delegate

49e37cd

Disable download_run_once and download_localhost for most CI scenarios

Merge pull request #1163 from mattymo/kvm_setup

17c5e96

Add KVM hypervisor playbook to contrib

Use checksum of dnsmasq config to trigger updates of dnsmasq

e020457

Allows config changes made by Ansible to restart dnsmasq deployment

add iptables --flush to reset role

da26c56

Setting defaults for docker log rotation

388469c

Merge pull request #1167 from mattymo/dnsmasq_when_deploying_master

8098b77

Change wait for dnsmasq to skip if there are no kube-nodes in play

Merge pull request #1172 from mattymo/dnsmasq_upgrade

daf8828

Use checksum of dnsmasq config to trigger updates of dnsmasq

Update README.md

728a36e

Update roadmap.md

8fdabb2

Merge pull request #1161 from VincentS/aws_deployment

037c5d9

Fixes for AWS Terraform Deployment

Add missing defaults

9f1ca93

Merge pull request #1179 from kubernetes-incubator/missing_defaults

5879d62

Add missing defaults

Merge pull request #1177 from rutsky/replace-nbsp

503dc26

replace non-breakable space with regular space

Merge pull request #1176 from zoidbergwill/patch-2

43367f9

Update roadmap.md

Bump calico policy controller version

bc0db79

Latest released version of kube-policy-controller contains important bug fixes and should be used by default.

Refactor etcd role

77671db

- Run docker run from script rather than directly from systemd target - Refactoring styling/templates Signed-off-by: Sergii Golovatiuk <[email protected]>

Merge pull request #1175 from zoidbergwill/patch-1

7e59cf6

Fix markdown of heading in README

fix conflict

a75955d

jwfang mentioned this pull request Jun 22, 2017

short-form dns query *nslookup kubernetes.default* not working kubernetes/dns#109

Closed

jwfang and others added 22 commits June 26, 2017 16:35

add kube-node to system:nodes group, add system:kube-proxy cert for k…

27e3998

…ube-proxy

seperate kube-proxy certs for each node

8ed48f0

certs for system:kube-controller-manager system:kube-scheduler

4fa142b

node identified as system:node:<node-name>

4a1a7bd

run kubedns as system:serviceaccount:kube-system:kube-dns; but dns do…

8e516e7

…es NOT work

add label for kube-dns sa

00e5fc8

Replace static references to system namespace

5a86194

Use kubectl patch

442ebce

patch system:kube-dns clusterrole for get

525db1f

replace insecure port with secure port for apiserver_endpoint on kube…

5c56085

…-masters

Address PR feedback.

971944e

* Consolidate variable definitions to `kargo-defaults`. * Set `AlwaysAllow` as the default authorization mode. * Ability to set multiple authorization modes. * Various style fixes and typos

Update docs.

c0db149

Extract kubectl commands to resource yaml files and use kube module

a22868e

Make rotate_kubernetes_certs default to false

d742a39

kube-proxy use kubeconfig on kube-master

d3ea13b

Remove cert rotation code. Remove disclaimer for supported auth methods.

a3760a8

Reverted leftover tasks from cert rotation functionality.

0816f62

Add note about auth modes

ef58242

Whitespace fixes

f5c887a

minor tune after merge @rajiteh's work

922ae45

merge after rebase

6876f60

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. and removed cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jun 26, 2017

jwfang closed this Jun 26, 2017

bradbeam mentioned this pull request Jun 26, 2017

basic rbac support #1382

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

basic RBAC support #1351

basic RBAC support #1351

jwfang commented Jun 15, 2017 •

edited

Loading

bradbeam commented Jun 23, 2017

k8s-ci-robot commented Jun 26, 2017

basic RBAC support #1351

basic RBAC support #1351

Conversation

jwfang commented Jun 15, 2017 • edited Loading

bradbeam commented Jun 23, 2017

k8s-ci-robot commented Jun 26, 2017

jwfang commented Jun 15, 2017 •

edited

Loading