Bumping k8s dependencies to 1.13
This commit is contained in:
Cheng Xing
246
vendor/k8s.io/kubernetes/cluster/gce/gci/configure-helper.sh
generated
vendored
246
vendor/k8s.io/kubernetes/cluster/gce/gci/configure-helper.sh
generated
vendored
@@ -30,6 +30,10 @@ readonly UUID_BLOCK_PREFIX="/dev/disk/by-uuid/google-local-ssds"
|
||||
readonly COREDNS_AUTOSCALER="Deployment/coredns"
|
||||
readonly KUBEDNS_AUTOSCALER="Deployment/kube-dns"
|
||||
|
||||
# Resource requests of master components.
|
||||
KUBE_CONTROLLER_MANAGER_CPU_REQUEST="${KUBE_CONTROLLER_MANAGER_CPU_REQUEST:-200m}"
|
||||
KUBE_SCHEDULER_CPU_REQUEST="${KUBE_SCHEDULER_CPU_REQUEST:-75m}"
|
||||
|
||||
# Use --retry-connrefused opt only if it's supported by curl.
|
||||
CURL_RETRY_CONNREFUSED=""
|
||||
if curl --help | grep -q -- '--retry-connrefused'; then
|
||||
@@ -43,6 +47,40 @@ function setup-os-params {
|
||||
echo "core.%e.%p.%t" > /proc/sys/kernel/core_pattern
|
||||
}
|
||||
|
||||
# secure_random generates a secure random string of bytes. This function accepts
|
||||
# a number of secure bytes desired and returns a base64 encoded string with at
|
||||
# least the requested entropy. Rather than directly reading from /dev/urandom,
|
||||
# we use uuidgen which calls getrandom(2). getrandom(2) verifies that the
|
||||
# entropy pool has been initialized sufficiently for the desired operation
|
||||
# before reading from /dev/urandom.
|
||||
#
|
||||
# ARGS:
|
||||
# #1: number of secure bytes to generate. We round up to the nearest factor of 32.
|
||||
function secure_random {
|
||||
local infobytes="${1}"
|
||||
if ((infobytes <= 0)); then
|
||||
echo "Invalid argument to secure_random: infobytes='${infobytes}'" 1>&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
local out=""
|
||||
for (( i = 0; i < "${infobytes}"; i += 32 )); do
|
||||
# uuids have 122 random bits, sha256 sums have 256 bits, so concatenate
|
||||
# three uuids and take their sum. The sum is encoded in ASCII hex, hence the
|
||||
# 64 character cut.
|
||||
out+="$(
|
||||
(
|
||||
uuidgen --random;
|
||||
uuidgen --random;
|
||||
uuidgen --random;
|
||||
) | sha256sum \
|
||||
| head -c 64
|
||||
)";
|
||||
done
|
||||
# Finally, convert the ASCII hex to base64 to increase the density.
|
||||
echo -n "${out}" | xxd -r -p | base64 -w 0
|
||||
}
|
||||
|
||||
function config-ip-firewall {
|
||||
echo "Configuring IP firewall rules"
|
||||
|
||||
@@ -51,18 +89,20 @@ function config-ip-firewall {
|
||||
sysctl -w net.ipv4.conf.all.route_localnet=1
|
||||
|
||||
# The GCI image has host firewall which drop most inbound/forwarded packets.
|
||||
# We need to add rules to accept all TCP/UDP/ICMP packets.
|
||||
# We need to add rules to accept all TCP/UDP/ICMP/SCTP packets.
|
||||
if iptables -w -L INPUT | grep "Chain INPUT (policy DROP)" > /dev/null; then
|
||||
echo "Add rules to accept all inbound TCP/UDP/ICMP packets"
|
||||
iptables -A INPUT -w -p TCP -j ACCEPT
|
||||
iptables -A INPUT -w -p UDP -j ACCEPT
|
||||
iptables -A INPUT -w -p ICMP -j ACCEPT
|
||||
iptables -A INPUT -w -p SCTP -j ACCEPT
|
||||
fi
|
||||
if iptables -w -L FORWARD | grep "Chain FORWARD (policy DROP)" > /dev/null; then
|
||||
echo "Add rules to accept all forwarded TCP/UDP/ICMP packets"
|
||||
echo "Add rules to accept all forwarded TCP/UDP/ICMP/SCTP packets"
|
||||
iptables -A FORWARD -w -p TCP -j ACCEPT
|
||||
iptables -A FORWARD -w -p UDP -j ACCEPT
|
||||
iptables -A FORWARD -w -p ICMP -j ACCEPT
|
||||
iptables -A FORWARD -w -p SCTP -j ACCEPT
|
||||
fi
|
||||
|
||||
# Flush iptables nat table
|
||||
@@ -568,6 +608,12 @@ EOF
|
||||
cat <<EOF >>/etc/gce.conf
|
||||
token-url = ${TOKEN_URL}
|
||||
token-body = ${TOKEN_BODY}
|
||||
EOF
|
||||
fi
|
||||
if [[ -n "${CONTAINER_API_ENDPOINT:-}" ]]; then
|
||||
use_cloud_config="true"
|
||||
cat <<EOF >>/etc/gce.conf
|
||||
container-api-endpoint = ${CONTAINER_API_ENDPOINT}
|
||||
EOF
|
||||
fi
|
||||
if [[ -n "${PROJECT_ID:-}" ]]; then
|
||||
@@ -615,6 +661,15 @@ EOF
|
||||
use_cloud_config="true"
|
||||
cat <<EOF >>/etc/gce.conf
|
||||
multizone = ${MULTIZONE}
|
||||
EOF
|
||||
fi
|
||||
# Multimaster indicates that the cluster is HA.
|
||||
# Currently the only HA clusters are regional.
|
||||
# If we introduce zonal multimaster this will need to be revisited.
|
||||
if [[ -n "${MULTIMASTER:-}" ]]; then
|
||||
use_cloud_config="true"
|
||||
cat <<EOF >>/etc/gce.conf
|
||||
regional = ${MULTIMASTER}
|
||||
EOF
|
||||
fi
|
||||
if [[ -n "${GCE_ALPHA_FEATURES:-}" ]]; then
|
||||
@@ -1152,6 +1207,7 @@ function start-kubelet {
|
||||
local -r kubelet_env_file="/etc/default/kubelet"
|
||||
local kubelet_opts="${KUBELET_ARGS} ${KUBELET_CONFIG_FILE_ARG:-}"
|
||||
echo "KUBELET_OPTS=\"${kubelet_opts}\"" > "${kubelet_env_file}"
|
||||
echo "KUBE_COVERAGE_FILE=\"/var/log/kubelet.cov\"" >> "${kubelet_env_file}"
|
||||
|
||||
# Write the systemd service file for kubelet.
|
||||
cat <<EOF >/etc/systemd/system/kubelet.service
|
||||
@@ -1170,6 +1226,7 @@ ExecStart=${kubelet_bin} \$KUBELET_OPTS
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl start kubelet.service
|
||||
}
|
||||
|
||||
@@ -1181,13 +1238,18 @@ function start-node-problem-detector {
|
||||
local -r km_config="${KUBE_HOME}/node-problem-detector/config/kernel-monitor.json"
|
||||
# TODO(random-liu): Handle this for alternative container runtime.
|
||||
local -r dm_config="${KUBE_HOME}/node-problem-detector/config/docker-monitor.json"
|
||||
local -r custom_km_config="${KUBE_HOME}/node-problem-detector/config/kernel-monitor-counter.json"
|
||||
echo "Using node problem detector binary at ${npd_bin}"
|
||||
local flags="${NPD_TEST_LOG_LEVEL:-"--v=2"} ${NPD_TEST_ARGS:-}"
|
||||
flags+=" --logtostderr"
|
||||
flags+=" --system-log-monitors=${km_config},${dm_config}"
|
||||
flags+=" --custom-plugin-monitors=${custom_km_config}"
|
||||
flags+=" --apiserver-override=https://${KUBERNETES_MASTER_NAME}?inClusterConfig=false&auth=/var/lib/node-problem-detector/kubeconfig"
|
||||
local -r npd_port=${NODE_PROBLEM_DETECTOR_PORT:-20256}
|
||||
flags+=" --port=${npd_port}"
|
||||
if [[ -n "${EXTRA_NPD_ARGS:-}" ]]; then
|
||||
flags+=" ${EXTRA_NPD_ARGS}"
|
||||
fi
|
||||
|
||||
# Write the systemd service file for node problem detector.
|
||||
cat <<EOF >/etc/systemd/system/node-problem-detector.service
|
||||
@@ -1256,10 +1318,6 @@ function prepare-kube-proxy-manifest-variables {
|
||||
kube_cache_mutation_detector_env_name="- name: KUBE_CACHE_MUTATION_DETECTOR"
|
||||
kube_cache_mutation_detector_env_value="value: \"${ENABLE_CACHE_MUTATION_DETECTOR}\""
|
||||
fi
|
||||
local pod_priority=""
|
||||
if [[ "${ENABLE_POD_PRIORITY:-}" == "true" ]]; then
|
||||
pod_priority="priorityClassName: system-node-critical"
|
||||
fi
|
||||
sed -i -e "s@{{kubeconfig}}@${kubeconfig}@g" ${src_file}
|
||||
sed -i -e "s@{{pillar\['kube_docker_registry'\]}}@${kube_docker_registry}@g" ${src_file}
|
||||
sed -i -e "s@{{pillar\['kube-proxy_docker_tag'\]}}@${kube_proxy_docker_tag}@g" ${src_file}
|
||||
@@ -1267,7 +1325,6 @@ function prepare-kube-proxy-manifest-variables {
|
||||
sed -i -e "s@{{container_env}}@${container_env}@g" ${src_file}
|
||||
sed -i -e "s@{{kube_cache_mutation_detector_env_name}}@${kube_cache_mutation_detector_env_name}@g" ${src_file}
|
||||
sed -i -e "s@{{kube_cache_mutation_detector_env_value}}@${kube_cache_mutation_detector_env_value}@g" ${src_file}
|
||||
sed -i -e "s@{{pod_priority}}@${pod_priority}@g" ${src_file}
|
||||
sed -i -e "s@{{ cpurequest }}@100m@g" ${src_file}
|
||||
sed -i -e "s@{{api_servers_with_port}}@${api_servers}@g" ${src_file}
|
||||
sed -i -e "s@{{kubernetes_service_host_env_value}}@${KUBERNETES_MASTER_NAME}@g" ${src_file}
|
||||
@@ -1326,7 +1383,6 @@ function prepare-etcd-manifest {
|
||||
sed -i -e "s@{{ *cpulimit *}}@\"$4\"@g" "${temp_file}"
|
||||
sed -i -e "s@{{ *hostname *}}@$host_name@g" "${temp_file}"
|
||||
sed -i -e "s@{{ *host_ip *}}@$host_ip@g" "${temp_file}"
|
||||
sed -i -e "s@{{ *srv_kube_path *}}@/etc/srv/kubernetes@g" "${temp_file}"
|
||||
sed -i -e "s@{{ *etcd_cluster *}}@$etcd_cluster@g" "${temp_file}"
|
||||
sed -i -e "s@{{ *liveness_probe_initial_delay *}}@${ETCD_LIVENESS_PROBE_INITIAL_DELAY_SEC:-15}@g" "${temp_file}"
|
||||
# Get default storage backend from manifest file.
|
||||
@@ -1459,8 +1515,12 @@ function start-kube-apiserver {
|
||||
params+=" --allow-privileged=true"
|
||||
params+=" --cloud-provider=gce"
|
||||
params+=" --client-ca-file=${CA_CERT_BUNDLE_PATH}"
|
||||
params+=" --etcd-servers=http://127.0.0.1:2379"
|
||||
params+=" --etcd-servers-overrides=/events#http://127.0.0.1:4002"
|
||||
params+=" --etcd-servers=${ETCD_SERVERS:-http://127.0.0.1:2379}"
|
||||
if [[ -z "${ETCD_SERVERS:-}" ]]; then
|
||||
params+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-/events#http://127.0.0.1:4002}"
|
||||
elif [[ -n "${ETCD_SERVERS_OVERRIDES:-}" ]]; then
|
||||
params+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-}"
|
||||
fi
|
||||
params+=" --secure-port=443"
|
||||
params+=" --tls-cert-file=${APISERVER_SERVER_CERT_PATH}"
|
||||
params+=" --tls-private-key-file=${APISERVER_SERVER_KEY_PATH}"
|
||||
@@ -1516,9 +1576,6 @@ function start-kube-apiserver {
|
||||
if [[ -n "${SERVICE_CLUSTER_IP_RANGE:-}" ]]; then
|
||||
params+=" --service-cluster-ip-range=${SERVICE_CLUSTER_IP_RANGE}"
|
||||
fi
|
||||
if [[ -n "${ETCD_QUORUM_READ:-}" ]]; then
|
||||
params+=" --etcd-quorum-read=${ETCD_QUORUM_READ}"
|
||||
fi
|
||||
if [[ -n "${SERVICEACCOUNT_ISSUER:-}" ]]; then
|
||||
params+=" --service-account-issuer=${SERVICEACCOUNT_ISSUER}"
|
||||
params+=" --service-account-signing-key-file=${SERVICEACCOUNT_KEY_PATH}"
|
||||
@@ -1529,26 +1586,7 @@ function start-kube-apiserver {
|
||||
local audit_policy_config_volume=""
|
||||
local audit_webhook_config_mount=""
|
||||
local audit_webhook_config_volume=""
|
||||
if [[ "${ENABLE_APISERVER_BASIC_AUDIT:-}" == "true" ]]; then
|
||||
# We currently only support enabling with a fixed path and with built-in log
|
||||
# rotation "disabled" (large value) so it behaves like kube-apiserver.log.
|
||||
# External log rotation should be set up the same as for kube-apiserver.log.
|
||||
params+=" --audit-log-path=/var/log/kube-apiserver-audit.log"
|
||||
params+=" --audit-log-maxage=0"
|
||||
params+=" --audit-log-maxbackup=0"
|
||||
# Lumberjack doesn't offer any way to disable size-based rotation. It also
|
||||
# has an in-memory counter that doesn't notice if you truncate the file.
|
||||
# 2000000000 (in MiB) is a large number that fits in 31 bits. If the log
|
||||
# grows at 10MiB/s (~30K QPS), it will rotate after ~6 years if apiserver
|
||||
# never restarts. Please manually restart apiserver before this time.
|
||||
params+=" --audit-log-maxsize=2000000000"
|
||||
# Disable AdvancedAuditing enabled by default
|
||||
if [[ -z "${FEATURE_GATES:-}" ]]; then
|
||||
FEATURE_GATES="AdvancedAuditing=false"
|
||||
else
|
||||
FEATURE_GATES="${FEATURE_GATES},AdvancedAuditing=false"
|
||||
fi
|
||||
elif [[ "${ENABLE_APISERVER_ADVANCED_AUDIT:-}" == "true" ]]; then
|
||||
if [[ "${ENABLE_APISERVER_ADVANCED_AUDIT:-}" == "true" ]]; then
|
||||
local -r audit_policy_file="/etc/audit_policy.config"
|
||||
params+=" --audit-policy-file=${audit_policy_file}"
|
||||
# Create the audit policy file, and mount it into the apiserver pod.
|
||||
@@ -1596,8 +1634,6 @@ function start-kube-apiserver {
|
||||
fi
|
||||
fi
|
||||
if [[ "${ADVANCED_AUDIT_BACKEND:-}" == *"webhook"* ]]; then
|
||||
params+=" --audit-webhook-mode=batch"
|
||||
|
||||
# Create the audit webhook config file, and mount it into the apiserver pod.
|
||||
local -r audit_webhook_config_file="/etc/audit_webhook.config"
|
||||
params+=" --audit-webhook-config-file=${audit_webhook_config_file}"
|
||||
@@ -1608,6 +1644,8 @@ function start-kube-apiserver {
|
||||
# Batching parameters
|
||||
if [[ -n "${ADVANCED_AUDIT_WEBHOOK_MODE:-}" ]]; then
|
||||
params+=" --audit-webhook-mode=${ADVANCED_AUDIT_WEBHOOK_MODE}"
|
||||
else
|
||||
params+=" --audit-webhook-mode=batch"
|
||||
fi
|
||||
if [[ -n "${ADVANCED_AUDIT_WEBHOOK_BUFFER_SIZE:-}" ]]; then
|
||||
params+=" --audit-webhook-batch-buffer-size=${ADVANCED_AUDIT_WEBHOOK_BUFFER_SIZE}"
|
||||
@@ -1773,7 +1811,6 @@ EOM
|
||||
local -r kube_apiserver_docker_tag="${KUBE_API_SERVER_DOCKER_TAG:-$(cat /home/kubernetes/kube-docker-files/kube-apiserver.docker_tag)}"
|
||||
sed -i -e "s@{{params}}@${params}@g" "${src_file}"
|
||||
sed -i -e "s@{{container_env}}@${container_env}@g" ${src_file}
|
||||
sed -i -e "s@{{srv_kube_path}}@/etc/srv/kubernetes@g" "${src_file}"
|
||||
sed -i -e "s@{{srv_sshproxy_path}}@/etc/srv/sshproxy@g" "${src_file}"
|
||||
sed -i -e "s@{{cloud_config_mount}}@${CLOUD_CONFIG_MOUNT}@g" "${src_file}"
|
||||
sed -i -e "s@{{cloud_config_volume}}@${CLOUD_CONFIG_VOLUME}@g" "${src_file}"
|
||||
@@ -1943,7 +1980,6 @@ function start-kube-controller-manager {
|
||||
|
||||
local -r src_file="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/kube-controller-manager.manifest"
|
||||
# Evaluate variables.
|
||||
sed -i -e "s@{{srv_kube_path}}@/etc/srv/kubernetes@g" "${src_file}"
|
||||
sed -i -e "s@{{pillar\['kube_docker_registry'\]}}@${DOCKER_REGISTRY}@g" "${src_file}"
|
||||
sed -i -e "s@{{pillar\['kube-controller-manager_docker_tag'\]}}@${kube_rc_docker_tag}@g" "${src_file}"
|
||||
sed -i -e "s@{{params}}@${params}@g" "${src_file}"
|
||||
@@ -1956,6 +1992,7 @@ function start-kube-controller-manager {
|
||||
sed -i -e "s@{{pv_recycler_volume}}@${PV_RECYCLER_VOLUME}@g" "${src_file}"
|
||||
sed -i -e "s@{{flexvolume_hostpath_mount}}@${FLEXVOLUME_HOSTPATH_MOUNT}@g" "${src_file}"
|
||||
sed -i -e "s@{{flexvolume_hostpath}}@${FLEXVOLUME_HOSTPATH_VOLUME}@g" "${src_file}"
|
||||
sed -i -e "s@{{cpurequest}}@${KUBE_CONTROLLER_MANAGER_CPU_REQUEST}@g" "${src_file}"
|
||||
|
||||
cp "${src_file}" /etc/kubernetes/manifests
|
||||
}
|
||||
@@ -1990,10 +2027,10 @@ function start-kube-scheduler {
|
||||
# Remove salt comments and replace variables with values.
|
||||
local -r src_file="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/kube-scheduler.manifest"
|
||||
|
||||
sed -i -e "s@{{srv_kube_path}}@/etc/srv/kubernetes@g" "${src_file}"
|
||||
sed -i -e "s@{{params}}@${params}@g" "${src_file}"
|
||||
sed -i -e "s@{{pillar\['kube_docker_registry'\]}}@${DOCKER_REGISTRY}@g" "${src_file}"
|
||||
sed -i -e "s@{{pillar\['kube-scheduler_docker_tag'\]}}@${kube_scheduler_docker_tag}@g" "${src_file}"
|
||||
sed -i -e "s@{{cpurequest}}@${KUBE_SCHEDULER_CPU_REQUEST}@g" "${src_file}"
|
||||
cp "${src_file}" /etc/kubernetes/manifests
|
||||
}
|
||||
|
||||
@@ -2042,6 +2079,12 @@ function setup-addon-manifests {
|
||||
copy-manifests "${psp_dir}" "${dst_dir}"
|
||||
fi
|
||||
fi
|
||||
if [[ "${ENABLE_NODE_TERMINATION_HANDLER:-}" == "true" ]]; then
|
||||
local -r nth_dir="${src_dir}/${3:-$2}/node-termination-handler"
|
||||
if [[ -d "${nth_dir}" ]]; then
|
||||
copy-manifests "${nth_dir}" "${dst_dir}"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# A function that downloads extra addons from a URL and puts them in the GCI
|
||||
@@ -2199,6 +2242,17 @@ function update-prometheus-to-sd-parameters {
|
||||
fi
|
||||
}
|
||||
|
||||
# Updates parameters in yaml file for prometheus-to-sd configuration in daemon sets, or
|
||||
# removes component if it is disabled.
|
||||
function update-daemon-set-prometheus-to-sd-parameters {
|
||||
if [[ "${DISABLE_PROMETHEUS_TO_SD_IN_DS:-}" == "true" ]]; then
|
||||
# Removes all lines between two patterns (throws away prometheus-to-sd)
|
||||
sed -i -e "/# BEGIN_PROMETHEUS_TO_SD/,/# END_PROMETHEUS_TO_SD/d" "$1"
|
||||
else
|
||||
update-prometheus-to-sd-parameters $1
|
||||
fi
|
||||
}
|
||||
|
||||
# Updates parameters in yaml file for event-exporter configuration
|
||||
function update-event-exporter {
|
||||
local -r stackdriver_resource_model="${LOGGING_STACKDRIVER_RESOURCE_TYPES:-old}"
|
||||
@@ -2231,6 +2285,7 @@ function setup-coredns-manifest {
|
||||
function setup-fluentd {
|
||||
local -r dst_dir="$1"
|
||||
local -r fluentd_gcp_yaml="${dst_dir}/fluentd-gcp/fluentd-gcp-ds.yaml"
|
||||
local -r fluentd_gcp_scaler_yaml="${dst_dir}/fluentd-gcp/scaler-deployment.yaml"
|
||||
# Ingest logs against new resources like "k8s_container" and "k8s_node" if
|
||||
# LOGGING_STACKDRIVER_RESOURCE_TYPES is "new".
|
||||
# Ingest logs against old resources like "gke_container" and "gce_instance" if
|
||||
@@ -2243,9 +2298,12 @@ function setup-fluentd {
|
||||
fluentd_gcp_configmap_name="fluentd-gcp-config-old"
|
||||
fi
|
||||
sed -i -e "s@{{ fluentd_gcp_configmap_name }}@${fluentd_gcp_configmap_name}@g" "${fluentd_gcp_yaml}"
|
||||
fluentd_gcp_version="${FLUENTD_GCP_VERSION:-0.2-1.5.30-1-k8s}"
|
||||
fluentd_gcp_yaml_version="${FLUENTD_GCP_YAML_VERSION:-v3.1.0}"
|
||||
sed -i -e "s@{{ fluentd_gcp_yaml_version }}@${fluentd_gcp_yaml_version}@g" "${fluentd_gcp_yaml}"
|
||||
sed -i -e "s@{{ fluentd_gcp_yaml_version }}@${fluentd_gcp_yaml_version}@g" "${fluentd_gcp_scaler_yaml}"
|
||||
fluentd_gcp_version="${FLUENTD_GCP_VERSION:-0.5-1.5.36-1-k8s}"
|
||||
sed -i -e "s@{{ fluentd_gcp_version }}@${fluentd_gcp_version}@g" "${fluentd_gcp_yaml}"
|
||||
update-prometheus-to-sd-parameters ${fluentd_gcp_yaml}
|
||||
update-daemon-set-prometheus-to-sd-parameters ${fluentd_gcp_yaml}
|
||||
start-fluentd-resource-update ${fluentd_gcp_yaml}
|
||||
update-container-runtime ${fluentd_gcp_configmap_yaml}
|
||||
update-node-journal ${fluentd_gcp_configmap_yaml}
|
||||
@@ -2258,7 +2316,7 @@ function setup-kube-dns-manifest {
|
||||
if [ -n "${CUSTOM_KUBE_DNS_YAML:-}" ]; then
|
||||
# Replace with custom GKE kube-dns deployment.
|
||||
cat > "${kubedns_file}" <<EOF
|
||||
$(echo "$CUSTOM_KUBE_DNS_YAML")
|
||||
$CUSTOM_KUBE_DNS_YAML
|
||||
EOF
|
||||
update-prometheus-to-sd-parameters ${kubedns_file}
|
||||
fi
|
||||
@@ -2281,7 +2339,24 @@ function setup-netd-manifest {
|
||||
if [ -n "${CUSTOM_NETD_YAML:-}" ]; then
|
||||
# Replace with custom GCP netd deployment.
|
||||
cat > "${netd_file}" <<EOF
|
||||
$(echo "$CUSTOM_NETD_YAML")
|
||||
$CUSTOM_NETD_YAML
|
||||
EOF
|
||||
fi
|
||||
}
|
||||
|
||||
# A helper function to set up a custom yaml for a k8s addon.
|
||||
#
|
||||
# $1: addon category under /etc/kubernetes
|
||||
# $2: manifest source dir
|
||||
# $3: manifest file
|
||||
# $4: custom yaml
|
||||
function setup-addon-custom-yaml {
|
||||
local -r manifest_path="/etc/kubernetes/$1/$2/$3"
|
||||
local -r custom_yaml="$4"
|
||||
if [ -n "${custom_yaml:-}" ]; then
|
||||
# Replace with custom manifest.
|
||||
cat > "${manifest_path}" <<EOF
|
||||
$custom_yaml
|
||||
EOF
|
||||
fi
|
||||
}
|
||||
@@ -2312,9 +2387,9 @@ function start-kube-addons {
|
||||
if [ -n "${CUSTOM_KUBE_PROXY_YAML:-}" ]; then
|
||||
# Replace with custom GKE kube proxy.
|
||||
cat > "$src_dir/kube-proxy/kube-proxy-ds.yaml" <<EOF
|
||||
$(echo "$CUSTOM_KUBE_PROXY_YAML")
|
||||
$CUSTOM_KUBE_PROXY_YAML
|
||||
EOF
|
||||
update-prometheus-to-sd-parameters "$src_dir/kube-proxy/kube-proxy-ds.yaml"
|
||||
update-daemon-set-prometheus-to-sd-parameters "$src_dir/kube-proxy/kube-proxy-ds.yaml"
|
||||
fi
|
||||
prepare-kube-proxy-manifest-variables "$src_dir/kube-proxy/kube-proxy-ds.yaml"
|
||||
setup-addon-manifests "addons" "kube-proxy"
|
||||
@@ -2337,10 +2412,17 @@ EOF
|
||||
base_eventer_memory="190Mi"
|
||||
base_metrics_cpu="${HEAPSTER_GCP_BASE_CPU:-80m}"
|
||||
nanny_memory="90Mi"
|
||||
local -r metrics_memory_per_node="${HEAPSTER_GCP_MEMORY_PER_NODE:-4}"
|
||||
local heapster_min_cluster_size="16"
|
||||
local metrics_memory_per_node="${HEAPSTER_GCP_MEMORY_PER_NODE:-4}"
|
||||
local -r metrics_cpu_per_node="${HEAPSTER_GCP_CPU_PER_NODE:-0.5}"
|
||||
local -r eventer_memory_per_node="500"
|
||||
local -r nanny_memory_per_node="200"
|
||||
if [[ "${ENABLE_SYSTEM_ADDON_RESOURCE_OPTIMIZATIONS:-}" == "true" ]]; then
|
||||
base_metrics_memory="${HEAPSTER_GCP_BASE_MEMORY:-100Mi}"
|
||||
base_metrics_cpu="${HEAPSTER_GCP_BASE_CPU:-10m}"
|
||||
metrics_memory_per_node="${HEAPSTER_GCP_MEMORY_PER_NODE:-4}"
|
||||
heapster_min_cluster_size="5"
|
||||
fi
|
||||
if [[ -n "${NUM_NODES:-}" && "${NUM_NODES}" -ge 1 ]]; then
|
||||
num_kube_nodes="$((${NUM_NODES}+1))"
|
||||
nanny_memory="$((${num_kube_nodes} * ${nanny_memory_per_node} + 90 * 1024))Ki"
|
||||
@@ -2361,6 +2443,7 @@ EOF
|
||||
sed -i -e "s@{{ *eventer_memory_per_node *}}@${eventer_memory_per_node}@g" "${controller_yaml}"
|
||||
sed -i -e "s@{{ *nanny_memory *}}@${nanny_memory}@g" "${controller_yaml}"
|
||||
sed -i -e "s@{{ *metrics_cpu_per_node *}}@${metrics_cpu_per_node}@g" "${controller_yaml}"
|
||||
sed -i -e "s@{{ *heapster_min_cluster_size *}}@${heapster_min_cluster_size}@g" "${controller_yaml}"
|
||||
update-prometheus-to-sd-parameters ${controller_yaml}
|
||||
|
||||
if [[ "${ENABLE_CLUSTER_MONITORING:-}" == "stackdriver" ]]; then
|
||||
@@ -2388,10 +2471,29 @@ EOF
|
||||
fi
|
||||
if [[ "${ENABLE_METRICS_SERVER:-}" == "true" ]]; then
|
||||
setup-addon-manifests "addons" "metrics-server"
|
||||
base_metrics_server_cpu="40m"
|
||||
base_metrics_server_memory="40Mi"
|
||||
metrics_server_memory_per_node="4"
|
||||
metrics_server_min_cluster_size="16"
|
||||
if [[ "${ENABLE_SYSTEM_ADDON_RESOURCE_OPTIMIZATIONS:-}" == "true" ]]; then
|
||||
base_metrics_server_cpu="40m"
|
||||
base_metrics_server_memory="35Mi"
|
||||
metrics_server_memory_per_node="4"
|
||||
metrics_server_min_cluster_size="5"
|
||||
fi
|
||||
local -r metrics_server_yaml="${dst_dir}/metrics-server/metrics-server-deployment.yaml"
|
||||
sed -i -e "s@{{ base_metrics_server_cpu }}@${base_metrics_server_cpu}@g" "${metrics_server_yaml}"
|
||||
sed -i -e "s@{{ base_metrics_server_memory }}@${base_metrics_server_memory}@g" "${metrics_server_yaml}"
|
||||
sed -i -e "s@{{ metrics_server_memory_per_node }}@${metrics_server_memory_per_node}@g" "${metrics_server_yaml}"
|
||||
sed -i -e "s@{{ metrics_server_min_cluster_size }}@${metrics_server_min_cluster_size}@g" "${metrics_server_yaml}"
|
||||
fi
|
||||
if [[ "${ENABLE_NVIDIA_GPU_DEVICE_PLUGIN:-}" == "true" ]]; then
|
||||
setup-addon-manifests "addons" "device-plugins/nvidia-gpu"
|
||||
fi
|
||||
if [[ "${ENABLE_NODE_TERMINATION_HANDLER:-}" == "true" ]]; then
|
||||
setup-addon-manifests "addons" "node-termination-handler"
|
||||
setup-node-termination-handler-manifest
|
||||
fi
|
||||
if [[ "${ENABLE_CLUSTER_DNS:-}" == "true" ]]; then
|
||||
if [[ "${CLUSTER_DNS_CORE_DNS:-}" == "true" ]]; then
|
||||
setup-addon-manifests "addons" "dns/coredns"
|
||||
@@ -2437,6 +2539,9 @@ EOF
|
||||
if [[ "${NETWORK_POLICY_PROVIDER:-}" == "calico" ]]; then
|
||||
setup-addon-manifests "addons" "calico-policy-controller"
|
||||
|
||||
setup-addon-custom-yaml "addons" "calico-policy-controller" "calico-node-daemonset.yaml" "${CUSTOM_CALICO_NODE_DAEMONSET_YAML:-}"
|
||||
setup-addon-custom-yaml "addons" "calico-policy-controller" "typha-deployment.yaml" "${CUSTOM_TYPHA_DEPLOYMENT_YAML:-}"
|
||||
|
||||
# Configure Calico CNI directory.
|
||||
local -r ds_file="${dst_dir}/calico-policy-controller/calico-node-daemonset.yaml"
|
||||
sed -i -e "s@__CALICO_CNI_DIR__@/home/kubernetes/bin@g" "${ds_file}"
|
||||
@@ -2450,7 +2555,7 @@ EOF
|
||||
if [[ "${ENABLE_METADATA_CONCEALMENT:-}" == "true" ]]; then
|
||||
setup-addon-manifests "addons" "metadata-proxy/gce"
|
||||
local -r metadata_proxy_yaml="${dst_dir}/metadata-proxy/gce/metadata-proxy.yaml"
|
||||
update-prometheus-to-sd-parameters ${metadata_proxy_yaml}
|
||||
update-daemon-set-prometheus-to-sd-parameters ${metadata_proxy_yaml}
|
||||
fi
|
||||
if [[ "${ENABLE_ISTIO:-}" == "true" ]]; then
|
||||
if [[ "${ISTIO_AUTH_TYPE:-}" == "MUTUAL_TLS" ]]; then
|
||||
@@ -2459,21 +2564,26 @@ EOF
|
||||
setup-addon-manifests "addons" "istio/noauth"
|
||||
fi
|
||||
fi
|
||||
if [[ "${FEATURE_GATES:-}" =~ "RuntimeClass=true" ]]; then
|
||||
setup-addon-manifests "addons" "runtimeclass"
|
||||
fi
|
||||
if [[ -n "${EXTRA_ADDONS_URL:-}" ]]; then
|
||||
download-extra-addons
|
||||
setup-addon-manifests "addons" "gce-extras"
|
||||
fi
|
||||
|
||||
|
||||
# Place addon manager pod manifest.
|
||||
cp "${src_dir}/kube-addon-manager.yaml" /etc/kubernetes/manifests
|
||||
src_file="${src_dir}/kube-addon-manager.yaml"
|
||||
sed -i -e "s@{{kubectl_extra_prune_whitelist}}@${ADDON_MANAGER_PRUNE_WHITELIST:-}@g" "${src_file}"
|
||||
cp "${src_file}" /etc/kubernetes/manifests
|
||||
}
|
||||
|
||||
# Starts an image-puller - used in test clusters.
|
||||
function start-image-puller {
|
||||
echo "Start image-puller"
|
||||
local -r e2e_image_puller_manifest="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/e2e-image-puller.manifest"
|
||||
update-container-runtime "${e2e_image_puller_manifest}"
|
||||
cp "${e2e_image_puller_manifest}" /etc/kubernetes/manifests/
|
||||
function setup-node-termination-handler-manifest {
|
||||
local -r nth_manifest="/etc/kubernetes/$1/$2/daemonset.yaml"
|
||||
if [[ -n "${NODE_TERMINATION_HANDLER_IMAGE}" ]]; then
|
||||
sed -i "s|image:.*|image: ${NODE_TERMINATION_HANDLER_IMAGE}|" "${nth_manifest}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Setups manifests for ingress controller and gce-specific policies for service controller.
|
||||
@@ -2502,16 +2612,6 @@ function start-lb-controller {
|
||||
fi
|
||||
}
|
||||
|
||||
# Starts rescheduler.
|
||||
function start-rescheduler {
|
||||
if [[ "${ENABLE_RESCHEDULER:-}" == "true" ]]; then
|
||||
echo "Start Rescheduler"
|
||||
prepare-log-file /var/log/rescheduler.log
|
||||
cp "${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/rescheduler.manifest" \
|
||||
/etc/kubernetes/manifests/
|
||||
fi
|
||||
}
|
||||
|
||||
# Setup working directory for kubelet.
|
||||
function setup-kubelet-dir {
|
||||
echo "Making /var/lib/kubelet executable for kubelet"
|
||||
@@ -2519,6 +2619,15 @@ function setup-kubelet-dir {
|
||||
mount -B -o remount,exec,suid,dev /var/lib/kubelet
|
||||
}
|
||||
|
||||
# Override for GKE custom master setup scripts (no-op outside of GKE).
|
||||
function gke-master-start {
|
||||
if [[ -e "${KUBE_HOME}/bin/gke-internal-configure-helper.sh" ]]; then
|
||||
echo "Running GKE internal configuration script"
|
||||
. "${KUBE_HOME}/bin/gke-internal-configure-helper.sh"
|
||||
gke-internal-master-start
|
||||
fi
|
||||
}
|
||||
|
||||
function reset-motd {
|
||||
# kubelet is installed both on the master and nodes, and the version is easy to parse (unlike kubectl)
|
||||
local -r version="$("${KUBE_HOME}"/bin/kubelet --version=true | cut -f2 -d " ")"
|
||||
@@ -2637,9 +2746,9 @@ function main() {
|
||||
fi
|
||||
|
||||
# generate the controller manager, scheduler and cluster autoscaler tokens here since they are only used on the master.
|
||||
KUBE_CONTROLLER_MANAGER_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
|
||||
KUBE_SCHEDULER_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
|
||||
KUBE_CLUSTER_AUTOSCALER_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
|
||||
KUBE_CONTROLLER_MANAGER_TOKEN="$(secure_random 32)"
|
||||
KUBE_SCHEDULER_TOKEN="$(secure_random 32)"
|
||||
KUBE_CLUSTER_AUTOSCALER_TOKEN="$(secure_random 32)"
|
||||
|
||||
setup-os-params
|
||||
config-ip-firewall
|
||||
@@ -2655,6 +2764,7 @@ function main() {
|
||||
create-master-kubelet-auth
|
||||
create-master-etcd-auth
|
||||
override-pv-recycler
|
||||
gke-master-start
|
||||
else
|
||||
create-node-pki
|
||||
create-kubelet-kubeconfig ${KUBERNETES_MASTER_NAME}
|
||||
@@ -2683,14 +2793,10 @@ function main() {
|
||||
start-kube-addons
|
||||
start-cluster-autoscaler
|
||||
start-lb-controller
|
||||
start-rescheduler
|
||||
else
|
||||
if [[ "${KUBE_PROXY_DAEMONSET:-}" != "true" ]]; then
|
||||
start-kube-proxy
|
||||
fi
|
||||
if [[ "${PREPULL_E2E_IMAGES:-}" == "true" ]]; then
|
||||
start-image-puller
|
||||
fi
|
||||
if [[ "${ENABLE_NODE_PROBLEM_DETECTOR:-}" == "standalone" ]]; then
|
||||
start-node-problem-detector
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user