Merge branch 'master' into rkt

This commit is contained in:
Bogdan Dobrelya 2017-01-05 10:34:18 +01:00 committed by GitHub
commit 6546869c42
10 changed files with 113 additions and 17 deletions

47
.github/ISSUE_TEMPLATE.md vendored Normal file
View file

@ -0,0 +1,47 @@
<!-- Thanks for filing an issue! Before hitting the button, please answer these questions.-->
**Is this a BUG REPORT or FEATURE REQUEST?** (choose one):
<!--
If this is a BUG REPORT, please:
- Fill in as much of the template below as you can. If you leave out
information, we can't help you as well.
If this is a FEATURE REQUEST, please:
- Describe *in detail* the feature/behavior/change you'd like to see.
In both cases, be ready for followup questions, and please respond in a timely
manner. If we can't reproduce a bug or think a feature already exists, we
might close your issue. If we're wrong, PLEASE feel free to reopen it and
explain why.
-->
**Environment**:
- **Cloud provider or hardware configuration:**
- **OS (`printf "$(uname -srm)\n$(cat /etc/os-release)\n"`):**
- **Version of Ansible** (`ansible --version`):
**Kargo version (commit) (`git rev-parse --short HEAD`):**
**Network plugin used**:
**Copy of your inventory file:**
**Command used to invoke ansible**:
**Output of ansible run**:
<!-- We recommend using snippets services like https://gist.github.com/ etc. -->
**Anything else do we need to know**:
<!-- By running scripts/collect-info.yaml you can get a lot of useful informations.
Script can be started by:
ansible-playbook -i <inventory_file_path> -u <ssh_user> -e ansible_ssh_user=<ssh_user> -b --become-user=root -e dir=`pwd` scripts/collect-info.yaml
(If you using CoreOS remember to add '-e ansible_python_interpreter=/opt/bin/python').
After running this command you can find logs in `pwd`/logs.tar.gz. You can even upload somewhere entire file and paste link here.-->

View file

@ -51,6 +51,7 @@ before_script:
LOG_LEVEL: "-vv" LOG_LEVEL: "-vv"
ETCD_DEPLOYMENT: "docker" ETCD_DEPLOYMENT: "docker"
KUBELET_DEPLOYMENT: "docker" KUBELET_DEPLOYMENT: "docker"
MAGIC: "ci check this"
.gce: &gce .gce: &gce
<<: *job <<: *job
@ -215,7 +216,7 @@ before_script:
ETCD_DEPLOYMENT: rkt ETCD_DEPLOYMENT: rkt
KUBELET_DEPLOYMENT: rkt KUBELET_DEPLOYMENT: rkt
# Builds for PRs only (auto) and triggers (auto) # Builds for PRs only (premoderated by unit-tests step) and triggers (auto)
coreos-calico-sep: coreos-calico-sep:
stage: deploy-gce-part1 stage: deploy-gce-part1
<<: *job <<: *job
@ -429,12 +430,16 @@ ubuntu-rkt-sep:
except: ['triggers'] except: ['triggers']
only: ['master', /^pr-.*$/] only: ['master', /^pr-.*$/]
# Premoderated with manual actions
syntax-check: syntax-check:
<<: *job <<: *job
stage: unit-tests stage: unit-tests
before_script:
- apt-get -y install jq
script: script:
- ansible-playbook -i inventory/local-tests.cfg -u root -e ansible_ssh_user=root -b --become-user=root cluster.yml -vvv --syntax-check - ansible-playbook -i inventory/local-tests.cfg -u root -e ansible_ssh_user=root -b --become-user=root cluster.yml -vvv --syntax-check
except: ['triggers'] - /bin/sh scripts/premoderator.sh
except: ['triggers', 'master']
tox-inventory-builder: tox-inventory-builder:
stage: unit-tests stage: unit-tests
@ -443,4 +448,4 @@ tox-inventory-builder:
- pip install tox - pip install tox
- cd contrib/inventory_builder && tox - cd contrib/inventory_builder && tox
when: manual when: manual
except: ['triggers'] except: ['triggers', 'master']

View file

@ -51,3 +51,5 @@ netchecker_kubectl_memory_requests: 64M
# SSL # SSL
etcd_cert_dir: "/etc/ssl/etcd/ssl" etcd_cert_dir: "/etc/ssl/etcd/ssl"
calico_cert_dir: "/etc/calico/certs"
canal_cert_dir: "/etc/canal/certs"

View file

@ -1,8 +1,13 @@
---
- set_fact:
calico_cert_dir: "{{ canal_cert_dir }}"
when: kube_network_plugin == 'canal'
tags: facts
- name: Write calico-policy-controller yaml - name: Write calico-policy-controller yaml
template: src=calico-policy-controller.yml.j2 dest={{kube_config_dir}}/calico-policy-controller.yml template: src=calico-policy-controller.yml.j2 dest={{kube_config_dir}}/calico-policy-controller.yml
when: inventory_hostname == groups['kube-master'][0] when: inventory_hostname == groups['kube-master'][0]
- name: Start of Calico policy controller - name: Start of Calico policy controller
kube: kube:
name: "calico-policy-controller" name: "calico-policy-controller"

View file

@ -36,11 +36,11 @@ spec:
- name: ETCD_ENDPOINTS - name: ETCD_ENDPOINTS
value: "{{ etcd_access_endpoint }}" value: "{{ etcd_access_endpoint }}"
- name: ETCD_CA_CERT_FILE - name: ETCD_CA_CERT_FILE
value: "{{ etcd_cert_dir }}/ca.pem" value: "{{ calico_cert_dir }}/ca_cert.crt"
- name: ETCD_CERT_FILE - name: ETCD_CERT_FILE
value: "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem" value: "{{ calico_cert_dir }}/cert.crt"
- name: ETCD_KEY_FILE - name: ETCD_KEY_FILE
value: "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}-key.pem" value: "{{ calico_cert_dir }}/key.pem"
# Location of the Kubernetes API - this shouldn't need to be # Location of the Kubernetes API - this shouldn't need to be
# changed so long as it is used in conjunction with # changed so long as it is used in conjunction with
# CONFIGURE_ETC_HOSTS="true". # CONFIGURE_ETC_HOSTS="true".
@ -53,10 +53,10 @@ spec:
- name: CONFIGURE_ETC_HOSTS - name: CONFIGURE_ETC_HOSTS
value: "true" value: "true"
volumeMounts: volumeMounts:
- mountPath: {{ etcd_cert_dir }} - mountPath: {{ calico_cert_dir }}
name: etcd-certs name: etcd-certs
readOnly: true readOnly: true
volumes: volumes:
- hostPath: - hostPath:
path: {{ etcd_cert_dir }} path: {{ calico_cert_dir }}
name: etcd-certs name: etcd-certs

View file

@ -2,13 +2,13 @@
{{ docker_bin_dir }}/docker run -i --privileged --rm \ {{ docker_bin_dir }}/docker run -i --privileged --rm \
--net=host --pid=host \ --net=host --pid=host \
-e ETCD_ENDPOINTS={{ etcd_access_endpoint }} \ -e ETCD_ENDPOINTS={{ etcd_access_endpoint }} \
-e ETCD_CA_CERT_FILE=/etc/calico/certs/ca_cert.crt \ -e ETCD_CA_CERT_FILE={{ calico_cert_dir }}/ca_cert.crt \
-e ETCD_CERT_FILE=/etc/calico/certs/cert.crt \ -e ETCD_CERT_FILE={{ calico_cert_dir }}/cert.crt \
-e ETCD_KEY_FILE=/etc/calico/certs/key.pem \ -e ETCD_KEY_FILE={{ calico_cert_dir }}/key.pem \
-v {{ docker_bin_dir }}/docker:{{ docker_bin_dir }}/docker \ -v {{ docker_bin_dir }}/docker:{{ docker_bin_dir }}/docker \
-v /var/run/docker.sock:/var/run/docker.sock \ -v /var/run/docker.sock:/var/run/docker.sock \
-v /var/run/calico:/var/run/calico \ -v /var/run/calico:/var/run/calico \
-v /etc/calico/certs:/etc/calico/certs:ro \ -v {{ calico_cert_dir }}:{{ calico_cert_dir }}:ro \
--memory={{ calicoctl_memory_limit|regex_replace('Mi', 'M') }} --cpu-shares={{ calicoctl_cpu_limit|regex_replace('m', '') }} \ --memory={{ calicoctl_memory_limit|regex_replace('Mi', 'M') }} --cpu-shares={{ calicoctl_cpu_limit|regex_replace('m', '') }} \
{{ calicoctl_image_repo }}:{{ calicoctl_image_tag}} \ {{ calicoctl_image_repo }}:{{ calicoctl_image_tag}} \
$@ $@

View file

@ -16,3 +16,6 @@ flannel_memory_limit: 500M
flannel_cpu_limit: 300m flannel_cpu_limit: 300m
flannel_memory_requests: 256M flannel_memory_requests: 256M
flannel_cpu_requests: 150m flannel_cpu_requests: 150m
flannel_cert_dir: /etc/flannel/certs
etcd_cert_dir: /etc/ssl/etcd/ssl

View file

@ -7,6 +7,25 @@
delegate_to: "{{groups['etcd'][0]}}" delegate_to: "{{groups['etcd'][0]}}"
run_once: true run_once: true
- name: Flannel | Create flannel certs directory
file:
dest: "{{ flannel_cert_dir }}"
state: directory
mode: 0750
owner: root
group: root
- name: Flannel | Link etcd certificates for flanneld
file:
src: "{{ etcd_cert_dir }}/{{ item.s }}"
dest: "{{ flannel_cert_dir }}/{{ item.d }}"
state: hard
force: yes
with_items:
- {s: "ca.pem", d: "ca_cert.crt"}
- {s: "node-{{ inventory_hostname }}.pem", d: "cert.crt"}
- {s: "node-{{ inventory_hostname }}-key.pem", d: "key.pem"}
- name: Flannel | Create flannel pod manifest - name: Flannel | Create flannel pod manifest
template: template:
src: flannel-pod.yml src: flannel-pod.yml

View file

@ -14,7 +14,7 @@
path: "/run/flannel" path: "/run/flannel"
- name: "etcd-certs" - name: "etcd-certs"
hostPath: hostPath:
path: "{{ etcd_cert_dir }}" path: "{{ flannel_cert_dir }}"
containers: containers:
- name: "flannel-container" - name: "flannel-container"
image: "{{ flannel_image_repo }}:{{ flannel_image_tag }}" image: "{{ flannel_image_repo }}:{{ flannel_image_tag }}"
@ -29,7 +29,7 @@
command: command:
- "/bin/sh" - "/bin/sh"
- "-c" - "-c"
- "/opt/bin/flanneld -etcd-endpoints {{ etcd_access_endpoint }} -etcd-prefix /{{ cluster_name }}/network -etcd-cafile {{ etcd_cert_dir }}/ca.pem -etcd-certfile {{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem -etcd-keyfile {{ etcd_cert_dir }}/node-{{ inventory_hostname }}-key.pem {% if flannel_interface is defined %}-iface {{ flannel_interface }}{% endif %} {% if flannel_public_ip is defined %}-public-ip {{ flannel_public_ip }}{% endif %}" - "/opt/bin/flanneld -etcd-endpoints {{ etcd_access_endpoint }} -etcd-prefix /{{ cluster_name }}/network -etcd-cafile {{ flannel_cert_dir }}/ca_cert.crt -etcd-certfile {{ flannel_cert_dir }}/cert.crt -etcd-keyfile {{ flannel_cert_dir }}/key.pem {% if flannel_interface is defined %}-iface {{ flannel_interface }}{% endif %} {% if flannel_public_ip is defined %}-public-ip {{ flannel_public_ip }}{% endif %}"
ports: ports:
- hostPort: 10253 - hostPort: 10253
containerPort: 10253 containerPort: 10253
@ -37,7 +37,7 @@
- name: "subnetenv" - name: "subnetenv"
mountPath: "/run/flannel" mountPath: "/run/flannel"
- name: "etcd-certs" - name: "etcd-certs"
mountPath: "{{ etcd_cert_dir }}" mountPath: "{{ flannel_cert_dir }}"
readOnly: true readOnly: true
securityContext: securityContext:
privileged: true privileged: true

15
scripts/premoderator.sh Normal file
View file

@ -0,0 +1,15 @@
#!/bin/sh -eux -o pipefail
# A naive premoderation script to allow Gitlab CI pipeline on a specific PRs' comment
# Exits with 0, if the pipeline is good to go
CURL_ARGS="-fs --connect-timeout 5 --max-time 5 --retry-max-time 20 --retry 4 --retry-delay 5"
MAGIC="${MAGIC:-ci check this}"
# Get PR number from CI_BUILD_REF_NAME
issue=$(echo ${CI_BUILD_REF_NAME} | perl -ne '/^pr-(\d+)-\S+$/ && print $1')
# Get the user name from the PR comments with the wanted magic incantation casted
user=$(curl ${CURL_ARGS} "https://api.github.com/repos/kubernetes-incubator/kargo/issues/${issue}/comments" \
| jq -M "map(select(.body | contains (\"$MAGIC\"))) | .[0] .user.login" | tr -d '"')
# Check for the required user group membership to allow (exit 0) or decline (exit >0) the pipeline
[ "$user" != "null" ] || exit 1
curl ${CURL_ARGS} "https://api.github.com/orgs/kubernetes-incubator/members/${user}"