Skip to content

Commit

Permalink
Feature/jdb/strict merge no ff (#2850)
Browse files Browse the repository at this point in the history
* Include ingress for addon status check

* Add addon to expose dashboard over ingress (#906)

* Add validator for dashboard-ingress (#906)

* Add note and workaround for nip.io in tests

* Force HTTPS redirect on dashboard ingress

* Fix lint on validator changes at dashboard_ingress

* Add config args to dashboard-ingress addon (#906)

* fix unclosed monospace text on nip.io workaround

* Move storage-dir argument to k8s-dqlite (#2672)

* Move storage-dir argument to k8s-dqlite

* Fix the config values

* Remove empty line

* Use Docker's own registry image (#2679)

* Update k8s-dqlite to include the empty cluster.yaml fix (#2683)

* Upgrade linkerd to version 2.11.1

* Fix yaml loading in tests (#2698)

* Update EnVar plugin (#2704)

* Installer 2.2.1 release (#2705)

* Bump actions/checkout from 2.3.5 to 2.4.0 (#2706)

Bumps [actions/checkout](https://github.com/actions/checkout) from 2.3.5 to 2.4.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v2.3.5...v2.4.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update inaccel add-on (#2681)

* Set `kube-system` as the default namespace

* Test mutating webhook features

Signed-off-by: Elias Koromilas <elias.koromilas@gmail.com>

* Inspect report to include basic dqlite info (#2688)

* Update check-formatting.yml (#2721)

Rename `build` to `check-formatting`.  This helps when running locally with `act`.

* Add clustering tests. Remove dead tests. (#2697)

* Update GPU operator to v1.8.2 and fix its test (#2708)

* updated portainer disable script (#2693)

* Update default kube-apiserver arguments (#2731)

- Disable profiling (--profiling=false)
- Reduce event TTL to 5 minutes (--event-ttl=5m)

* Bump ingress to v1.0.5 (#2732)

* Bump actions/setup-python from 2.2.2 to 2.3.0 (#2738)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 2.2.2 to 2.3.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v2.2.2...v2.3.0)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Use SafeLoader instead of FullLoader (#2726)

* Pull inspection tarball out of the multipass VM (#2711)

* upgrade keda to the latest version

* upgrade jaeger operator

* upgrade metrics server to v0.5.2

* Worker only node with dqlite (#2444)

microk8s join command has an additional --worker option to add the node as a worker node not running the control plane.

Kubelet and kube-proxy contact a Traefik loadbalancer running locally on port 16443 (same as the API server) and Traefik forwards the requests towards a set of configured API servers.

Kubelet and kube-proxy are authenticated based on x509 certificates so it does not matter which master node they contact.

Nodes running the control plane are labeled with node.kubernetes.io/microk8s-controlplane=microk8s-controlplane, worker nodes are labeled with node.kubernetes.io/microk8s-worker=microk8s-worker.

Nodes labeled with node.kubernetes.io/microk8s-controlplane=microk8s-controlplane at the time of the joining operation will be added to the Traefik loadbalancer.

The leave, join and reset operations were refactored to use click.

* Fixed a typo

* Improve handling for missing k8s-dqlite arguments file (#2753)

* Fix typo in configure script (#2758)

* Remove the --insecure-port argument (#2756)

* Fix add-node output in etcd based clusters (#2760)

* Warn rpi users they need extra modules (#2754)

* Remove deprecated configuration from containerd-template.toml and adapt it as suggested by containerd documentation. (#2648)

* Fix removal of callback tokens (#2759)

Co-authored-by: Angelos Kolaitis <angelos.kolaitis@canonical.com>

* Bump actions/setup-python from 2.3.0 to 2.3.1 (#2765)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 2.3.0 to 2.3.1.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v2.3.0...v2.3.1)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Replace depreated call from net-tools to iproute2 (#2751)

* Replace deprecated network tools in inspect script (#2657)

Use networks tools from iproute2 (ip addr + ss) instead of
net-tools (ifconfig, netstat)

* Replacement of deprecated net-tools to iproute2 tools

It removes the use of the deprecated ifconfig and netstat tools
notably when performing enabling/disabling host-access action and
inside common/utils functions

* Print warning for docker iff docker daemon is installed (#2769)

* Update the PATH containerd-shims has to find runc (#2772)

* Build traefik from source for s390x (#2768)

* Remove colon from localhost ctonatinerd configuration (#2781)

* Allow kube-proxy to change nf_conntrack_max on lxc (#2777)

* Allow kube-proxy to change nf_conntrack_max on lxc

* If you detect we are on lxc do not try set any conntrack params

* Prepare for v1.23 (#2787)

* Remove insecure-port only from local config (#2789)

* Runc now requires Go 1.16 minimum in order to go get (#2799)

* Hotfix ElasticSearch for Log4Shell (#2802)

* Bump Multipass and default track (#2794)

* fix ingress leader election when rbac is enabled (#2813)

* fix ingress rbac so it can acquire lock

* upgrade nginx ingress to v1.1.0 and update the rolebinding to use only  resourceName

* Bump carlosperate/download-file-action from 1.0.3 to 1.1.0 (#2808)

Bumps [carlosperate/download-file-action](https://github.com/carlosperate/download-file-action) from 1.0.3 to 1.1.0.
- [Release notes](https://github.com/carlosperate/download-file-action/releases)
- [Commits](carlosperate/download-file-action@v1.0.3...v1.1.0)

---
updated-dependencies:
- dependency-name: carlosperate/download-file-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* upgrade dashboard to v2.3.0 to fix ingress API 404 (#2792)

* Bump traefik version to 2.5 (#2809)


Co-authored-by: Konstantinos Tsakalozos <konstantinos.tsakalozos@canonical.com>

* Refuse joining nodes when hostname does not resolve (#2838)

* Add low-memory guard (#2828)

* Deprecate storage addon (#2833)

* Replace 'storage' with 'hostpath-storage'

* Do not start traefik and k8s-dqlite until interfaces are connected (#2851)

* Remove sudo

* Add touch installed lock back in

Co-authored-by: John P Lettman <john.lettman@canonical.com>
Co-authored-by: Konstantinos Tsakalozos <kos.tsakalozos@canonical.com>
Co-authored-by: Tobias Muehl <t@muehl.io>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Elias Koromilas <elias.koromilas@gmail.com>
Co-authored-by: balasu <balasundarammaster@gmail.com>
Co-authored-by: Angelos Kolaitis <angelos.kolaitis@canonical.com>
Co-authored-by: Mohammad Faraz <farazm708@gmail.com>
Co-authored-by: balchua <balchua@yahoo.com>
Co-authored-by: Stefano Palazzo <stefano.palazzo@gmail.com>
Co-authored-by: Babis K <babis_k@outlook.com>
Co-authored-by: odufourc <84727096+odufourc@users.noreply.github.com>
Co-authored-by: YanZheng <vincent19376@gmail.com>
Co-authored-by: Miroslav Balaz <gpslayer@gmail.com>
Co-authored-by: Konstantinos Tsakalozos <konstantinos.tsakalozos@canonical.com>
  • Loading branch information
16 people authored Jan 19, 2022
1 parent 8091ab5 commit b12ae07
Show file tree
Hide file tree
Showing 28 changed files with 262 additions and 58 deletions.
16 changes: 16 additions & 0 deletions microk8s-resources/actions/common/utils.sh
Original file line number Diff line number Diff line change
Expand Up @@ -775,3 +775,19 @@ then
exit 1
fi
fi

exit_if_low_memory_guard() {
if [ -e ${SNAP_DATA}/var/lock/low-memory-guard.lock ]
then
echo ''
echo 'This node does not have enough RAM to host the Kubernetes control plane services'
echo 'and join the database quorum. You may consider joining this node as a worker'
echo 'node to a cluster.'
echo ''
echo 'If you would still like to start the control plane services, start MicroK8s with:'
echo ''
echo ' microk8s start --disable-low-memory-guard'
echo ''
exit 1
fi
}
1 change: 0 additions & 1 deletion microk8s-resources/actions/disable.host-access.sh
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,3 @@ then
else
echo "Host-access is not enabled. Nothing to do.."
fi

23 changes: 23 additions & 0 deletions microk8s-resources/actions/disable.hostpath-storage.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
#!/usr/bin/env bash

set -e

source $SNAP/actions/common/utils.sh

echo "Disabling hostpath storage."
read -ra ARGUMENTS <<< "$1"

declare -A map
map[\$SNAP_COMMON]="$SNAP_COMMON"
use_manifest storage delete "$(declare -p map)"
sleep 5
echo "Storage removed."
if [ ! -z "${ARGUMENTS[@]}" ] && [ "${ARGUMENTS[@]}" = "destroy-storage" ]
then
rm -rf "$SNAP_COMMON/default-storage"
echo "Storage space reclaimed."
else
read -p "Remove PVC storage at $SNAP_COMMON/default-storage ? (Y/N): " confirm && [[ $confirm == [yY] || $confirm == [yY][eE][sS] ]] || exit 1
rm -rf "$SNAP_COMMON/default-storage"
echo "Storage space reclaimed."
fi
2 changes: 1 addition & 1 deletion microk8s-resources/actions/disable.registry.sh
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@ source $SNAP/actions/common/utils.sh
echo "Disabling the private registry"
use_manifest registry delete
use_manifest registry-help apply
echo "The registry is disabled. Use 'microk8s disable storage:destroy-storage' to free the storage space."
echo "The registry is disabled. Use 'microk8s disable hostpath-storage:destroy-storage' to free the storage space."
19 changes: 3 additions & 16 deletions microk8s-resources/actions/disable.storage.sh
Original file line number Diff line number Diff line change
Expand Up @@ -4,20 +4,7 @@ set -e

source $SNAP/actions/common/utils.sh

echo "Disabling default storage"
read -ra ARGUMENTS <<< "$1"
echo "DEPRECIATION WARNING: 'storage' is deprecated and will soon be removed. Please use 'hostpath-storage' instead."
echo ""

declare -A map
map[\$SNAP_COMMON]="$SNAP_COMMON"
use_manifest storage delete "$(declare -p map)"
sleep 5
echo "Storage removed"
if [ ! -z "${ARGUMENTS[@]}" ] && [ "${ARGUMENTS[@]}" = "destroy-storage" ]
then
rm -rf "$SNAP_COMMON/default-storage"
echo "Storage space reclaimed"
else
read -p "Remove PVC storage at $SNAP_COMMON/default-storage ? (Y/N): " confirm && [[ $confirm == [yY] || $confirm == [yY][eE][sS] ]] || exit 1
rm -rf "$SNAP_COMMON/default-storage"
echo "Storage space reclaimed"
fi
"$SNAP/microk8s-disable.wrapper" hostpath-storage $1
2 changes: 0 additions & 2 deletions microk8s-resources/actions/enable.host-access.sh
Original file line number Diff line number Diff line change
Expand Up @@ -33,5 +33,3 @@ echo "Setting ${IP_ADDRESS} as host-access"
"$SNAP/sbin/ip" addr add "$IP_ADDRESS"/32 dev lo label lo:microk8s

echo "Host-access is enabled"


28 changes: 28 additions & 0 deletions microk8s-resources/actions/enable.hostpath-storage.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
#!/usr/bin/env bash

set -e

source $SNAP/actions/common/utils.sh

if [ -d "$SNAP_COMMON/default-storage" ]
then
echo "Hostpath storage is already enabled."
exit 0
fi

echo "Enabling default storage class."
echo "WARNING: Hostpath storage is not suitable for production environments."
echo ""
mkdir -p ${SNAP_COMMON}/default-storage

declare -A map
map[\$SNAP_COMMON]="$SNAP_COMMON"
use_manifest storage apply "$(declare -p map)"
echo "Storage will be available soon."

if [ -e ${SNAP_DATA}/var/lock/clustered.lock ]
then
echo ""
echo "WARNING: The storage class enabled does not persist volumes across nodes."
echo ""
fi
2 changes: 1 addition & 1 deletion microk8s-resources/actions/enable.portainer.sh
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ MANIFEST_PTR="https://raw.githubusercontent.com/portainer/k8s/master/deploy/mani

KUBECTL="$SNAP/kubectl --kubeconfig=${SNAP_DATA}/credentials/client.config"

"$SNAP/microk8s-enable.wrapper" hostpath-storage
"$SNAP/microk8s-enable.wrapper" dns
"$SNAP/microk8s-enable.wrapper" storage

echo "Enabling portainer"

Expand Down
4 changes: 2 additions & 2 deletions microk8s-resources/actions/enable.registry.sh
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ if [ -z "${ARGUMENTS[@]}" ]; then
echo "You can use the \"size\" argument while enabling the registry, eg microk8s.enable registry:size=30Gi"
declare -A map
map[\$DISKSIZE]="20Gi"
"$SNAP/microk8s-enable.wrapper" storage
"$SNAP/microk8s-enable.wrapper" hostpath-storage
echo "Applying registry manifest"
use_manifest registry apply "$(declare -p map)"
echo "The registry is enabled"
Expand All @@ -29,7 +29,7 @@ elif [[ ${ARGUMENTS[@]} =~ $regex_args ]]; then
echo "The size of the registry should be higher or equal to 20Gi and match the regex: (^[2-9][0-9]{1,}|^[1-9][0-9]{2,})(Gi$)"
exit 1
elif [ "$key" = "size" ] && [[ $value =~ $REGEX_DISK_SIZE ]]; then
"$SNAP/microk8s-enable.wrapper" storage
"$SNAP/microk8s-enable.wrapper" hostpath-storage
declare -A map
map[\$DISKSIZE]=$value
fi
Expand Down
16 changes: 3 additions & 13 deletions microk8s-resources/actions/enable.storage.sh
Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,7 @@ set -e

source $SNAP/actions/common/utils.sh

echo "Enabling default storage class"
mkdir -p ${SNAP_COMMON}/default-storage
echo "DEPRECIATION WARNING: 'storage' is deprecated and will soon be removed. Please use 'hostpath-storage' instead."
echo ""

declare -A map
map[\$SNAP_COMMON]="$SNAP_COMMON"
use_manifest storage apply "$(declare -p map)"
echo "Storage will be available soon"

if [ -e ${SNAP_DATA}/var/lock/clustered.lock ]
then
echo ""
echo "WARNING: The storage class enabled does not persist volumes across nodes"
echo ""
fi
"$SNAP/microk8s-enable.wrapper" hostpath-storage
2 changes: 1 addition & 1 deletion microk8s-resources/wrappers/addon-lists.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ microk8s-addons:
- arm64
- amd64

- name: "storage"
- name: "hostpath-storage"
description: "Storage class; allocates storage from host directory"
version: "1.0.0"
check_status: "pod/hostpath-provisioner"
Expand Down
8 changes: 7 additions & 1 deletion microk8s-resources/wrappers/apiservice-kicker
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,12 @@ then
exit 0
fi

if [ -e "${SNAP_DATA}/var/lock/low-memory-guard.lock" ]
then
echo "not starting api service kicker because of low memory guard lock"
exit 0
fi

restart_attempt=0
installed_registry_help=0
nic_name="vxlan.calico"
Expand Down Expand Up @@ -154,7 +160,7 @@ do
then
use_manifest registry-help apply
fi

installed_registry_help=1
fi
fi
Expand Down
2 changes: 1 addition & 1 deletion microk8s-resources/wrappers/microk8s-add-node.wrapper
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ subject=$(openssl x509 -sha256 -days 365 -noout -subject -in "$SNAP_DATA/certs/c
if [[ $subject == *"127.0.0.1"* ]]; then
echo "Clustering requires a fresh MicroK8s installation. Reinstall with:"
echo "sudo snap remove microk8s"
echo "sudo snap install microk8s --classic"
echo "sudo snap install microk8s"
exit 1
fi

Expand Down
11 changes: 8 additions & 3 deletions microk8s-resources/wrappers/microk8s-join.wrapper
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,17 @@ export PYTHONNOUSERSITE=false

source $SNAP/actions/common/utils.sh

if [ -e "$SNAP_DATA/args/cni-network/cni.yaml.disabled" ] && [ -e "$SNAP_DATA/args/cni-network/05-cilium-cni.conf" ] ; then
echo "Cilium is enabled and is not suitable for multi node clusters."
if [ -e "$SNAP_DATA/args/cni-network/cni.yaml.disabled" ] && [ -e "$SNAP_DATA/args/cni-network/05-cilium-cni.conf" ] ; then
echo "WARNING: Cilium is enabled and is not suitable for multi node clusters."
exit 1
fi

exit_if_not_root
if [ -d "$SNAP_COMMON/default-storage" ]
then
echo "WARNING: Hostpath storage is enabled and is not suitable for multi node clusters."
echo ""
fi

exit_if_no_permissions

LD_LIBRARY_PATH=$IN_SNAP_LD_LIBRARY_PATH ${SNAP}/usr/bin/python3 ${SNAP}/scripts/cluster/join.py $@
2 changes: 1 addition & 1 deletion microk8s-resources/wrappers/microk8s-reset.wrapper
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ disable_addons() {
fi
echo "Disabling addon : $action"
addon_arguments=""
if [ "$action" = "storage" ] && [ ${destroy_storage_enabled} ]
if [ "$action" = "hostpath-storage" ] && [ ${destroy_storage_enabled} ]
then
microk8s disable $action:destroy-storage > /dev/null 2>&1 || true
else
Expand Down
12 changes: 9 additions & 3 deletions microk8s-resources/wrappers/microk8s-start.wrapper
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,22 @@ fi
exit_if_not_root
exit_if_no_permissions

PARSED=$(getopt --options=lho: --longoptions=help,output: --name "$@" -- "$@")
PARSED=$(getopt --options=lho: --longoptions=help,output:,disable-low-memory-guard --name "$@" -- "$@")
eval set -- "$PARSED"
while true; do
case "$1" in
--disable-low-memory-guard)
rm "${SNAP_DATA}/var/lock/low-memory-guard.lock" || true
shift
;;
-h|--help)
echo "Usage: $0 [OPTIONS]"
echo
echo "Start Kubernetes services"
echo
echo "Options:"
echo " -h, --help Show this help"
echo " -h, --help Show this help"
echo " --disable-low-memory-guard Start MicroK8s in machines with RAM < 512MB"
exit 0
;;
--)
Expand All @@ -38,6 +43,7 @@ while true; do
esac
done

exit_if_low_memory_guard

if ! snapctl start ${SNAP_NAME} --enable
then
Expand All @@ -52,4 +58,4 @@ else
fi
fi

wait_for_node
wait_for_node
9 changes: 9 additions & 0 deletions microk8s-resources/wrappers/microk8s-status.wrapper
Original file line number Diff line number Diff line change
Expand Up @@ -11,4 +11,13 @@ source $SNAP/actions/common/utils.sh

exit_if_no_permissions

if [ -e ${SNAP_DATA}/var/lock/clustered.lock ]
then
echo "This MicroK8s deployment is acting as a node in a cluster."
echo "Please use the control plane node."
exit 0
fi

exit_if_low_memory_guard

LD_LIBRARY_PATH=$IN_SNAP_LD_LIBRARY_PATH ${SNAP}/usr/bin/python3 ${SNAP}/scripts/wrappers/status.py $@
6 changes: 6 additions & 0 deletions microk8s-resources/wrappers/run-k8s-dqlite-with-args
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,12 @@ source $SNAP/actions/common/utils.sh

exit_if_service_not_expected_to_start k8s-dqlite

if [ -e "${SNAP_DATA}/var/lock/low-memory-guard.lock" ]
then
echo "not starting dqlite because of low memory guard lock"
exit 0
fi

app=k8s-dqlite

if ! [ -e "$SNAP_DATA/args/${app}" ]
Expand Down
4 changes: 4 additions & 0 deletions microk8s-resources/wrappers/run-kubelite-with-args
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,10 @@ fi
if [ -e ${SNAP_DATA}/var/lock/clustered.lock ]
then
refresh_opt_in_local_config "start-control-plane" "false" kubelite
elif [ -e ${SNAP_DATA}/var/lock/low-memory-guard.lock ]
then
echo "${app} will not run, memory guard is enabled"
exit 0
else
refresh_opt_in_local_config "start-control-plane" "true" kubelite
fi
Expand Down
30 changes: 30 additions & 0 deletions scripts/cluster/agent.py
Original file line number Diff line number Diff line change
Expand Up @@ -644,6 +644,36 @@ def join_node_dqlite():
ca_key = get_cert("ca.key")
admin_token = get_token("admin")

# Ensure that the joining node hostname resolves to the expected IP address.
try:
resolved_addr = socket.gethostbyname(hostname)
if resolved_addr != request.remote_addr:
return Response(
json.dumps(
{
"error": "The hostname ({}) of the joining node resolves"
" to {} instead of {}. Refusing join.".format(
hostname,
resolved_addr,
request.remote_addr,
),
}
),
mimetype="application/json",
status=400,
)
except socket.gaierror:
return Response(
json.dumps(
{
"error": "Hostname {} should resolve to {}, but it did not. "
"Refusing join.".format(hostname, request.remote_addr)
}
),
mimetype="application/json",
status=400,
)

kubelet_args = read_kubelet_args_file()
cluster_cert, cluster_key = get_cluster_certs()
# Make sure calico can autodetect the right interface for packet routing
Expand Down
10 changes: 10 additions & 0 deletions scripts/cluster/common/utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,16 @@ def is_node_dqlite_worker():
)


def is_low_memory_guard_enabled():
"""
Check if the low memory guard is enabled on this Node
:returns: True if enabled, otherwise False
"""
lock = os.path.expandvars("${SNAP_DATA}/var/lock/low-memory-guard.lock")
return os.path.isfile(lock)


def get_dqlite_port():
"""
What is the port dqlite listens on
Expand Down
Loading

0 comments on commit b12ae07

Please sign in to comment.