Add kubens.service, drop-ins, and kubensenter prefix to kubelet.service #3274
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -o errexit | ||
| set -o nounset | ||
| set -o pipefail | ||
|
|
||
| dropin_yaml() { | ||
| local service=$1 | ||
| local name=$2 | ||
| local source=$3 | ||
| echo "# Autogenerated by hack/update-templates.sh; do not edit" | ||
| echo "name: $service" | ||
| echo "dropins:" | ||
| echo " - name: $name" | ||
| echo " contents: |" | ||
| sed 's/^/ /' $source | ||
|
|
||
| } | ||
|
|
||
| write_dropin_yaml() { | ||
| local service=$1 | ||
| local name=$2 | ||
| local source=$3 | ||
| local dst=$4 | ||
| echo "Generating template for drop-in $service::$name => $dst" >&2 | ||
| dropin_yaml "$service" "$name" "$source" > "$dst" | ||
| } | ||
|
|
||
| service_yaml() { | ||
| local name=$1 | ||
| local enabled=$2 | ||
| local source=$3 | ||
| echo "# Autogenerated by hack/update-templates.sh; do not edit" | ||
| echo "name: $name" | ||
| echo "enabled: $enabled" | ||
| echo "contents: |" | ||
| sed 's/^/ /' $source | ||
| } | ||
|
|
||
| write_service_yaml() { | ||
| local name=$1 | ||
| local enabled=$2 | ||
| local source=$3 | ||
| local dst=$4 | ||
| echo "Generating template for service $name (enabled=$enabled) => $dst" >&2 | ||
| service_yaml "$name" "$enabled" "$source" > "$dst" | ||
| } | ||
|
|
||
| SCRIPT_ROOT=$(dirname ${BASH_SOURCE})/.. | ||
| UNITS=${SCRIPT_ROOT}/templates/common/_base/units | ||
|
|
||
| KUBENS_VENDOR=${SCRIPT_ROOT}/vendor/github.com/containers/kubensmnt/utils/systemd | ||
| echo "Updating templates from vendor/github.com/containers/kubensmnt/utils/systemd..." >&2 | ||
| write_service_yaml kubens.service "false" ${KUBENS_VENDOR}/kubens.service ${UNITS}/kubens.service.yaml | ||
| write_dropin_yaml kubelet.service 01-kubens.conf ${KUBENS_VENDOR}/kubens-dropin.conf ${UNITS}/kubelet.service-kubens.yaml | ||
| write_dropin_yaml crio.service 01-kubens.conf ${KUBENS_VENDOR}/kubens-dropin.conf ${UNITS}/crio.service-kubens.yaml | ||
|
|
||
| log_cp() { | ||
| echo "Copying $1 => $2" | ||
| cp $1 $2 | ||
| } | ||
|
|
||
| echo "Copying worker templates from equivalent master templates" | ||
| log_cp templates/master/01-master-kubelet/_base/files/kubenswrapper.yaml templates/worker/01-worker-kubelet/_base/files/kubenswrapper.yaml |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -o errexit | ||
| set -o nounset | ||
| set -o pipefail | ||
|
|
||
| SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")/.. | ||
|
|
||
| DIFFROOT="${SCRIPT_ROOT}/templates" | ||
| TMP_DIFFROOT="${SCRIPT_ROOT}/_tmp/templates" | ||
| _tmp="${SCRIPT_ROOT}/_tmp" | ||
|
|
||
| cleanup() { | ||
| rm -rf "${_tmp}" | ||
| } | ||
| trap "cleanup" EXIT SIGINT | ||
|
|
||
| cleanup | ||
|
|
||
| mkdir -p "${TMP_DIFFROOT}" | ||
| cp -R "${DIFFROOT}"/* "${TMP_DIFFROOT}" | ||
|
|
||
| "${SCRIPT_ROOT}/hack/update-templates.sh" | ||
| echo "diffing ${DIFFROOT} against freshly generated codegen" | ||
| ret=0 | ||
| diff -Naupr "${TMP_DIFFROOT}" "${DIFFROOT}" || ret=$? | ||
| cp -R "${TMP_DIFFROOT}"/* "${DIFFROOT}" | ||
| if [[ $ret -eq 0 ]] | ||
| then | ||
| echo "${DIFFROOT} up to date." | ||
| else | ||
| echo "${DIFFROOT} is out of date. Please run make update" | ||
| exit 1 | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| # Autogenerated by hack/update-templates.sh; do not edit | ||
| name: crio.service | ||
| dropins: | ||
| - name: 01-kubens.conf | ||
| contents: | | ||
| # vim:set ft=systemd : | ||
| # | ||
| # This drop-in will enable any service built with this | ||
| # github.com/containers/kubemntns library to properly join the mount namespace | ||
| # managed by kubens.service | ||
| # | ||
|
|
||
| [Unit] | ||
| After=kubens.service | ||
|
|
||
| [Service] | ||
| EnvironmentFile=-/run/kubens/env | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| # Autogenerated by hack/update-templates.sh; do not edit | ||
| name: kubelet.service | ||
| dropins: | ||
| - name: 01-kubens.conf | ||
| contents: | | ||
| # vim:set ft=systemd : | ||
| # | ||
| # This drop-in will enable any service built with this | ||
| # github.com/containers/kubemntns library to properly join the mount namespace | ||
| # managed by kubens.service | ||
| # | ||
|
|
||
| [Unit] | ||
| After=kubens.service | ||
|
|
||
| [Service] | ||
| EnvironmentFile=-/run/kubens/env | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| # Autogenerated by hack/update-templates.sh; do not edit | ||
| name: kubens.service | ||
| enabled: false | ||
| contents: | | ||
| [Unit] | ||
| Description=Manages a mount namespace for kubernetes-specific mounts | ||
|
|
||
| [Service] | ||
| Type=oneshot | ||
| RemainAfterExit=yes | ||
| RuntimeDirectory=kubens | ||
| Environment=RUNTIME_DIRECTORY=%t/kubens | ||
| Environment=BIND_POINT=%t/kubens/mnt | ||
| Environment=ENVFILE=%t/kubens/env | ||
|
|
||
| # Set up the runtime directory as an unbindable mountpoint | ||
| ExecStartPre=bash -c "findmnt ${RUNTIME_DIRECTORY} || mount --make-unbindable --bind ${RUNTIME_DIRECTORY} ${RUNTIME_DIRECTORY}" | ||
| # Ensure the bind point exists | ||
| ExecStartPre=touch ${BIND_POINT} | ||
| # Use 'unshare' to create the new mountpoint, then 'mount --make-rshared' so it cascades internally | ||
| ExecStart=unshare --mount=${BIND_POINT} --propagation slave mount --make-rshared / | ||
| # Finally, set an env pointer for ease-of-use | ||
| ExecStartPost=bash -c 'echo "KUBENSMNT=${BIND_POINT}" > "${ENVFILE}"' | ||
|
|
||
| # On stop, a recursive unmount cleans up the namespace and bind-mounted unbindable parent directory | ||
| ExecStop=umount -R ${RUNTIME_DIRECTORY} | ||
|
|
||
| [Install] | ||
| WantedBy=multi-user.target |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| # Note: This compatibility wrapper is needed to bridge the gap from OCP 4.11->4.12 when the new 'kubensenter' script is being introduced. | ||
| # It can be removed (and the kubelet.service should call kubensenter directly) when 4.11 is no longer a release we must upgrade from. | ||
| mode: 0755 | ||
| path: "/usr/local/bin/kubenswrapper" | ||
| contents: | ||
| inline: | | ||
| #!/bin/sh | ||
| if [ -x /usr/bin/kubensenter ]; then | ||
| exec /usr/bin/kubensenter "$@" | ||
| else | ||
| exec "$@" | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| # Note: This compatibility wrapper is needed to bridge the gap from OCP 4.11->4.12 when the new 'kubensenter' script is being introduced. | ||
| # It can be removed (and the kubelet.service should call kubensenter directly) when 4.11 is no longer a release we must upgrade from. | ||
| mode: 0755 | ||
| path: "/usr/local/bin/kubenswrapper" | ||
|
There was a problem hiding this comment. why /usr/local instead of /usr? There was a problem hiding this comment. Ignition can't write to |
||
| contents: | ||
| inline: | | ||
| #!/bin/sh | ||
| if [ -x /usr/bin/kubensenter ]; then | ||
| exec /usr/bin/kubensenter "$@" | ||
| else | ||
| exec "$@" | ||
| fi | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
does this being here mean we'll have the kubens enabled by default? is that intended?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This drop-in does nothing except set the environment variable that will be laid down by kubens.service if it's running, so it's safe fro this to be present all the time.
The kubens.service itself is not being enabled by default (see https://github.com/openshift/machine-config-operator/pull/3274/files/d8f42ae7a8e66970a5fcbdaac6fd8712d1466ba7#diff-c38a0be931e5bc991f959879c6af89aee96be94967b4544f63ace1d52e5f88ccR3)