Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(MAINT) Revert hardening changes #599

Merged
merged 3 commits into from
Dec 13, 2022
Merged

(MAINT) Revert hardening changes #599

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9444c12
(MAINT) Revert hardening changes
chelnak Dec 9, 2022
fe6c101
(MAINT) Remove additional variables
chelnak Dec 12, 2022
4bdf2a8
(MAINT) Remove safe_node_name
chelnak Dec 12, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 17 additions & 37 deletions manifests/kube_addons.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,37 +27,26 @@
$exec_onlyif = 'kubectl get nodes'

if $cni_rbac_binding {
$binding_command = ['kubectl', 'apply', '-f', $cni_rbac_binding]
$binding_unless = 'kubectl get clusterrole | grep calico'

exec { 'Install calico rbac bindings':
environment => $env,
command => $binding_command,
command => ['kubectl', 'apply', '-f', $cni_rbac_binding],
onlyif => $exec_onlyif,
unless => $binding_unless,
unless => 'kubectl get clusterrole | grep calico',
}
}

if $cni_network_provider {
if $cni_provider == 'calico-tigera' {
if $cni_network_preinstall {
$preinstall_command = ['kubectl', 'apply', '-f', $cni_network_preinstall]
$preinstall_unless = 'kubectl -n tigera-operator get deployments | egrep "^tigera-operator"'

exec { 'Install cni network (preinstall)':
command => $preinstall_command,
command => ['kubectl', 'apply', '-f', $cni_network_preinstall],
onlyif => $exec_onlyif,
unless => $preinstall_unless,
unless => 'kubectl -n tigera-operator get deployments | egrep "^tigera-operator"',
environment => $env,
before => Exec['Install cni network provider'],
}
}
# Removing Calico_installation_path variable as it doesnt seem to apport any extra value here.
$calico_installation_path = '/etc/kubernetes/calico-installation.yaml'
$path_command = 'kubectl apply -f /etc/kubernetes/calico-installation.yaml'
$path_unless = 'kubectl -n calico-system get daemonset | egrep "^calico-node"'

file { $calico_installation_path:
file { '/etc/kubernetes/calico-installation.yaml':
ensure => 'present',
group => 'root',
mode => '0400',
Expand All @@ -66,51 +55,42 @@
source => $cni_network_provider,
} -> file_line { 'Configure calico ipPools.cidr':
ensure => present,
path => $calico_installation_path,
path => '/etc/kubernetes/calico-installation.yaml',
match => ' cidr:',
line => " cidr: ${cni_pod_cidr}",
multiple => false,
replace => true,
} -> exec { 'Install cni network provider':
command => $path_command,
command => 'kubectl apply -f /etc/kubernetes/calico-installation.yaml',
onlyif => $exec_onlyif,
unless => $path_unless,
unless => 'kubectl -n calico-system get daemonset | egrep "^calico-node"',
environment => $env,
}
} else {
$provider_command = ['kubectl', 'apply', '-f', $cni_network_provider]
$provider_unless = 'kubectl -n kube-system get daemonset | egrep "(flannel|weave|calico-node|cilium)"'

exec { 'Install cni network provider':
command => $provider_command,
command => ['kubectl', 'apply', '-f', $cni_network_provider],
onlyif => $exec_onlyif,
unless => $provider_unless,
unless => 'kubectl -n kube-system get daemonset | egrep "(flannel|weave|calico-node|cilium)"',
environment => $env,
}
}
}

if $schedule_on_controller {
$schedule_command = ['kubectl', 'taint', 'nodes', $node_name, 'node-role.kubernetes.io/master-']
$schedule_onlyif = "kubectl describe nodes ${node_name} | tr -s ' ' | grep 'Taints: node-role.kubernetes.io/master:NoSchedule'"

exec { 'schedule on controller':
command => $schedule_command,
onlyif => $schedule_onlyif,
command => "kubectl taint nodes ${node_name} node-role.kubernetes.io/master-",
onlyif => "kubectl describe nodes ${node_name} | tr -s ' ' | grep 'Taints: node-role.kubernetes.io/master:NoSchedule'",
}
}

if $install_dashboard {
$dashboard_command = ['kubectl', 'apply', '-f', $dashboard_url]
$dashboard_unless = [
'kubectl get pods --field-selector="status.phase=Running" -n kubernetes-dashboard | grep kubernetes-dashboard-',
'kubectl get pods --field-selector="status.phase=Running" -n kube-system | grep kubernetes-dashboard-'
]

exec { 'Install Kubernetes dashboard':
command => $dashboard_command,
command => ['kubectl', 'apply', '-f', $dashboard_url],
onlyif => $exec_onlyif,
unless => $dashboard_unless,
unless => [
'kubectl get pods --field-selector="status.phase=Running" -n kubernetes-dashboard | grep kubernetes-dashboard-',
'kubectl get pods --field-selector="status.phase=Running" -n kube-system | grep kubernetes-dashboard-',
],
environment => $env,
}
}
Expand Down
6 changes: 2 additions & 4 deletions manifests/kubeadm_init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,15 +15,13 @@
skip_phases => $skip_phases,
})

$exec_init = ['kubeadm', 'init', $kubeadm_init_flags]
$unless_init = "kubectl get nodes | grep ${node_name}"
exec { 'kubeadm init':
command => $exec_init,
command => "kubeadm init ${kubeadm_init_flags}",
environment => $env,
path => $path,
logoutput => true,
timeout => 0,
unless => $unless_init,
unless => "kubectl get nodes | grep ${node_name}",
}

# This prevents a known race condition https://github.com/kubernetes/kubernetes/issues/66689
Expand Down
7 changes: 2 additions & 5 deletions manifests/kubeadm_join.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,15 +43,12 @@
}
}

$exec_join = ['kubeadm', 'join', $kubeadm_join_flags]
$unless_join = "kubectl get nodes | grep ${node_name}"

exec { 'kubeadm join':
command => $exec_join,
command => "kubeadm join ${kubeadm_join_flags}",
environment => $env,
path => $path,
logoutput => true,
timeout => 0,
unless => $unless_join,
unless => "kubectl get nodes | grep ${node_name}",
}
}
7 changes: 2 additions & 5 deletions manifests/packages.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,13 +60,10 @@
$kube_packages = ['kubelet', 'kubectl', 'kubeadm']

if $disable_swap {
$command = ['swapoff', '-a']
$unless = [['awk', '"{ if (NR > 1) exit 1}"', '/proc/swaps']]

exec { 'disable swap':
path => ['/usr/sbin/', '/usr/bin', '/bin', '/sbin'],
command => $command,
unless => $unless,
command => 'swapoff -a',
unless => "awk '{ if (NR > 1) exit 1}' /proc/swaps",
}
file_line { 'remove swap in /etc/fstab':
ensure => absent,
Expand Down
6 changes: 2 additions & 4 deletions manifests/service.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,9 @@
ensure => directory,
}

$exec_reload = ['systemctl', 'daemon-reload']

exec { 'kubernetes-systemd-reload':
path => '/bin',
command => $exec_reload,
command => 'systemctl daemon-reload',
refreshonly => true,
}

Expand Down Expand Up @@ -107,7 +105,7 @@
if $etcd_install_method == 'wget' {
exec { 'systemctl-daemon-reload-etcd':
path => '/usr/bin:/bin:/usr/sbin:/sbin',
command => $exec_reload,
command => 'systemctl daemon-reload',
refreshonly => true,
subscribe => File['/etc/systemd/system/etcd.service'],
notify => Service['etcd'],
Expand Down
7 changes: 2 additions & 5 deletions manifests/wait_for_default_sa.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,9 @@
$safe_namespace = shell_escape($namespace)

# This prevents a known race condition https://github.com/kubernetes/kubernetes/issues/66689
$cmd = ['kubectl', '-n', $safe_namespace, 'get', 'serviceaccount', 'default', '-o', 'name']
$unless_cmd = [['kubectl', '-n', $safe_namespace, 'get', 'serviceaccount', 'default', '-o', 'name']]

exec { "wait for default serviceaccount creation in ${safe_namespace}":
command => $cmd,
unless => $unless_cmd,
command => "kubectl -n ${safe_namespace} get serviceaccount default -o name",
unless => ["kubectl -n ${safe_namespace} get serviceaccount default -o name"],
path => $path,
environment => $env,
timeout => $timeout,
Expand Down
2 changes: 1 addition & 1 deletion spec/classes/kube_addons_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@
when 'calico-tigera'
it { is_expected.to contain_exec('Install cni network (preinstall)').with({
'command': ['kubectl', 'apply', '-f', 'https://foo.test/tigera-operator'],
'onlyif': ['kubectl get nodes'],
'onlyif': 'kubectl get nodes',
})
}
it { is_expected.to contain_file('/etc/kubernetes/calico-installation.yaml')}
Expand Down
6 changes: 3 additions & 3 deletions spec/defines/kubeadm_init_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
}
end
it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_exec('kubeadm init').with_command(["kubeadm", "init", "--config '/etc/kubernetes/config.yaml'"])}
it { is_expected.to contain_exec('kubeadm init').with_command("kubeadm init --config '/etc/kubernetes/config.yaml'")}
it { is_expected.to contain_kubernetes__wait_for_default_sa('default')}
end

Expand All @@ -44,7 +44,7 @@
}
end
it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_exec('kubeadm init').with_command(["kubeadm", "init", "--config '/etc/kubernetes/config.yaml' --dry-run"])}
it { is_expected.to contain_exec('kubeadm init').with_command("kubeadm init --config '/etc/kubernetes/config.yaml' --dry-run")}
it { is_expected.to contain_kubernetes__wait_for_default_sa('default')}
end

Expand All @@ -59,7 +59,7 @@
}
end
it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_exec('kubeadm init').with_command(["kubeadm", "init", "--config '/etc/kubernetes/config.yaml' --ignore-preflight-errors='foo,bar'"])}
it { is_expected.to contain_exec('kubeadm init').with_command("kubeadm init --config '/etc/kubernetes/config.yaml' --ignore-preflight-errors='foo,bar'")}
it { is_expected.to contain_kubernetes__wait_for_default_sa('default')}
end
end
8 changes: 4 additions & 4 deletions spec/defines/kubeadm_join_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
end

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_exec('kubeadm join').with_command(["kubeadm", "join", "'10.0.0.1:6443' --discovery-token 'token' --discovery-token-ca-cert-hash 'sha256:hash' --node-name 'kube-node' --token 'token'"])}
it { is_expected.to contain_exec('kubeadm join').with_command("kubeadm join '10.0.0.1:6443' --discovery-token 'token' --discovery-token-ca-cert-hash 'sha256:hash' --node-name 'kube-node' --token 'token'")}
end

context 'with kubernetes_version => 1.12.3 and controller_address => 10.0.0.1:6443' do
Expand All @@ -48,7 +48,7 @@
end

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_exec('kubeadm join').with_command(["kubeadm", "join", "--config '/etc/kubernetes/config.yaml'"])}
it { is_expected.to contain_exec('kubeadm join').with_command("kubeadm join --config '/etc/kubernetes/config.yaml'")}
end

context 'with kubernetes_version => 1.12.3 and ignore_preflight_errors => [foo, bar]' do
Expand All @@ -60,7 +60,7 @@
end

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_exec('kubeadm join').with_command(["kubeadm", "join", "--config '/etc/kubernetes/config.yaml' --ignore-preflight-errors 'foo,bar'"])}
it { is_expected.to contain_exec('kubeadm join').with_command("kubeadm join --config '/etc/kubernetes/config.yaml' --ignore-preflight-errors 'foo,bar'")}
end

context 'with kubernetes_version => 1.12.3 and discovery_file => /etc/kubernetes/admin.conf' do
Expand All @@ -72,6 +72,6 @@
end

it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_exec('kubeadm join').with_command(["kubeadm", "join", "--discovery-file '/etc/kubernetes/admin.conf'"])}
it { is_expected.to contain_exec('kubeadm join').with_command("kubeadm join --discovery-file '/etc/kubernetes/admin.conf'")}
end
end
4 changes: 2 additions & 2 deletions spec/defines/wait_for_default_sa_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
end
it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_exec('wait for default serviceaccount creation in default')
.with_command(['kubectl', '-n', 'default', 'get', 'serviceaccount', 'default', '-o', 'name'])}
.with_command('kubectl -n default get serviceaccount default -o name')}
end

context 'with namespace foo and path /bar' do
Expand All @@ -39,7 +39,7 @@
end
it { is_expected.to compile.with_all_deps }
it { is_expected.to contain_exec('wait for default serviceaccount creation in foo')
.with_command(['kubectl', '-n', 'foo', 'get', 'serviceaccount', 'default', '-o', 'name'])
.with_command('kubectl -n foo get serviceaccount default -o name')
.with_path(['/bar'])}
end
end