diff --git a/CHANGES.md b/CHANGES.md index af33ce60..30da5a91 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -4,6 +4,9 @@ Notable changes between versions. ## Latest +* Kubernetes [v1.11.0](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1110) +* Force apiserver to stop listening on `127.0.0.1:8080` + ## v1.10.5 * Kubernetes [v1.10.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1105) diff --git a/README.md b/README.md index d7a7b18c..1c02fa1a 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Typhoon distributes upstream Kubernetes, architectural conventions, and cluster ## Features -* Kubernetes v1.10.5 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) +* Kubernetes v1.11.0 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) * Single or multi-master, workloads isolated on workers, [Calico](https://www.projectcalico.org/) or [flannel](https://github.com/coreos/flannel) networking * On-cluster etcd with TLS, [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)-enabled, [network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) * Advanced features like [worker pools](https://typhoon.psdn.io/advanced/worker-pools/) and [preemption](https://typhoon.psdn.io/google-cloud/#preemption) (varies by platform) @@ -46,7 +46,7 @@ Define a Kubernetes cluster by using the Terraform module for your chosen platfo ```tf module "google-cloud-yavin" { - source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.11.0" providers = { google = "google.default" @@ -88,9 +88,9 @@ In 4-8 minutes (varies by platform), the cluster will be ready. This Google Clou $ export KUBECONFIG=/home/user/.secrets/clusters/yavin/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -yavin-controller-0.c.example-com.internal Ready 6m v1.10.5 -yavin-worker-jrbf.c.example-com.internal Ready 5m v1.10.5 -yavin-worker-mzdm.c.example-com.internal Ready 5m v1.10.5 +yavin-controller-0.c.example-com.internal Ready 6m v1.11.0 +yavin-worker-jrbf.c.example-com.internal Ready 5m v1.11.0 +yavin-worker-mzdm.c.example-com.internal Ready 5m v1.11.0 ``` List the pods. diff --git a/aws/container-linux/kubernetes/README.md b/aws/container-linux/kubernetes/README.md index 546d810c..050a6211 100644 --- a/aws/container-linux/kubernetes/README.md +++ b/aws/container-linux/kubernetes/README.md @@ -11,7 +11,7 @@ Typhoon distributes upstream Kubernetes, architectural conventions, and cluster ## Features -* Kubernetes v1.10.5 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) +* Kubernetes v1.11.0 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) * Single or multi-master, workloads isolated on workers, [Calico](https://www.projectcalico.org/) or [flannel](https://github.com/coreos/flannel) networking * On-cluster etcd with TLS, [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)-enabled, [network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) * Advanced features like [worker pools](https://typhoon.psdn.io/advanced/worker-pools/) diff --git a/aws/container-linux/kubernetes/bootkube.tf b/aws/container-linux/kubernetes/bootkube.tf index 3f9e1273..1b14bc5d 100644 --- a/aws/container-linux/kubernetes/bootkube.tf +++ b/aws/container-linux/kubernetes/bootkube.tf @@ -1,6 +1,6 @@ # Self-hosted Kubernetes assets (kubeconfig, manifests) module "bootkube" { - source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=1d4db824f09246266a6b9e54df5d4df5dcd4477a" + source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=eb2dfa64de3f6c31bf5d2a8ca8912223ac1aef05" cluster_name = "${var.cluster_name}" api_servers = ["${format("%s.%s", var.cluster_name, var.dns_zone)}"] diff --git a/aws/container-linux/kubernetes/cl/controller.yaml.tmpl b/aws/container-linux/kubernetes/cl/controller.yaml.tmpl index 2df0c351..8e829ff0 100644 --- a/aws/container-linux/kubernetes/cl/controller.yaml.tmpl +++ b/aws/container-linux/kubernetes/cl/controller.yaml.tmpl @@ -74,7 +74,6 @@ systemd: ExecStartPre=/usr/bin/bash -c "grep 'certificate-authority-data' /etc/kubernetes/kubeconfig | awk '{print $2}' | base64 -d > /etc/kubernetes/ca.crt" ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/cache/kubelet-pod.uuid ExecStart=/usr/lib/coreos/kubelet-wrapper \ - --allow-privileged \ --anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ @@ -123,7 +122,7 @@ storage: contents: inline: | KUBELET_IMAGE_URL=docker://k8s.gcr.io/hyperkube - KUBELET_IMAGE_TAG=v1.10.5 + KUBELET_IMAGE_TAG=v1.11.0 - path: /etc/sysctl.d/max-user-watches.conf filesystem: root contents: diff --git a/aws/container-linux/kubernetes/workers/cl/worker.yaml.tmpl b/aws/container-linux/kubernetes/workers/cl/worker.yaml.tmpl index 1636de29..871881b5 100644 --- a/aws/container-linux/kubernetes/workers/cl/worker.yaml.tmpl +++ b/aws/container-linux/kubernetes/workers/cl/worker.yaml.tmpl @@ -47,7 +47,6 @@ systemd: ExecStartPre=/usr/bin/bash -c "grep 'certificate-authority-data' /etc/kubernetes/kubeconfig | awk '{print $2}' | base64 -d > /etc/kubernetes/ca.crt" ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/cache/kubelet-pod.uuid ExecStart=/usr/lib/coreos/kubelet-wrapper \ - --allow-privileged \ --anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ @@ -93,7 +92,7 @@ storage: contents: inline: | KUBELET_IMAGE_URL=docker://k8s.gcr.io/hyperkube - KUBELET_IMAGE_TAG=v1.10.5 + KUBELET_IMAGE_TAG=v1.11.0 - path: /etc/sysctl.d/max-user-watches.conf filesystem: root contents: @@ -111,7 +110,7 @@ storage: --volume config,kind=host,source=/etc/kubernetes \ --mount volume=config,target=/etc/kubernetes \ --insecure-options=image \ - docker://k8s.gcr.io/hyperkube:v1.10.5 \ + docker://k8s.gcr.io/hyperkube:v1.11.0 \ --net=host \ --dns=host \ --exec=/kubectl -- --kubeconfig=/etc/kubernetes/kubeconfig delete node $(hostname) diff --git a/aws/fedora-atomic/kubernetes/README.md b/aws/fedora-atomic/kubernetes/README.md index 546d810c..050a6211 100644 --- a/aws/fedora-atomic/kubernetes/README.md +++ b/aws/fedora-atomic/kubernetes/README.md @@ -11,7 +11,7 @@ Typhoon distributes upstream Kubernetes, architectural conventions, and cluster ## Features -* Kubernetes v1.10.5 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) +* Kubernetes v1.11.0 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) * Single or multi-master, workloads isolated on workers, [Calico](https://www.projectcalico.org/) or [flannel](https://github.com/coreos/flannel) networking * On-cluster etcd with TLS, [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)-enabled, [network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) * Advanced features like [worker pools](https://typhoon.psdn.io/advanced/worker-pools/) diff --git a/aws/fedora-atomic/kubernetes/bootkube.tf b/aws/fedora-atomic/kubernetes/bootkube.tf index d14557bf..141bc224 100644 --- a/aws/fedora-atomic/kubernetes/bootkube.tf +++ b/aws/fedora-atomic/kubernetes/bootkube.tf @@ -1,6 +1,6 @@ # Self-hosted Kubernetes assets (kubeconfig, manifests) module "bootkube" { - source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=1d4db824f09246266a6b9e54df5d4df5dcd4477a" + source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=eb2dfa64de3f6c31bf5d2a8ca8912223ac1aef05" cluster_name = "${var.cluster_name}" api_servers = ["${format("%s.%s", var.cluster_name, var.dns_zone)}"] diff --git a/aws/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl b/aws/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl index aa5652c8..329571b6 100644 --- a/aws/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl +++ b/aws/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl @@ -51,8 +51,7 @@ write_files: RestartSec=10 - path: /etc/kubernetes/kubelet.conf content: | - ARGS="--allow-privileged \ - --anonymous-auth=false \ + ARGS="--anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ --client-ca-file=/etc/kubernetes/ca.crt \ diff --git a/aws/fedora-atomic/kubernetes/workers/cloudinit/worker.yaml.tmpl b/aws/fedora-atomic/kubernetes/workers/cloudinit/worker.yaml.tmpl index 02edda6a..6dac9351 100644 --- a/aws/fedora-atomic/kubernetes/workers/cloudinit/worker.yaml.tmpl +++ b/aws/fedora-atomic/kubernetes/workers/cloudinit/worker.yaml.tmpl @@ -30,8 +30,7 @@ write_files: RestartSec=10 - path: /etc/kubernetes/kubelet.conf content: | - ARGS="--allow-privileged \ - --anonymous-auth=false \ + ARGS="--anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ --client-ca-file=/etc/kubernetes/ca.crt \ diff --git a/bare-metal/container-linux/kubernetes/README.md b/bare-metal/container-linux/kubernetes/README.md index 837ca15a..ffc571e2 100644 --- a/bare-metal/container-linux/kubernetes/README.md +++ b/bare-metal/container-linux/kubernetes/README.md @@ -11,7 +11,7 @@ Typhoon distributes upstream Kubernetes, architectural conventions, and cluster ## Features -* Kubernetes v1.10.5 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) +* Kubernetes v1.11.0 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) * Single or multi-master, workloads isolated on workers, [Calico](https://www.projectcalico.org/) or [flannel](https://github.com/coreos/flannel) networking * On-cluster etcd with TLS, [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)-enabled, [network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) * Ready for Ingress, Prometheus, Grafana, and other optional [addons](https://typhoon.psdn.io/addons/overview/) diff --git a/bare-metal/container-linux/kubernetes/bootkube.tf b/bare-metal/container-linux/kubernetes/bootkube.tf index 140aeb13..846d760a 100644 --- a/bare-metal/container-linux/kubernetes/bootkube.tf +++ b/bare-metal/container-linux/kubernetes/bootkube.tf @@ -1,6 +1,6 @@ # Self-hosted Kubernetes assets (kubeconfig, manifests) module "bootkube" { - source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=1d4db824f09246266a6b9e54df5d4df5dcd4477a" + source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=eb2dfa64de3f6c31bf5d2a8ca8912223ac1aef05" cluster_name = "${var.cluster_name}" api_servers = ["${var.k8s_domain_name}"] diff --git a/bare-metal/container-linux/kubernetes/cl/controller.yaml.tmpl b/bare-metal/container-linux/kubernetes/cl/controller.yaml.tmpl index a67e81a0..aa6aafbf 100644 --- a/bare-metal/container-linux/kubernetes/cl/controller.yaml.tmpl +++ b/bare-metal/container-linux/kubernetes/cl/controller.yaml.tmpl @@ -82,7 +82,6 @@ systemd: ExecStartPre=/usr/bin/bash -c "grep 'certificate-authority-data' /etc/kubernetes/kubeconfig | awk '{print $2}' | base64 -d > /etc/kubernetes/ca.crt" ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/cache/kubelet-pod.uuid ExecStart=/usr/lib/coreos/kubelet-wrapper \ - --allow-privileged \ --anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ @@ -124,7 +123,7 @@ storage: contents: inline: | KUBELET_IMAGE_URL=docker://k8s.gcr.io/hyperkube - KUBELET_IMAGE_TAG=v1.10.5 + KUBELET_IMAGE_TAG=v1.11.0 - path: /etc/hostname filesystem: root mode: 0644 diff --git a/bare-metal/container-linux/kubernetes/cl/worker.yaml.tmpl b/bare-metal/container-linux/kubernetes/cl/worker.yaml.tmpl index 0417f71d..23fd011c 100644 --- a/bare-metal/container-linux/kubernetes/cl/worker.yaml.tmpl +++ b/bare-metal/container-linux/kubernetes/cl/worker.yaml.tmpl @@ -55,7 +55,6 @@ systemd: ExecStartPre=/usr/bin/bash -c "grep 'certificate-authority-data' /etc/kubernetes/kubeconfig | awk '{print $2}' | base64 -d > /etc/kubernetes/ca.crt" ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/cache/kubelet-pod.uuid ExecStart=/usr/lib/coreos/kubelet-wrapper \ - --allow-privileged \ --anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ @@ -85,7 +84,7 @@ storage: contents: inline: | KUBELET_IMAGE_URL=docker://k8s.gcr.io/hyperkube - KUBELET_IMAGE_TAG=v1.10.5 + KUBELET_IMAGE_TAG=v1.11.0 - path: /etc/hostname filesystem: root mode: 0644 diff --git a/bare-metal/fedora-atomic/kubernetes/README.md b/bare-metal/fedora-atomic/kubernetes/README.md index 837ca15a..ffc571e2 100644 --- a/bare-metal/fedora-atomic/kubernetes/README.md +++ b/bare-metal/fedora-atomic/kubernetes/README.md @@ -11,7 +11,7 @@ Typhoon distributes upstream Kubernetes, architectural conventions, and cluster ## Features -* Kubernetes v1.10.5 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) +* Kubernetes v1.11.0 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) * Single or multi-master, workloads isolated on workers, [Calico](https://www.projectcalico.org/) or [flannel](https://github.com/coreos/flannel) networking * On-cluster etcd with TLS, [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)-enabled, [network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) * Ready for Ingress, Prometheus, Grafana, and other optional [addons](https://typhoon.psdn.io/addons/overview/) diff --git a/bare-metal/fedora-atomic/kubernetes/bootkube.tf b/bare-metal/fedora-atomic/kubernetes/bootkube.tf index e5ae156b..180d6eed 100644 --- a/bare-metal/fedora-atomic/kubernetes/bootkube.tf +++ b/bare-metal/fedora-atomic/kubernetes/bootkube.tf @@ -1,6 +1,6 @@ # Self-hosted Kubernetes assets (kubeconfig, manifests) module "bootkube" { - source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=1d4db824f09246266a6b9e54df5d4df5dcd4477a" + source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=eb2dfa64de3f6c31bf5d2a8ca8912223ac1aef05" cluster_name = "${var.cluster_name}" api_servers = ["${var.k8s_domain_name}"] diff --git a/bare-metal/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl b/bare-metal/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl index 55d89913..9a3b39f7 100644 --- a/bare-metal/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl +++ b/bare-metal/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl @@ -36,8 +36,7 @@ write_files: RestartSec=10 - path: /etc/kubernetes/kubelet.conf content: | - ARGS="--allow-privileged \ - --anonymous-auth=false \ + ARGS="--anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ --client-ca-file=/etc/kubernetes/ca.crt \ diff --git a/bare-metal/fedora-atomic/kubernetes/cloudinit/worker.yaml.tmpl b/bare-metal/fedora-atomic/kubernetes/cloudinit/worker.yaml.tmpl index 9adb0057..940b505f 100644 --- a/bare-metal/fedora-atomic/kubernetes/cloudinit/worker.yaml.tmpl +++ b/bare-metal/fedora-atomic/kubernetes/cloudinit/worker.yaml.tmpl @@ -15,8 +15,7 @@ write_files: RestartSec=10 - path: /etc/kubernetes/kubelet.conf content: | - ARGS="--allow-privileged \ - --anonymous-auth=false \ + ARGS="--anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ --client-ca-file=/etc/kubernetes/ca.crt \ diff --git a/digital-ocean/container-linux/kubernetes/README.md b/digital-ocean/container-linux/kubernetes/README.md index 39a139b5..472d3d1d 100644 --- a/digital-ocean/container-linux/kubernetes/README.md +++ b/digital-ocean/container-linux/kubernetes/README.md @@ -11,7 +11,7 @@ Typhoon distributes upstream Kubernetes, architectural conventions, and cluster ## Features -* Kubernetes v1.10.5 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) +* Kubernetes v1.11.0 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) * Single or multi-master, workloads isolated on workers, [flannel](https://github.com/coreos/flannel) networking * On-cluster etcd with TLS, [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)-enabled, [network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) * Ready for Ingress, Prometheus, Grafana, and other optional [addons](https://typhoon.psdn.io/addons/overview/) diff --git a/digital-ocean/container-linux/kubernetes/bootkube.tf b/digital-ocean/container-linux/kubernetes/bootkube.tf index 7ea0914b..e10c12e3 100644 --- a/digital-ocean/container-linux/kubernetes/bootkube.tf +++ b/digital-ocean/container-linux/kubernetes/bootkube.tf @@ -1,6 +1,6 @@ # Self-hosted Kubernetes assets (kubeconfig, manifests) module "bootkube" { - source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=1d4db824f09246266a6b9e54df5d4df5dcd4477a" + source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=eb2dfa64de3f6c31bf5d2a8ca8912223ac1aef05" cluster_name = "${var.cluster_name}" api_servers = ["${format("%s.%s", var.cluster_name, var.dns_zone)}"] diff --git a/digital-ocean/container-linux/kubernetes/cl/controller.yaml.tmpl b/digital-ocean/container-linux/kubernetes/cl/controller.yaml.tmpl index 10c82509..95ef2d12 100644 --- a/digital-ocean/container-linux/kubernetes/cl/controller.yaml.tmpl +++ b/digital-ocean/container-linux/kubernetes/cl/controller.yaml.tmpl @@ -85,7 +85,6 @@ systemd: ExecStartPre=/usr/bin/bash -c "grep 'certificate-authority-data' /etc/kubernetes/kubeconfig | awk '{print $2}' | base64 -d > /etc/kubernetes/ca.crt" ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/cache/kubelet-pod.uuid ExecStart=/usr/lib/coreos/kubelet-wrapper \ - --allow-privileged \ --anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ @@ -129,7 +128,7 @@ storage: contents: inline: | KUBELET_IMAGE_URL=docker://k8s.gcr.io/hyperkube - KUBELET_IMAGE_TAG=v1.10.5 + KUBELET_IMAGE_TAG=v1.11.0 - path: /etc/sysctl.d/max-user-watches.conf filesystem: root contents: diff --git a/digital-ocean/container-linux/kubernetes/cl/worker.yaml.tmpl b/digital-ocean/container-linux/kubernetes/cl/worker.yaml.tmpl index 2db4699a..1e0cdd24 100644 --- a/digital-ocean/container-linux/kubernetes/cl/worker.yaml.tmpl +++ b/digital-ocean/container-linux/kubernetes/cl/worker.yaml.tmpl @@ -58,7 +58,6 @@ systemd: ExecStartPre=/usr/bin/bash -c "grep 'certificate-authority-data' /etc/kubernetes/kubeconfig | awk '{print $2}' | base64 -d > /etc/kubernetes/ca.crt" ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/cache/kubelet-pod.uuid ExecStart=/usr/lib/coreos/kubelet-wrapper \ - --allow-privileged \ --anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ @@ -99,7 +98,7 @@ storage: contents: inline: | KUBELET_IMAGE_URL=docker://k8s.gcr.io/hyperkube - KUBELET_IMAGE_TAG=v1.10.5 + KUBELET_IMAGE_TAG=v1.11.0 - path: /etc/sysctl.d/max-user-watches.conf filesystem: root contents: @@ -117,7 +116,7 @@ storage: --volume config,kind=host,source=/etc/kubernetes \ --mount volume=config,target=/etc/kubernetes \ --insecure-options=image \ - docker://k8s.gcr.io/hyperkube:v1.10.5 \ + docker://k8s.gcr.io/hyperkube:v1.11.0 \ --net=host \ --dns=host \ --exec=/kubectl -- --kubeconfig=/etc/kubernetes/kubeconfig delete node $(hostname) diff --git a/digital-ocean/fedora-atomic/kubernetes/README.md b/digital-ocean/fedora-atomic/kubernetes/README.md index 1da1eb23..06ca2643 100644 --- a/digital-ocean/fedora-atomic/kubernetes/README.md +++ b/digital-ocean/fedora-atomic/kubernetes/README.md @@ -11,7 +11,7 @@ Typhoon distributes upstream Kubernetes, architectural conventions, and cluster ## Features -* Kubernetes v1.10.5 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) +* Kubernetes v1.11.0 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) * Single or multi-master, workloads isolated on workers, [Calico](https://www.projectcalico.org/) or [flannel](https://github.com/coreos/flannel) networking * On-cluster etcd with TLS, [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)-enabled, [network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) * Ready for Ingress, Prometheus, Grafana, and other optional [addons](https://typhoon.psdn.io/addons/overview/) diff --git a/digital-ocean/fedora-atomic/kubernetes/bootkube.tf b/digital-ocean/fedora-atomic/kubernetes/bootkube.tf index f583c937..c20ed431 100644 --- a/digital-ocean/fedora-atomic/kubernetes/bootkube.tf +++ b/digital-ocean/fedora-atomic/kubernetes/bootkube.tf @@ -1,6 +1,6 @@ # Self-hosted Kubernetes assets (kubeconfig, manifests) module "bootkube" { - source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=1d4db824f09246266a6b9e54df5d4df5dcd4477a" + source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=eb2dfa64de3f6c31bf5d2a8ca8912223ac1aef05" cluster_name = "${var.cluster_name}" api_servers = ["${format("%s.%s", var.cluster_name, var.dns_zone)}"] diff --git a/digital-ocean/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl b/digital-ocean/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl index 45a4c689..e28d51b9 100644 --- a/digital-ocean/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl +++ b/digital-ocean/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl @@ -51,8 +51,7 @@ write_files: RestartSec=10 - path: /etc/kubernetes/kubelet.conf content: | - ARGS="--allow-privileged \ - --anonymous-auth=false \ + ARGS="--anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ --client-ca-file=/etc/kubernetes/ca.crt \ diff --git a/digital-ocean/fedora-atomic/kubernetes/cloudinit/worker.yaml.tmpl b/digital-ocean/fedora-atomic/kubernetes/cloudinit/worker.yaml.tmpl index 2e1552b4..7fa2af6e 100644 --- a/digital-ocean/fedora-atomic/kubernetes/cloudinit/worker.yaml.tmpl +++ b/digital-ocean/fedora-atomic/kubernetes/cloudinit/worker.yaml.tmpl @@ -30,8 +30,7 @@ write_files: RestartSec=10 - path: /etc/kubernetes/kubelet.conf content: | - ARGS="--allow-privileged \ - --anonymous-auth=false \ + ARGS="--anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ --client-ca-file=/etc/kubernetes/ca.crt \ diff --git a/docs/advanced/worker-pools.md b/docs/advanced/worker-pools.md index 0bc02750..34b66028 100644 --- a/docs/advanced/worker-pools.md +++ b/docs/advanced/worker-pools.md @@ -15,7 +15,7 @@ Create a cluster following the AWS [tutorial](../cl/aws.md#cluster). Define a wo ```tf module "tempest-worker-pool" { - source = "git::https://github.com/poseidon/typhoon//aws/container-linux/kubernetes/workers?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//aws/container-linux/kubernetes/workers?ref=v1.11.0" providers = { aws = "aws.default" @@ -80,7 +80,7 @@ Create a cluster following the Google Cloud [tutorial](../cl/google-cloud.md#clu ```tf module "yavin-worker-pool" { - source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes/workers?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes/workers?ref=v1.11.0" providers = { google = "google.default" @@ -114,11 +114,11 @@ Verify a managed instance group of workers joins the cluster within a few minute ``` $ kubectl get nodes NAME STATUS AGE VERSION -yavin-controller-0.c.example-com.internal Ready 6m v1.10.5 -yavin-worker-jrbf.c.example-com.internal Ready 5m v1.10.5 -yavin-worker-mzdm.c.example-com.internal Ready 5m v1.10.5 -yavin-16x-worker-jrbf.c.example-com.internal Ready 3m v1.10.5 -yavin-16x-worker-mzdm.c.example-com.internal Ready 3m v1.10.5 +yavin-controller-0.c.example-com.internal Ready 6m v1.11.0 +yavin-worker-jrbf.c.example-com.internal Ready 5m v1.11.0 +yavin-worker-mzdm.c.example-com.internal Ready 5m v1.11.0 +yavin-16x-worker-jrbf.c.example-com.internal Ready 3m v1.11.0 +yavin-16x-worker-mzdm.c.example-com.internal Ready 3m v1.11.0 ``` ### Variables diff --git a/docs/atomic/aws.md b/docs/atomic/aws.md index 2ff2300d..7cb82ebc 100644 --- a/docs/atomic/aws.md +++ b/docs/atomic/aws.md @@ -3,7 +3,7 @@ !!! danger Typhoon for Fedora Atomic is alpha. Expect rough edges and changes. -In this tutorial, we'll create a Kubernetes v1.10.5 cluster on AWS with Fedora Atomic. +In this tutorial, we'll create a Kubernetes v1.11.0 cluster on AWS with Fedora Atomic. We'll declare a Kubernetes cluster using the Typhoon Terraform module. Then apply the changes to create a VPC, gateway, subnets, security groups, controller instances, worker auto-scaling group, network load balancer, and TLS assets. Instances are provisioned on first boot with cloud-init. @@ -83,7 +83,7 @@ Define a Kubernetes cluster using the module `aws/fedora-atomic/kubernetes`. ```tf module "aws-tempest" { - source = "git::https://github.com/poseidon/typhoon//aws/fedora-atomic/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//aws/fedora-atomic/kubernetes?ref=v1.11.0" providers = { aws = "aws.default" @@ -156,9 +156,9 @@ In 5-10 minutes, the Kubernetes cluster will be ready. $ export KUBECONFIG=/home/user/.secrets/clusters/tempest/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -ip-10-0-12-221 Ready 34m v1.10.5 -ip-10-0-19-112 Ready 34m v1.10.5 -ip-10-0-4-22 Ready 34m v1.10.5 +ip-10-0-12-221 Ready 34m v1.11.0 +ip-10-0-19-112 Ready 34m v1.11.0 +ip-10-0-4-22 Ready 34m v1.11.0 ``` List the pods. diff --git a/docs/atomic/bare-metal.md b/docs/atomic/bare-metal.md index cd4abe7c..9675d589 100644 --- a/docs/atomic/bare-metal.md +++ b/docs/atomic/bare-metal.md @@ -3,7 +3,7 @@ !!! danger Typhoon for Fedora Atomic is alpha. Expect rough edges and changes. -In this tutorial, we'll network boot and provision a Kubernetes v1.10.5 cluster on bare-metal with Fedora Atomic. +In this tutorial, we'll network boot and provision a Kubernetes v1.11.0 cluster on bare-metal with Fedora Atomic. First, we'll deploy a [Matchbox](https://github.com/coreos/matchbox) service and setup a network boot environment. Then, we'll declare a Kubernetes cluster using the Typhoon Terraform module and power on machines. On PXE boot, machines will install Fedora Atomic via kickstart, reboot into the disk install, and provision themselves as Kubernetes controllers or workers via cloud-init. @@ -234,7 +234,7 @@ Define a Kubernetes cluster using the module `bare-metal/fedora-atomic/kubernete ```tf module "bare-metal-mercury" { - source = "git::https://github.com/poseidon/typhoon//bare-metal/fedora-atomic/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//bare-metal/fedora-atomic/kubernetes?ref=v1.11.0" providers = { local = "local.default" @@ -360,9 +360,9 @@ bootkube[5]: Tearing down temporary bootstrap control plane... $ export KUBECONFIG=/home/user/.secrets/clusters/mercury/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -node1.example.com Ready 11m v1.10.5 -node2.example.com Ready 11m v1.10.5 -node3.example.com Ready 11m v1.10.5 +node1.example.com Ready 11m v1.11.0 +node2.example.com Ready 11m v1.11.0 +node3.example.com Ready 11m v1.11.0 ``` List the pods. diff --git a/docs/atomic/digital-ocean.md b/docs/atomic/digital-ocean.md index a469db43..8cd845d5 100644 --- a/docs/atomic/digital-ocean.md +++ b/docs/atomic/digital-ocean.md @@ -3,7 +3,7 @@ !!! danger Typhoon for Fedora Atomic is alpha. Expect rough edges and changes. -In this tutorial, we'll create a Kubernetes v1.10.5 cluster on DigitalOcean with Fedora Atomic. +In this tutorial, we'll create a Kubernetes v1.11.0 cluster on DigitalOcean with Fedora Atomic. We'll declare a Kubernetes cluster using the Typhoon Terraform module. Then apply the changes to create controller droplets, worker droplets, DNS records, tags, and TLS assets. Instances are provisioned on first boot with cloud-init. @@ -77,7 +77,7 @@ Define a Kubernetes cluster using the module `digital-ocean/fedora-atomic/kubern ```tf module "digital-ocean-nemo" { - source = "git::https://github.com/poseidon/typhoon//digital-ocean/fedora-atomic/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//digital-ocean/fedora-atomic/kubernetes?ref=v1.11.0" providers = { digitalocean = "digitalocean.default" @@ -152,9 +152,9 @@ In 3-6 minutes, the Kubernetes cluster will be ready. $ export KUBECONFIG=/home/user/.secrets/clusters/nemo/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -10.132.110.130 Ready 10m v1.10.5 -10.132.115.81 Ready 10m v1.10.5 -10.132.124.107 Ready 10m v1.10.5 +10.132.110.130 Ready 10m v1.11.0 +10.132.115.81 Ready 10m v1.11.0 +10.132.124.107 Ready 10m v1.11.0 ``` List the pods. diff --git a/docs/atomic/google-cloud.md b/docs/atomic/google-cloud.md index 2442e0d2..c4735b9b 100644 --- a/docs/atomic/google-cloud.md +++ b/docs/atomic/google-cloud.md @@ -3,7 +3,7 @@ !!! danger Typhoon for Fedora Atomic is very alpha. Fedora does not publish official images for Google Cloud so you must prepare them yourself. Some addons don't work yet. Expect rough edges and changes. -In this tutorial, we'll create a Kubernetes v1.10.5 cluster on Google Compute Engine with Fedora Atomic. +In this tutorial, we'll create a Kubernetes v1.11.0 cluster on Google Compute Engine with Fedora Atomic. We'll declare a Kubernetes cluster using the Typhoon Terraform module. Then apply the changes to create a network, firewall rules, health checks, controller instances, worker managed instance group, load balancers, and TLS assets. Instances are provisioned on first boot with cloud-init. @@ -119,7 +119,7 @@ Define a Kubernetes cluster using the module `google-cloud/fedora-atomic/kuberne ```tf module "google-cloud-yavin" { - source = "git::https://github.com/poseidon/typhoon//google-cloud/fedora-atomic/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//google-cloud/fedora-atomic/kubernetes?ref=v1.11.0" providers = { google = "google.default" @@ -195,9 +195,9 @@ In 5-10 minutes, the Kubernetes cluster will be ready. $ export KUBECONFIG=/home/user/.secrets/clusters/yavin/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -yavin-controller-0.c.example-com.internal Ready 6m v1.10.5 -yavin-worker-jrbf.c.example-com.internal Ready 5m v1.10.5 -yavin-worker-mzdm.c.example-com.internal Ready 5m v1.10.5 +yavin-controller-0.c.example-com.internal Ready 6m v1.11.0 +yavin-worker-jrbf.c.example-com.internal Ready 5m v1.11.0 +yavin-worker-mzdm.c.example-com.internal Ready 5m v1.11.0 ``` List the pods. diff --git a/docs/cl/aws.md b/docs/cl/aws.md index ac541286..d947d5cd 100644 --- a/docs/cl/aws.md +++ b/docs/cl/aws.md @@ -1,6 +1,6 @@ # AWS -In this tutorial, we'll create a Kubernetes v1.10.5 cluster on AWS with Container Linux. +In this tutorial, we'll create a Kubernetes v1.11.0 cluster on AWS with Container Linux. We'll declare a Kubernetes cluster using the Typhoon Terraform module. Then apply the changes to create a VPC, gateway, subnets, security groups, controller instances, worker auto-scaling group, network load balancer, and TLS assets. @@ -96,7 +96,7 @@ Define a Kubernetes cluster using the module `aws/container-linux/kubernetes`. ```tf module "aws-tempest" { - source = "git::https://github.com/poseidon/typhoon//aws/container-linux/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//aws/container-linux/kubernetes?ref=v1.11.0" providers = { aws = "aws.default" @@ -169,9 +169,9 @@ In 4-8 minutes, the Kubernetes cluster will be ready. $ export KUBECONFIG=/home/user/.secrets/clusters/tempest/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -ip-10-0-12-221 Ready 34m v1.10.5 -ip-10-0-19-112 Ready 34m v1.10.5 -ip-10-0-4-22 Ready 34m v1.10.5 +ip-10-0-12-221 Ready 34m v1.11.0 +ip-10-0-19-112 Ready 34m v1.11.0 +ip-10-0-4-22 Ready 34m v1.11.0 ``` List the pods. diff --git a/docs/cl/bare-metal.md b/docs/cl/bare-metal.md index 1bec2638..4ff46fe3 100644 --- a/docs/cl/bare-metal.md +++ b/docs/cl/bare-metal.md @@ -1,6 +1,6 @@ # Bare-Metal -In this tutorial, we'll network boot and provision a Kubernetes v1.10.5 cluster on bare-metal with Container Linux. +In this tutorial, we'll network boot and provision a Kubernetes v1.11.0 cluster on bare-metal with Container Linux. First, we'll deploy a [Matchbox](https://github.com/coreos/matchbox) service and setup a network boot environment. Then, we'll declare a Kubernetes cluster using the Typhoon Terraform module and power on machines. On PXE boot, machines will install Container Linux to disk, reboot into the disk install, and provision themselves as Kubernetes controllers or workers via Ignition. @@ -174,7 +174,7 @@ Define a Kubernetes cluster using the module `bare-metal/container-linux/kuberne ```tf module "bare-metal-mercury" { - source = "git::https://github.com/poseidon/typhoon//bare-metal/container-linux/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//bare-metal/container-linux/kubernetes?ref=v1.11.0" providers = { local = "local.default" @@ -283,9 +283,9 @@ Apply complete! Resources: 55 added, 0 changed, 0 destroyed. To watch the install to disk (until machines reboot from disk), SSH to port 2222. ``` -# before v1.10.5 +# before v1.11.0 $ ssh debug@node1.example.com -# after v1.10.5 +# after v1.11.0 $ ssh -p 2222 core@node1.example.com ``` @@ -310,9 +310,9 @@ bootkube[5]: Tearing down temporary bootstrap control plane... $ export KUBECONFIG=/home/user/.secrets/clusters/mercury/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -node1.example.com Ready 11m v1.10.5 -node2.example.com Ready 11m v1.10.5 -node3.example.com Ready 11m v1.10.5 +node1.example.com Ready 11m v1.11.0 +node2.example.com Ready 11m v1.11.0 +node3.example.com Ready 11m v1.11.0 ``` List the pods. diff --git a/docs/cl/digital-ocean.md b/docs/cl/digital-ocean.md index 7f8c9ee3..c0be37ce 100644 --- a/docs/cl/digital-ocean.md +++ b/docs/cl/digital-ocean.md @@ -1,6 +1,6 @@ # Digital Ocean -In this tutorial, we'll create a Kubernetes v1.10.5 cluster on DigitalOcean with Container Linux. +In this tutorial, we'll create a Kubernetes v1.11.0 cluster on DigitalOcean with Container Linux. We'll declare a Kubernetes cluster using the Typhoon Terraform module. Then apply the changes to create controller droplets, worker droplets, DNS records, tags, and TLS assets. @@ -90,7 +90,7 @@ Define a Kubernetes cluster using the module `digital-ocean/container-linux/kube ```tf module "digital-ocean-nemo" { - source = "git::https://github.com/poseidon/typhoon//digital-ocean/container-linux/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//digital-ocean/container-linux/kubernetes?ref=v1.11.0" providers = { digitalocean = "digitalocean.default" @@ -164,9 +164,9 @@ In 3-6 minutes, the Kubernetes cluster will be ready. $ export KUBECONFIG=/home/user/.secrets/clusters/nemo/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -10.132.110.130 Ready 10m v1.10.5 -10.132.115.81 Ready 10m v1.10.5 -10.132.124.107 Ready 10m v1.10.5 +10.132.110.130 Ready 10m v1.11.0 +10.132.115.81 Ready 10m v1.11.0 +10.132.124.107 Ready 10m v1.11.0 ``` List the pods. diff --git a/docs/cl/google-cloud.md b/docs/cl/google-cloud.md index 65844196..82240a64 100644 --- a/docs/cl/google-cloud.md +++ b/docs/cl/google-cloud.md @@ -1,6 +1,6 @@ # Google Cloud -In this tutorial, we'll create a Kubernetes v1.10.5 cluster on Google Compute Engine with Container Linux. +In this tutorial, we'll create a Kubernetes v1.11.0 cluster on Google Compute Engine with Container Linux. We'll declare a Kubernetes cluster using the Typhoon Terraform module. Then apply the changes to create a network, firewall rules, health checks, controller instances, worker managed instance group, load balancers, and TLS assets. @@ -97,7 +97,7 @@ Define a Kubernetes cluster using the module `google-cloud/container-linux/kuber ```tf module "google-cloud-yavin" { - source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.11.0" providers = { google = "google.default" @@ -172,9 +172,9 @@ In 4-8 minutes, the Kubernetes cluster will be ready. $ export KUBECONFIG=/home/user/.secrets/clusters/yavin/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -yavin-controller-0.c.example-com.internal Ready 6m v1.10.5 -yavin-worker-jrbf.c.example-com.internal Ready 5m v1.10.5 -yavin-worker-mzdm.c.example-com.internal Ready 5m v1.10.5 +yavin-controller-0.c.example-com.internal Ready 6m v1.11.0 +yavin-worker-jrbf.c.example-com.internal Ready 5m v1.11.0 +yavin-worker-mzdm.c.example-com.internal Ready 5m v1.11.0 ``` List the pods. diff --git a/docs/index.md b/docs/index.md index 9b00c846..5b4ab589 100644 --- a/docs/index.md +++ b/docs/index.md @@ -11,7 +11,7 @@ Typhoon distributes upstream Kubernetes, architectural conventions, and cluster ## Features -* Kubernetes v1.10.5 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) +* Kubernetes v1.11.0 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) * Single or multi-master, workloads isolated on workers, [Calico](https://www.projectcalico.org/) or [flannel](https://github.com/coreos/flannel) networking * On-cluster etcd with TLS, [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)-enabled, [network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) * Advanced features like [worker pools](https://typhoon.psdn.io/advanced/worker-pools/) and [preemption](https://typhoon.psdn.io/google-cloud/#preemption) (varies by platform) @@ -45,7 +45,7 @@ Define a Kubernetes cluster by using the Terraform module for your chosen platfo ```tf module "google-cloud-yavin" { - source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.11.0" providers = { google = "google.default" @@ -86,9 +86,9 @@ In 4-8 minutes (varies by platform), the cluster will be ready. This Google Clou $ export KUBECONFIG=/home/user/.secrets/clusters/yavin/auth/kubeconfig $ kubectl get nodes NAME STATUS AGE VERSION -yavin-controller-0.c.example-com.internal Ready 6m v1.10.5 -yavin-worker-jrbf.c.example-com.internal Ready 5m v1.10.5 -yavin-worker-mzdm.c.example-com.internal Ready 5m v1.10.5 +yavin-controller-0.c.example-com.internal Ready 6m v1.11.0 +yavin-worker-jrbf.c.example-com.internal Ready 5m v1.11.0 +yavin-worker-mzdm.c.example-com.internal Ready 5m v1.11.0 ``` List the pods. diff --git a/docs/topics/maintenance.md b/docs/topics/maintenance.md index a2397338..08c6a3da 100644 --- a/docs/topics/maintenance.md +++ b/docs/topics/maintenance.md @@ -18,7 +18,7 @@ module "google-cloud-yavin" { } module "bare-metal-mercury" { - source = "git::https://github.com/poseidon/typhoon//bare-metal/container-linux/kubernetes?ref=v1.10.5" + source = "git::https://github.com/poseidon/typhoon//bare-metal/container-linux/kubernetes?ref=v1.11.0" ... } ``` diff --git a/google-cloud/container-linux/kubernetes/README.md b/google-cloud/container-linux/kubernetes/README.md index afc2e320..b2589d08 100644 --- a/google-cloud/container-linux/kubernetes/README.md +++ b/google-cloud/container-linux/kubernetes/README.md @@ -11,7 +11,7 @@ Typhoon distributes upstream Kubernetes, architectural conventions, and cluster ## Features -* Kubernetes v1.10.5 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) +* Kubernetes v1.11.0 (upstream, via [kubernetes-incubator/bootkube](https://github.com/kubernetes-incubator/bootkube)) * Single or multi-master, workloads isolated on workers, [Calico](https://www.projectcalico.org/) or [flannel](https://github.com/coreos/flannel) networking * On-cluster etcd with TLS, [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)-enabled, [network policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) * Ready for Ingress, Prometheus, Grafana, and other optional [addons](https://typhoon.psdn.io/addons/overview/) diff --git a/google-cloud/container-linux/kubernetes/bootkube.tf b/google-cloud/container-linux/kubernetes/bootkube.tf index 9aa2b0d1..675af9e4 100644 --- a/google-cloud/container-linux/kubernetes/bootkube.tf +++ b/google-cloud/container-linux/kubernetes/bootkube.tf @@ -1,6 +1,6 @@ # Self-hosted Kubernetes assets (kubeconfig, manifests) module "bootkube" { - source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=1d4db824f09246266a6b9e54df5d4df5dcd4477a" + source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=eb2dfa64de3f6c31bf5d2a8ca8912223ac1aef05" cluster_name = "${var.cluster_name}" api_servers = ["${format("%s.%s", var.cluster_name, var.dns_zone)}"] diff --git a/google-cloud/container-linux/kubernetes/cl/controller.yaml.tmpl b/google-cloud/container-linux/kubernetes/cl/controller.yaml.tmpl index 06392089..d57795ff 100644 --- a/google-cloud/container-linux/kubernetes/cl/controller.yaml.tmpl +++ b/google-cloud/container-linux/kubernetes/cl/controller.yaml.tmpl @@ -75,7 +75,6 @@ systemd: ExecStartPre=/usr/bin/bash -c "grep 'certificate-authority-data' /etc/kubernetes/kubeconfig | awk '{print $2}' | base64 -d > /etc/kubernetes/ca.crt" ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/cache/kubelet-pod.uuid ExecStart=/usr/lib/coreos/kubelet-wrapper \ - --allow-privileged \ --anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ @@ -124,7 +123,7 @@ storage: contents: inline: | KUBELET_IMAGE_URL=docker://k8s.gcr.io/hyperkube - KUBELET_IMAGE_TAG=v1.10.5 + KUBELET_IMAGE_TAG=v1.11.0 - path: /etc/sysctl.d/max-user-watches.conf filesystem: root contents: diff --git a/google-cloud/container-linux/kubernetes/workers/cl/worker.yaml.tmpl b/google-cloud/container-linux/kubernetes/workers/cl/worker.yaml.tmpl index 90956966..10e58aea 100644 --- a/google-cloud/container-linux/kubernetes/workers/cl/worker.yaml.tmpl +++ b/google-cloud/container-linux/kubernetes/workers/cl/worker.yaml.tmpl @@ -48,7 +48,6 @@ systemd: ExecStartPre=/usr/bin/bash -c "grep 'certificate-authority-data' /etc/kubernetes/kubeconfig | awk '{print $2}' | base64 -d > /etc/kubernetes/ca.crt" ExecStartPre=-/usr/bin/rkt rm --uuid-file=/var/cache/kubelet-pod.uuid ExecStart=/usr/lib/coreos/kubelet-wrapper \ - --allow-privileged \ --anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ @@ -94,7 +93,7 @@ storage: contents: inline: | KUBELET_IMAGE_URL=docker://k8s.gcr.io/hyperkube - KUBELET_IMAGE_TAG=v1.10.5 + KUBELET_IMAGE_TAG=v1.11.0 - path: /etc/sysctl.d/max-user-watches.conf filesystem: root contents: @@ -112,7 +111,7 @@ storage: --volume config,kind=host,source=/etc/kubernetes \ --mount volume=config,target=/etc/kubernetes \ --insecure-options=image \ - docker://k8s.gcr.io/hyperkube:v1.10.5 \ + docker://k8s.gcr.io/hyperkube:v1.11.0 \ --net=host \ --dns=host \ --exec=/kubectl -- --kubeconfig=/etc/kubernetes/kubeconfig delete node $(hostname) diff --git a/google-cloud/fedora-atomic/kubernetes/bootkube.tf b/google-cloud/fedora-atomic/kubernetes/bootkube.tf index a36e0d57..48e16f0e 100644 --- a/google-cloud/fedora-atomic/kubernetes/bootkube.tf +++ b/google-cloud/fedora-atomic/kubernetes/bootkube.tf @@ -1,6 +1,6 @@ # Self-hosted Kubernetes assets (kubeconfig, manifests) module "bootkube" { - source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=1d4db824f09246266a6b9e54df5d4df5dcd4477a" + source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=eb2dfa64de3f6c31bf5d2a8ca8912223ac1aef05" cluster_name = "${var.cluster_name}" api_servers = ["${format("%s.%s", var.cluster_name, var.dns_zone)}"] diff --git a/google-cloud/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl b/google-cloud/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl index 4825bd16..814b4df6 100644 --- a/google-cloud/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl +++ b/google-cloud/fedora-atomic/kubernetes/cloudinit/controller.yaml.tmpl @@ -52,8 +52,7 @@ write_files: RestartSec=10 - path: /etc/kubernetes/kubelet.conf content: | - ARGS="--allow-privileged \ - --anonymous-auth=false \ + ARGS="--anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ --client-ca-file=/etc/kubernetes/ca.crt \ diff --git a/google-cloud/fedora-atomic/kubernetes/workers/cloudinit/worker.yaml.tmpl b/google-cloud/fedora-atomic/kubernetes/workers/cloudinit/worker.yaml.tmpl index cdd3f521..750c848a 100644 --- a/google-cloud/fedora-atomic/kubernetes/workers/cloudinit/worker.yaml.tmpl +++ b/google-cloud/fedora-atomic/kubernetes/workers/cloudinit/worker.yaml.tmpl @@ -31,8 +31,7 @@ write_files: RestartSec=10 - path: /etc/kubernetes/kubelet.conf content: | - ARGS="--allow-privileged \ - --anonymous-auth=false \ + ARGS="--anonymous-auth=false \ --authentication-token-webhook \ --authorization-mode=Webhook \ --client-ca-file=/etc/kubernetes/ca.crt \