CadolesKube/typhoon
7
0
Fork 0
mirror of https://github.com/puppetmaster/typhoon.git synced 2024-12-27 13:29:33 +01:00
Code Issues Packages Projects Releases Wiki Activity
666 Commits 4 Branches 126 Tags 9.4 MiB
189487ecaa
Commit Graph

72 Commits

Author SHA1 Message Date
Dalton Hubble
5eb4078d68 Add docker/default seccomp to control plane and addons 
* Annotate pods, deployments, and daemonsets to start containers
with the Docker runtime's default seccomp profile
* Overrides Kubernetes default behavior which started containers
with seccomp=unconfined
* https://docs.docker.com/engine/security/seccomp/#pass-a-profile-for-a-container
 2018-10-16 20:07:29 -07:00
Dalton Hubble
55bb4dfba6 Raise CoreDNS replica count to 2 or more 
* Run at least two replicas of CoreDNS to better support
rolling updates (previously, kube-dns had a pod nanny)
* On multi-master clusters, set the CoreDNS replica count
to match the number of masters (e.g. a 3-master cluster
previously used replicas:1, now replicas:3)
* Add AntiAffinity preferred rule to favor distributing
CoreDNS pods across controller nodes nodes
 2018-10-13 20:31:29 -07:00
Dalton Hubble
43fe78a2cc Raise scheduler/controller-manager replicas in multi-master 
* Continue to ensure scheduler and controller-manager run
at least two replicas to support performing kubectl edits
on single-master clusters (no change)
* For multi-master clusters, set scheduler / controller-manager
replica count to the number of masters (e.g. a 3-master cluster
previously used replicas:2, now replicas:3)
 2018-10-13 16:16:29 -07:00
Dalton Hubble
7653e511be Update CoreDNS and Calico versions 
* Update CoreDNS from 1.1.3 to 1.2.2
* Update Calico from v3.2.1 to v3.2.3
 2018-10-02 16:07:48 +02:00
Dalton Hubble
ad871dbfa9 Update Kubernetes from v1.11.2 to v1.11.3 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1113
 2018-09-13 18:50:41 -07:00
Dalton Hubble
7eb09237f4 Update Calico from v3.1.3 to v3.2.1 
* Add new bird and felix readiness checks
* Read MTU from ConfigMap veth_mtu
* Add RBAC read for serviceaccounts
* Remove invalid description from CRDs
 2018-08-25 17:53:11 -07:00
Dalton Hubble
b8eeafe4f9 Template etcd_servers list to replace null_resource.repeat 
* Remove the last usage of null_resource.repeat, which has
always been an eyesore for creating the etcd server list
* Originally, #224 switched to templating the etcd_servers
list for all clouds, but had to revert on GCP in #237
* https://github.com/poseidon/typhoon/pull/224
* https://github.com/poseidon/typhoon/pull/237
 2018-08-21 22:46:24 -07:00
Dalton Hubble
f7ebdf475d Update Kubernetes from v1.11.1 to v1.11.2 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1112
 2018-08-07 21:57:25 -07:00
Dalton Hubble
d8d524d10b Update Kubernetes from v1.11.0 to v1.11.1 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.11.md#v1111
 2018-07-20 00:41:27 -07:00
Dalton Hubble
6f958d7577 Replace kube-dns with CoreDNS 
* Add system:coredns ClusterRole and binding
* Annotate CoreDNS for Prometheus metrics scraping
* Remove kube-dns deployment, service, & service account
* https://github.com/poseidon/terraform-render-bootkube/pull/71
* https://kubernetes.io/blog/2018/06/27/kubernetes-1.11-release-announcement/
 2018-07-01 22:55:01 -07:00
Dalton Hubble
8464b258d8 Update Kubernetes from v1.10.5 to v1.11.0 
* Force apiserver to stop listening on 127.0.0.1:8080
* Remove deprecated Kubelet `--allow-privileged`. Defaults to
true. Use `PodSecurityPolicy` if limiting is desired
* https://github.com/kubernetes/kubernetes/releases/tag/v1.11.0
* https://github.com/poseidon/terraform-render-bootkube/pull/68
 2018-06-27 22:47:35 -07:00
Dalton Hubble
0227014fa0 Fix terraform formatting 2018-06-22 00:28:36 -07:00
Dalton Hubble
f4d3059b00 Update Kubernetes from v1.10.4 to v1.10.5 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1105
 2018-06-21 22:51:39 -07:00
Dalton Hubble
6c5a1964aa Change kube-apiserver port from 443 to 6443 
* Adjust firewall rules, security groups, cloud load balancers,
and generated kubeconfig's
* Facilitates some future simplifications and cost reductions
* Bare-Metal users who exposed kube-apiserver on a WAN via their
router or load balancer will need to adjust its configuration.
This is uncommon, most apiserver are on LAN and/or behind VPN
so no routing infrastructure is configured with the port number
 2018-06-19 23:48:51 -07:00
Dalton Hubble
79260c48f6 Update Kubernetes from v1.10.3 to v1.10.4 2018-06-06 23:23:11 -07:00
Dalton Hubble
6e968cd152 Update Calico from v3.1.2 to v3.1.3 
* https://github.com/projectcalico/calico/releases/tag/v3.1.3
* https://github.com/projectcalico/cni-plugin/releases/tag/v3.1.3
 2018-05-30 21:32:12 -07:00
Dalton Hubble
4ea1fde9c5 Update Kubernetes from v1.10.2 to v1.10.3 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#v1103
* Update Calico from v3.1.1 to v3.1.2
 2018-05-21 21:38:43 -07:00
Dalton Hubble
37981f9fb1 Allow bearer token authn/authz to the Kubelet 
* Require Webhook authorization to the Kubelet
* Switch apiserver X509 client cert org to systems:masters
to grant the apiserver admin and satisfy the authorization
requirement. kubectl commands like logs or exec that have
the apiserver make requests of a kubelet continue to work
as before
* https://kubernetes.io/docs/admin/kubelet-authentication-authorization/
* https://github.com/poseidon/typhoon/issues/215
 2018-05-13 23:20:42 -07:00
Dalton Hubble
e889430926 Update kube-dns from v1.14.9 to v1.14.10 
* https://github.com/kubernetes/kubernetes/pull/62676
 2018-04-28 00:43:09 -07:00
Dalton Hubble
32ddfa94e1 Update Kubernetes from v1.10.1 to v1.10.2 
* https://github.com/kubernetes/kubernetes/releases/tag/v1.10.2
 2018-04-28 00:27:00 -07:00
Dalton Hubble
7198b9016c Update Calico from v3.0.4 to v3.1.1 for Atomic 2018-04-21 18:46:56 -07:00
Dalton Hubble
2b74aba564 Add Google Cloud fedora-atomic module 
* Network load balancer for ingress doesn't work yet
because Compute Engine packages are missing
* port-forward / socat is broken
 2018-04-21 18:46:56 -07:00