CadolesKube
/
typhoon
mirror of https://github.com/puppetmaster/typhoon.git
7
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
1,429 Commits 3 Branches 113 Tags 8.7 MiB
Commit Graph

120 Commits

Author SHA1 Message Date
Dalton Hubble 5744e10329 Update Cilium from v1.0.4 to v1.0.5 
* https://github.com/cilium/cilium/releases/tag/v1.10.5
 2021-10-17 11:26:59 -07:00
Dalton Hubble f8162b9be3 Update Calico from v3.20.1 to v3.20.2 
* Use Calico's iptables legacy vs nft auto-detection
 2021-10-11 20:28:48 -07:00
Dalton Hubble b30de949b8 Update Calico and Cilium CNI 
* Update Calico from v3.20.0 to v3.20.1
* Update Cilium from v1.10.3 to v1.10.4
 2021-09-22 22:18:16 -07:00
Dalton Hubble bb7f31822e Update Kubernetes from v1.22.1 to v1.22.2 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.22.md#v1222
 2021-09-15 19:56:24 -07:00
Dalton Hubble fcbdb50d93 Update Kubernetes from v1.22.0 to v1.22.1 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.22.md#v1221
 2021-08-19 21:12:02 -07:00
Dalton Hubble cbef202eec Update Prometheus discovery of kube components 
* Kubernetes v1.22.0 disabled kube-controller-manager insecure
port, which was used internally for Prometheus metrics scraping
* Configure Prometheus to discover and scrape endpoints for
kube-scheduler and kube-controller-manager via the authenticated
https ports, via bearer token
* Change firewall ports to allow Prometheus (on worker nodes)
to scrape kube-scheduler and kube-controller-manager targets
that run on controller(s) with hostNetwork
* Disable the insecure port on kube-scheduler
 2021-08-10 21:25:19 -07:00
Dalton Hubble 1a5949824c Update etcd from v3.4.16 to v3.5.0 
* Use multi-arch container image instead of a special
"-arm64" suffix on arm64
* https://github.com/etcd-io/etcd/releases/tag/v3.5.0
 2021-08-04 22:10:07 -07:00
Dalton Hubble 9bac641511 Update Kubernetes from v1.21.3 to v1.22.0 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.22.md#v1220
 2021-08-04 22:09:19 -07:00
Dalton Hubble f03045f0dc Update Cilium for cgroups v2 support 
* On Fedora CoreOS, Cilium cross-node service IP load balancing
stopped working for a time (first observable as CoreDNS pods
located on worker nodes not being able to reach the kubernetes
API service 10.3.0.1). This turned out to have two parts:
* Fedora CoreOS switched to cgroups v2 by default. In our early
testing with cgroups v2, Calico (default) was used. With the
cgroups v2 change, SELinux policy denied some eBPF operations.
Since fixed in all Fedora CoreOS channels
* Cilium requires new mounts to support cgroups v2, which are
added here

* https://github.com/coreos/fedora-coreos-tracker/issues/292
* https://github.com/coreos/fedora-coreos-tracker/issues/881
* https://github.com/cilium/cilium/pull/16259
 2021-07-24 10:36:47 -07:00
Dalton Hubble fdade5b40c Update poseidon/ct provider from v0.8.0 to v0.9.0 
* Continue targeting Ignition v3.2.0 for some time
 2021-07-18 09:05:02 -07:00
Dalton Hubble 171fd2c998 Update Kubernetes from v1.21.2 to v1.21.3 
* https://github.com/kubernetes/kubernetes/releases/tag/v1.21.3
 2021-07-17 18:22:24 -07:00
Dalton Hubble 3a71b2ccb1 Update Cilium from v1.10.1 to v1.10.2 
* https://github.com/cilium/cilium/releases/tag/v1.10.2
 2021-07-04 10:11:21 -07:00
Dalton Hubble d0e73b8174 Bump terraform-render-bootstrap 2021-06-27 18:11:43 -07:00
Dalton Hubble 485feb82c4 Update CoreDNS from v1.8.0 to v1.8.4 
* https://coredns.io/2021/01/20/coredns-1.8.1-release/
* https://coredns.io/2021/02/23/coredns-1.8.2-release/
* https://coredns.io/2021/02/24/coredns-1.8.3-release/
* https://coredns.io/2021/05/28/coredns-1.8.4-release/
 2021-06-23 23:31:25 -07:00
Dalton Hubble 0b276b6b7e Update Kubernetes from v1.21.1 to v1.21.2 
* https://github.com/kubernetes/kubernetes/releases/tag/v1.21.2
 2021-06-17 16:15:20 -07:00
Dalton Hubble e8513e58bb Add support for Terraform v1.0.0 
* https://github.com/hashicorp/terraform/releases/tag/v1.0.0
 2021-06-17 13:32:56 -07:00
Dalton Hubble 996bdd9112 Update Calico from v3.19.0 to v3.19.1 
* https://docs.projectcalico.org/archive/v3.19/release-notes/
 2021-06-02 14:51:15 -07:00
Dalton Hubble 966fd280b0 Update Cilium from v0.10.0-rc1 to v0.10.0 
* https://github.com/cilium/cilium/releases/tag/v1.10.0
 2021-05-24 11:16:51 -07:00
Dalton Hubble e4e074c894 Update Cilium from v1.9.6 to v1.10.0-rc1 
* Add multi-arch container images and arm64 support
* https://github.com/cilium/cilium/releases/tag/v1.10.0-rc1
 2021-05-14 14:24:52 -07:00
Dalton Hubble d51da49925 Update docs for Kubernetes v1.21.1 and Terraform v0.15.x 2021-05-13 11:34:01 -07:00
Dalton Hubble 2076a779a3 Update Kubernetes from v1.21.0 to v1.21.1 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.21.md#v1211
 2021-05-13 11:23:26 -07:00
Dalton Hubble 048094b256 Update etcd from v3.4.15 to v3.4.16 
* https://github.com/etcd-io/etcd/blob/main/CHANGELOG-3.4.md
 2021-05-13 10:53:04 -07:00
Dalton Hubble b152b9f973 Reduce the default disk_size from 40GB to 30GB 
* We're typically reducing the `disk_size` in real clusters
since the space is under used. The default should be lower.
 2021-04-26 11:43:26 -07:00
Dalton Hubble 9c842395a8 Update Cilium from v1.9.5 to v1.9.6 
* https://github.com/cilium/cilium/releases/tag/v1.9.6
 2021-04-26 10:55:23 -07:00
Dalton Hubble 67047ead08 Update Terraform version to allow v0.15.0 
* Require Terraform version v0.13 <= x < v0.16
 2021-04-16 09:46:01 -07:00
Dalton Hubble ebd9570ede Update Fedora CoreOS Config version from v1.1.0 to v1.2.0 
* Require [poseidon/ct](https://github.com/poseidon/terraform-provider-ct)
Terraform provider v0.8+
* Require any [snippets](https://typhoon.psdn.io/advanced/customization/#hosts)
customizations to update to v1.2.0

See upgrade [notes](https://typhoon.psdn.io/topics/maintenance/#upgrade-terraform-provider-ct)
 2021-04-11 15:26:54 -07:00
Dalton Hubble 34e8db7aae Update static Pod manifests for Kubernetes v1.21.0 
* https://github.com/poseidon/terraform-render-bootstrap/pull/257
 2021-04-11 15:05:46 -07:00
Dalton Hubble 084e8bea49 Allow custom initial node taints on worker pool nodes 
* Add `node_taints` variable to worker modules to set custom
initial node taints on cloud platforms that support auto-scaling
worker pools of heterogeneous nodes (i.e. AWS, Azure, GCP)
* Worker pools could use custom `node_labels` to allowed workloads
to select among differentiated nodes, while custom `node_taints`
allows a worker pool's nodes to be tainted as special to prevent
scheduling, except by workloads that explicitly tolerate the
taint
* Expose `daemonset_tolerations` in AWS, Azure, and GCP kubernetes
cluster modules, to determine whether `kube-system` components
should tolerate the custom taint (advanced use covered in docs)

Rel: #550, #663
Closes #429
 2021-04-11 15:00:11 -07:00
Dalton Hubble d73621c838 Update Kubernetes from v1.20.5 to v1.21.0 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.21.md#v1210
 2021-04-08 21:44:31 -07:00
Dalton Hubble 798ec9a92f Change CNI config directory to /etc/cni/net.d 
* Change CNI config directory from `/etc/kubernetes/cni/net.d`
to `/etc/cni/net.d` (Kubelet default)
* https://github.com/poseidon/terraform-render-bootstrap/pull/255
 2021-04-02 00:03:48 -07:00
Dalton Hubble 597ca4acce Update CoreDNS from v1.7.0 to v1.8.0 
* https://github.com/poseidon/terraform-render-bootstrap/pull/254
 2021-03-20 16:47:25 -07:00
Dalton Hubble 796149d122 Update Kubernetes from v1.20.4 to v1.20.5 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#v1205
 2021-03-19 11:27:31 -07:00
Dalton Hubble a66bccd590 Update Cilium from v1.9.4 to v1.9.5 
* https://github.com/cilium/cilium/releases/tag/v1.9.5
 2021-03-14 11:48:22 -07:00
Dalton Hubble 30b1edfcc6 Mark bootstrap token as sensitive in plan/apply 
* Mark the bootstrap token as sensitive, which is useful when
Terraform is run in automated CI/CD systems to avoid showing
the token
* https://github.com/poseidon/terraform-render-bootstrap/pull/251
 2021-03-14 11:32:35 -07:00
Dalton Hubble a4afe06b64 Update Calico from v3.17.3 to v3.18.1 
* https://docs.projectcalico.org/archive/v3.18/release-notes/
 2021-03-14 10:35:24 -07:00
Dalton Hubble a5c1a96df1 Update etcd from v3.4.14 to v3.4.15 
* https://github.com/etcd-io/etcd/releases/tag/v3.4.15
 2021-03-05 17:02:57 -08:00
Dalton Hubble e76fe80b45 Update Kubernetes from v1.20.3 to v1.20.4 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#v1204
 2021-02-19 00:02:07 -08:00
Dalton Hubble 32853aaa7b Update Kubernetes from v1.20.2 to v1.20.3 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#v1203
 2021-02-17 22:29:33 -08:00
Dalton Hubble 9671b1c734 Update flannel-cni from v0.4.1 to v0.4.2 
* https://github.com/poseidon/flannel-cni/releases/tag/v0.4.2
 2021-02-14 12:04:59 -08:00
Dalton Hubble 18165d8076 Update Calico from v3.17.1 to v3.17.2 
* https://github.com/projectcalico/calico/releases/tag/v3.17.2
 2021-02-04 22:03:51 -08:00
Dalton Hubble 50acf28ce5 Update Cilium from v1.9.3 to v1.9.4 
* https://github.com/cilium/cilium/releases/tag/v1.9.4
 2021-02-03 23:08:22 -08:00
Dalton Hubble ab793eb842 Update Cilium from v1.9.2 to v1.9.3 
* https://github.com/cilium/cilium/releases/tag/v1.9.3
 2021-01-26 17:13:52 -08:00
Dalton Hubble b74c958524 Update Cilium from v1.9.1 to v1.9.2 
* https://github.com/cilium/cilium/releases/tag/v1.9.2
 2021-01-20 22:06:45 -08:00
Dalton Hubble 05f7df9e80 Update Kubernetes from v1.20.1 to v1.20.2 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#v1202
 2021-01-13 17:46:51 -08:00
Dalton Hubble 4220b9ce18 Add support for Terraform v0.14.4+ 
* Support Terraform v0.13.x and v0.14.4+
 2021-01-12 21:43:12 -08:00
Dalton Hubble 646bdd78e4 Update Kubernetes from v1.20.0 to v1.20.1 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#v1201
 2020-12-19 12:56:28 -08:00
Dalton Hubble 86e0f806b3 Revert "Add support for Terraform v0.14.x" 
This reverts commit 968febb050.
 2020-12-11 00:47:57 -08:00
Dalton Hubble ee9ce3d0ab Update Calico from v3.17.0 to v3.17.1 
* https://github.com/projectcalico/calico/releases/tag/v3.17.1
 2020-12-10 22:48:38 -08:00
Dalton Hubble a8b8a9b454 Update Kubernetes from v1.20.0-rc.0 to v1.20.0 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#v1200
 2020-12-08 18:28:13 -08:00
Dalton Hubble 968febb050 Add support for Terraform v0.14.x 
* Support Terraform v0.13.x and v0.14.x
 2020-12-07 00:22:38 -08:00
Dalton Hubble bee455f83a Update Cilium from v1.9.0 to v1.9.1 
* https://github.com/cilium/cilium/releases/tag/v1.9.1
 2020-12-04 14:14:18 -08:00
Dalton Hubble e77dd6ecd4 Update Kubernetes from v1.19.4 to v1.20.0-rc.0 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#v1200-rc0
 2020-12-03 16:01:28 -08:00
Dalton Hubble 4fd4a0f540 Move control plane static pod TLS assets to /etc/kubernetes/pki 
* Change control plane static pods to mount `/etc/kubernetes/pki`,
instead of `/etc/kubernetes/bootstrap-secrets` to better reflect
their purpose and match some loose conventions upstream
* Place control plane and bootstrap TLS assets and kubeconfig's
in `/etc/kubernetes/pki`
* Mount to `/etc/kubernetes/pki` (rather than `/etc/kubernetes/secrets`)
to match the host location (less surprise)

Rel: https://github.com/poseidon/terraform-render-bootstrap/pull/233
 2020-12-02 23:26:42 -08:00
Dalton Hubble 804dfea0f9 Add kubeconfig's for kube-scheduler and kube-controller-manager 
* Generate TLS client certificates for `kube-scheduler` and
`kube-controller-manager` with `system:kube-scheduler` and
`system:kube-controller-manager` CNs
* Template separate kubeconfigs for kube-scheduler and
kube-controller manager (`scheduler.conf` and
`controller-manager.conf`). Rename admin for clarity
* Before v1.16.0, Typhoon scheduled a self-hosted control
plane, which allowed the steady-state kube-scheduler and
kube-controller-manager to use a scoped ServiceAccount.
With a static pod control plane, separate CN TLS client
certificates are the nearest equiv.
* https://kubernetes.io/docs/setup/best-practices/certificates/
* Remove unused Kubelet certificate, TLS bootstrap is used
instead
 2020-12-01 22:02:15 -08:00
Dalton Hubble 8ba23f364c Add TokenReview and TokenRequestProjection flags 
* Add kube-apiserver flags for TokenReview and TokenRequestProjection
(beta, defaults on) to allow using Service Account Token Volume
Projection to create and mount service account tokens tied to a Pod's
lifecycle

Rel:

* https://github.com/poseidon/terraform-render-bootstrap/pull/231
* https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection
 2020-12-01 20:02:33 -08:00
Dalton Hubble f6025666eb Update etcd from v3.4.12 to v3.4.14 
* https://github.com/etcd-io/etcd/releases/tag/v3.4.14
 2020-11-29 20:04:25 -08:00
Dalton Hubble fa3184fb9c Relax terraform-provider-ct version constraint 
* Allow terraform-provider-ct versions v0.6+ (e.g. v0.7.1)
Before, only v0.6.x point updates were allowed
* Update terraform-provider-ct to v0.7.1 in docs
* READ the docs before updating terraform-provider-ct,
as changing worker user-data is handled differently
by different cloud platforms
 2020-11-29 19:51:26 -08:00
Dalton Hubble ae548ce213 Update Calico from v3.16.5 to v3.17.0 
* Enable Calico MTU auto-detection
* Remove [workaround](https://github.com/poseidon/typhoon/pull/724) to
Calico cni-plugin [issue](https://github.com/projectcalico/cni-plugin/issues/874)

Rel: https://github.com/poseidon/terraform-render-bootstrap/pull/230
 2020-11-25 14:22:58 -08:00
Dalton Hubble c0347ca0c6 Set kubeconfig and asset_dist as sensitive 
* Mark `kubeconfig` and `asset_dist` as `sensitive` to
prevent the Terraform CLI displaying these values, esp.
for CI systems
* In particular, external tools or tfvars style uses (not
recommended) reportedly display all outputs and are improved
by setting sensitive
* For Terraform v0.14, outputs referencing sensitive fields
must also be annotated as sensitive

Closes https://github.com/poseidon/typhoon/issues/884
 2020-11-23 11:41:55 -08:00
Dalton Hubble cc00afa4e1 Add Terraform v0.13 input variable validations 
* Support for migrating from Terraform v0.12.x to v0.13.x
was added in v1.18.8
* Require Terraform v0.13+. Drop support for Terraform v0.12
 2020-11-17 12:02:34 -08:00
Dalton Hubble 1113a22f61 Update Kubernetes from v1.19.3 to v1.19.4 
* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md#v1194
 2020-11-11 22:56:27 -08:00
Dalton Hubble 152c7d86bd Change bootstrap.service container from rkt to docker 
* Use docker to run `bootstrap.service` container
* Background https://github.com/poseidon/typhoon/pull/855
 2020-11-11 22:26:05 -08:00
Dalton Hubble 79deb8a967 Update Cilium from v1.9.0-rc3 to v1.9.0 
* https://github.com/cilium/cilium/releases/tag/v1.9.0
 2020-11-10 23:42:41 -08:00
Dalton Hubble f412f0d9f2 Update Calico from v3.16.4 to v3.16.5 
* https://github.com/projectcalico/calico/releases/tag/v3.16.5
 2020-11-10 22:58:19 -08:00
Phil Sautter eca6c4a1a1
Fix broken flatcar linux documentation links (#870) 
* Fix old documentation links
 2020-11-10 18:30:30 -08:00
Dalton Hubble ad1f59ce91 Change Flatcar etcd-member.service container from rkt to docker 
* Use docker to run the `etcd-member.service` container
* Use env-file `/etc/etcd/etcd.env` like podman on FCOS
* Background: https://github.com/poseidon/typhoon/pull/855
 2020-11-03 16:42:18 -08:00
Dalton Hubble 82e5ac3e7c Update Cilium from v1.8.5 to v1.9.0-rc3 
* https://github.com/poseidon/terraform-render-bootstrap/pull/224
 2020-11-03 10:29:07 -08:00
Dalton Hubble a8f7880511 Update Cilium from v1.8.4 to v1.8.5 
* https://github.com/cilium/cilium/releases/tag/v1.8.5
 2020-10-29 00:50:18 -07:00
Dalton Hubble 893d139590 Update Calico from v3.16.3 to v3.16.4 
* https://github.com/projectcalico/calico/releases/tag/v3.16.4
 2020-10-26 00:50:40 -07:00
Dalton Hubble 7c3f3ab6d0 Rename container-linux modules to flatcar-linux 
* CoreOS Container Linux was deprecated in v1.18.3
* Continue transitioning docs and modules from supporting
both CoreOS and Flatcar "variants" of Container Linux to
now supporting Flatcar Linux and equivalents

Action Required: Update the Flatcar Linux modules `source`
to replace `s/container-linux/flatcar-linux`. See docs for
examples
 2020-10-20 22:47:19 -07:00