Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick changes from the master branch #1592

Merged
merged 5 commits into from
Oct 27, 2021
Merged

Cherry-pick changes from the master branch #1592

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
759abe0
edit selinux config file only if file exists (#1532)
kron4eg Sep 17, 2021
0a64297
openstack-terraform: open nodeports SG (#1530)
kron4eg Sep 22, 2021
75ec213
gce-terraform: Open GCE nodeports (#1529)
kron4eg Sep 22, 2021
3ed9c69
azure-terraform: allow nodeports (#1528)
kron4eg Sep 23, 2021
e2dd374
Bump Hetzner Cloud CCM to latest version (#1583)
MattiasGees Oct 18, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions examples/terraform/azure/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ resource "azurerm_network_security_group" "sg" {

security_rule {
name = "SSH"
description = "Allow inbound SSH"
priority = 1001
direction = "Inbound"
access = "Allow"
Expand All @@ -94,6 +95,20 @@ resource "azurerm_network_security_group" "sg" {
source_address_prefix = "*"
destination_address_prefix = "*"
}

security_rule {
name = "NodePorts"
description = "Allow inbound NodePorts"
priority = 1010
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "*"
destination_port_range = "30000-32767"
source_address_prefix = "*"
destination_address_prefix = "*"
}

tags = {
environment = "kubeone"
cluster = var.cluster_name
Expand Down
4 changes: 2 additions & 2 deletions examples/terraform/azure/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,13 +69,13 @@ variable "location" {

variable "control_plane_vm_size" {
description = "VM Size for control plane machines"
default = "Standard_B2s"
default = "Standard_F2"
type = string
}

variable "worker_vm_size" {
description = "VM Size for worker machines"
default = "Standard_B2s"
default = "Standard_F2"
type = string
}

Expand Down
17 changes: 16 additions & 1 deletion examples/terraform/gce/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,21 @@ resource "google_compute_firewall" "internal" {
]
}

resource "google_compute_firewall" "nodeports" {
name = "${var.cluster_name}-nodeports"
network = google_compute_network.network.self_link

allow {
protocol = "tcp"
ports = ["30000-32767"]
}

source_ranges = [
"0.0.0.0/0",
]
}


resource "google_compute_address" "lb_ip" {
name = "${var.cluster_name}-lb-ip"
}
Expand Down Expand Up @@ -137,7 +152,7 @@ resource "google_compute_instance" "control_plane" {
zone = data.google_compute_zones.available.names[count.index % local.zones_count]

# Changing the machine_type, min_cpu_platform, or service_account on an
# instance requires stopping it. To acknowledge this,
# instance requires stopping it. To acknowledge this,
# allow_stopping_for_update = true is required
allow_stopping_for_update = true

Expand Down
11 changes: 11 additions & 0 deletions examples/terraform/openstack/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,17 @@ resource "openstack_networking_secgroup_rule_v2" "secgroup_ssh" {
security_group_id = openstack_networking_secgroup_v2.securitygroup.id
}

resource "openstack_networking_secgroup_rule_v2" "nodeports" {
description = "Allow NodePorts"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 30000
port_range_max = 32767
remote_ip_prefix = "0.0.0.0/0"
security_group_id = openstack_networking_secgroup_v2.securitygroup.id
}

resource "openstack_networking_secgroup_rule_v2" "secgroup_apiserver" {
description = "Allow kube-apiserver"
direction = "ingress"
Expand Down
5 changes: 3 additions & 2 deletions examples/terraform/openstack/output.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,10 +65,11 @@ output "kubeone_workers" {
securityGroups = [openstack_networking_secgroup_v2.securitygroup.name]
network = openstack_networking_network_v2.network.name
subnet = openstack_networking_subnet_v2.subnet.name
# Optional: If set, the rootDisk will be a volume.
floatingIpPool = var.external_network_name
# Optional: If set, the rootDisk will be a volume.
# Otherwise, the rootDisk will be on ephemeral storage and its size will
# be derived from the flavor
rootDiskSizeGB = 50
# rootDiskSizeGB = 50
# Optional: limit how many volumes can be attached to a node
# nodeVolumeAttachLimit = 25
tags = {
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/os_amzn.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ const (
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/os_centos.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,7 @@ const (
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestKubeadmAmazonLinux-force.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestKubeadmAmazonLinux-overwrite_registry.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestKubeadmAmazonLinux-overwrite_registry_insecure.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestKubeadmAmazonLinux-proxy.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestKubeadmAmazonLinux-simple.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestKubeadmAmazonLinux-v1.16.1.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestKubeadmAmazonLinux-with_containerd.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestKubeadmAmazonLinux-with_containerd_with_insecure_registry.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestKubeadmCentOS-force.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestKubeadmCentOS-overwrite_registry.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestKubeadmCentOS-overwrite_registry_insecure.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestKubeadmCentOS-proxy.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestKubeadmCentOS-simple.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestKubeadmCentOS-v1.16.1.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestKubeadmCentOS-with_containerd.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestKubeadmCentOS-with_containerd_with_insecure_registry.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestUpgradeKubeadmAndCNIAmazonLinux.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestUpgradeKubeadmAndCNICentOS.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/scripts/testdata/TestUpgradeKubeletAndKubectlAmazonLinux.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
3 changes: 1 addition & 2 deletions pkg/scripts/testdata/TestUpgradeKubeletAndKubectlCentOS.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ export "PATH=$PATH:/sbin:/usr/local/bin:/opt/bin"
sudo swapoff -a
sudo sed -i '/.*swap.*/d' /etc/fstab
sudo setenforce 0 || true
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/sysconfig/selinux
sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
[ -f /etc/selinux/config ] && sudo sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
sudo systemctl disable --now firewalld || true

source /etc/kubeone/proxy-env
Expand Down
2 changes: 1 addition & 1 deletion pkg/templates/images/images.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ func optionalResources() map[Resource]map[string]string {
DigitaloceanCCM: {"*": "docker.io/digitalocean/digitalocean-cloud-controller-manager:v0.1.33"},

// Hetzner CCM
HetznerCCM: {"*": "docker.io/hetznercloud/hcloud-cloud-controller-manager:v1.9.1"},
HetznerCCM: {"*": "docker.io/hetznercloud/hcloud-cloud-controller-manager:v1.12.0"},

// Hetzner CSI
HetznerCSI: {"*": "docker.io/hetznercloud/hcloud-csi-driver:1.6.0"},
Expand Down