[pull] master from kubernetes:master - #1924
Open
pull[bot] wants to merge 8486 commits into
Open
Conversation
Initially the LB sent traffic to both. The DNS None is a new case. Now we only send traffic to the APIServer in this case. This protects the Control Plane nodes to do core controller work. Remove separate tests. Regenerated docs.
Fixing LB behavior when you have both APIServer and Control Plane.
Remove namespace from DO ClusterRole
chore(channels): promote to stable, bump node images, update recommended kOps versions
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…ctions/checkout-7.0.0 build(deps): bump actions/checkout from 6.0.3 to 7.0.0
In e2e, `kops create cluster --channel=alpha` reads the channel from the kops master branch, so a PR's edits to channels/alpha or channels/stable are never exercised by its own e2e jobs. When kops is built from the PR checkout, the deployer now rewrites --channel to a file:// path into that checkout's channels/ directory (defaulting to alpha when --channel is unset), so the build uses the PR's channels. Downloaded release/marker binaries don't match the checkout and keep using master's channels.
scaletest: bind etcd metrics to all interfaces
e2e: test the PR's own channels, not master's
The externalTrafficPolicy=Local source-IP-preservation tests only fail on Cilium (the client IP is SNATed to a pod IP instead of being preserved), tracked upstream in cilium/cilium#37613. Move the "implement NodePort and HealthCheckNodePort correctly when ExternalTrafficPolicy changes" skip into the Cilium block next to its sibling so other CNIs run the test. The hostNetwork "function for service endpoints" test was fixed in k8s 1.37 by kubernetes/kubernetes#139819 (it now reads spec.nodeName via the Downward API instead of os.Hostname()), so drop its skip gate from < 1.38 to < 1.37. Also clean up stale/incorrect issue references in the surrounding comments (wrong Azure issue, superseded hostname WIP PR, and the unrelated #129221).
tests/e2e: refine externalTrafficPolicy=Local and hostNetwork skips
Grow slices for explicit indexes while processing --set paths, so paths like cluster.spec.addons[0].manifest can create the first element.
Configure the scenario to install Gateway API CRDs via cluster.spec.addons, using the Gateway API version documented by Istio 1.29.
Allow setting missing slice elements from the command line
Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>
Add managed Karpenter EC2NodeClass and NodePool
Preperation for something like #18495. Moving away from direct comparison (== or !=) on IG role. Using helper methods such as HasNode() or HasControlPlane(). Also added a hack test so we don't backtrack. Should help prepare for supporting more control plane roles.
The "Services should implement NodePort and HealthCheckNodePort correctly when ExternalTrafficPolicy changes" test was previously gated to Cilium only, but the e2e-kops-aws-cni-* periodic jobs show it also fails on flannel, kopeio and kube-router: the client source IP is SNATed to a pod IP instead of being preserved (kube-router instead times out reaching the local endpoint). It is the sole failure in those three jobs' latest runs. Move it out of the Cilium block into a condition covering cilium, flannel, kopeio and kube-router. amazon-vpc, calico and kindnet preserve the source IP and continue running the test. The sibling "externalTrafficPolicy=Local for type=NodePort" test passes on every non-Cilium CNI, so it stays gated to Cilium only.
chore(networking): bump aws-cni to version 1.22.4
Remove gossip leftovers
pkg/dns/hosts (the /etc/hosts writer used by none-DNS clusters) and pkg/etcd (etcd cluster spec parsing from volume tags) are still used outside protokube, so relocate them ahead of the protokube removal. protokube temporarily imports the new locations.
protokube no longer had any responsibilities after the gossip DNS removal: nodes stopped installing and running it, and its only remaining function was serving gossip DNS. Delete the protokube tree, the forked memberlistmesh library, and the gcediscovery package whose only consumer was protokube's GCE volume provider. Remove the protokube build targets and stop publishing its release assets. The gossip well-known ports are kept (and the two dns-controller ones restored) as Deprecated constants so the port numbers are not reused. The release promotion and validation scripts learn an OPTIONAL_BINARIES mechanism, probing artifacts.k8s.io per version, so older releases that still ship protokube (and channels, dropped in kOps 1.36) keep full coverage while newer releases skip them. Only a confirmed 404 counts as absent; any other probe outcome fails the scripts.
github.com/hashicorp/memberlist and github.com/weaveworks/mesh are no longer used after the protokube removal.
Removed concept of CCM node as it is dynamic. Fixed KubController -> KubeController. Added setting kops role labels on nodes via kops-channel.
Fixed APIServer label test.
Fix IG HasAPIServer to RunsAPIServer
Remove the protokube binary
docs: gossip removal in kOps 1.37 and migration guide
The DIGITALOCEAN_ACCESS_TOKEN, HCLOUD_TOKEN and SCW_* exports in the bootstrap script existed only for protokube's gossip seed discovery. Workers stopped receiving them in kOps 1.36 and protokube itself was removed in kOps 1.37, so the control-plane exports and their persistence in /etc/sysconfig/kops-configuration have no consumer left. All remaining consumers (etcd-manager, kops-controller, dns-controller, CCM, CSI) receive credentials via manifests built at kops update time. Also write /etc/sysconfig/kops-configuration with mode 0600; it can still contain state store and OpenStack credentials and was previously world-readable.
Skip the dns-controller Route 53 grant on the control-plane instance role when useServiceAccountExternalPermissions is set; dns-controller and external-dns get dedicated IAM roles in that mode, matching how the other addon permissions are handled. Scope the kube-router and kindnet ec2:ModifyInstanceAttribute grants to cluster-tagged instances, matching the CCM and IRSA variants of the same permission. Add golden coverage for the kube-router node policy.
Narrow instance cloud permissions to actual consumers
The list of expected files in Go was a second copy of the test data directory, which now also has to describe conditional output: an instance role that needs no permissions has no inline IAM policy. Nothing is lost by dropping it. hack/update-expected.sh never deletes existing expected files, so a file that is wrongly no longer generated keeps failing the comparison until its expected file is deleted too.
Grant ec2:DescribeInstanceTypes only where something on the instance calls it: nodeup Nvidia GPU detection and the kubelet MaxPods calculation for AWS VPC CNI and Cilium ENI IPAM. The cluster autoscaler grant now honors awsUseStaticInstanceList, whose branch was a no-op because the action was also inserted unconditionally. Drop ec2:DescribeRegions from the etcd-manager permissions, as it reads the region from the instance metadata service. Move ec2:DescribeInstances to a kops-controller helper, which needs it for node verification and identification independently of etcd-manager. Render policies without statements as empty documents instead of erroring, so that roles which need no permissions, such as the bastion role, have no inline policy. Updating an existing cluster deletes the policy created for it before.
…sions Narrow instance describe permissions
Clean up remaining gossip removal leftovers
Adding dynamic channel labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )