Pull in config enhancements from the upstream eks-ami

See: * awslabs/amazon-eks-ami#168 * awslabs/amazon-eks-ami#167 * awslabs/amazon-eks-ami#170 * awslabs/amazon-eks-ami#137
errm · Apr 10, 2019 · bfef619 · bfef619
1 parent d0ae081
commit bfef619
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 6 deletions.
diff --git a/pkg/system/system_test.go b/pkg/system/system_test.go
@@ -79,16 +79,18 @@ After=docker.service
 Requires=docker.service
 
 [Service]
+ExecStartPre=/sbin/iptables -P FORWARD ACCEPT
 ExecStart=/usr/bin/kubelet \
   --allow-privileged=true \
   --cloud-provider=aws \
   --config=/etc/kubernetes/kubelet/config.yaml \
   --network-plugin=cni \
   --kubeconfig=/var/lib/kubelet/kubeconfig $KUBELET_CONTAINER_RUNTIME_ARGS $KUBELET_ARGS $KUBELET_NODE_LABELS $KUBELET_NODE_TAINTS $KUBELET_EXTRA_ARGS
 
-Restart=always
-StartLimitInterval=0
+Restart=on-failure
+RestartForceExitStatus=SIGPIPE
 RestartSec=5
+KillMode=process
 
 [Install]
 WantedBy=multi-user.target
@@ -117,11 +119,14 @@ authorization:
     cacheAuthorizedTTL: 5m0s
     cacheUnauthorizedTTL: 30s
 clusterDomain: cluster.local
+hairpinMode: hairpin-veth
 clusterDNS: [172.20.0.10]
 cgroupDriver: cgroupfs
+cgroupRoot: /
 featureGates:
   RotateKubeletServerCertificate: true
 serverTLSBootstrap: true
+serializeImagePulls: false
 kubeReserved:
   cpu: 70m
   memory: 1024Mi
@@ -256,16 +261,18 @@ After=containerd.service
 Requires=containerd.service
 
 [Service]
+ExecStartPre=/sbin/iptables -P FORWARD ACCEPT
 ExecStart=/usr/bin/kubelet \
   --allow-privileged=true \
   --cloud-provider=aws \
   --config=/etc/kubernetes/kubelet/config.yaml \
   --network-plugin=cni \
   --kubeconfig=/var/lib/kubelet/kubeconfig $KUBELET_CONTAINER_RUNTIME_ARGS $KUBELET_ARGS $KUBELET_NODE_LABELS $KUBELET_NODE_TAINTS $KUBELET_EXTRA_ARGS
 
-Restart=always
-StartLimitInterval=0
+Restart=on-failure
+RestartForceExitStatus=SIGPIPE
 RestartSec=5
+KillMode=process
 
 [Install]
 WantedBy=multi-user.target

diff --git a/pkg/system/templates/etc/kubernetes/kubelet/config.yaml b/pkg/system/templates/etc/kubernetes/kubelet/config.yaml
@@ -15,11 +15,14 @@ authorization:
     cacheAuthorizedTTL: 5m0s
     cacheUnauthorizedTTL: 30s
 clusterDomain: cluster.local
+hairpinMode: hairpin-veth
 clusterDNS: [{{.Node.ClusterDNS}}]
 cgroupDriver: cgroupfs
+cgroupRoot: /
 featureGates:
   RotateKubeletServerCertificate: true
 serverTLSBootstrap: true
+serializeImagePulls: false
 {{- if and .Node.ReservedCPU .Node.ReservedMemory }}
 kubeReserved:
   cpu: {{.Node.ReservedCPU}}

diff --git a/pkg/system/templates/etc/systemd/system/kubelet.service b/pkg/system/templates/etc/systemd/system/kubelet.service
@@ -5,16 +5,18 @@ After={{.Node.ContainerRuntime}}.service
 Requires={{.Node.ContainerRuntime}}.service
 
 [Service]
+ExecStartPre=/sbin/iptables -P FORWARD ACCEPT
 ExecStart=/usr/bin/kubelet \
   --allow-privileged=true \
   --cloud-provider=aws \
   --config=/etc/kubernetes/kubelet/config.yaml \
   --network-plugin=cni \
   --kubeconfig=/var/lib/kubelet/kubeconfig $KUBELET_CONTAINER_RUNTIME_ARGS $KUBELET_ARGS $KUBELET_NODE_LABELS $KUBELET_NODE_TAINTS $KUBELET_EXTRA_ARGS
 
-Restart=always
-StartLimitInterval=0
+Restart=on-failure
+RestartForceExitStatus=SIGPIPE
 RestartSec=5
+KillMode=process
 
 [Install]
 WantedBy=multi-user.target