Merge pull request #53 from errm/enhancements

Small Config enhancements
errm · Apr 10, 2019 · deddde9 · deddde9
2 parents 19049eb + bfef619
commit deddde9
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 11 deletions.
diff --git a/pkg/system/system_test.go b/pkg/system/system_test.go
@@ -79,16 +79,18 @@ After=docker.service
 Requires=docker.service
 
 [Service]
+ExecStartPre=/sbin/iptables -P FORWARD ACCEPT
 ExecStart=/usr/bin/kubelet \
   --allow-privileged=true \
   --cloud-provider=aws \
-  --config /etc/kubernetes/kubelet/config.yaml \
+  --config=/etc/kubernetes/kubelet/config.yaml \
   --network-plugin=cni \
   --kubeconfig=/var/lib/kubelet/kubeconfig $KUBELET_CONTAINER_RUNTIME_ARGS $KUBELET_ARGS $KUBELET_NODE_LABELS $KUBELET_NODE_TAINTS $KUBELET_EXTRA_ARGS
 
-Restart=always
-StartLimitInterval=0
+Restart=on-failure
+RestartForceExitStatus=SIGPIPE
 RestartSec=5
+KillMode=process
 
 [Install]
 WantedBy=multi-user.target
@@ -117,11 +119,14 @@ authorization:
     cacheAuthorizedTTL: 5m0s
     cacheUnauthorizedTTL: 30s
 clusterDomain: cluster.local
+hairpinMode: hairpin-veth
 clusterDNS: [172.20.0.10]
 cgroupDriver: cgroupfs
+cgroupRoot: /
 featureGates:
   RotateKubeletServerCertificate: true
 serverTLSBootstrap: true
+serializeImagePulls: false
 kubeReserved:
   cpu: 70m
   memory: 1024Mi
@@ -256,24 +261,26 @@ After=containerd.service
 Requires=containerd.service
 
 [Service]
+ExecStartPre=/sbin/iptables -P FORWARD ACCEPT
 ExecStart=/usr/bin/kubelet \
   --allow-privileged=true \
   --cloud-provider=aws \
-  --config /etc/kubernetes/kubelet/config.yaml \
+  --config=/etc/kubernetes/kubelet/config.yaml \
   --network-plugin=cni \
   --kubeconfig=/var/lib/kubelet/kubeconfig $KUBELET_CONTAINER_RUNTIME_ARGS $KUBELET_ARGS $KUBELET_NODE_LABELS $KUBELET_NODE_TAINTS $KUBELET_EXTRA_ARGS
 
-Restart=always
-StartLimitInterval=0
+Restart=on-failure
+RestartForceExitStatus=SIGPIPE
 RestartSec=5
+KillMode=process
 
 [Install]
 WantedBy=multi-user.target
 `
 	fs.Check(t, "/etc/systemd/system/kubelet.service", expected, 0640)
 
 	expected = `[Service]
-Environment="KUBELET_CONTAINER_RUNTIME_ARGS=--container-runtime=remote --runtime-request-timeout=15m --container-runtime-endpoint=unix:///run/containerd/containerd.sock --cgroup-driver=systemd"
+Environment="KUBELET_CONTAINER_RUNTIME_ARGS=--container-runtime=remote --runtime-request-timeout=15m --container-runtime-endpoint=unix:///run/containerd/containerd.sock"
 `
 	fs.Check(t, "/etc/systemd/system/kubelet.service.d/40-container-runtime.conf", expected, 0640)
 }

diff --git a/pkg/system/templates/etc/kubernetes/kubelet/config.yaml b/pkg/system/templates/etc/kubernetes/kubelet/config.yaml
@@ -15,11 +15,14 @@ authorization:
     cacheAuthorizedTTL: 5m0s
     cacheUnauthorizedTTL: 30s
 clusterDomain: cluster.local
+hairpinMode: hairpin-veth
 clusterDNS: [{{.Node.ClusterDNS}}]
 cgroupDriver: cgroupfs
+cgroupRoot: /
 featureGates:
   RotateKubeletServerCertificate: true
 serverTLSBootstrap: true
+serializeImagePulls: false
 {{- if and .Node.ReservedCPU .Node.ReservedMemory }}
 kubeReserved:
   cpu: {{.Node.ReservedCPU}}

diff --git a/pkg/system/templates/etc/systemd/system/kubelet.service b/pkg/system/templates/etc/systemd/system/kubelet.service
@@ -5,16 +5,18 @@ After={{.Node.ContainerRuntime}}.service
 Requires={{.Node.ContainerRuntime}}.service
 
 [Service]
+ExecStartPre=/sbin/iptables -P FORWARD ACCEPT
 ExecStart=/usr/bin/kubelet \
   --allow-privileged=true \
   --cloud-provider=aws \
-  --config /etc/kubernetes/kubelet/config.yaml \
+  --config=/etc/kubernetes/kubelet/config.yaml \
   --network-plugin=cni \
   --kubeconfig=/var/lib/kubelet/kubeconfig $KUBELET_CONTAINER_RUNTIME_ARGS $KUBELET_ARGS $KUBELET_NODE_LABELS $KUBELET_NODE_TAINTS $KUBELET_EXTRA_ARGS
 
-Restart=always
-StartLimitInterval=0
+Restart=on-failure
+RestartForceExitStatus=SIGPIPE
 RestartSec=5
+KillMode=process
 
 [Install]
 WantedBy=multi-user.target
diff --git a/pkg/system/templates/etc/systemd/system/kubelet.service.d/40-container-runtime.conf b/pkg/system/templates/etc/systemd/system/kubelet.service.d/40-container-runtime.conf
@@ -1,6 +1,6 @@
 [Service]
 {{- if eq .Node.ContainerRuntime "containerd" }}
-Environment="KUBELET_CONTAINER_RUNTIME_ARGS=--container-runtime=remote --runtime-request-timeout=15m --container-runtime-endpoint=unix:///run/containerd/containerd.sock --cgroup-driver=systemd"
+Environment="KUBELET_CONTAINER_RUNTIME_ARGS=--container-runtime=remote --runtime-request-timeout=15m --container-runtime-endpoint=unix:///run/containerd/containerd.sock"
 {{ else if eq .Node.ContainerRuntime "docker" }}
 Environment="KUBELET_CONTAINER_RUNTIME_ARGS=--container-runtime=docker"
 {{ end -}}