base for image stamping #25

vincepri · 2018-08-27T03:07:37Z

This is an initial port from wardroom adding support for containerd in Ubuntu (RHEL to follow).

Fixes #12

chuckha · 2018-08-27T13:51:56Z

Thoughts on purging the wardroom name in favor of something more descriptive like 'kubernetes-image', 'kubeadm-image', or 'cluster-api-provider-aws-image'?

detiber · 2018-08-27T13:16:03Z

images/README.md

+| Variable | Default | Description |
+|----------|---------|-------------|
+| build_version | unset | A unique build version for the image |
+| kubernetes_version | 1.9.5-00 | Kubernetes Version to install |


We should probably default to the latest available stable version here, same with kubernetes_cni_version.

detiber · 2018-08-27T13:16:26Z

images/README.md

+| kubernetes_version | 1.9.5-00 | Kubernetes Version to install |
+| kubernetes_cni_version | 0.6.0-00 | CNI Version to install |
+
+For exmaple, to build all images for use with Kubernetes 1.8.9 for build version 1:


comment doesn't align with the snippet below.

detiber · 2018-08-27T13:17:35Z

images/README.md

+
+- A Google Cloud account
+- The gcloud CLI installed and configured
+- A precreated service account json file


We should remove any references to GCP image building here.

images/ansible/filter_plugins/kube.py

detiber · 2018-08-27T13:22:30Z

images/ansible/playbook.yml

+  - name: install python
+    raw: bash -c "test -e /usr/bin/python || (apt-get -qqy update && apt-get install -qqy python python-pip)"
+    register: output
+    changed_when: output.stdout != ""


This is a bit of an ugly hack that we can most likely avoid by using a shell provisioner script in packer instead.

detiber · 2018-08-27T15:18:46Z

images/ansible/roles/kubernetes/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+kubernetes_version: "{{ kubernetes.version if kubernetes_version_defined else '1.9.3-00' }}"


Kill all the backwards compat for kubernetes.* variables here and switch to simple defaults.

Default for versions should probably be an empty string or undefined, and the role should default to latest available release version if not specified.

At some point we may want to consider a way to handle alpha/beta/rc releases as well, but that isn't a priority for the MVP.

detiber · 2018-08-27T15:22:54Z

images/ansible/roles/kubernetes/tasks/main.yml

+  docker_image:
+    name: "{{ item }}"
+  with_items: kubernetes_cached_images
+  when: kubernetes_enable_cached_images | bool


Lets kill the cached image handling for now, especially since it is docker specific.

detiber · 2018-08-27T15:25:09Z

images/ansible/roles/kubernetes/templates/etc/systemd/system/kubelet.service

+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target


We shouldn't need this systemd unit file, it should be managed by the kubelet/kubeadm packages.

detiber · 2018-08-27T15:27:00Z

images/ansible/roles/kubernetes/templates/etc/systemd/system/kubelet.service.d/10-kubeadm.conf

+Environment="KUBELET_NETWORK_ARGS=--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin"
+Environment="KUBELET_DNS_ARGS=--cluster-dns=10.96.0.10 --cluster-domain=cluster.local"
+ExecStart=
+ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_SYSTEM_PODS_ARGS $KUBELET_NETWORK_ARGS $KUBELET_DNS_ARGS $KUBELET_EXTRA_ARGS


For kubernetes v1.11+, we should be setting values in /var/lib/kubelet/kubeadm-flags.env insetad of overriding the unit files here.

detiber · 2018-08-27T15:27:19Z

images/ansible/roles/kubernetes/vars/main.yml

+kubernetes_apt_key_url_defined: "{{ kubernetes is defined and 'apt_key_url' in kubernetes }}"
+kubernetes_apt_repo_string_defined: "{{ kubernetes is defined and 'apt_repo_string' in kubernetes }}"
+kubernetes_yum_baseurl_defined: "{{ kubernetes is defined and 'yum_baseurl' in kubernetes }}"
+kubernetes_yum_gpgkey_defined: "{{ kubernetes is defined and 'yum_gpgkey' in kubernetes }}"


This is all backward compat crud.

detiber · 2018-08-27T15:36:05Z

@chuckha good point on the naming. @vincepri we'll also need to migrate over the python tool for sync'ing images. I'm also thinking that it might be a good idea to use that python tool for wrapping the interaction with packer for common use cases as well.

vincepri · 2018-08-27T17:17:55Z

@detiber thanks for the review! fixed most comments and updated the PR. I didn't initially migrate the wardroom tool because we should be able to use packer directly to copy images to different regions this line is a list of regions we want to copy the images to. Thoughts?

detiber · 2018-08-27T18:04:54Z

@detiber thanks for the review! fixed most comments and updated the PR. I didn't initially migrate the wardroom tool because we should be able to use packer directly to copy images to different regions this line is a list of regions we want to copy the images to. Thoughts?

Nice, I think that would work for the general user use case, but we will still probably want some tooling for the community AMI building. The wardroom tool for example will sync to all available regions in the client config and ensure the images are public.

detiber · 2018-08-27T20:04:19Z

images/ansible/roles/kubernetes/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+kubernetes_version: ""
+kubernetes_cni_version: ""


Does this behave correctly with the defaults here? It appears this may fail, since we are passing the value into the kube_platform_version filter.

images/packer/packer.json

images/README.md

detiber · 2018-08-30T17:47:25Z

images/README.md

+        }
+    ]
+}
+```


Have you been able to test using these limited permissions? I'm wondering if the use of ami_groups or ami_regions adds additional requirements.

I've updated the permissions to match the official packer suggested ones. Which include permissions to modify images attributes, needed for ami_groups to function. The ami_regions should be good too.

detiber · 2018-08-30T17:50:36Z

images/packer/packer.json

+      "ssh_username": "centos",
+      "tags": {
+        "build_version": "{{user `build_version`}}",
+        "source_ami": "{{user `centos_7_4_ami`}}",


I'm wondering if we can use source_ami_filter here instead to be able to automatically choose the newest base image rather than having to hard code it into a variable file like we are currently doing.

Thoughts?

Yeah. I was actually going to change it to use the official versions. The reason I left it untouched is that with the current behavior it's easier for folks to provide their own base image, which might contain different drivers/tweaks/security tools.

vincepri · 2018-08-30T18:15:21Z

@detiber Fixed / replied to the other comments. I think this is ready to be merged in. 😊

chuckha · 2018-08-30T18:43:21Z

Do these files need the licensing stanza at the top?

vincepri · 2018-08-30T19:15:52Z

All done! Thanks @chuckha

detiber

Lets get the licensing wrapped up and these commits squashed and get this merged :)

detiber · 2018-08-30T19:18:08Z

images/ansible/filter_plugins/kube.py

@@ -1,3 +1,17 @@
+# Copyright 2018 Heptio Inc.


s/Heptio/The Kubernetes Authors/

We should probably have this on all the Ansible yaml files as well.

Signed-off-by: Vince Prignano <vince@vincepri.com>

vincepri · 2018-08-30T19:39:58Z

@detiber License notices added, squashed commits.

detiber · 2018-08-30T20:13:35Z

/ok-to-test
/lgtm

detiber · 2018-08-30T20:15:26Z

/approve

k8s-ci-robot · 2018-08-30T20:15:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: detiber, vincepri

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [detiber]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…same-ami Make all examples use ami-060f14ef82deddfc6

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 27, 2018

k8s-ci-robot requested review from chuckha and detiber August 27, 2018 03:07

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 27, 2018

detiber reviewed Aug 27, 2018

View reviewed changes

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Aug 27, 2018

detiber reviewed Aug 27, 2018

View reviewed changes

vincepri mentioned this pull request Aug 29, 2018

Add support for containerd-based images vmware-archive/wardroom#79

Open

detiber added this to the Initial MVP milestone Aug 30, 2018

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 30, 2018

vincepri changed the title ~~WIP: image stamping~~ base for image stamping Aug 30, 2018

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 30, 2018

vincepri force-pushed the aws-images branch from 2b87871 to b02ed16 Compare August 30, 2018 17:39

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Aug 30, 2018

detiber reviewed Aug 30, 2018

View reviewed changes

add base for packer and ansible

cf98032

Signed-off-by: Vince Prignano <vince@vincepri.com>

vincepri force-pushed the aws-images branch from 0da18c5 to cf98032 Compare August 30, 2018 19:38

k8s-ci-robot assigned detiber Aug 30, 2018

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 30, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 30, 2018

k8s-ci-robot merged commit f103494 into kubernetes-sigs:master Aug 30, 2018

vincepri mentioned this pull request Sep 19, 2018

REQUEST: New membership for vincepri kubernetes/org#102

Closed

6 tasks

enxebre pushed a commit to enxebre/cluster-api-provider-aws-2 that referenced this pull request Sep 28, 2018

Merge pull request kubernetes-sigs#25 from frobware/all-examples-use-…

3c2108a

…same-ami Make all examples use ami-060f14ef82deddfc6

vincepri deleted the aws-images branch October 15, 2018 19:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

base for image stamping #25

base for image stamping #25

vincepri commented Aug 27, 2018 •

edited

Loading

chuckha commented Aug 27, 2018

detiber Aug 27, 2018

detiber Aug 27, 2018

detiber Aug 27, 2018

detiber Aug 27, 2018

detiber Aug 27, 2018

detiber Aug 27, 2018

detiber Aug 27, 2018

detiber Aug 27, 2018

detiber Aug 27, 2018

detiber commented Aug 27, 2018

vincepri commented Aug 27, 2018

detiber commented Aug 27, 2018

detiber Aug 27, 2018

detiber Aug 30, 2018

vincepri Aug 30, 2018

detiber Aug 30, 2018

vincepri Aug 30, 2018

vincepri commented Aug 30, 2018

chuckha commented Aug 30, 2018

vincepri commented Aug 30, 2018

detiber left a comment

detiber Aug 30, 2018

vincepri commented Aug 30, 2018

detiber commented Aug 30, 2018

detiber commented Aug 30, 2018

k8s-ci-robot commented Aug 30, 2018

		@@ -0,0 +1,9 @@
		---
		kubernetes_version: "{{ kubernetes.version if kubernetes_version_defined else '1.9.3-00' }}"

base for image stamping #25

base for image stamping #25

Conversation

vincepri commented Aug 27, 2018 • edited Loading

chuckha commented Aug 27, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

detiber commented Aug 27, 2018

vincepri commented Aug 27, 2018

detiber commented Aug 27, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vincepri commented Aug 30, 2018

chuckha commented Aug 30, 2018

vincepri commented Aug 30, 2018

detiber left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vincepri commented Aug 30, 2018

detiber commented Aug 30, 2018

detiber commented Aug 30, 2018

k8s-ci-robot commented Aug 30, 2018

vincepri commented Aug 27, 2018 •

edited

Loading