From d1aa7da9f1328cb9945a18bc6c649e3e322b7cf4 Mon Sep 17 00:00:00 2001 From: Bo Huang Date: Tue, 18 Aug 2020 15:26:30 -0700 Subject: [PATCH 1/4] Fix SELinux label of bootstrap-secrets --- aws/fedora-coreos/kubernetes/fcc/controller.yaml | 1 + azure/fedora-coreos/kubernetes/fcc/controller.yaml | 1 + bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml | 1 + digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml | 1 + google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml | 1 + 5 files changed, 5 insertions(+) diff --git a/aws/fedora-coreos/kubernetes/fcc/controller.yaml b/aws/fedora-coreos/kubernetes/fcc/controller.yaml index eff6fff79..1fd2cf566 100644 --- a/aws/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/aws/fedora-coreos/kubernetes/fcc/controller.yaml @@ -160,6 +160,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking + chcon -R -u system_u /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: diff --git a/azure/fedora-coreos/kubernetes/fcc/controller.yaml b/azure/fedora-coreos/kubernetes/fcc/controller.yaml index 6949ba04e..e049f965c 100644 --- a/azure/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/azure/fedora-coreos/kubernetes/fcc/controller.yaml @@ -159,6 +159,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking + chcon -R -u system_u /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: diff --git a/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml b/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml index 4fa1342fa..f57fa7086 100644 --- a/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml @@ -170,6 +170,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking + chcon -R -u system_u /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: diff --git a/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml b/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml index 7e404fc20..dd244bd5a 100644 --- a/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml @@ -166,6 +166,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking + chcon -R -u system_u /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: diff --git a/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml b/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml index 5dbf6a4ee..83ef0c96e 100644 --- a/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml @@ -159,6 +159,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking + chcon -R -u system_u /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: From 759ec814dc241fc9dfb79f4cc6a561d93a565aaa Mon Sep 17 00:00:00 2001 From: Bo Huang Date: Tue, 18 Aug 2020 15:53:47 -0700 Subject: [PATCH 2/4] update changelog --- CHANGES.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index 3b7952e25..b9499b958 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -33,6 +33,8 @@ Notable changes between versions. ### Fedora CoreOS +* Fix SELinux label of bootstrap-secrets on non-bootstrapping controllers ([#808](https://github.com/poseidon/typhoon/pull/808)) + * Fix support for Flannel with Fedora CoreOS ([#795](https://github.com/poseidon/typhoon/pull/795)) * Configure `flannel.1` link to select its own MAC address to solve flannel pod-to-pod traffic drops starting with default link changes in Fedora CoreOS From a488509155eada7b1eff938fea97f1b0af9cc216 Mon Sep 17 00:00:00 2001 From: Bo Huang Date: Wed, 19 Aug 2020 09:09:52 -0700 Subject: [PATCH 3/4] mv changelog under latest --- CHANGES.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index b9499b958..fc9b7d132 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -4,7 +4,11 @@ Notable changes between versions. ## Latest -### v1.18.8 +### Fedora CoreOS + +* Fix SELinux label of bootstrap-secrets on non-bootstrapping controllers ([#808](https://github.com/poseidon/typhoon/pull/808)) + +## v1.18.8 * Kubernetes [v1.18.8](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1188) * Migrate from Terraform v0.12.x to v0.13.x ([#804](https://github.com/poseidon/typhoon/pull/804)) (**action required**) @@ -33,8 +37,6 @@ Notable changes between versions. ### Fedora CoreOS -* Fix SELinux label of bootstrap-secrets on non-bootstrapping controllers ([#808](https://github.com/poseidon/typhoon/pull/808)) - * Fix support for Flannel with Fedora CoreOS ([#795](https://github.com/poseidon/typhoon/pull/795)) * Configure `flannel.1` link to select its own MAC address to solve flannel pod-to-pod traffic drops starting with default link changes in Fedora CoreOS From 4ef47ff992c8b8d7d0e1af45511d674459401ac5 Mon Sep 17 00:00:00 2001 From: Bo Huang Date: Wed, 19 Aug 2020 19:39:15 -0700 Subject: [PATCH 4/4] fix type label --- aws/fedora-coreos/kubernetes/fcc/controller.yaml | 2 +- azure/fedora-coreos/kubernetes/fcc/controller.yaml | 2 +- bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml | 2 +- digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml | 2 +- google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/aws/fedora-coreos/kubernetes/fcc/controller.yaml b/aws/fedora-coreos/kubernetes/fcc/controller.yaml index 1fd2cf566..0b04e113d 100644 --- a/aws/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/aws/fedora-coreos/kubernetes/fcc/controller.yaml @@ -160,7 +160,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking - chcon -R -u system_u /etc/kubernetes/bootstrap-secrets + chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: diff --git a/azure/fedora-coreos/kubernetes/fcc/controller.yaml b/azure/fedora-coreos/kubernetes/fcc/controller.yaml index e049f965c..8e90442f4 100644 --- a/azure/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/azure/fedora-coreos/kubernetes/fcc/controller.yaml @@ -159,7 +159,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking - chcon -R -u system_u /etc/kubernetes/bootstrap-secrets + chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: diff --git a/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml b/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml index f57fa7086..9ca7657b7 100644 --- a/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/bare-metal/fedora-coreos/kubernetes/fcc/controller.yaml @@ -170,7 +170,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking - chcon -R -u system_u /etc/kubernetes/bootstrap-secrets + chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: diff --git a/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml b/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml index dd244bd5a..e72786726 100644 --- a/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/digital-ocean/fedora-coreos/kubernetes/fcc/controller.yaml @@ -166,7 +166,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking - chcon -R -u system_u /etc/kubernetes/bootstrap-secrets + chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: diff --git a/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml b/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml index 83ef0c96e..a3ac0401e 100644 --- a/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml +++ b/google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml @@ -159,7 +159,7 @@ storage: mv manifests /opt/bootstrap/assets/manifests mv manifests-networking/* /opt/bootstrap/assets/manifests/ rm -rf assets auth static-manifests tls manifests-networking - chcon -R -u system_u /etc/kubernetes/bootstrap-secrets + chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets - path: /opt/bootstrap/apply mode: 0544 contents: