natalie
/
nixpkgs-custom
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #33954 from kuznero/pr/kubernetes 

kubernetes: 1.7.9 -> 1.9.1
release-18.03-flake
Tim Steinbach 2018-02-16 13:56:59 +00:00 committed by GitHub
parent b2f39f97d0 f44a81e19f
commit 87559028ef
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 19 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/modules/services/cluster/kubernetes/dashboard.nix
View File

@ -6,12 +6,12 @@ let
cfg = config.services.kubernetes.addons.dashboard;
name = "gcr.io/google_containers/kubernetes-dashboard-amd64";
version = "v1.6.3";
version = "v1.8.2";
image = pkgs.dockerTools.pullImage {
imageName = name;
imageTag = version;
sha256 = "1sf54d96nkgic9hir9c6p14gw24ns1k5d5a0r1sg414kjrvic0b4";
sha256 = "11h0fz3wxp0f10fsyqaxjm7l2qg7xws50dv5iwlck5gb1fjmajad";
};
in {
options.services.kubernetes.addons.dashboard = {

6
nixos/modules/services/cluster/kubernetes/default.nix
View File

@ -301,8 +301,8 @@ in {
Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
<link xlink:href="http://kubernetes.io/docs/admin/authorization.html"/>
'';
default = ["RBAC"];
type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC"]);
default = ["RBAC" "Node"];
type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC" "Node"]);
};
authorizationPolicy = mkOption {
@ -344,7 +344,7 @@ in {
Kubernetes admission control plugins to use. See
<link xlink:href="http://kubernetes.io/docs/admin/admission-controllers/"/>
'';
default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota" "DefaultStorageClass" "DefaultTolerationSeconds"];
default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota" "DefaultStorageClass" "DefaultTolerationSeconds" "NodeRestriction"];
example = [
"NamespaceLifecycle" "NamespaceExists" "LimitRanger"
"SecurityContextDeny" "ServiceAccount" "ResourceQuota"

2
nixos/tests/kubernetes/base.nix
View File

@ -7,7 +7,7 @@ let
mkKubernetesBaseTest =
{ name, domain ? "my.zyx", test, machines
, pkgs ? import <nixpkgs> { inherit system; }
, certs ? import ./certs.nix { inherit pkgs; externalDomain = domain; }
, certs ? import ./certs.nix { inherit pkgs; externalDomain = domain; kubelets = attrNames machines; }
, extraConfiguration ? null }:
let
masterName = head (filter (machineName: any (role: role == "master") machines.${machineName}.roles) (attrNames machines));

11
nixos/tests/kubernetes/certs.nix
View File

@ -2,7 +2,8 @@
pkgs ? import <nixpkgs> {},
internalDomain ? "cloud.yourdomain.net",
externalDomain ? "myawesomecluster.cluster.yourdomain.net",
serviceClusterIp ? "10.0.0.1"
serviceClusterIp ? "10.0.0.1",
kubelets
}:
let
runWithCFSSL = name: cmd:
@ -123,9 +124,10 @@ let
};
apiserver-client = {
kubelet = createClientCertKey {
kubelet = hostname: createClientCertKey {
inherit ca;
cn = "apiserver-client-kubelet";
name = "apiserver-client-kubelet-${hostname}";
cn = "system:node:${hostname}.${externalDomain}";
groups = ["system:nodes"];
};
@ -175,10 +177,9 @@ in {
paths = [
(writeCFSSL (noKey ca))
(writeCFSSL kubelet)
(writeCFSSL apiserver-client.kubelet)
(writeCFSSL apiserver-client.kube-proxy)
(writeCFSSL etcd-client)
];
] ++ map (hostname: writeCFSSL (apiserver-client.kubelet hostname)) kubelets;
};
admin = writeCFSSL apiserver-client.admin;

2
nixos/tests/kubernetes/dns.nix
View File

@ -3,7 +3,7 @@ with import ./base.nix { inherit system; };
let
domain = "my.zyx";
certs = import ./certs.nix { externalDomain = domain; };
certs = import ./certs.nix { externalDomain = domain; kubelets = [ "machine1" "machine2" ]; };
redisPod = pkgs.writeText "redis-pod.json" (builtins.toJSON {
kind = "Pod";

4
nixos/tests/kubernetes/kubernetes-common.nix
View File

@ -29,8 +29,8 @@ let
tlsKeyFile = "${certs.worker}/kubelet-key.pem";
hostname = "${config.networking.hostName}.${config.networking.domain}";
kubeconfig = {
certFile = "${certs.worker}/apiserver-client-kubelet.pem";
keyFile = "${certs.worker}/apiserver-client-kubelet-key.pem";
certFile = "${certs.worker}/apiserver-client-kubelet-${config.networking.hostName}.pem";
keyFile = "${certs.worker}/apiserver-client-kubelet-${config.networking.hostName}-key.pem";
};
};
controllerManager = {

4
pkgs/applications/networking/cluster/kubecfg/default.nix
View File

@ -1,6 +1,6 @@
{ lib, buildGoPackage, fetchFromGitHub, ... }:
let version = "0.5.0"; in
let version = "0.6.0"; in
buildGoPackage {
name = "kubecfg-${version}";
@ -9,7 +9,7 @@ buildGoPackage {
owner = "ksonnet";
repo = "kubecfg";
rev = "v${version}";
sha256 = "1s8w133p8qkj3dr73jimajm9ddp678lw9k9symj8rjw5p35igr93";
sha256 = "12kv1p707kdxjx5l8rcikd1gjwp5xjxdmmyvlpnvyagrphgrwpsf";
};
goPackagePath = "github.com/ksonnet/kubecfg";

6
pkgs/applications/networking/cluster/kubernetes/default.nix
View File

@ -8,8 +8,6 @@
"cmd/kube-controller-manager"
"cmd/kube-proxy"
"plugin/cmd/kube-scheduler"
"federation/cmd/federation-apiserver"
"federation/cmd/federation-controller-manager"
"test/e2e/e2e.test"
]
}:
@ -18,13 +16,13 @@ with lib;
stdenv.mkDerivation rec {
name = "kubernetes-${version}";
version = "1.7.9";
version = "1.9.1";
src = fetchFromGitHub {
owner = "kubernetes";
repo = "kubernetes";
rev = "v${version}";
sha256 = "0lxagvv8mysw6n0vp5vsccl87b628dgsjrf298dx2dqx7wn7zjgi";
sha256 = "1dmq2g138h7fsswmq4l47b44gsl9anmm3ywqyi7y48f1rkvc11mk";
};
buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];