Skip to content

K
k3s
Commit abe9d2f7 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #54150 from ihmccreery/mdc-e2e

Automatic merge from submit-queue (batch tested with PRs 54112, 54150, 53816, 54321, 54338). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Enable metadata concealment for tests **What this PR does / why we need it**: Metadata concealment is going to beta for v1.9; enable it by default in tests. Also, just use `ENABLE_METADATA_CONCEALMENT` instead of two different vars. Work toward #8867. **Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: none **Special notes for your reviewer**: **Release note**: ```release-note Metadata concealment on GCE is now controlled by the `ENABLE_METADATA_CONCEALMENT` env var. See cluster/gce/config-default.sh for more info. ```
parents b3205553 6c1f63ab
Hide whitespace changes
Inline Side-by-side
Showing with 22 additions and 23 deletions
cluster/common.sh
View file @ abe9d2f7
...@@ -752,16 +752,6 @@ EOF ...@@ -752,16 +752,6 @@ EOF
ENABLE_CUSTOM_METRICS: $(yaml-quote ${ENABLE_CUSTOM_METRICS}) ENABLE_CUSTOM_METRICS: $(yaml-quote ${ENABLE_CUSTOM_METRICS})
EOF EOF
fi fi
if [ -n "${ENABLE_METADATA_PROXY:-}" ]; then
cat >>$file <<EOF
ENABLE_METADATA_PROXY: $(yaml-quote ${ENABLE_METADATA_PROXY})
EOF
fi
if [ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]; then
cat >>$file <<EOF
KUBE_FIREWALL_METADATA_SERVER: $(yaml-quote ${KUBE_FIREWALL_METADATA_SERVER})
EOF
fi
if [ -n "${FEATURE_GATES:-}" ]; then if [ -n "${FEATURE_GATES:-}" ]; then
cat >>$file <<EOF cat >>$file <<EOF
FEATURE_GATES: $(yaml-quote ${FEATURE_GATES}) FEATURE_GATES: $(yaml-quote ${FEATURE_GATES})
......
cluster/gce/config-default.sh
View file @ abe9d2f7
...@@ -154,12 +154,16 @@ if [[ ${NETWORK_POLICY_PROVIDER:-} == "calico" ]]; then ...@@ -154,12 +154,16 @@ if [[ ${NETWORK_POLICY_PROVIDER:-} == "calico" ]]; then
NODE_LABELS="${NODE_LABELS},projectcalico.org/ds-ready=true" NODE_LABELS="${NODE_LABELS},projectcalico.org/ds-ready=true"
fi fi
# Currently, ENABLE_METADATA_PROXY supports only "simple". In the future, we # Enable metadata concealment by firewalling pod traffic to the metadata server
# may add other options. # and run a proxy daemonset on nodes.
ENABLE_METADATA_PROXY="${ENABLE_METADATA_PROXY:-}" #
# Apply the right node label if metadata proxy is on. # TODO(#8867) Enable by default.
if [[ ${ENABLE_METADATA_PROXY:-} == "simple" ]]; then ENABLE_METADATA_CONCEALMENT="${ENABLE_METADATA_CONCEALMENT:-false}" # true, false
NODE_LABELS="${NODE_LABELS},beta.kubernetes.io/metadata-proxy-ready=true" if [[ ${ENABLE_METADATA_CONCEALMENT:-} == "true" ]]; then
# Put the necessary label on the node so the daemonset gets scheduled.
NODE_LABELS="${NODE_LABELS},beta.kubernetes.io/metadata-proxy-ready=true"
# Add to the provider custom variables.
PROVIDER_VARS="${PROVIDER_VARS:-} ENABLE_METADATA_CONCEALMENT"
fi fi
# Optional: Enable node logging. # Optional: Enable node logging.
......
cluster/gce/config-test.sh
View file @ abe9d2f7
...@@ -205,9 +205,14 @@ if [[ ${NETWORK_POLICY_PROVIDER:-} == "calico" ]]; then ...@@ -205,9 +205,14 @@ if [[ ${NETWORK_POLICY_PROVIDER:-} == "calico" ]]; then
NODE_LABELS="$NODE_LABELS,projectcalico.org/ds-ready=true" NODE_LABELS="$NODE_LABELS,projectcalico.org/ds-ready=true"
fi fi
# Apply the right node label if metadata proxy is on. # Enable metadata concealment by firewalling pod traffic to the metadata server
if [[ ${ENABLE_METADATA_PROXY:-} == "simple" ]]; then # and run a proxy daemonset on nodes.
NODE_LABELS="${NODE_LABELS},beta.kubernetes.io/metadata-proxy-ready=true" ENABLE_METADATA_CONCEALMENT="${ENABLE_METADATA_CONCEALMENT:-true}" # true, false
if [[ ${ENABLE_METADATA_CONCEALMENT:-} == "true" ]]; then
# Put the necessary label on the node so the daemonset gets scheduled.
NODE_LABELS="${NODE_LABELS},beta.kubernetes.io/metadata-proxy-ready=true"
# Add to the provider custom variables.
PROVIDER_VARS="${PROVIDER_VARS:-} ENABLE_METADATA_CONCEALMENT"
fi fi
# Optional: Enable node logging. # Optional: Enable node logging.
......
cluster/gce/configure-vm.sh
View file @ abe9d2f7
...@@ -93,7 +93,7 @@ function config-ip-firewall { ...@@ -93,7 +93,7 @@ function config-ip-firewall {
iptables -N KUBE-METADATA-SERVER iptables -N KUBE-METADATA-SERVER
iptables -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER iptables -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER
if [[ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]]; then if [[ -n "${ENABLE_METADATA_CONCEALMENT:-}" ]]; then
iptables -A KUBE-METADATA-SERVER -j DROP iptables -A KUBE-METADATA-SERVER -j DROP
fi fi
} }
...@@ -419,7 +419,7 @@ enable_cluster_ui: '$(echo "$ENABLE_CLUSTER_UI" | sed -e "s/'/''/g")' ...@@ -419,7 +419,7 @@ enable_cluster_ui: '$(echo "$ENABLE_CLUSTER_UI" | sed -e "s/'/''/g")'
enable_node_problem_detector: '$(echo "$ENABLE_NODE_PROBLEM_DETECTOR" | sed -e "s/'/''/g")' enable_node_problem_detector: '$(echo "$ENABLE_NODE_PROBLEM_DETECTOR" | sed -e "s/'/''/g")'
enable_l7_loadbalancing: '$(echo "$ENABLE_L7_LOADBALANCING" | sed -e "s/'/''/g")' enable_l7_loadbalancing: '$(echo "$ENABLE_L7_LOADBALANCING" | sed -e "s/'/''/g")'
enable_node_logging: '$(echo "$ENABLE_NODE_LOGGING" | sed -e "s/'/''/g")' enable_node_logging: '$(echo "$ENABLE_NODE_LOGGING" | sed -e "s/'/''/g")'
enable_metadata_proxy: '$(echo "$ENABLE_METADATA_PROXY" | sed -e "s/'/''/g")' enable_metadata_proxy: '$(echo "$ENABLE_METADATA_CONCEALMENT" | sed -e "s/'/''/g")'
enable_metrics_server: '$(echo "$ENABLE_METRICS_SERVER" | sed -e "s/'/''/g")' enable_metrics_server: '$(echo "$ENABLE_METRICS_SERVER" | sed -e "s/'/''/g")'
enable_rescheduler: '$(echo "$ENABLE_RESCHEDULER" | sed -e "s/'/''/g")' enable_rescheduler: '$(echo "$ENABLE_RESCHEDULER" | sed -e "s/'/''/g")'
logging_destination: '$(echo "$LOGGING_DESTINATION" | sed -e "s/'/''/g")' logging_destination: '$(echo "$LOGGING_DESTINATION" | sed -e "s/'/''/g")'
......
cluster/gce/gci/configure-helper.sh
View file @ abe9d2f7
...@@ -52,7 +52,7 @@ function config-ip-firewall { ...@@ -52,7 +52,7 @@ function config-ip-firewall {
iptables -N KUBE-METADATA-SERVER iptables -N KUBE-METADATA-SERVER
iptables -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER iptables -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER
if [[ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]]; then if [[ -n "${ENABLE_METADATA_CONCEALMENT:-}" ]]; then
iptables -A KUBE-METADATA-SERVER -j DROP iptables -A KUBE-METADATA-SERVER -j DROP
fi fi
} }
...@@ -1862,7 +1862,7 @@ EOF ...@@ -1862,7 +1862,7 @@ EOF
if [[ "${ENABLE_IP_MASQ_AGENT:-}" == "true" ]]; then if [[ "${ENABLE_IP_MASQ_AGENT:-}" == "true" ]]; then
setup-addon-manifests "addons" "ip-masq-agent" setup-addon-manifests "addons" "ip-masq-agent"
fi fi
if [[ "${ENABLE_METADATA_PROXY:-}" == "simple" ]]; then if [[ "${ENABLE_METADATA_CONCEALMENT:-}" == "true" ]]; then
setup-addon-manifests "addons" "metadata-proxy/gce" setup-addon-manifests "addons" "metadata-proxy/gce"
fi fi
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment