From c3353fba5de7d3c55aa110a8dfd20344be6079b5 Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Thu, 6 Jul 2017 12:25:50 -0700 Subject: [PATCH 1/8] initial commit --- Dockerfile | 26 ++++++ config.json.template | 184 +++++++++++++++++++++++++++++++++++++++++++ launch.sh | 8 ++ service.template | 12 +++ 4 files changed, 230 insertions(+) create mode 100644 Dockerfile create mode 100644 config.json.template create mode 100644 launch.sh create mode 100644 service.template diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..348d60f --- /dev/null +++ b/Dockerfile @@ -0,0 +1,26 @@ +FROM registry.fedoraproject.org/kubernetes-master:rawhide +MAINTAINER "Jason Brooks" + +ENV container=docker + +ENV NAME=kubernetes-apiserver VERSION=0.1 RELEASE=8 ARCH=x86_64 +LABEL bzcomponent="$NAME" \ + name="$FGC/$NAME" \ + version="$VERSION" \ + release="$RELEASE.$DISTTAG" \ + architecture="$ARCH" \ + atomic.type='system' + +COPY launch.sh /usr/bin/kube-apiserver-docker.sh + +RUN chmod +x /usr/bin/kube-apiserver + +LABEL RUN /usr/bin/docker/ run -d --net=host -p 443:443 + +COPY service.template config.json.template /exports/ + +RUN mkdir -p /exports/hostfs/usr/local/bin/ && cp /usr/bin/kubectl /exports/hostfs/usr/local/bin/kubectl + +RUN mkdir -p /exports/hostfs/etc/kubernetes && cp /etc/kubernetes/{config,apiserver} /exports/hostfs/etc/kubernetes + +ENTRYPOINT ["/usr/bin/kube-apiserver-docker.sh"] diff --git a/config.json.template b/config.json.template new file mode 100644 index 0000000..8a58c2a --- /dev/null +++ b/config.json.template @@ -0,0 +1,184 @@ +{ + "ociVersion": "1.0.0", + "platform": { + "os": "linux", + "arch": "amd64" + }, + "process": { + "terminal": false, + "user": { + "uid": 994, + "gid": 996 + }, + "args": [ + "/usr/bin/kube-apiserver-docker.sh" + ], + "env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm" + ], + "cwd": "/", + "capabilities": { + "bounding": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_DAC_READ_SEARCH" + ], + "permitted": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_DAC_READ_SEARCH" + ], + "inheritable": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_DAC_READ_SEARCH" + ], + "effective": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_DAC_READ_SEARCH" + ], + "ambient": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_DAC_READ_SEARCH" + ] + }, + "rlimits": [ + { + "type": "RLIMIT_NOFILE", + "hard": 1024, + "soft": 1024 + } + ] + }, + "root": { + "path": "rootfs", + "readonly": true + }, + "mounts": [ + { + "destination": "/proc", + "type": "proc", + "source": "proc" + }, + { + "destination": "/dev", + "type": "tmpfs", + "source": "tmpfs", + "options": [ + "nosuid", + "strictatime", + "mode=755", + "size=65536k" + ] + }, + { + "destination": "/dev/pts", + "type": "devpts", + "source": "devpts", + "options": [ + "nosuid", + "noexec", + "newinstance", + "ptmxmode=0666", + "mode=0620", + "gid=5" + ] + }, + { + "destination": "/dev/shm", + "type": "tmpfs", + "source": "shm", + "options": [ + "nosuid", + "noexec", + "nodev", + "mode=1777", + "size=65536k" + ] + }, + { + "destination": "/dev/mqueue", + "type": "mqueue", + "source": "mqueue", + "options": [ + "nosuid", + "noexec", + "nodev" + ] + }, + { + "destination": "/sys", + "type": "sysfs", + "source": "sysfs", + "options": [ + "nosuid", + "noexec", + "nodev" + ] + }, + { + "destination": "/sys/fs/cgroup", + "type": "cgroup", + "source": "cgroup", + "options": [ + "nosuid", + "noexec", + "nodev", + "relatime", + "ro" + ] + }, + { + "type": "bind", + "source": "/etc/kubernetes", + "destination": "/etc/kubernetes", + "options": [ + "rbind", + "ro", + "rprivate" + ] + }, + { + "destination": "/etc/resolv.conf", + "type": "bind", + "source": "/etc/resolv.conf", + "options": [ + "ro", + "rbind", + "rprivate" + ] + } + ], + "linux": { + "resources": { + "devices": [ + { + "allow": false, + "access": "rwm" + } + ] + }, + "namespaces": [ + { + "type": "pid" + }, + { + "type": "ipc" + }, + { + "type": "mount" + } + ], + "devices": null, + "apparmorProfile": "", + "selinuxProcessLabel": "" + } +} diff --git a/launch.sh b/launch.sh new file mode 100644 index 0000000..feb0ebd --- /dev/null +++ b/launch.sh @@ -0,0 +1,8 @@ +#!/bin/bash + +source /etc/kubernetes/apiserver +source /etc/kubernetes/config + +ARGS=$(echo "$@ $KUBE_LOGTOSTDERR $KUBE_LOG_LEVEL $KUBE_ETCD_SERVERS $KUBE_API_ADDRESS $KUBE_API_PORT $KUBELET_PORT $KUBE_ALLOW_PRIV $KUBE_SERVICE_ADDRESSES $KUBE_ADMISSION_CONTROL $KUBE_API_ARGS" | xargs -n1 | sort -u -t = -k 1,1 | xargs) + +exec /usr/bin/kube-apiserver $ARGS diff --git a/service.template b/service.template new file mode 100644 index 0000000..d895a99 --- /dev/null +++ b/service.template @@ -0,0 +1,12 @@ +[Unit] +Description=kubernetes-apiserver + +[Service] +ExecStart=$EXEC_START +ExecStop=$EXEC_STOP +Restart=on-failure +WorkingDirectory=$DESTDIR + +[Install] +WantedBy=multi-user.target + From 178aa6caf33bb08caeacd4767a57a0c7ae7e55b7 Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Thu, 6 Jul 2017 13:00:05 -0700 Subject: [PATCH 2/8] fix BZComponent capitalization --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 348d60f..4603801 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ MAINTAINER "Jason Brooks" ENV container=docker ENV NAME=kubernetes-apiserver VERSION=0.1 RELEASE=8 ARCH=x86_64 -LABEL bzcomponent="$NAME" \ +LABEL BZComponent="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ release="$RELEASE.$DISTTAG" \ From 2be605a4aacdf0a85fa57dce6498757f37e6c0aa Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Thu, 6 Jul 2017 13:50:18 -0700 Subject: [PATCH 3/8] build from f27 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 4603801..ffc968f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM registry.fedoraproject.org/kubernetes-master:rawhide +FROM registry.fedoraproject.org/kubernetes-master:f27 MAINTAINER "Jason Brooks" ENV container=docker From bb8789bd1923c3a66ed7c12036d5d8755a389c3e Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Thu, 6 Jul 2017 13:53:17 -0700 Subject: [PATCH 4/8] build from f27 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index ffc968f..564178e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM registry.fedoraproject.org/kubernetes-master:f27 +FROM registry.fedoraproject.org/f27/kubernetes-master:latest MAINTAINER "Jason Brooks" ENV container=docker From 776d5ac79d0d0ac5c5294d5fa8b58345c1418082 Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Thu, 20 Jul 2017 14:24:38 -0700 Subject: [PATCH 5/8] version 1.7.1, don't sort args --- Dockerfile | 4 ++-- launch.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 564178e..e36f385 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,9 @@ -FROM registry.fedoraproject.org/f27/kubernetes-master:latest +FROM candidate-registry.fedoraproject.org/f27/kubernetes-node:1.7.1 MAINTAINER "Jason Brooks" ENV container=docker -ENV NAME=kubernetes-apiserver VERSION=0.1 RELEASE=8 ARCH=x86_64 +ENV NAME=kubernetes-apiserver VERSION=1.7.1 RELEASE=0 ARCH=x86_64 LABEL BZComponent="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ diff --git a/launch.sh b/launch.sh index feb0ebd..534fa58 100644 --- a/launch.sh +++ b/launch.sh @@ -3,6 +3,6 @@ source /etc/kubernetes/apiserver source /etc/kubernetes/config -ARGS=$(echo "$@ $KUBE_LOGTOSTDERR $KUBE_LOG_LEVEL $KUBE_ETCD_SERVERS $KUBE_API_ADDRESS $KUBE_API_PORT $KUBELET_PORT $KUBE_ALLOW_PRIV $KUBE_SERVICE_ADDRESSES $KUBE_ADMISSION_CONTROL $KUBE_API_ARGS" | xargs -n1 | sort -u -t = -k 1,1 | xargs) +ARGS="$@ $KUBE_LOGTOSTDERR $KUBE_LOG_LEVEL $KUBE_ETCD_SERVERS $KUBE_API_ADDRESS $KUBE_API_PORT $KUBELET_PORT $KUBE_ALLOW_PRIV $KUBE_SERVICE_ADDRESSES $KUBE_ADMISSION_CONTROL $KUBE_API_ARGS" exec /usr/bin/kube-apiserver $ARGS From 85566a57dece9b05f916ea8b3ed6d3899df02722 Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Thu, 20 Jul 2017 14:28:03 -0700 Subject: [PATCH 6/8] fix FROM --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index e36f385..b386efb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM candidate-registry.fedoraproject.org/f27/kubernetes-node:1.7.1 +FROM candidate-registry.fedoraproject.org/f27/kubernetes-master:1.7.1 MAINTAINER "Jason Brooks" ENV container=docker From 51b38c026272d1cd2b09f8c3b7f5dfb8a95ab1dd Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Tue, 28 Nov 2017 12:49:30 -0800 Subject: [PATCH 7/8] fix uid/gid, bind mount /var/run/kubernetes --- Dockerfile | 6 +++--- config.json.template | 13 +++++++++++-- launch.sh | 0 tmpfiles.template | 1 + 4 files changed, 15 insertions(+), 5 deletions(-) mode change 100644 => 100755 launch.sh create mode 100644 tmpfiles.template diff --git a/Dockerfile b/Dockerfile index b386efb..e3c35cb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,9 @@ -FROM candidate-registry.fedoraproject.org/f27/kubernetes-master:1.7.1 +FROM registry.fedoraproject.org/kubernetes-master:rawhide MAINTAINER "Jason Brooks" ENV container=docker -ENV NAME=kubernetes-apiserver VERSION=1.7.1 RELEASE=0 ARCH=x86_64 +ENV NAME=kubernetes-apiserver VERSION=0 RELEASE=0 ARCH=x86_64 LABEL BZComponent="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ @@ -17,7 +17,7 @@ RUN chmod +x /usr/bin/kube-apiserver LABEL RUN /usr/bin/docker/ run -d --net=host -p 443:443 -COPY service.template config.json.template /exports/ +COPY service.template config.json.template tmpfiles.template /exports/ RUN mkdir -p /exports/hostfs/usr/local/bin/ && cp /usr/bin/kubectl /exports/hostfs/usr/local/bin/kubectl diff --git a/config.json.template b/config.json.template index 8a58c2a..ec6bae5 100644 --- a/config.json.template +++ b/config.json.template @@ -7,8 +7,8 @@ "process": { "terminal": false, "user": { - "uid": 994, - "gid": 996 + "uid": 996, + "gid": 994 }, "args": [ "/usr/bin/kube-apiserver-docker.sh" @@ -155,6 +155,15 @@ "rbind", "rprivate" ] + }, + { + "destination": "/var/run/kubernetes", + "type": "bind", + "source": "/var/run/kubernetes", + "options": [ + "rw", + "rbind" + ] } ], "linux": { diff --git a/launch.sh b/launch.sh old mode 100644 new mode 100755 diff --git a/tmpfiles.template b/tmpfiles.template new file mode 100644 index 0000000..0fc3bdf --- /dev/null +++ b/tmpfiles.template @@ -0,0 +1 @@ +d /var/run/kubernetes 0755 kube kube - From 1c35a2501b0fbfa7c86fd7be09bb9e8e3e06b99e Mon Sep 17 00:00:00 2001 From: Bhavin Gandhi Date: Tue, 21 Aug 2018 23:18:40 +0530 Subject: [PATCH 8/8] Drop Release label in favor of OSBS release_bump plugin OSBS can automatically bump the release number, for that we just need to drop the label from the Dockerfile See https://pagure.io/ContainerSIG/container-sig/issue/1 Signed-off-by: Bhavin Gandhi --- Dockerfile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index e3c35cb..84d5631 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,11 +3,10 @@ MAINTAINER "Jason Brooks" ENV container=docker -ENV NAME=kubernetes-apiserver VERSION=0 RELEASE=0 ARCH=x86_64 +ENV NAME=kubernetes-apiserver VERSION=0 ARCH=x86_64 LABEL BZComponent="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ - release="$RELEASE.$DISTTAG" \ architecture="$ARCH" \ atomic.type='system'