From 8bf131dcbc3cbd6d915089da94d6214b18c17b1d Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Fri, 7 Jul 2017 09:47:55 -0700 Subject: [PATCH 1/6] import from rawhide --- Dockerfile | 25 +++ config.json.template | 403 +++++++++++++++++++++++++++++++++++++++++++ launch.sh | 10 ++ service.template | 13 ++ 4 files changed, 451 insertions(+) create mode 100644 Dockerfile create mode 100644 config.json.template create mode 100644 launch.sh create mode 100644 service.template diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..afbd975 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,25 @@ +FROM registry.fedoraproject.org/f26/kubernetes-node:latest +MAINTAINER "Jason Brooks" + +ENV container=docker + +ENV NAME=kubernetes-kubelet VERSION=0 RELEASE=0 ARCH=x86_64 +LABEL BZComponent="$NAME" \ + name="$FGC/$NAME" \ + version="$VERSION" \ + release="$RELEASE.$DISTTAG" \ + architecture="$ARCH" \ + atomic.type='system' + +# Containerized kubelet requires nsenter +RUN dnf install -y util-linux ethtool && dnf clean all + +LABEL RUN /usr/bin/docker run -d --privileged --net=host --pid=host -v /:/rootfs:ro -v /sys:/sys:rw -v /var/run:/var/run:rw -v /run:/run:rw -v /var/lib/docker:/var/lib/docker:rw -v /var/lib/kubelet:/var/lib/kubelet:slave -v /var/log/containers:/var/log/containers:rw + +COPY launch.sh /usr/bin/kubelet-docker.sh + +COPY service.template config.json.template /exports/ + +RUN mkdir -p /exports/hostfs/etc/kubernetes && cp /etc/kubernetes/{config,kubelet} /exports/hostfs/etc/kubernetes + +ENTRYPOINT ["/usr/bin/kubelet-docker.sh"] diff --git a/config.json.template b/config.json.template new file mode 100644 index 0000000..0e64af2 --- /dev/null +++ b/config.json.template @@ -0,0 +1,403 @@ +{ + "ociVersion": "1.0.0", + "platform": { + "os": "linux", + "arch": "amd64" + }, + "process": { + "terminal": false, + "user": {}, + "args": [ + "/usr/bin/kubelet-docker.sh" + ], + "env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm" + ], + "noNewPrivileges": false, + "cwd": "/", + "capabilities": { + "bounding": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_DAC_READ_SEARCH", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_SETGID", + "CAP_SETUID", + "CAP_SETPCAP", + "CAP_LINUX_IMMUTABLE", + "CAP_NET_BIND_SERVICE", + "CAP_NET_BROADCAST", + "CAP_NET_ADMIN", + "CAP_NET_RAW", + "CAP_IPC_LOCK", + "CAP_IPC_OWNER", + "CAP_SYS_MODULE", + "CAP_SYS_RAWIO", + "CAP_SYS_CHROOT", + "CAP_SYS_PTRACE", + "CAP_SYS_PACCT", + "CAP_SYS_ADMIN", + "CAP_SYS_BOOT", + "CAP_SYS_NICE", + "CAP_SYS_RESOURCE", + "CAP_SYS_TIME", + "CAP_SYS_TTY_CONFIG", + "CAP_MKNOD", + "CAP_LEASE", + "CAP_AUDIT_WRITE", + "CAP_AUDIT_CONTROL", + "CAP_SETFCAP", + "CAP_MAC_OVERRIDE", + "CAP_MAC_ADMIN", + "CAP_SYSLOG", + "CAP_WAKE_ALARM", + "CAP_BLOCK_SUSPEND" + ], + "permitted": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_DAC_READ_SEARCH", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_SETGID", + "CAP_SETUID", + "CAP_SETPCAP", + "CAP_LINUX_IMMUTABLE", + "CAP_NET_BIND_SERVICE", + "CAP_NET_BROADCAST", + "CAP_NET_ADMIN", + "CAP_NET_RAW", + "CAP_IPC_LOCK", + "CAP_IPC_OWNER", + "CAP_SYS_MODULE", + "CAP_SYS_RAWIO", + "CAP_SYS_CHROOT", + "CAP_SYS_PTRACE", + "CAP_SYS_PACCT", + "CAP_SYS_ADMIN", + "CAP_SYS_BOOT", + "CAP_SYS_NICE", + "CAP_SYS_RESOURCE", + "CAP_SYS_TIME", + "CAP_SYS_TTY_CONFIG", + "CAP_MKNOD", + "CAP_LEASE", + "CAP_AUDIT_WRITE", + "CAP_AUDIT_CONTROL", + "CAP_SETFCAP", + "CAP_MAC_OVERRIDE", + "CAP_MAC_ADMIN", + "CAP_SYSLOG", + "CAP_WAKE_ALARM", + "CAP_BLOCK_SUSPEND" + ], + "inheritable": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_DAC_READ_SEARCH", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_SETGID", + "CAP_SETUID", + "CAP_SETPCAP", + "CAP_LINUX_IMMUTABLE", + "CAP_NET_BIND_SERVICE", + "CAP_NET_BROADCAST", + "CAP_NET_ADMIN", + "CAP_NET_RAW", + "CAP_IPC_LOCK", + "CAP_IPC_OWNER", + "CAP_SYS_MODULE", + "CAP_SYS_RAWIO", + "CAP_SYS_CHROOT", + "CAP_SYS_PTRACE", + "CAP_SYS_PACCT", + "CAP_SYS_ADMIN", + "CAP_SYS_BOOT", + "CAP_SYS_NICE", + "CAP_SYS_RESOURCE", + "CAP_SYS_TIME", + "CAP_SYS_TTY_CONFIG", + "CAP_MKNOD", + "CAP_LEASE", + "CAP_AUDIT_WRITE", + "CAP_AUDIT_CONTROL", + "CAP_SETFCAP", + "CAP_MAC_OVERRIDE", + "CAP_MAC_ADMIN", + "CAP_SYSLOG", + "CAP_WAKE_ALARM", + "CAP_BLOCK_SUSPEND" + ], + "effective": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_DAC_READ_SEARCH", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_SETGID", + "CAP_SETUID", + "CAP_SETPCAP", + "CAP_LINUX_IMMUTABLE", + "CAP_NET_BIND_SERVICE", + "CAP_NET_BROADCAST", + "CAP_NET_ADMIN", + "CAP_NET_RAW", + "CAP_IPC_LOCK", + "CAP_IPC_OWNER", + "CAP_SYS_MODULE", + "CAP_SYS_RAWIO", + "CAP_SYS_CHROOT", + "CAP_SYS_PTRACE", + "CAP_SYS_PACCT", + "CAP_SYS_ADMIN", + "CAP_SYS_BOOT", + "CAP_SYS_NICE", + "CAP_SYS_RESOURCE", + "CAP_SYS_TIME", + "CAP_SYS_TTY_CONFIG", + "CAP_MKNOD", + "CAP_LEASE", + "CAP_AUDIT_WRITE", + "CAP_AUDIT_CONTROL", + "CAP_SETFCAP", + "CAP_MAC_OVERRIDE", + "CAP_MAC_ADMIN", + "CAP_SYSLOG", + "CAP_WAKE_ALARM", + "CAP_BLOCK_SUSPEND" + ], + "ambient": [ + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_DAC_READ_SEARCH", + "CAP_FOWNER", + "CAP_FSETID", + "CAP_KILL", + "CAP_SETGID", + "CAP_SETUID", + "CAP_SETPCAP", + "CAP_LINUX_IMMUTABLE", + "CAP_NET_BIND_SERVICE", + "CAP_NET_BROADCAST", + "CAP_NET_ADMIN", + "CAP_NET_RAW", + "CAP_IPC_LOCK", + "CAP_IPC_OWNER", + "CAP_SYS_MODULE", + "CAP_SYS_RAWIO", + "CAP_SYS_CHROOT", + "CAP_SYS_PTRACE", + "CAP_SYS_PACCT", + "CAP_SYS_ADMIN", + "CAP_SYS_BOOT", + "CAP_SYS_NICE", + "CAP_SYS_RESOURCE", + "CAP_SYS_TIME", + "CAP_SYS_TTY_CONFIG", + "CAP_MKNOD", + "CAP_LEASE", + "CAP_AUDIT_WRITE", + "CAP_AUDIT_CONTROL", + "CAP_SETFCAP", + "CAP_MAC_OVERRIDE", + "CAP_MAC_ADMIN", + "CAP_SYSLOG", + "CAP_WAKE_ALARM", + "CAP_BLOCK_SUSPEND" + ] + }, + "rlimits": [ + { + "type": "RLIMIT_NOFILE", + "hard": 1024, + "soft": 1024 + } + ] + }, + "root": { + "path": "rootfs", + "readonly": true + }, + "mounts": [ + { + "destination": "/proc", + "type": "proc", + "source": "proc" + }, + { + "destination": "/dev", + "type": "tmpfs", + "source": "tmpfs", + "options": [ + "nosuid", + "strictatime", + "mode=755", + "size=65536k" + ] + }, + { + "destination": "/dev/pts", + "type": "devpts", + "source": "devpts", + "options": [ + "nosuid", + "noexec", + "newinstance", + "ptmxmode=0666", + "mode=0620", + "gid=5" + ] + }, + { + "destination": "/dev/shm", + "type": "tmpfs", + "source": "shm", + "options": [ + "nosuid", + "noexec", + "nodev", + "mode=1777", + "size=65536k" + ] + }, + { + "destination": "/dev/mqueue", + "type": "mqueue", + "source": "mqueue", + "options": [ + "nosuid", + "noexec", + "nodev" + ] + }, + { + "destination": "/sys", + "type": "sysfs", + "source": "sysfs", + "options": [ + "nosuid", + "noexec", + "nodev" + ] + }, + { + "destination": "/sys/fs/cgroup", + "type": "cgroup", + "source": "cgroup", + "options": [ + "nosuid", + "noexec", + "nodev", + "relatime", + "ro" + ] + }, + { + "type": "bind", + "source": "/etc/kubernetes", + "destination": "/etc/kubernetes", + "options": [ + "rbind", + "ro", + "rprivate" + ] + }, + { + "destination": "/etc/resolv.conf", + "type": "bind", + "source": "/etc/resolv.conf", + "options": [ + "ro", + "rbind", + "rprivate" + ] + }, + { + "type": "bind", + "source": "/", + "destination": "/rootfs", + "options": [ + "rbind", + "rslave", + "ro" + ] + }, + { + "type": "bind", + "source": "/var/run/", + "destination": "/var/run/", + "options": [ + "rbind", + "rw", + "mode=755" + ] + }, + { + "type": "bind", + "source": "/run", + "destination": "/run", + "options": [ + "rbind", + "rw", + "mode=755" + ] + }, + { + "type": "bind", + "source": "/var/lib", + "destination": "/var/lib", + "options": [ + "bind", + "rw", + "mode=755" + ] + }, + { + "type": "bind", + "source": "/var/lib/kubelet", + "destination": "/var/lib/kubelet", + "options": [ + "rbind", + "rslave", + "rw", + "mode=755" + ] + }, + { + "type": "bind", + "source": "/var/log", + "destination": "/var/log", + "options": [ + "bind", + "rw", + "mode=755" + ] + } + ], + "linux": { + "rootfsPropagation": "rslave", + "resources": { + "devices": [ + { + "allow": false, + "access": "rwm" + } + ] + }, + "namespaces": [ + { + "type": "mount" + } + ], + "devices": null, + "apparmorProfile": "", + "selinuxProcessLabel": "" + } +} diff --git a/launch.sh b/launch.sh new file mode 100644 index 0000000..4e8ea66 --- /dev/null +++ b/launch.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +source /etc/kubernetes/kubelet +source /etc/kubernetes/config + +TEMP_KUBELET_ARGS='--cgroup-driver=systemd --cgroups-per-qos=false --enforce-node-allocatable=' + +ARGS=$(echo "$@ $TEMP_KUBELET_ARGS $KUBE_LOGTOSTDERR $KUBE_LOG_LEVEL $KUBELET_API_SERVER $KUBELET_ADDRESS $KUBELET_PORT $KUBELET_HOSTNAME $KUBE_ALLOW_PRIV $KUBELET_ARGS" | xargs -n1 | sort -u -t = -k 1,1 | xargs) + +exec /usr/bin/kubelet $ARGS --containerized diff --git a/service.template b/service.template new file mode 100644 index 0000000..54d70b0 --- /dev/null +++ b/service.template @@ -0,0 +1,13 @@ +[Unit] +Description=kubernetes-kubelet +After=docker.service + +[Service] +ExecStart=$EXEC_START +ExecStop=$EXEC_STOP +Restart=on-failure +WorkingDirectory=$DESTDIR + +[Install] +WantedBy=multi-user.target + From 6f2ac8faf0980cd12aa813844a8d554676ec46e0 Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Mon, 24 Jul 2017 18:19:46 -0700 Subject: [PATCH 2/6] don't sort args, Mount /dev to allow block storage support --- Dockerfile | 2 +- config.json.template | 22 +++++----------------- launch.sh | 2 +- 3 files changed, 7 insertions(+), 19 deletions(-) diff --git a/Dockerfile b/Dockerfile index afbd975..cbbe136 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,7 +12,7 @@ LABEL BZComponent="$NAME" \ atomic.type='system' # Containerized kubelet requires nsenter -RUN dnf install -y util-linux ethtool && dnf clean all +RUN dnf install -y util-linux ethtool systemd-udev e2fsprogs xfsprogs && dnf clean all LABEL RUN /usr/bin/docker run -d --privileged --net=host --pid=host -v /:/rootfs:ro -v /sys:/sys:rw -v /var/run:/var/run:rw -v /run:/run:rw -v /var/lib/docker:/var/lib/docker:rw -v /var/lib/kubelet:/var/lib/kubelet:slave -v /var/log/containers:/var/log/containers:rw diff --git a/config.json.template b/config.json.template index 0e64af2..73d7d59 100644 --- a/config.json.template +++ b/config.json.template @@ -233,13 +233,11 @@ }, { "destination": "/dev", - "type": "tmpfs", - "source": "tmpfs", + "type": "bind", + "source": "/dev", "options": [ - "nosuid", - "strictatime", - "mode=755", - "size=65536k" + "rbind", + "rslave" ] }, { @@ -267,16 +265,6 @@ "size=65536k" ] }, - { - "destination": "/dev/mqueue", - "type": "mqueue", - "source": "mqueue", - "options": [ - "nosuid", - "noexec", - "nodev" - ] - }, { "destination": "/sys", "type": "sysfs", @@ -386,7 +374,7 @@ "resources": { "devices": [ { - "allow": false, + "allow": true, "access": "rwm" } ] diff --git a/launch.sh b/launch.sh index 4e8ea66..f7242e3 100644 --- a/launch.sh +++ b/launch.sh @@ -5,6 +5,6 @@ source /etc/kubernetes/config TEMP_KUBELET_ARGS='--cgroup-driver=systemd --cgroups-per-qos=false --enforce-node-allocatable=' -ARGS=$(echo "$@ $TEMP_KUBELET_ARGS $KUBE_LOGTOSTDERR $KUBE_LOG_LEVEL $KUBELET_API_SERVER $KUBELET_ADDRESS $KUBELET_PORT $KUBELET_HOSTNAME $KUBE_ALLOW_PRIV $KUBELET_ARGS" | xargs -n1 | sort -u -t = -k 1,1 | xargs) +ARGS="$@ $TEMP_KUBELET_ARGS $KUBE_LOGTOSTDERR $KUBE_LOG_LEVEL $KUBELET_API_SERVER $KUBELET_ADDRESS $KUBELET_PORT $KUBELET_HOSTNAME $KUBE_ALLOW_PRIV $KUBELET_ARGS" exec /usr/bin/kubelet $ARGS --containerized From 5d74086904652d4bae15f6b5e8c007ce864bde36 Mon Sep 17 00:00:00 2001 From: Jason Brooks Date: Wed, 16 Aug 2017 21:23:28 -0700 Subject: [PATCH 3/6] make init file executable --- Dockerfile | 2 +- launch.sh | 0 2 files changed, 1 insertion(+), 1 deletion(-) mode change 100644 => 100755 launch.sh diff --git a/Dockerfile b/Dockerfile index cbbe136..f78f6cc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ MAINTAINER "Jason Brooks" ENV container=docker -ENV NAME=kubernetes-kubelet VERSION=0 RELEASE=0 ARCH=x86_64 +ENV NAME=kubernetes-kubelet VERSION=0 RELEASE=1 ARCH=x86_64 LABEL BZComponent="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ diff --git a/launch.sh b/launch.sh old mode 100644 new mode 100755 From cd687b15bb494511e0ab65b3bc287309481a8ad3 Mon Sep 17 00:00:00 2001 From: Adam Miller Date: Thu, 24 Aug 2017 18:01:10 -0500 Subject: [PATCH 4/6] Bump RELEASE for automatic rebuild --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index f78f6cc..25f79cf 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ MAINTAINER "Jason Brooks" ENV container=docker -ENV NAME=kubernetes-kubelet VERSION=0 RELEASE=1 ARCH=x86_64 +ENV NAME=kubernetes-kubelet VERSION=0 RELEASE=2 ARCH=x86_64 LABEL BZComponent="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ From 12f39af772d90e9dadfab64ae9c594ddc9222b99 Mon Sep 17 00:00:00 2001 From: Adam Miller Date: Thu, 21 Sep 2017 15:06:53 -0500 Subject: [PATCH 5/6] Bump RELEASE for automatic rebuild --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 25f79cf..81b54db 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ MAINTAINER "Jason Brooks" ENV container=docker -ENV NAME=kubernetes-kubelet VERSION=0 RELEASE=2 ARCH=x86_64 +ENV NAME=kubernetes-kubelet VERSION=0 RELEASE=3 ARCH=x86_64 LABEL BZComponent="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ From f4e3ba3e7139eab9a39aedbda6601571a618fdf6 Mon Sep 17 00:00:00 2001 From: Adam Miller Date: Tue, 14 Nov 2017 16:43:14 -0600 Subject: [PATCH 6/6] Bump RELEASE for automatic rebuild --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 81b54db..cfbe2a0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ MAINTAINER "Jason Brooks" ENV container=docker -ENV NAME=kubernetes-kubelet VERSION=0 RELEASE=3 ARCH=x86_64 +ENV NAME=kubernetes-kubelet VERSION=0 RELEASE=4 ARCH=x86_64 LABEL BZComponent="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \