Merge #1 Drop Release label in favor of OSBS release_bump plugin

Use 29 tag for f29 branch
Signed-off-by: Bhavin Gandhi <bhavin7392@gmail.com>
2018-08-29 16:34:58 +00:00 · 2018-08-26 23:24:01 +05:30 · 2018-08-26 23:22:00 +05:30 · 2018-08-26 23:19:59 +05:30 · 2018-05-17 13:52:04 -07:00 · 2018-03-20 13:20:48 -07:00
6 changed files with 473 additions and 0 deletions
--- a/26
+++ b/26
@ -0,0 +1,26 @@
+FROM registry.fedoraproject.org/kubernetes-node:29
+
+ENV container=docker
+
+ENV NAME=kubernetes-kubelet VERSION=0 ARCH=x86_64
+LABEL BZComponent="$NAME" \
+        name="$FGC/$NAME" \
+        version="$VERSION" \
+        architecture="$ARCH" \
+        atomic.type='system' \
+        maintainer="Jason Brooks <jbrooks@redhat.com>"
+
+# Containerized kubelet requires nsenter
+RUN dnf install -y --setopt=tsflags=nodocs util-linux ethtool systemd-udev e2fsprogs xfsprogs && dnf clean all
+
+LABEL RUN /usr/bin/docker run -d --privileged --net=host --pid=host -v /:/rootfs:ro -v /sys:/sys:rw -v /var/run:/var/run:rw -v /run:/run:rw -v /var/lib/docker:/var/lib/docker:rw -v /var/lib/kubelet:/var/lib/kubelet:slave -v /var/log/containers:/var/log/containers:rw
+
+COPY launch.sh /usr/bin/kubelet-docker.sh
+
+COPY manifest.json tmpfiles.template service.template config.json.template /exports/
+
+RUN mkdir -p /exports/hostfs/etc/cni/net.d && \
+    mkdir -p /exports/hostfs/etc/kubernetes && \
+    cp /etc/kubernetes/{config,kubelet} /exports/hostfs/etc/kubernetes
+
+ENTRYPOINT ["/usr/bin/kubelet-docker.sh"]
--- a/config.json.template
+++ b/config.json.template
@ -0,0 +1,415 @@
+{
+    "ociVersion": "1.0.0",
+    "platform": {
+        "os": "linux",
+        "arch": "amd64"
+    },
+    "process": {
+        "terminal": false,
+        "user": {},
+        "args": [
+            "/usr/bin/kubelet-docker.sh"
+        ],
+        "env": [
+            "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+            "TERM=xterm"
+        ],
+        "noNewPrivileges": false,
+        "cwd": "/",
+        "capabilities": {
+            "bounding": [
+                "CAP_CHOWN",
+                "CAP_DAC_OVERRIDE",
+                "CAP_DAC_READ_SEARCH",
+                "CAP_FOWNER",
+                "CAP_FSETID",
+                "CAP_KILL",
+                "CAP_SETGID",
+                "CAP_SETUID",
+                "CAP_SETPCAP",
+                "CAP_LINUX_IMMUTABLE",
+                "CAP_NET_BIND_SERVICE",
+                "CAP_NET_BROADCAST",
+                "CAP_NET_ADMIN",
+                "CAP_NET_RAW",
+                "CAP_IPC_LOCK",
+                "CAP_IPC_OWNER",
+                "CAP_SYS_MODULE",
+                "CAP_SYS_RAWIO",
+                "CAP_SYS_CHROOT",
+                "CAP_SYS_PTRACE",
+                "CAP_SYS_PACCT",
+                "CAP_SYS_ADMIN",
+                "CAP_SYS_BOOT",
+                "CAP_SYS_NICE",
+                "CAP_SYS_RESOURCE",
+                "CAP_SYS_TIME",
+                "CAP_SYS_TTY_CONFIG",
+                "CAP_MKNOD",
+                "CAP_LEASE",
+                "CAP_AUDIT_WRITE",
+                "CAP_AUDIT_CONTROL",
+                "CAP_SETFCAP",
+                "CAP_MAC_OVERRIDE",
+                "CAP_MAC_ADMIN",
+                "CAP_SYSLOG",
+                "CAP_WAKE_ALARM",
+                "CAP_BLOCK_SUSPEND"
+            ],
+            "permitted": [
+                "CAP_CHOWN",
+                "CAP_DAC_OVERRIDE",
+                "CAP_DAC_READ_SEARCH",
+                "CAP_FOWNER",
+                "CAP_FSETID",
+                "CAP_KILL",
+                "CAP_SETGID",
+                "CAP_SETUID",
+                "CAP_SETPCAP",
+                "CAP_LINUX_IMMUTABLE",
+                "CAP_NET_BIND_SERVICE",
+                "CAP_NET_BROADCAST",
+                "CAP_NET_ADMIN",
+                "CAP_NET_RAW",
+                "CAP_IPC_LOCK",
+                "CAP_IPC_OWNER",
+                "CAP_SYS_MODULE",
+                "CAP_SYS_RAWIO",
+                "CAP_SYS_CHROOT",
+                "CAP_SYS_PTRACE",
+                "CAP_SYS_PACCT",
+                "CAP_SYS_ADMIN",
+                "CAP_SYS_BOOT",
+                "CAP_SYS_NICE",
+                "CAP_SYS_RESOURCE",
+                "CAP_SYS_TIME",
+                "CAP_SYS_TTY_CONFIG",
+                "CAP_MKNOD",
+                "CAP_LEASE",
+                "CAP_AUDIT_WRITE",
+                "CAP_AUDIT_CONTROL",
+                "CAP_SETFCAP",
+                "CAP_MAC_OVERRIDE",
+                "CAP_MAC_ADMIN",
+                "CAP_SYSLOG",
+                "CAP_WAKE_ALARM",
+                "CAP_BLOCK_SUSPEND"
+            ],
+            "inheritable": [
+                "CAP_CHOWN",
+                "CAP_DAC_OVERRIDE",
+                "CAP_DAC_READ_SEARCH",
+                "CAP_FOWNER",
+                "CAP_FSETID",
+                "CAP_KILL",
+                "CAP_SETGID",
+                "CAP_SETUID",
+                "CAP_SETPCAP",
+                "CAP_LINUX_IMMUTABLE",
+                "CAP_NET_BIND_SERVICE",
+                "CAP_NET_BROADCAST",
+                "CAP_NET_ADMIN",
+                "CAP_NET_RAW",
+                "CAP_IPC_LOCK",
+                "CAP_IPC_OWNER",
+                "CAP_SYS_MODULE",
+                "CAP_SYS_RAWIO",
+                "CAP_SYS_CHROOT",
+                "CAP_SYS_PTRACE",
+                "CAP_SYS_PACCT",
+                "CAP_SYS_ADMIN",
+                "CAP_SYS_BOOT",
+                "CAP_SYS_NICE",
+                "CAP_SYS_RESOURCE",
+                "CAP_SYS_TIME",
+                "CAP_SYS_TTY_CONFIG",
+                "CAP_MKNOD",
+                "CAP_LEASE",
+                "CAP_AUDIT_WRITE",
+                "CAP_AUDIT_CONTROL",
+                "CAP_SETFCAP",
+                "CAP_MAC_OVERRIDE",
+                "CAP_MAC_ADMIN",
+                "CAP_SYSLOG",
+                "CAP_WAKE_ALARM",
+                "CAP_BLOCK_SUSPEND"
+            ],
+            "effective": [
+                "CAP_CHOWN",
+                "CAP_DAC_OVERRIDE",
+                "CAP_DAC_READ_SEARCH",
+                "CAP_FOWNER",
+                "CAP_FSETID",
+                "CAP_KILL",
+                "CAP_SETGID",
+                "CAP_SETUID",
+                "CAP_SETPCAP",
+                "CAP_LINUX_IMMUTABLE",
+                "CAP_NET_BIND_SERVICE",
+                "CAP_NET_BROADCAST",
+                "CAP_NET_ADMIN",
+                "CAP_NET_RAW",
+                "CAP_IPC_LOCK",
+                "CAP_IPC_OWNER",
+                "CAP_SYS_MODULE",
+                "CAP_SYS_RAWIO",
+                "CAP_SYS_CHROOT",
+                "CAP_SYS_PTRACE",
+                "CAP_SYS_PACCT",
+                "CAP_SYS_ADMIN",
+                "CAP_SYS_BOOT",
+                "CAP_SYS_NICE",
+                "CAP_SYS_RESOURCE",
+                "CAP_SYS_TIME",
+                "CAP_SYS_TTY_CONFIG",
+                "CAP_MKNOD",
+                "CAP_LEASE",
+                "CAP_AUDIT_WRITE",
+                "CAP_AUDIT_CONTROL",
+                "CAP_SETFCAP",
+                "CAP_MAC_OVERRIDE",
+                "CAP_MAC_ADMIN",
+                "CAP_SYSLOG",
+                "CAP_WAKE_ALARM",
+                "CAP_BLOCK_SUSPEND"
+            ],
+            "ambient": [
+                "CAP_CHOWN",
+                "CAP_DAC_OVERRIDE",
+                "CAP_DAC_READ_SEARCH",
+                "CAP_FOWNER",
+                "CAP_FSETID",
+                "CAP_KILL",
+                "CAP_SETGID",
+                "CAP_SETUID",
+                "CAP_SETPCAP",
+                "CAP_LINUX_IMMUTABLE",
+                "CAP_NET_BIND_SERVICE",
+                "CAP_NET_BROADCAST",
+                "CAP_NET_ADMIN",
+                "CAP_NET_RAW",
+                "CAP_IPC_LOCK",
+                "CAP_IPC_OWNER",
+                "CAP_SYS_MODULE",
+                "CAP_SYS_RAWIO",
+                "CAP_SYS_CHROOT",
+                "CAP_SYS_PTRACE",
+                "CAP_SYS_PACCT",
+                "CAP_SYS_ADMIN",
+                "CAP_SYS_BOOT",
+                "CAP_SYS_NICE",
+                "CAP_SYS_RESOURCE",
+                "CAP_SYS_TIME",
+                "CAP_SYS_TTY_CONFIG",
+                "CAP_MKNOD",
+                "CAP_LEASE",
+                "CAP_AUDIT_WRITE",
+                "CAP_AUDIT_CONTROL",
+                "CAP_SETFCAP",
+                "CAP_MAC_OVERRIDE",
+                "CAP_MAC_ADMIN",
+                "CAP_SYSLOG",
+                "CAP_WAKE_ALARM",
+                "CAP_BLOCK_SUSPEND"
+            ]
+        },
+        "rlimits": [
+            {
+                "type": "RLIMIT_NOFILE",
+                "hard": 1024,
+                "soft": 1024
+            }
+        ]
+    },
+    "root": {
+        "path": "rootfs",
+        "readonly": true
+    },
+    "mounts": [
+        {
+            "destination": "/proc",
+            "type": "proc",
+            "source": "proc"
+        },
+        {
+            "source": "/dev",
+            "destination": "/dev",
+            "type": "bind",
+            "options": [
+                "rbind",
+                "rslave"
+            ]
+        },
+        {
+            "destination": "/dev/pts",
+            "type": "devpts",
+            "source": "devpts",
+            "options": [
+                "nosuid",
+                "noexec",
+                "newinstance",
+                "ptmxmode=0666",
+                "mode=0620",
+                "gid=5"
+            ]
+        },
+        {
+            "destination": "/dev/shm",
+            "type": "tmpfs",
+            "source": "shm",
+            "options": [
+                "nosuid",
+                "noexec",
+                "nodev",
+                "mode=1777",
+                "size=65536k"
+            ]
+        },
+        {
+            "type": "bind",
+            "source": "/sys",
+            "destination": "/sys",
+            "options": [
+                "rbind",
+                "rw"
+            ]
+        },
+        {
+          "type": "bind",
+          "source": "/etc/cni/net.d",
+          "destination": "/etc/cni/net.d",
+          "options": [
+              "bind",
+              "slave",
+              "rw",
+              "mode=777"
+          ]
+        },
+        {
+            "type": "bind",
+            "source": "/etc/kubernetes",
+            "destination": "/etc/kubernetes",
+            "options": [
+                "rbind",
+                "ro",
+                "rprivate"
+            ]
+         },
+         {
+           "type": "bind",
+           "source": "/etc/localtime",
+           "destination": "/etc/localtime",
+           "options": [
+               "rbind",
+               "ro"
+           ]
+         },
+	 {
+	    "type": "bind",
+	    "source": "/etc/pki",
+	    "destination": "/etc/pki",
+	    "options": [
+		"bind",
+		"ro"
+	    ]
+	 },
+         {
+            "destination": "/etc/resolv.conf",
+            "type": "bind",
+            "source": "/etc/resolv.conf",
+            "options": [
+                "ro",
+                "bind"
+             ]
+          },
+          {
+            "type": "bind",
+            "source": "/",
+            "destination": "/rootfs",
+            "options": [
+                "rbind",
+                "rslave",
+                "ro"
+             ]
+          },
+          {
+            "type": "bind",
+            "source": "/var/run/secrets",
+            "destination": "/var/run/secrets",
+            "options": [
+                "rbind",
+                "rw",
+                "mode=755"
+             ]
+          },
+          {
+            "type": "bind",
+            "source": "${RUN_DIRECTORY}",
+            "destination": "/run",
+            "options": [
+                "rbind",
+                "rw",
+                "mode=755"
+             ]
+          },
+          {
+            "type": "bind",
+            "source": "${STATE_DIRECTORY}",
+            "destination": "/var/lib",
+            "options": [
+                "bind",
+                "rw",
+                "mode=755"
+             ]
+          },
+          {
+            "type": "bind",
+            "source": "${STATE_DIRECTORY}/kubelet",
+            "destination": "/var/lib/kubelet",
+            "options": [
+                "rbind",
+                "rshared",
+                "rw",
+                "mode=755"
+             ]
+          },
+          {
+            "type": "bind",
+            "source": "/var/log",
+            "destination": "/var/log",
+            "options": [
+                "bind",
+                "rw",
+                "mode=755"
+             ]
+          },
+          {
+            "destination": "/tmp",
+            "type": "tmpfs",
+            "source": "tmpfs",
+            "options": [
+                "mode=755",
+                "size=65536k"
+            ]
+          }
+          $ADDTL_MOUNTS
+    ],
+    "linux": {
+        "rootfsPropagation": "rslave",
+        "resources": {
+            "devices": [
+                {
+                    "allow": true,
+                    "access": "rwm"
+                }
+            ]
+        },
+        "namespaces": [
+            {
+                "type": "mount"
+            }
+        ],
+        "devices": null,
+        "apparmorProfile": ""
+    }
+}
--- a/launch.sh
+++ b/launch.sh
@ -0,0 +1,10 @@
+#!/bin/bash
+
+source /etc/kubernetes/kubelet
+source /etc/kubernetes/config
+
+TEMP_KUBELET_ARGS='--cgroup-driver=systemd --cgroups-per-qos=false --enforce-node-allocatable='
+
+ARGS="$@ $TEMP_KUBELET_ARGS $KUBE_LOGTOSTDERR $KUBE_LOG_LEVEL $KUBELET_API_SERVER $KUBELET_ADDRESS $KUBELET_PORT $KUBELET_HOSTNAME $KUBE_ALLOW_PRIV $KUBELET_ARGS"
+
+exec /usr/bin/kubelet $ARGS --containerized
--- a/manifest.json
+++ b/manifest.json
@ -0,0 +1,6 @@
+{
+    "version": "1.0",
+    "defaultValues": {
+        "ADDTL_MOUNTS": ""
+    }
+}
--- a/service.template
+++ b/service.template
@ -0,0 +1,13 @@
+[Unit]
+Description=kubernetes-kubelet
+After=docker.service
+
+[Service]
+ExecStart=$EXEC_START
+ExecStop=$EXEC_STOP
+Restart=on-failure
+WorkingDirectory=$DESTDIR
+
+[Install]
+WantedBy=multi-user.target
+
--- a/tmpfiles.template
+++ b/tmpfiles.template
@ -0,0 +1,3 @@
+d   ${STATE_DIRECTORY}/kubelet - - - - -
+d   /var/lib/cni - - - - -
+d   /var/run/secrets - - - - -
Author	SHA1	Message	Date
Jason Brooks	28f98bfc6e	Merge #1 `Drop Release label in favor of OSBS release_bump plugin`	2018-08-29 16:34:58 +00:00
Bhavin Gandhi	99636e7114	Use 29 tag for f29 branch Signed-off-by: Bhavin Gandhi <bhavin7392@gmail.com>	2018-08-26 23:24:01 +05:30
Bhavin Gandhi	c338dca994	Drop Release label in favor of OSBS release_bump plugin OSBS can automatically bump the release number, for that we just need to drop the label from the Dockerfile See https://pagure.io/ContainerSIG/container-sig/issue/1 Signed-off-by: Bhavin Gandhi <bhavin7392@gmail.com>	2018-08-26 23:22:00 +05:30
Bhavin Gandhi	cf334d024a	Drop Release label in favor of OSBS release_bump plugin OSBS can automatically bump the release number, for that we just need to drop the label from the Dockerfile See https://pagure.io/ContainerSIG/container-sig/issue/1 Signed-off-by: Bhavin Gandhi <bhavin7392@gmail.com>	2018-08-26 23:19:59 +05:30
Jason Brooks	99dce7ecad	fix BZComponent capitalization	2018-05-17 13:52:04 -07:00
Jason Brooks	502959b2aa	from rawhide	2018-03-20 13:20:48 -07:00
Jason Brooks	87638b8689	* FROM f28 * Add ${STATE_DIR}/kubelet to tmpfiles * Add kubelet system-container ADDLT_MOUNTS * Update kubelet based openshift/node * Enable mount propagation in /var/lib/kubelet	2018-03-20 13:15:27 -07:00
Jason Brooks	ab4a89ee75	make launch executable	2017-11-28 12:57:37 -08:00
Jason Brooks	b9edb641df	build from f27	2017-07-06 14:01:56 -07:00
Jason Brooks	7240b66091	fix BZComponent capitalization	2017-07-06 13:02:53 -07:00
Jason Brooks	a4e90204f6	initial commit	2017-07-06 12:33:39 -07:00