Add etcd-operator seamless integration with TLS by aanm · Pull Request #4921 · cilium/cilium

aanm · 2018-07-20T22:38:18Z

EDIT: It turns out there's no need to perform code-changes. I'll used our current etcd-configuration map and mount the cilium-etcd-client-tls secrete into the Cilium pod.

Summary of changes:

Add seamless integration for etcd-operator running with TLS.

A developer cilium.yaml is available in examples/kubernetes/addons/etcd-operator/cilium-development.yaml which contains the necessary options to run etcd-operator.

This change is

aanm · 2018-07-20T22:38:25Z

test-me-please

houndci-bot · 2018-07-20T22:38:41Z

exported function CreateDefaultClient should have comment or be unexported

aanm · 2018-07-20T22:39:08Z

test-me-please

aanm · 2018-07-20T22:53:56Z

test-me-please

aanm · 2018-07-22T17:03:51Z

 			}
 		}
+
+		k8sclient.Configure("", "/var/lib/cilium/cilium.kubeconfig")


This is a leftover, it needs to be fixed as when using cilium kvstore get the cilium CLI command does not have the necessary configuration to contact kubernetes, to retrieve the certificates to contact etcd.

A few questions:

Is the kubeconfig always guaranteed to be at this path? I presume yes because we are mounting it as such in the Cilium DS, but this is user-configurable, yes?

This will always result in k8sclient.IsEnabled() to return true:

cilium/pkg/k8s/config.go

Lines 60 to 66 in db67415

// IsEnabled checks if Cilium is being used in tandem with Kubernetes.

func IsEnabled() bool {

return config.APIServer != "" ||

config.KubeconfigPath != "" ||

(os.Getenv("KUBERNETES_SERVICE_HOST") != "" &&

os.Getenv("KUBERNETES_SERVICE_PORT") != "")

}

IsEnabled returns true if the KubeconfigPath is non-nil, and you unconditionally set KubeconfigPath above in your call to k8sclient.Configure:

cilium/pkg/k8s/config.go

Lines 48 to 58 in db67415

// Configure sets the parameters of the Kubernetes package

func Configure(apiServer, kubeconfigPath string) {

config.APIServer = apiServer

config.KubeconfigPath = kubeconfigPath

if IsEnabled() &&

config.APIServer != "" &&

!strings.HasPrefix(apiServer, "http") {

config.APIServer = "http://" + apiServer

}

}

Won't this break non-K8s setups?

I think the path is returned by /config in https://github.com/cilium/cilium/blob/master/api/v1/models/daemon_configuration_status.go#L33:2 (I noticed this being printed in https://github.com/cilium/cilium/blob/master/cilium/cmd/config.go#L80:59)

That might simplify things a bit?

tgraf · 2018-07-22T17:31:44Z

+		return nil, err
+	}
+	return &tlsData{
+		certData: secret.Data[etcdutil.CliCertFile],


Let's define constants for this as this is a stable API. No need to add dependencies.

tgraf · 2018-07-22T17:33:10Z

+          - "--debug=$(CILIUM_DEBUG)"
+          - "-t=vxlan"
+          - "--kvstore=etcd"
+          - "--kvstore-opt=etcd.k8s.secret=kube-system/kube-system/cilium-etcd-client-tls"


Duplicate kube-system

ianvernon

Still reviewing, have one important observation that I'd like clarification on.

ianvernon · 2018-07-23T18:20:07Z

+
+var (
+	// log is the k8s package logger object.
+	log = logging.DefaultLogger.WithField(logfields.LogSubsys, subsysK8s)


Should LogSubsys be changed due to this refactoring?

ianvernon · 2018-07-23T18:23:33Z

 			}
 		}
+
+		k8sclient.Configure("", "/var/lib/cilium/cilium.kubeconfig")


A few questions:

Is the kubeconfig always guaranteed to be at this path? I presume yes because we are mounting it as such in the Cilium DS, but this is user-configurable, yes?

This will always result in k8sclient.IsEnabled() to return true:

cilium/pkg/k8s/config.go

Lines 60 to 66 in db67415

// IsEnabled checks if Cilium is being used in tandem with Kubernetes.

func IsEnabled() bool {

return config.APIServer != "" ||

config.KubeconfigPath != "" ||

(os.Getenv("KUBERNETES_SERVICE_HOST") != "" &&

os.Getenv("KUBERNETES_SERVICE_PORT") != "")

}

IsEnabled returns true if the KubeconfigPath is non-nil, and you unconditionally set KubeconfigPath above in your call to k8sclient.Configure:

cilium/pkg/k8s/config.go

Lines 48 to 58 in db67415

// Configure sets the parameters of the Kubernetes package

func Configure(apiServer, kubeconfigPath string) {

config.APIServer = apiServer

config.KubeconfigPath = kubeconfigPath

if IsEnabled() &&

config.APIServer != "" &&

!strings.HasPrefix(apiServer, "http") {

config.APIServer = "http://" + apiServer

}

}

Won't this break non-K8s setups?

ianvernon · 2018-07-23T18:33:18Z

+	cfgOption           = "etcd.config"
+	k8sSecretNameOption = "etcd.k8s.secret"
+
+	k8sSecretNamespace   = "kube-system"


Is this guaranteed to always be kube-system?

ianvernon · 2018-07-23T18:35:06Z

 	return getOpts(e.opts)
 }

+func getNamespaceName(s string) (string, string, error) {


Add a unit test for this function.

ianvernon · 2018-07-23T18:39:42Z

+- apiGroups:
+  - extensions
+  resources:
+  - networkpolicies #FIXME remove this when we drop support for k8s NP-beta GH-1202


This can be removed since #1202 has been closed

ianvernon · 2018-07-23T18:41:05Z

+the label `io.cilium.fixed-identity=kube-dns`.
+
+```
+kubectl label -n kube-system pod $(kubectl get pods -n kube-system | grep kube-dns | cut -f 1 -d " ") io.cilium.fixed-identity=kube-dns


Use JSON parsing instead of grep / cut; this has proven brittle for us in the past due to the K8s CLI formatting changes.

ianvernon · 2018-07-23T18:41:27Z

+$ kubectl get pods -n kube-system
+NAME                             READY     STATUS    RESTARTS   AGE
+etcd-operator-69b5bfc669-fvm8c   1/1       Running   0          1d
+kube-dns-7dcc557ddd-tsqjt        3/3       Running   12         1d


Should we change this to zero restarts? ;)

@ianvernon this is actually expected because kube-dns will keep restarting until the user changes the label

I'd make a note of this then in the "Deploy kube-dns..." step above. As a user who is following the guide, seeing restarts may be worrisome.

aanm · 2018-07-27T20:36:57Z

test-me-please

ianvernon · 2018-07-27T21:25:19Z

How do the contents of this commit match the commit title ?

eloycoto · 2018-07-29T05:14:52Z

@aanm I think that the jsonpath that you ask can be in different ways:

To retrieve only one:

 kubectl -n kube-system get pods -l k8s-app=kube-dns -o jsonpath='{.items[0].metadata.name}'

To retrieve all:

kubectl -n kube-system get pods -l k8s-app=kube-dns -o jsonpath='{range .items[]}{.metadata.name}{"\n"}{end}'

eloycoto · 2018-07-29T05:16:27Z

That undefined should be a const no?

and also test for the string being empty?

This is a copy from another part of the code.

eloycoto · 2018-07-29T05:20:33Z

Should we add this into the contributing guide as a dependency?

I'd rather we put it into a docker image and have some type of wrapper script which generates stuff within that image so that we don't have to worry about maintaining more dependencies outside of images.

This is a dependency on the user system.

We probably don't want to require being able to run containers on the system that is running kubectl.

There may be some resistance to running a random container image to generate certificates.

We can definitely offer it as an alternative but I would not make it the default.

raybejjani

I couldn't get the readme instructions to work. I built cilium-agent locally, and modified the spec to use that file (mounted in at a specific path).
I could only get the cilium-etcd to start when I deleted cilium-development.yaml, but then cilium-development.yaml seemed to bounce between being ready and not. It also seemed like cilium status was blocked on something sometimes.

raybejjani · 2018-07-30T11:32:09Z

Can source == FromAgentLocal be overwritten by any other source? We don't end up calling UpdateNode in updateK8sNodeTunneling but checking here makes the relationships between sources more clear.

raybejjani · 2018-07-30T12:03:32Z

and also test for the string being empty?

raybejjani · 2018-07-30T18:09:12Z

Following up on my comment. I tested with a prebuilt image for this PR (in case my hacky way was the problem). I did find that, on minikube, one needs to edit cilium-etcd-cluster.yaml to have a size of 1 otherwise etcd never comes and up and nothing works. I'm not sure if it's worth mentioning that somewhere since inevitably someone will try this on a <3 node system.

ianvernon · 2018-07-30T19:19:32Z

We can remove this yes?

Let's drop this once we remove the support for 1.7

ianvernon · 2018-07-30T19:20:31Z

I'd rather we put it into a docker image and have some type of wrapper script which generates stuff within that image so that we don't have to worry about maintaining more dependencies outside of images.

ianvernon · 2018-07-30T19:22:44Z

"on" --> "by"

ianvernon · 2018-07-30T19:22:55Z

"running." --> "running:"

ianvernon · 2018-07-30T19:23:28Z

kube-dns --> ``kube-dns``

ianvernon · 2018-07-30T19:24:11Z

+$ kubectl get pods -n kube-system
+NAME                             READY     STATUS    RESTARTS   AGE
+etcd-operator-69b5bfc669-fvm8c   1/1       Running   0          1d
+kube-dns-7dcc557ddd-tsqjt        3/3       Running   12         1d


I'd make a note of this then in the "Deploy kube-dns..." step above. As a user who is following the guide, seeing restarts may be worrisome.

ianvernon · 2018-07-30T19:25:32Z

Instead of FIXME create a GH issue and note it here in the format "GH-XXXX"

This is a copy from another part of the code.

aanm

@tgraf Storing the node's source in the node structure was tricky to the fact I have to force it to be FromKVStore in OnUpdate()

aanm · 2018-07-30T21:13:19Z

Let's drop this once we remove the support for 1.7

aanm · 2018-07-30T21:26:09Z

aanm · 2018-07-30T21:26:17Z

aanm · 2018-07-30T21:27:06Z

aanm · 2018-07-30T21:28:48Z

It won't help. The etcd-operator will take some time until it creates the CRD. I'll create a file with the CRD and add it to the directory.

aanm · 2018-07-30T21:31:50Z

This is a copy from another part of the code.

aanm · 2018-07-30T21:31:54Z

This is a copy from another part of the code.

aanm · 2018-07-30T21:33:35Z

aanm · 2018-07-30T21:45:04Z

aanm · 2018-07-30T21:45:12Z

…ator Signed-off-by: André Martins <andre@cilium.io>

Signed-off-by: André Martins <andre@cilium.io>

aanm · 2018-07-30T23:04:45Z

test-me-please

As the previous commit mentions, this does not occur on main, v1.16, and v1.15 due to cilium#29036. However, in v1.14 and v1.13, we need to take special care because the NameManager and SelectorCache lock can be taken while the Endpoint lock is held during Endpoint deletion. Here are the relevant stacktraces regarding the deadlock: ``` 1: sync.Mutex.Lock [75 minutes] [Created by http.(*Server).Serve in goroutine 1699 @ server.go:3086] sync sema.go:77 runtime_SemacquireMutex(*uint32(0x5), false, 43690) sync mutex.go:171 (*Mutex).lockSlow(*Mutex(cilium#1733)) sync mutex.go:90 (*Mutex).Lock(...) sync rwmutex.go:147 (*RWMutex).Lock(*RWMutex(0xb0)) fqdn name_manager.go:70 (*NameManager).Lock(0xffffffffffffffff) policy selectorcache.go:964 (*SelectorCache).RemoveSelectors(cilium#1088, {cilium#28569, 0xb, 1}, {cilium#643, cilium#32582}) policy l4.go:810 (*L4Filter).removeSelectors(cilium#32582, cilium#29992) policy l4.go:817 (*L4Filter).detach(cilium#719, cilium#29993) policy l4.go:988 L4PolicyMap.Detach(...) policy l4.go:1179 (*L4Policy).Detach(cilium#20318, cilium#1383) policy resolve.go:103 (*selectorPolicy).Detach(...) policy distillery.go:81 (*PolicyCache).delete(cilium#1354, cilium#19354) policy distillery.go:138 (*PolicyCache).LocalEndpointIdentityRemoved(cilium#523, cilium#1163) identitymanager manager.go:167 (*IdentityManager).remove(cilium#706, cilium#19354) identitymanager manager.go:147 (*IdentityManager).Remove(cilium#706, cilium#19354) identitymanager manager.go:52 Remove(...) endpoint endpoint.go:1146 (*Endpoint).leaveLocked(cilium#1883, cilium#12221, {0x30, 0}) endpoint endpoint.go:2192 (*Endpoint).Delete(cilium#1883, {0x80, 0xaa}) endpointmanager manager.go:380 (*EndpointManager).removeEndpoint(cilium#1161, 0, {0xff, 0xff}) endpointmanager manager.go:394 (*EndpointManager).RemoveEndpoint(...) cmd endpoint.go:684 (*Daemon).deleteEndpointQuiet(...) cmd endpoint.go:666 (*Daemon).deleteEndpoint(cilium#1155, cilium#1883) cmd endpoint.go:713 (*Daemon).DeleteEndpoint(cilium#1155, {cilium#27399, cilium#8108}) cmd endpoint.go:770 (*deleteEndpointID).Handle(cilium#21193, {cilium#2452, {cilium#27399, 0x4d}}) endpoint delete_endpoint_id.go:66 (*DeleteEndpointID).ServeHTTP(cilium#5934, {cilium#666, cilium#2242}, cilium#2452) middleware operation.go:28 (*Context).RoutesHandler.NewOperationExecutor.func1({cilium#666, cilium#2242}, cilium#2452) http server.go:2136 HandlerFunc.ServeHTTP(ReadCloser(cilium#130), func{cilium#2242, 0x3}) middleware router.go:78 NewRouter.func1({cilium#666, cilium#2242}, cilium#2451) http server.go:2136 HandlerFunc.ServeHTTP(ReadCloser(cilium#718), func{cilium#2242, #59}) middleware redoc.go:72 Redoc.func1({cilium#666, cilium#2242}, cilium#1251) http server.go:2136 HandlerFunc.ServeHTTP(ReadCloser(cilium#4920), func{cilium#2242, #45}) middleware spec.go:46 Spec.func1({cilium#666, cilium#2242}, cilium#4921) http server.go:2136 HandlerFunc.ServeHTTP(ReadCloser(cilium#10532), func{cilium#2242, cilium#23015}) metrics middleware.go:64 (*APIEventTSHelper).ServeHTTP(cilium#1459, {cilium#668, cilium#10533}, cilium#2451) api apipanic.go:42 (*APIPanicHandler).ServeHTTP(cilium#722, {cilium#668, cilium#10533}, cilium#4922) http server.go:2938 serverHandler.ServeHTTP(*Server(cilium#8105), cilium#668, cilium#10533, 0x6) http server.go:2009 (*conn).serve(*conn(cilium#16005), Context{cilium#673, cilium#1554}) 8: sync.Mutex.Lock [74 minutes] [Created by http.(*Server).Serve in goroutine 1699 @ server.go:3086] sync sema.go:77 runtime_SemacquireMutex(*, 0x47, cilium#1154) sync mutex.go:171 (*Mutex).lockSlow(cilium#706) sync mutex.go:90 (*Mutex).Lock(...) sync rwmutex.go:147 (*RWMutex).Lock(*) identitymanager manager.go:99 (*IdentityManager).RemoveOldAddNew(cilium#706, 0, cilium#1154) identitymanager manager.go:123 RemoveOldAddNew(...) endpoint policy.go:852 (*Endpoint).SetIdentity(*, cilium#1154, 0) endpoint endpoint.go:1932 (*Endpoint).identityLabelsChanged(*, {cilium#674, *}, 1) endpoint endpoint.go:1780 (*Endpoint).runIdentityResolver(*, {cilium#674, *}, 1, 1) endpoint endpoint.go:1720 (*Endpoint).UpdateLabels(*, {cilium#674, *}, *, *, 8) cmd endpoint.go:477 (*Daemon).createEndpoint(cilium#1155, {cilium#673, *}, {cilium#683, cilium#1155}, *) cmd endpoint.go:542 (*putEndpointID).Handle(cilium#21192, {*, *, {*, 0xe}}) endpoint put_endpoint_id.go:58 (*PutEndpointID).ServeHTTP(cilium#3961, {cilium#666, *}, *) middleware operation.go:28 (*Context).RoutesHandler.NewOperationExecutor.func1({cilium#666, *}, *) http server.go:2136 HandlerFunc.ServeHTTP(*, {cilium#666, *}, *) middleware router.go:78 NewRouter.func1({cilium#666, *}, *) http server.go:2136 HandlerFunc.ServeHTTP(*, {cilium#666, *}, *) middleware redoc.go:72 Redoc.func1({cilium#666, *}, cilium#1251) http server.go:2136 HandlerFunc.ServeHTTP(*, {cilium#666, *}, #45) middleware spec.go:46 Spec.func1({cilium#666, *}, *) http server.go:2136 HandlerFunc.ServeHTTP(*, {cilium#666, *}, *) metrics middleware.go:64 (*APIEventTSHelper).ServeHTTP(cilium#1459, {cilium#668, *}, *) api apipanic.go:42 (*APIPanicHandler).ServeHTTP(#49, {cilium#668, *}, *) http server.go:2938 serverHandler.ServeHTTP({cilium#653}, {cilium#668, *}, 6) http server.go:2009 (*conn).serve(*, {cilium#673, cilium#1554}) 5: sync.Mutex.Lock [75 minutes] [Created by eventqueue.(*EventQueue).Run in goroutine 1482 @ eventqueue.go:229] sync sema.go:77 runtime_SemacquireMutex(cilium#142, 0xe8, *) sync mutex.go:171 (*Mutex).lockSlow(cilium#1733) sync mutex.go:90 (*Mutex).Lock(...) sync rwmutex.go:147 (*RWMutex).Lock(0x68) fqdn name_manager.go:70 (*NameManager).Lock(*) policy selectorcache.go:798 (*SelectorCache).AddFQDNSelector(cilium#1088, {cilium#643, *}, {{*, 0x4d}, {0, 0}}) policy l4.go:628 (*L4Filter).cacheFQDNSelector(...) policy l4.go:623 (*L4Filter).cacheFQDNSelectors(*, {*, 4, cilium#193}, cilium#536) policy l4.go:725 createL4Filter({cilium#680, *}, {*, 1, 1}, 0, {cilium#660, *}, {{*, 4}, ...}, ...) policy l4.go:879 createL4EgressFilter(...) policy rule.go:717 mergeEgressPortProto({cilium#680, *}, #44, {*, 0xa, 0}, *, {cilium#660, *}, {{*, ...}, ...}, ...) policy rule.go:672 mergeEgress.func1({cilium#660, *}) api l4.go:284 PortRules.Iterate({*, 1, cilium#546}, *) policy rule.go:624 mergeEgress({cilium#680, *}, *, {*, 1, 1}, 0, {cilium#661, *}, {cilium#662, ...}, ...) policy rule.go:753 (*rule).resolveEgressPolicy(*, {cilium#680, *}, *, *, *, {0, 0, 0}, {0, ...}) policy rules.go:103 ruleSlice.resolveL4EgressPolicy({*, *, *}, {cilium#680, *}, *) policy repository.go:718 (*Repository).resolvePolicyLocked(cilium#1089, *) policy distillery.go:119 (*PolicyCache).updateSelectorPolicy(cilium#1354, *) policy distillery.go:153 (*PolicyCache).UpdatePolicy(...) endpoint policy.go:262 (*Endpoint).regeneratePolicy(*) endpoint bpf.go:744 (*Endpoint).runPreCompilationSteps(*, *, *) endpoint bpf.go:589 (*Endpoint).regenerateBPF(*, *) endpoint policy.go:457 (*Endpoint).regenerate(*, *) endpoint events.go:53 (*EndpointRegenerationEvent).Handle(*, *) eventqueue eventqueue.go:245 (*EventQueue).run.func1() sync once.go:74 (*Once).doSlow(*, *) sync once.go:65 (*Once).Do(...) eventqueue eventqueue.go:233 (*EventQueue).run(*) 1: select [75 minutes] [Created by eventqueue.(*EventQueue).Run in goroutine 1482 @ eventqueue.go:229] semaphore semaphore.go:60 (*Weighted).Acquire(cilium#1092, {cilium#671, cilium#722}, cilium#766) lock semaphored_mutex.go:30 (*SemaphoredMutex).Lock(...) ipcache ipcache.go:140 (*IPCache).Lock(...) ipcache cidr.go:56 (*IPCache).AllocateCIDRs(cilium#1316, {0, 0, cilium#2037}, {0, 0, 0}, 0) ipcache cidr.go:103 (*IPCache).AllocateCIDRsForIPs(0, {0, cilium#697, 0}, 0xffffffffffffffff) cmd identity.go:114 cachingIdentityAllocator.AllocateCIDRsForIPs(...) policy selectorcache.go:509 (*SelectorCache).allocateIdentityMappings(cilium#1088, {{0, 0}, {cilium#5036, 0x2b}}, #45) policy selectorcache.go:843 (*SelectorCache).AddFQDNSelector(cilium#1088, {cilium#643, cilium#27811}, {{0, 0}, {cilium#5036, 0x2b}}) policy l4.go:628 (*L4Filter).cacheFQDNSelector(...) policy l4.go:623 (*L4Filter).cacheFQDNSelectors(cilium#27811, {cilium#42936, 0x287, cilium#193}, cilium#536) policy l4.go:725 createL4Filter({cilium#680, cilium#22826}, {cilium#22828, 1, 1}, 0, {cilium#660, cilium#24510}, {{cilium#4487, 3}, ...}, ...) policy l4.go:879 createL4EgressFilter(...) policy rule.go:717 mergeEgressPortProto({cilium#680, cilium#22826}, #44, {cilium#22828, 0xa, #78536}, #79633, {cilium#660, cilium#24510}, {{cilium#4487, ...}, ...}, ...) policy rule.go:672 mergeEgress.func1({cilium#660, cilium#24510}) api l4.go:284 PortRules.Iterate({cilium#24510, 1, cilium#546}, cilium#11741) policy rule.go:624 mergeEgress({cilium#680, cilium#22826}, cilium#18687, {cilium#22828, 1, 1}, 0, {cilium#661, cilium#5624}, {cilium#662, ...}, ...) policy rule.go:753 (*rule).resolveEgressPolicy(cilium#24575, {cilium#680, cilium#22826}, cilium#18687, cilium#29345, cilium#4782, {0, 0, 0}, {0, ...}) policy rules.go:103 ruleSlice.resolveL4EgressPolicy({cilium#10690, 0xb, 5}, {cilium#680, cilium#22826}, cilium#18687) policy repository.go:718 (*Repository).resolvePolicyLocked(cilium#1089, cilium#18461) policy distillery.go:119 (*PolicyCache).updateSelectorPolicy(cilium#1354, cilium#18461) policy distillery.go:153 (*PolicyCache).UpdatePolicy(...) endpoint policy.go:262 (*Endpoint).regeneratePolicy(cilium#1748) endpoint bpf.go:744 (*Endpoint).runPreCompilationSteps(cilium#1748, cilium#27542, cilium#4781) endpoint bpf.go:589 (*Endpoint).regenerateBPF(cilium#1748, cilium#27542) endpoint policy.go:457 (*Endpoint).regenerate(cilium#1748, cilium#27542) endpoint events.go:53 (*EndpointRegenerationEvent).Handle(cilium#18609, cilium#703) eventqueue eventqueue.go:245 (*EventQueue).run.func1() sync once.go:74 (*Once).doSlow(*Once(cilium#45414), func(cilium#69)) sync once.go:65 (*Once).Do(...) eventqueue eventqueue.go:233 (*EventQueue).run(cilium#6023) ``` Generated from pp tool: https://github.com/maruel/panicparse Signed-off-by: Chris Tarazi <chris@isovalent.com>

aanm added pending-review area/k8s Impacts the kubernetes API, or kubernetes -> cilium internals translation layers. labels Jul 20, 2018

aanm added this to the 1.2-bugfix milestone Jul 20, 2018

aanm requested a review from a team July 20, 2018 22:38

aanm requested review from a team as code owners July 20, 2018 22:38

aanm requested a review from a team July 20, 2018 22:38

aanm requested a review from a team as a code owner July 20, 2018 22:38

aanm requested a review from a team July 20, 2018 22:38

aanm requested review from a team as code owners July 20, 2018 22:38

houndci-bot reviewed Jul 20, 2018

View reviewed changes

Comment thread pkg/k8s/client/client.go Outdated

Copy link
Copy Markdown

houndci-bot Jul 20, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

exported function CreateDefaultClient should have comment or be unexported

aanm force-pushed the pr/add-etcd-operator-seamless-integration branch 2 times, most recently from 23c738f to da2289c Compare July 20, 2018 22:53

aanm requested a review from a team as a code owner July 20, 2018 22:53

aanm commented Jul 22, 2018

View reviewed changes

tgraf suggested changes Jul 22, 2018

View reviewed changes

ianvernon suggested changes Jul 23, 2018

View reviewed changes

aanm force-pushed the pr/add-etcd-operator-seamless-integration branch 4 times, most recently from 8cbe0de to edded5c Compare July 27, 2018 20:36

aanm force-pushed the pr/add-etcd-operator-seamless-integration branch from edded5c to 485726e Compare July 27, 2018 21:05

ianvernon reviewed Jul 27, 2018

View reviewed changes

eloycoto approved these changes Jul 29, 2018

View reviewed changes

raybejjani reviewed Jul 30, 2018

View reviewed changes

ianvernon suggested changes Jul 30, 2018

View reviewed changes

aanm commented Jul 30, 2018

View reviewed changes

aanm added 2 commits July 31, 2018 00:55

kubernetes/addons: add Cilium development spec file to test etcd-oper…

7767020

…ator Signed-off-by: André Martins <andre@cilium.io>

etcd-operator: add instructions how to install cfssl utilities

7543a6e

Signed-off-by: André Martins <andre@cilium.io>

aanm force-pushed the pr/add-etcd-operator-seamless-integration branch from 6e90aa6 to 031c9c6 Compare July 30, 2018 22:56

aanm added 4 commits July 31, 2018 01:04

etcd-operator: add developer README to deploy etcd-operator

37d7cfd

Signed-off-by: André Martins <andre@cilium.io>

pkg/node: re-add k8s node watcher until kvstore is connected

52ec31e

Signed-off-by: André Martins <andre@cilium.io>

etcd-operator/tls/certs: do some minor cleanups

c6c4144

Signed-off-by: André Martins <andre@cilium.io>

pkg/k8s: set node cluster with the option.Config.ClusterName

022e7ee

Signed-off-by: André Martins <andre@cilium.io>

aanm force-pushed the pr/add-etcd-operator-seamless-integration branch from 031c9c6 to 022e7ee Compare July 30, 2018 23:04

aanm requested review from raybejjani and tgraf July 30, 2018 23:04

raybejjani approved these changes Jul 31, 2018

View reviewed changes

tgraf approved these changes Jul 31, 2018

View reviewed changes

tgraf merged commit b22cc7c into master Jul 31, 2018

tgraf deleted the pr/add-etcd-operator-seamless-integration branch July 31, 2018 23:42

joestringer added backport-pending/1.2 and removed needs-backport/1.2 labels Aug 2, 2018

joestringer mentioned this pull request Aug 2, 2018

v1.2 backports 2018-08-02 #5079

Merged

tgraf mentioned this pull request Aug 6, 2018

Populate node list based on k8s node #4953

Closed

joestringer added backport-done/1.2 and removed backport-pending/1.2 labels Aug 7, 2018

	// IsEnabled checks if Cilium is being used in tandem with Kubernetes.
	func IsEnabled() bool {
	return config.APIServer != "" \|\|
	config.KubeconfigPath != "" \|\|
	(os.Getenv("KUBERNETES_SERVICE_HOST") != "" &&
	os.Getenv("KUBERNETES_SERVICE_PORT") != "")
	}

	// Configure sets the parameters of the Kubernetes package
	func Configure(apiServer, kubeconfigPath string) {
	config.APIServer = apiServer
	config.KubeconfigPath = kubeconfigPath

	if IsEnabled() &&
	config.APIServer != "" &&
	!strings.HasPrefix(apiServer, "http") {
	config.APIServer = "http://" + apiServer
	}
	}

Conversation

aanm commented Jul 20, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aanm commented Jul 20, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aanm commented Jul 20, 2018

Uh oh!

aanm commented Jul 20, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

raybejjani Jul 23, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ianvernon left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aanm commented Jul 27, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eloycoto commented Jul 29, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

raybejjani left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

raybejjani commented Jul 30, 2018

Uh oh!

aanm commented Jul 20, 2018 •

edited

Loading

raybejjani Jul 23, 2018 •

edited

Loading