Skip to content

Commit 52b2cd3

Browse files
alexander-demicevsbueringer
alexander-demicev
authored and
sbueringer
committed
POC: KCP in-place update
1 parent 313199c commit 52b2cd3

File tree

23 files changed

+2295
-47
lines changed

23 files changed

+2295
-47
lines changed

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -615,6 +615,7 @@ generate-e2e-templates-main: $(KUSTOMIZE)
615615
$(KUSTOMIZE) build $(DOCKER_TEMPLATES)/main/cluster-template-ipv6 --load-restrictor LoadRestrictionsNone > $(DOCKER_TEMPLATES)/main/cluster-template-ipv6.yaml
616616
$(KUSTOMIZE) build $(DOCKER_TEMPLATES)/main/cluster-template-topology-dualstack-ipv6-primary --load-restrictor LoadRestrictionsNone > $(DOCKER_TEMPLATES)/main/cluster-template-topology-dualstack-ipv6-primary.yaml
617617
$(KUSTOMIZE) build $(DOCKER_TEMPLATES)/main/cluster-template-topology-dualstack-ipv4-primary --load-restrictor LoadRestrictionsNone > $(DOCKER_TEMPLATES)/main/cluster-template-topology-dualstack-ipv4-primary.yaml
618+
$(KUSTOMIZE) build $(DOCKER_TEMPLATES)/main/cluster-template-topology-in-place --load-restrictor LoadRestrictionsNone > $(DOCKER_TEMPLATES)/main/cluster-template-topology-in-place.yaml
618619
$(KUSTOMIZE) build $(DOCKER_TEMPLATES)/main/cluster-template-topology-no-workers --load-restrictor LoadRestrictionsNone > $(DOCKER_TEMPLATES)/main/cluster-template-topology-no-workers.yaml
619620
$(KUSTOMIZE) build $(DOCKER_TEMPLATES)/main/cluster-template-topology-runtimesdk-v1beta1 --load-restrictor LoadRestrictionsNone > $(DOCKER_TEMPLATES)/main/cluster-template-topology-runtimesdk-v1beta1.yaml
620621
$(KUSTOMIZE) build $(DOCKER_TEMPLATES)/main/cluster-template-topology-kcp-only --load-restrictor LoadRestrictionsNone > $(DOCKER_TEMPLATES)/main/cluster-template-topology-kcp-only.yaml

‎_manual-testing/cluster-quick-start.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
apiVersion: cluster.x-k8s.io/v1beta2
2+
kind: Cluster
3+
metadata:
4+
name: quick-start
5+
namespace: default
6+
spec:
7+
clusterNetwork:
8+
services:
9+
cidrBlocks: ["10.128.0.0/12"]
10+
pods:
11+
cidrBlocks: ["192.168.0.0/16"]
12+
serviceDomain: "cluster.local"
13+
topology:
14+
classRef:
15+
name: quick-start
16+
controlPlane:
17+
replicas: 3
18+
variables:
19+
- name: imageRepository
20+
value: ""
21+
- name: etcdImageTag
22+
value: "3.6.4-0"
23+
- name: coreDNSImageTag
24+
value: ""
25+
- name: podSecurityStandard
26+
value:
27+
enabled: true
28+
enforce: "baseline"
29+
audit: "restricted"
30+
warn: "restricted"
31+
version: v1.33.4
32+
workers:
33+
machineDeployments:
34+
- class: default-worker
35+
name: md-0
36+
replicas: 1
37+
---

‎_manual-testing/clusterclass-quick-start.yaml‎

Lines changed: 323 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,323 @@
1+
apiVersion: cluster.x-k8s.io/v1beta2
2+
kind: ClusterClass
3+
metadata:
4+
name: quick-start
5+
spec:
6+
controlPlane:
7+
templateRef:
8+
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
9+
kind: KubeadmControlPlaneTemplate
10+
name: quick-start-control-plane
11+
machineInfrastructure:
12+
templateRef:
13+
kind: DockerMachineTemplate
14+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
15+
name: quick-start-control-plane
16+
healthCheck:
17+
checks:
18+
unhealthyNodeConditions:
19+
- type: Ready
20+
status: Unknown
21+
timeoutSeconds: 300
22+
- type: Ready
23+
status: "False"
24+
timeoutSeconds: 300
25+
infrastructure:
26+
templateRef:
27+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
28+
kind: DockerClusterTemplate
29+
name: quick-start-cluster
30+
workers:
31+
machineDeployments:
32+
- class: default-worker
33+
bootstrap:
34+
templateRef:
35+
apiVersion: bootstrap.cluster.x-k8s.io/v1beta2
36+
kind: KubeadmConfigTemplate
37+
name: quick-start-default-worker-bootstraptemplate
38+
infrastructure:
39+
templateRef:
40+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
41+
kind: DockerMachineTemplate
42+
name: quick-start-default-worker-machinetemplate
43+
healthCheck:
44+
checks:
45+
unhealthyNodeConditions:
46+
- type: Ready
47+
status: Unknown
48+
timeoutSeconds: 300
49+
- type: Ready
50+
status: "False"
51+
timeoutSeconds: 300
52+
machinePools:
53+
- class: default-worker
54+
bootstrap:
55+
templateRef:
56+
apiVersion: bootstrap.cluster.x-k8s.io/v1beta2
57+
kind: KubeadmConfigTemplate
58+
name: quick-start-default-worker-bootstraptemplate
59+
infrastructure:
60+
templateRef:
61+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
62+
kind: DockerMachinePoolTemplate
63+
name: quick-start-default-worker-machinepooltemplate
64+
variables:
65+
- name: imageRepository
66+
required: true
67+
schema:
68+
openAPIV3Schema:
69+
type: string
70+
default: ""
71+
example: "registry.k8s.io"
72+
description: "imageRepository sets the container registry to pull images from. If empty, nothing will be set and the from of kubeadm will be used."
73+
- name: etcdImageTag
74+
required: true
75+
schema:
76+
openAPIV3Schema:
77+
type: string
78+
default: ""
79+
example: "3.5.3-0"
80+
description: "etcdImageTag sets the tag for the etcd image."
81+
- name: coreDNSImageTag
82+
required: true
83+
schema:
84+
openAPIV3Schema:
85+
type: string
86+
default: ""
87+
example: "v1.8.5"
88+
description: "coreDNSImageTag sets the tag for the coreDNS image."
89+
- name: podSecurityStandard
90+
required: false
91+
schema:
92+
openAPIV3Schema:
93+
type: object
94+
properties:
95+
enabled:
96+
type: boolean
97+
default: true
98+
description: "enabled enables the patches to enable Pod Security Standard via AdmissionConfiguration."
99+
enforce:
100+
type: string
101+
default: "baseline"
102+
description: "enforce sets the level for the enforce PodSecurityConfiguration mode. One of privileged, baseline, restricted."
103+
audit:
104+
type: string
105+
default: "restricted"
106+
description: "audit sets the level for the audit PodSecurityConfiguration mode. One of privileged, baseline, restricted."
107+
warn:
108+
type: string
109+
default: "restricted"
110+
description: "warn sets the level for the warn PodSecurityConfiguration mode. One of privileged, baseline, restricted."
111+
patches:
112+
- name: imageRepository
113+
description: "Sets the imageRepository used for the KubeadmControlPlane."
114+
enabledIf: '{{ ne .imageRepository "" }}'
115+
definitions:
116+
- selector:
117+
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
118+
kind: KubeadmControlPlaneTemplate
119+
matchResources:
120+
controlPlane: true
121+
jsonPatches:
122+
- op: add
123+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/imageRepository"
124+
valueFrom:
125+
variable: imageRepository
126+
- name: etcdImageTag
127+
enabledIf: '{{ ne .etcdImageTag "" }}'
128+
description: "Sets tag to use for the etcd image in the KubeadmControlPlane."
129+
definitions:
130+
- selector:
131+
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
132+
kind: KubeadmControlPlaneTemplate
133+
matchResources:
134+
controlPlane: true
135+
jsonPatches:
136+
- op: add
137+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/etcd"
138+
valueFrom:
139+
template: |
140+
local:
141+
imageTag: {{ .etcdImageTag }}
142+
- name: coreDNSImageTag
143+
enabledIf: '{{ ne .coreDNSImageTag "" }}'
144+
description: "Sets tag to use for the etcd image in the KubeadmControlPlane."
145+
definitions:
146+
- selector:
147+
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
148+
kind: KubeadmControlPlaneTemplate
149+
matchResources:
150+
controlPlane: true
151+
jsonPatches:
152+
- op: add
153+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/dns"
154+
valueFrom:
155+
template: |
156+
imageTag: {{ .coreDNSImageTag }}
157+
- name: customImage
158+
description: "Sets the container image that is used for running dockerMachines for the controlPlane and default-worker machineDeployments."
159+
definitions:
160+
- selector:
161+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
162+
kind: DockerMachineTemplate
163+
matchResources:
164+
machineDeploymentClass:
165+
names:
166+
- default-worker
167+
jsonPatches:
168+
- op: add
169+
path: "/spec/template/spec/customImage"
170+
valueFrom:
171+
template: |
172+
kindest/node:{{ .builtin.machineDeployment.version | replace "+" "_" }}
173+
- selector:
174+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
175+
kind: DockerMachinePoolTemplate
176+
matchResources:
177+
machinePoolClass:
178+
names:
179+
- default-worker
180+
jsonPatches:
181+
- op: add
182+
path: "/spec/template/spec/template/customImage"
183+
valueFrom:
184+
template: |
185+
kindest/node:{{ .builtin.machinePool.version | replace "+" "_" }}
186+
- selector:
187+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
188+
kind: DockerMachineTemplate
189+
matchResources:
190+
controlPlane: true
191+
jsonPatches:
192+
- op: add
193+
path: "/spec/template/spec/customImage"
194+
valueFrom:
195+
template: |
196+
kindest/node:{{ .builtin.controlPlane.version | replace "+" "_" }}
197+
- name: podSecurityStandard
198+
description: "Adds an admission configuration for PodSecurity to the kube-apiserver."
199+
definitions:
200+
- selector:
201+
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
202+
kind: KubeadmControlPlaneTemplate
203+
matchResources:
204+
controlPlane: true
205+
jsonPatches:
206+
- op: add
207+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs"
208+
value:
209+
- name: admission-control-config-file
210+
value: "/etc/kubernetes/kube-apiserver-admission-pss.yaml"
211+
- op: add
212+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraVolumes"
213+
value:
214+
- name: admission-pss
215+
hostPath: /etc/kubernetes/kube-apiserver-admission-pss.yaml
216+
mountPath: /etc/kubernetes/kube-apiserver-admission-pss.yaml
217+
readOnly: true
218+
pathType: "File"
219+
- op: add
220+
path: "/spec/template/spec/kubeadmConfigSpec/files"
221+
valueFrom:
222+
template: |
223+
- content: |
224+
apiVersion: apiserver.config.k8s.io/v1
225+
kind: AdmissionConfiguration
226+
plugins:
227+
- name: PodSecurity
228+
configuration:
229+
apiVersion: pod-security.admission.config.k8s.io/v1{{ if semverCompare "< v1.25-0" .builtin.controlPlane.version }}beta1{{ end }}
230+
kind: PodSecurityConfiguration
231+
defaults:
232+
enforce: "{{ .podSecurityStandard.enforce }}"
233+
enforce-version: "latest"
234+
audit: "{{ .podSecurityStandard.audit }}"
235+
audit-version: "latest"
236+
warn: "{{ .podSecurityStandard.warn }}"
237+
warn-version: "latest"
238+
exemptions:
239+
usernames: []
240+
runtimeClasses: []
241+
namespaces: [kube-system]
242+
path: /etc/kubernetes/kube-apiserver-admission-pss.yaml
243+
enabledIf: "{{ .podSecurityStandard.enabled }}"
244+
---
245+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
246+
kind: DockerClusterTemplate
247+
metadata:
248+
name: quick-start-cluster
249+
spec:
250+
template:
251+
spec: {}
252+
---
253+
kind: KubeadmControlPlaneTemplate
254+
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
255+
metadata:
256+
name: quick-start-control-plane
257+
spec:
258+
template:
259+
spec:
260+
rollout:
261+
strategy:
262+
type: RollingUpdate
263+
rollingUpdate:
264+
maxSurge: 0
265+
kubeadmConfigSpec:
266+
clusterConfiguration:
267+
apiServer:
268+
# host.docker.internal is required by kubetest when running on MacOS because of the way ports are proxied.
269+
certSANs: [localhost, 127.0.0.1, 0.0.0.0, host.docker.internal]
270+
initConfiguration:
271+
nodeRegistration: # node registration parameters are automatically injected by CAPD according to the kindest/node image in use.
272+
kubeletExtraArgs: # having a not empty kubeletExtraArgs is required for the externalCloudProvider patch to work
273+
- name: eviction-hard
274+
value: 'nodefs.available<0%,nodefs.inodesFree<0%,imagefs.available<0%'
275+
joinConfiguration:
276+
nodeRegistration: # node registration parameters are automatically injected by CAPD according to the kindest/node image in use.
277+
kubeletExtraArgs: # having a not empty kubeletExtraArgs is required for the externalCloudProvider patch to work
278+
- name: eviction-hard
279+
value: 'nodefs.available<0%,nodefs.inodesFree<0%,imagefs.available<0%'
280+
---
281+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
282+
kind: DockerMachineTemplate
283+
metadata:
284+
name: quick-start-control-plane
285+
spec:
286+
template:
287+
spec:
288+
extraMounts:
289+
- containerPath: "/var/run/docker.sock"
290+
hostPath: "/var/run/docker.sock"
291+
---
292+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
293+
kind: DockerMachineTemplate
294+
metadata:
295+
name: quick-start-default-worker-machinetemplate
296+
spec:
297+
template:
298+
spec:
299+
extraMounts:
300+
- containerPath: "/var/run/docker.sock"
301+
hostPath: "/var/run/docker.sock"
302+
---
303+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
304+
kind: DockerMachinePoolTemplate
305+
metadata:
306+
name: quick-start-default-worker-machinepooltemplate
307+
spec:
308+
template:
309+
spec:
310+
template: {}
311+
---
312+
apiVersion: bootstrap.cluster.x-k8s.io/v1beta2
313+
kind: KubeadmConfigTemplate
314+
metadata:
315+
name: quick-start-default-worker-bootstraptemplate
316+
spec:
317+
template:
318+
spec:
319+
joinConfiguration:
320+
nodeRegistration: # node registration parameters are automatically injected by CAPD according to the kindest/node image in use.
321+
kubeletExtraArgs: # having a not empty kubeletExtraArgs is required for the externalCloudProvider to work
322+
- name: eviction-hard
323+
value: 'nodefs.available<0%,nodefs.inodesFree<0%,imagefs.available<0%'

‎api/core/v1beta2/machine_phase_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,10 @@ const (
4545
// become a Kubernetes Node in a Ready state.
4646
MachinePhaseRunning = MachinePhase("Running")
4747

48+
// MachinePhaseUpdating is the Machine state when the Machine
49+
// is updating.
50+
MachinePhaseUpdating = MachinePhase("Updating")
51+
4852
// MachinePhaseDeleting is the Machine state when a delete
4953
// request has been sent to the API Server,
5054
// but its infrastructure has not yet been fully deleted.

0 commit comments

Comments
 (0)