switch kube subnet manager to PATCH #681
Conversation
This means we're now using a newer version of go and arm-linux-gnueabihf-gcc instead of arm-linux-gnueabi-gcc Also, switch to an alpine base image for amd64
mikedanese
force-pushed
the
patch
branch
4 times, most recently
from
61ed91c to
0ef5b19
Compare
|
/cc @diegs |
|
This LGTM but I haven't tested it. |
| return nil, fmt.Errorf("failed to create patch for node %q: %v", ksm.nodeName, err) | ||
| } | ||
|
|
||
| _, err = ksm.client.Core().Nodes().Patch(ksm.nodeName, api.StrategicMergePatchType, patchBytes, "status") |
There was a problem hiding this comment.
What does providing the "status" subresource do/mean?
There was a problem hiding this comment.
@aaronlevy it's a subresource under node that only allows updates to .status fields and annotations. It's less privileged then the node resource and can be acl'd seperately. This code was written pre-rbac and I'm trying to reduce the privilege required by kube-flannel.
https://github.com/kubernetes/kubernetes/blob/master/pkg/registry/core/node/strategy.go#L122 status strategy zeros out changes to spec.
There was a problem hiding this comment.
Also see changes to rbac file.
|
I tested this by hand on friday. We should probably merge this, cut a release then consider merging #677. |
|
The changes themselves LGTM to me then. |
|
(more hand testing is always appreciated) |
|
Also hand-tested this one: launched a node using |
This works too.
@aaronlevy