Merge pull request #9334 from hakman/docker-selinux

Add "--selinux-enabled" flag for Docker
kubernetes · Jun 16, 2020 · 2a73c9d · 2a73c9d
2 parents dc0c219 + d888b1f
commit 2a73c9d
Show file tree

Hide file tree

Showing 101 changed files with 138 additions and 115 deletions.
diff --git a/k8s/crds/kops.k8s.io_clusters.yaml b/k8s/crds/kops.k8s.io_clusters.yaml
@@ -555,6 +555,9 @@ spec:
                     items:
                       type: string
                     type: array
+                  selinuxEnabled:
+                    description: SelinuxEnabled enables SELinux support
+                    type: boolean
                   skipInstall:
                     description: SkipInstall when set to true will prevent kops from
                       installing and modifying Docker in any way

diff --git a/pkg/apis/kops/dockerconfig.go b/pkg/apis/kops/dockerconfig.go
@@ -60,6 +60,8 @@ type DockerConfig struct {
 	MTU *int32 `json:"mtu,omitempty" flag:"mtu"`
 	// RegistryMirrors is a referred list of docker registry mirror
 	RegistryMirrors []string `json:"registryMirrors,omitempty" flag:"registry-mirror,repeat"`
+	// SelinuxEnabled enables SELinux support
+	SelinuxEnabled *bool `json:"selinuxEnabled,omitempty" flag:"selinux-enabled"`
 	// SkipInstall when set to true will prevent kops from installing and modifying Docker in any way
 	SkipInstall bool `json:"skipInstall,omitempty"`
 	// Storage is the docker storage driver to use

diff --git a/pkg/apis/kops/v1alpha2/dockerconfig.go b/pkg/apis/kops/v1alpha2/dockerconfig.go
@@ -60,6 +60,8 @@ type DockerConfig struct {
 	MTU *int32 `json:"mtu,omitempty" flag:"mtu"`
 	// RegistryMirrors is a referred list of docker registry mirror
 	RegistryMirrors []string `json:"registryMirrors,omitempty" flag:"registry-mirror,repeat"`
+	// SelinuxEnabled enables SELinux support
+	SelinuxEnabled *bool `json:"selinuxEnabled,omitempty" flag:"selinux-enabled"`
 	// SkipInstall when set to true will prevent kops from installing and modifying Docker in any way
 	SkipInstall bool `json:"skipInstall,omitempty"`
 	// Storage is the docker storage driver to use

diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go
diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go
diff --git a/pkg/commands/set_cluster.go b/pkg/commands/set_cluster.go
@@ -92,11 +92,15 @@ func SetClusterFields(fields []string, cluster *api.Cluster, instanceGroups []*a
 			cluster.Spec.Kubelet.AuthenticationTokenWebhook = &v
 		case "cluster.spec.nodePortAccess":
 			cluster.Spec.NodePortAccess = append(cluster.Spec.NodePortAccess, kv[1])
-		case "spec.docker.execOpt":
+		case "spec.docker.selinuxEnabled":
+			v, err := strconv.ParseBool(kv[1])
+			if err != nil {
+				return fmt.Errorf("unknown boolean value: %q", kv[1])
+			}
 			if cluster.Spec.Docker == nil {
 				cluster.Spec.Docker = &api.DockerConfig{}
 			}
-			cluster.Spec.Docker.ExecOpt = append(cluster.Spec.Docker.ExecOpt, kv[1])
+			cluster.Spec.Docker.SelinuxEnabled = &v
 		case "spec.kubernetesVersion":
 			cluster.Spec.KubernetesVersion = kv[1]
 		case "spec.masterPublicName":

diff --git a/pkg/model/components/docker.go b/pkg/model/components/docker.go
@@ -66,7 +66,7 @@ func (b *DockerOptionsBuilder) BuildOptions(o interface{}) error {
 		clusterSpec.Docker.LogOpt = append(clusterSpec.Docker.LogOpt, "max-file=5")
 	}
 
-	docker.LogLevel = fi.String("warn")
+	docker.LogLevel = fi.String("info")
 	docker.IPTables = fi.Bool(false)
 	docker.IPMasq = fi.Bool(false)
 

diff --git a/tests/integration/update_cluster/additional_cidr/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/additional_cidr/cloudformation.json.extracted.yaml
@@ -150,7 +150,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1bmastersadditionalcidrexamplecom.Prop
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5
@@ -453,7 +453,7 @@ Resources.AWSEC2LaunchTemplatenodesadditionalcidrexamplecom.Properties.LaunchTem
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5

diff --git a/...r/data/aws_launch_template_master-us-test-1a.masters.additionalcidr.example.com_user_data b/...r/data/aws_launch_template_master-us-test-1a.masters.additionalcidr.example.com_user_data
diff --git a/...r/data/aws_launch_template_master-us-test-1b.masters.additionalcidr.example.com_user_data b/...r/data/aws_launch_template_master-us-test-1b.masters.additionalcidr.example.com_user_data
diff --git a/...r/data/aws_launch_template_master-us-test-1c.masters.additionalcidr.example.com_user_data b/...r/data/aws_launch_template_master-us-test-1c.masters.additionalcidr.example.com_user_data
diff --git a/...uster/additional_cidr/data/aws_launch_template_nodes.additionalcidr.example.com_user_data b/...uster/additional_cidr/data/aws_launch_template_nodes.additionalcidr.example.com_user_data
diff --git a/tests/integration/update_cluster/additional_user-data/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/additional_user-data/cloudformation.json.extracted.yaml
@@ -159,7 +159,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersadditionaluserdataexamplecom.
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5
@@ -482,7 +482,7 @@ Resources.AWSEC2LaunchTemplatenodesadditionaluserdataexamplecom.Properties.Launc
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5

diff --git a/...s_zone/data/aws_launch_template_master-us-test-1a.masters.crosszone.example.com_user_data b/...s_zone/data/aws_launch_template_master-us-test-1a.masters.crosszone.example.com_user_data
diff --git a/...cluster/api_elb_cross_zone/data/aws_launch_template_nodes.crosszone.example.com_user_data b/...cluster/api_elb_cross_zone/data/aws_launch_template_nodes.crosszone.example.com_user_data
diff --git a/.../data/aws_launch_template_master-us-test-1a.masters.bastionuserdata.example.com_user_data b/.../data/aws_launch_template_master-us-test-1a.masters.bastionuserdata.example.com_user_data
diff --git a/...additional_user-data/data/aws_launch_template_nodes.bastionuserdata.example.com_user_data b/...additional_user-data/data/aws_launch_template_nodes.bastionuserdata.example.com_user_data
diff --git a/tests/integration/update_cluster/complex/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/complex/cloudformation.json.extracted.yaml
@@ -150,7 +150,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscomplexexamplecom.Properties.
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5
@@ -455,7 +455,7 @@ Resources.AWSEC2LaunchTemplatenodescomplexexamplecom.Properties.LaunchTemplateDa
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5

diff --git a/.../complex/data/aws_launch_template_master-us-test-1a.masters.complex.example.com_user_data b/.../complex/data/aws_launch_template_master-us-test-1a.masters.complex.example.com_user_data
diff --git a/...ation/update_cluster/complex/data/aws_launch_template_nodes.complex.example.com_user_data b/...ation/update_cluster/complex/data/aws_launch_template_nodes.complex.example.com_user_data
diff --git a/...iam/data/aws_launch_template_master-us-test-1a.masters.existing-iam.example.com_user_data b/...iam/data/aws_launch_template_master-us-test-1a.masters.existing-iam.example.com_user_data
diff --git a/...iam/data/aws_launch_template_master-us-test-1b.masters.existing-iam.example.com_user_data b/...iam/data/aws_launch_template_master-us-test-1b.masters.existing-iam.example.com_user_data
diff --git a/...iam/data/aws_launch_template_master-us-test-1c.masters.existing-iam.example.com_user_data b/...iam/data/aws_launch_template_master-us-test-1c.masters.existing-iam.example.com_user_data
diff --git a/...te_cluster/existing_iam/data/aws_launch_template_nodes.existing-iam.example.com_user_data b/...te_cluster/existing_iam/data/aws_launch_template_nodes.existing-iam.example.com_user_data
diff --git a/...integration/update_cluster/existing_iam_cloudformation/cloudformation.json.extracted.yaml b/...integration/update_cluster/existing_iam_cloudformation/cloudformation.json.extracted.yaml
@@ -150,7 +150,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersminimalexamplecom.Properties.
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5
@@ -453,7 +453,7 @@ Resources.AWSEC2LaunchTemplatenodesminimalexamplecom.Properties.LaunchTemplateDa
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5

diff --git a/...ng_sg/data/aws_launch_template_master-us-test-1a.masters.existingsg.example.com_user_data b/...ng_sg/data/aws_launch_template_master-us-test-1a.masters.existingsg.example.com_user_data
diff --git a/...ng_sg/data/aws_launch_template_master-us-test-1b.masters.existingsg.example.com_user_data b/...ng_sg/data/aws_launch_template_master-us-test-1b.masters.existingsg.example.com_user_data
diff --git a/...ng_sg/data/aws_launch_template_master-us-test-1c.masters.existingsg.example.com_user_data b/...ng_sg/data/aws_launch_template_master-us-test-1c.masters.existingsg.example.com_user_data
diff --git a/...pdate_cluster/existing_sg/data/aws_launch_template_nodes.existingsg.example.com_user_data b/...pdate_cluster/existing_sg/data/aws_launch_template_nodes.existingsg.example.com_user_data
diff --git a/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml
@@ -150,7 +150,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersexternallbexamplecom.Properti
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5
@@ -453,7 +453,7 @@ Resources.AWSEC2LaunchTemplatenodesexternallbexamplecom.Properties.LaunchTemplat
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5

diff --git a/...nallb/data/aws_launch_template_master-us-test-1a.masters.externallb.example.com_user_data b/...nallb/data/aws_launch_template_master-us-test-1a.masters.externallb.example.com_user_data
diff --git a/...update_cluster/externallb/data/aws_launch_template_nodes.externallb.example.com_user_data b/...update_cluster/externallb/data/aws_launch_template_nodes.externallb.example.com_user_data
diff --git a/...data/aws_launch_template_master-us-test-1a.masters.externalpolicies.example.com_user_data b/...data/aws_launch_template_master-us-test-1a.masters.externalpolicies.example.com_user_data
diff --git a/...er/externalpolicies/data/aws_launch_template_nodes.externalpolicies.example.com_user_data b/...er/externalpolicies/data/aws_launch_template_nodes.externalpolicies.example.com_user_data
diff --git a/...te_cluster/ha/data/aws_launch_template_master-us-test-1a.masters.ha.example.com_user_data b/...te_cluster/ha/data/aws_launch_template_master-us-test-1a.masters.ha.example.com_user_data
diff --git a/...te_cluster/ha/data/aws_launch_template_master-us-test-1b.masters.ha.example.com_user_data b/...te_cluster/ha/data/aws_launch_template_master-us-test-1b.masters.ha.example.com_user_data
diff --git a/...te_cluster/ha/data/aws_launch_template_master-us-test-1c.masters.ha.example.com_user_data b/...te_cluster/ha/data/aws_launch_template_master-us-test-1c.masters.ha.example.com_user_data
diff --git a/tests/integration/update_cluster/ha/data/aws_launch_template_nodes.ha.example.com_user_data b/tests/integration/update_cluster/ha/data/aws_launch_template_nodes.ha.example.com_user_data
diff --git a/...le_compute_instance_template_master-us-test1-a-ha-gce-example-com_metadata_startup-script b/...le_compute_instance_template_master-us-test1-a-ha-gce-example-com_metadata_startup-script
@@ -151,7 +151,7 @@ docker:
   ipMasq: false
   ipTables: false
   logDriver: json-file
-  logLevel: warn
+  logLevel: info
   logOpt:
   - max-size=10m
   - max-file=5

diff --git a/...le_compute_instance_template_master-us-test1-b-ha-gce-example-com_metadata_startup-script b/...le_compute_instance_template_master-us-test1-b-ha-gce-example-com_metadata_startup-script
@@ -151,7 +151,7 @@ docker:
   ipMasq: false
   ipTables: false
   logDriver: json-file
-  logLevel: warn
+  logLevel: info
   logOpt:
   - max-size=10m
   - max-file=5

diff --git a/...le_compute_instance_template_master-us-test1-c-ha-gce-example-com_metadata_startup-script b/...le_compute_instance_template_master-us-test1-c-ha-gce-example-com_metadata_startup-script
@@ -151,7 +151,7 @@ docker:
   ipMasq: false
   ipTables: false
   logDriver: json-file
-  logLevel: warn
+  logLevel: info
   logOpt:
   - max-size=10m
   - max-file=5

diff --git a/...ce/data/google_compute_instance_template_nodes-ha-gce-example-com_metadata_startup-script b/...ce/data/google_compute_instance_template_nodes-ha-gce-example-com_metadata_startup-script
@@ -151,7 +151,7 @@ docker:
   ipMasq: false
   ipTables: false
   logDriver: json-file
-  logLevel: warn
+  logLevel: info
   logOpt:
   - max-size=10m
   - max-file=5

diff --git a/tests/integration/update_cluster/launch_templates/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/launch_templates/cloudformation.json.extracted.yaml
@@ -150,7 +150,7 @@ Resources.AWSAutoScalingLaunchConfigurationmasterustest1amasterslaunchtemplatese
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5
@@ -455,7 +455,7 @@ Resources.AWSAutoScalingLaunchConfigurationmasterustest1bmasterslaunchtemplatese
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5
@@ -760,7 +760,7 @@ Resources.AWSAutoScalingLaunchConfigurationmasterustest1cmasterslaunchtemplatese
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5
@@ -1065,7 +1065,7 @@ Resources.AWSAutoScalingLaunchConfigurationnodeslaunchtemplatesexamplecom.Proper
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5

diff --git a/.../aws_launch_configuration_master-us-test-1a.masters.launchtemplates.example.com_user_data b/.../aws_launch_configuration_master-us-test-1a.masters.launchtemplates.example.com_user_data
@@ -149,7 +149,7 @@ docker:
   ipMasq: false
   ipTables: false
   logDriver: json-file
-  logLevel: warn
+  logLevel: info
   logOpt:
   - max-size=10m
   - max-file=5

diff --git a/.../aws_launch_configuration_master-us-test-1b.masters.launchtemplates.example.com_user_data b/.../aws_launch_configuration_master-us-test-1b.masters.launchtemplates.example.com_user_data
@@ -149,7 +149,7 @@ docker:
   ipMasq: false
   ipTables: false
   logDriver: json-file
-  logLevel: warn
+  logLevel: info
   logOpt:
   - max-size=10m
   - max-file=5

diff --git a/.../aws_launch_configuration_master-us-test-1c.masters.launchtemplates.example.com_user_data b/.../aws_launch_configuration_master-us-test-1c.masters.launchtemplates.example.com_user_data
@@ -149,7 +149,7 @@ docker:
   ipMasq: false
   ipTables: false
   logDriver: json-file
-  logLevel: warn
+  logLevel: info
   logOpt:
   - max-size=10m
   - max-file=5

diff --git a/...aunch_templates/data/aws_launch_configuration_nodes.launchtemplates.example.com_user_data b/...aunch_templates/data/aws_launch_configuration_nodes.launchtemplates.example.com_user_data
@@ -149,7 +149,7 @@ docker:
   ipMasq: false
   ipTables: false
   logDriver: json-file
-  logLevel: warn
+  logLevel: info
   logOpt:
   - max-size=10m
   - max-file=5

diff --git a/tests/integration/update_cluster/minimal-cloudformation/cloudformation.json.extracted.yaml b/tests/integration/update_cluster/minimal-cloudformation/cloudformation.json.extracted.yaml
@@ -150,7 +150,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersminimalexamplecom.Properties.
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5
@@ -453,7 +453,7 @@ Resources.AWSEC2LaunchTemplatenodesminimalexamplecom.Properties.LaunchTemplateDa
     ipMasq: false
     ipTables: false
     logDriver: json-file
-    logLevel: warn
+    logLevel: info
     logOpt:
     - max-size=10m
     - max-file=5