Merge branch 'master' of https://github.com/kubernetes/kops into fixName

.bazelversion

@@ -1 +1 @@
-1.2.0
+1.2.0

Makefile

@@ -553,7 +553,7 @@ verify-bazel:
 	hack/verify-bazel.sh
 
 .PHONY: verify-staticcheck
-verify-staticcheck:
+verify-staticcheck: ${BINDATA_TARGETS}
 	hack/verify-staticcheck.sh
 
 # ci target is for developers, it aims to cover all the CI jobs

WORKSPACE

@@ -71,10 +71,10 @@ load(
 container_pull(
     name = "debian_hyperkube_base_amd64",
     # 'tag' is also supported, but digest is encouraged for reproducibility.
-    digest = "sha256:cc782ed16599000ca4c85d47ec6264753747ae1e77520894dca84b104a7621e2",
+    digest = "sha256:5d4ea2fb5fbe9a9a9da74f67cf2faefc881968bc39f2ac5d62d9167e575812a1",
     registry = "k8s.gcr.io",
     repository = "debian-hyperkube-base-amd64",
-    tag = "0.10",
+    tag = "0.12.1",
 )
 
 git_repository(
@@ -170,7 +170,14 @@ go_repository(
 # Start using distroless base
 container_pull(
     name = "distroless_base",
-    digest = "sha256:a4624843fb1d7d43d9e3d62f6d76b51b6e02b3d03221e29fef4e223d81ef3378",
+    digest = "sha256:7fa7445dfbebae4f4b7ab0e6ef99276e96075ae42584af6286ba080750d6dfe5",
+    registry = "gcr.io",
+    repository = "distroless/base",
+)
+
+container_pull(
+    name = "distroless_base_debug",
+    digest = "sha256:6f78124292427599fcef84139cdc9f4ab2d1851fe129b140c92b997f8fe4d289",
     registry = "gcr.io",
     repository = "distroless/base",
 )

cmd/kops-controller/BUILD.bazel

@@ -41,6 +41,7 @@ container_image(
     name = "image",
     base = "@distroless_base//image",
     cmd = ["/usr/bin/kops-controller"],
+    user = "1000",
     directory = "/usr/bin/",
     files = [
         "//cmd/kops-controller",

cmd/kops/create.go

@@ -28,6 +28,7 @@ import (
 	"k8s.io/kops/cmd/kops/util"
 	kopsapi "k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/pkg/apis/kops/v1alpha1"
+	"k8s.io/kops/pkg/featureflag"
 	"k8s.io/kops/pkg/kopscodecs"
 	"k8s.io/kops/upup/pkg/fi/cloudup"
 	"k8s.io/kops/util/pkg/text"
@@ -147,6 +148,9 @@ func RunCreate(f *util.Factory, out io.Writer, c *CreateOptions) error {
 
 			switch v := o.(type) {
 			case *kopsapi.Cluster:
+				if v.Spec.ExternalCloudControllerManager != nil && !featureflag.EnableExternalCloudController.Enabled() {
+					klog.Warningf("Without setting the feature flag `+EnableExternalCloudController` the external cloud controller manager configuration will be discarded")
+				}
 				// Adding a PerformAssignments() call here as the user might be trying to use
 				// the new `-f` feature, with an old cluster definition.
 				err = cloudup.PerformAssignments(v)

cmd/kops/create_cluster.go

@@ -1260,6 +1260,10 @@ func RunCreateCluster(f *util.Factory, out io.Writer, c *CreateClusterOptions) e
 		return fmt.Errorf("error populating configuration: %v", err)
 	}
 
+	if cluster.Spec.ExternalCloudControllerManager != nil && !featureflag.EnableExternalCloudController.Enabled() {
+		klog.Warningf("Without setting the feature flag `+EnableExternalCloudController` the external cloud controller manager configuration will be discarded")
+	}
+
 	strict := false
 	err = validation.DeepValidate(cluster, instanceGroups, strict)
 	if err != nil {

cmd/kops/integration_test.go

@@ -226,6 +226,11 @@ func TestMixedInstancesSpotASG(t *testing.T) {
 	runTestCloudformation(t, "mixedinstances.example.com", "mixed_instances_spot", "v1alpha2", false, nil)
 }
 
+// TestContainerdCloudformation runs the test on a containerd configuration
+func TestContainerdCloudformation(t *testing.T) {
+	runTestCloudformation(t, "containerd.example.com", "containerd-cloudformation", "v1alpha2", false, nil)
+}
+
 func runTest(t *testing.T, h *testutils.IntegrationTestHarness, clusterName string, srcDir string, version string, private bool, zones int, expectedDataFilenames []string, tfFileName string, phase *cloudup.Phase, lifecycleOverrides []string) {
 	var stdout bytes.Buffer
 

cmd/kops/replace.go

@@ -27,6 +27,7 @@ import (
 	"k8s.io/kops/cmd/kops/util"
 	kopsapi "k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/pkg/commands"
+	"k8s.io/kops/pkg/featureflag"
 	"k8s.io/kops/pkg/kopscodecs"
 	"k8s.io/kops/util/pkg/text"
 	"k8s.io/kops/util/pkg/vfs"
@@ -117,6 +118,9 @@ func RunReplace(f *util.Factory, cmd *cobra.Command, out io.Writer, c *replaceOp
 			switch v := o.(type) {
 			case *kopsapi.Cluster:
 				{
+					if v.Spec.ExternalCloudControllerManager != nil && !featureflag.EnableExternalCloudController.Enabled() {
+						klog.Warningf("Without setting the feature flag `+EnableExternalCloudController` the external cloud controller manager configuration will be discarded")
+					}
 					// Retrieve the current status of the cluster.  This will eventually be part of the cluster object.
 					statusDiscovery := &commands.CloudDiscoveryStatusStore{}
 					status, err := statusDiscovery.FindClusterStatus(v)

cmd/kops/update_cluster.go

@@ -368,7 +368,7 @@ func RunUpdateCluster(f *util.Factory, clusterName string, out io.Writer, c *Upd
 				}
 			}
 			fmt.Fprintf(sb, " * the admin user is specific to Debian. If not using Debian please use the appropriate user based on your OS.\n")
-			fmt.Fprintf(sb, " * read about installing addons at: https://github.com/kubernetes/kops/blob/master/docs/operations/addons.md.\n")
+			fmt.Fprintf(sb, " * read about installing addons at: https://kops.sigs.k8s.io/operations/addons.\n")
 			fmt.Fprintf(sb, "\n")
 		}
 

cmd/kops/util/factory.go

@@ -54,7 +54,7 @@ func NewFactory(options *FactoryOptions) *Factory {
 const (
 	STATE_ERROR = `Please set the --state flag or export KOPS_STATE_STORE.
 For example, a valid value follows the format s3://<bucket>.
-You can find the supported stores in https://github.com/kubernetes/kops/blob/master/docs/state.md.`
+You can find the supported stores in https://kops.sigs.k8s.io/state.`
 
 	INVALID_STATE_ERROR = `Unable to read state store.
 Please use a valid state store when setting --state or KOPS_STATE_STORE env var.

cmd/nodeup/main.go

@@ -37,27 +37,21 @@ const (
 func main() {
 	klog.InitFlags(nil)
 
-	gitVersion := ""
+	var flagConf, flagCacheDir, flagRootFS, gitVersion string
+	var flagRetries int
+	var dryrun, installSystemdUnit bool
+	target := "direct"
+
 	if kops.GitVersion != "" {
 		gitVersion = fmt.Sprintf(" (git-%s)", kops.GitVersion)
 	}
 	fmt.Printf("nodeup version %s%s\n", kops.Version, gitVersion)
-
-	var flagConf string
 	flag.StringVar(&flagConf, "conf", "node.yaml", "configuration location")
-	var flagCacheDir string
 	flag.StringVar(&flagCacheDir, "cache", "/var/cache/nodeup", "the location for the local asset cache")
-	var flagRootFS string
 	flag.StringVar(&flagRootFS, "rootfs", "/", "the location of the machine root (for running in a container)")
-	var flagRetries int
 	flag.IntVar(&flagRetries, "retries", -1, "maximum number of retries on failure: -1 means retry forever")
-
-	dryrun := false
 	flag.BoolVar(&dryrun, "dryrun", false, "Don't create cloud resources; just show what would be done")
-	target := "direct"
 	flag.StringVar(&target, "target", target, "Target - direct, cloudinit")
-
-	installSystemdUnit := false
 	flag.BoolVar(&installSystemdUnit, "install-systemd-unit", installSystemdUnit, "If true, will install a systemd unit instead of running directly")
 
 	if dryrun {

dns-controller/cmd/dns-controller/BUILD.bazel

@@ -47,6 +47,7 @@ container_image(
     name = "image",
     base = "@distroless_base//image",
     cmd = ["/usr/bin/dns-controller"],
+    user = "1000",
     directory = "/usr/bin/",
     files = [
         "dns-controller",

dnsprovider/pkg/dnsprovider/providers/aws/route53/route53_test.go

@@ -128,11 +128,6 @@ func getExampleRrs(zone dnsprovider.Zone) dnsprovider.ResourceRecordSet {
 	return rrsets.New("www11."+zone.Name(), []string{"10.10.10.10", "169.20.20.20"}, 180, rrstype.A)
 }
 
-func getInvalidRrs(zone dnsprovider.Zone) dnsprovider.ResourceRecordSet {
-	rrsets, _ := zone.ResourceRecordSets()
-	return rrsets.New("www12."+zone.Name(), []string{"rubbish", "rubbish"}, 180, rrstype.A)
-}
-
 func addRrsetOrFail(t *testing.T, rrsets dnsprovider.ResourceRecordSets, rrset dnsprovider.ResourceRecordSet) {
 	err := rrsets.StartChangeset().Add(rrset).Apply()
 	if err != nil {

dnsprovider/pkg/dnsprovider/providers/coredns/coredns_test.go

@@ -108,20 +108,6 @@ func rrs(t *testing.T, zone dnsprovider.Zone) (r dnsprovider.ResourceRecordSets)
 	return rrsets
 }
 
-func listRrsOrFail(t *testing.T, rrsets dnsprovider.ResourceRecordSets) []dnsprovider.ResourceRecordSet {
-	rrset, err := rrsets.List()
-	if err != nil {
-		t.Fatalf("Failed to list recordsets: %v", err)
-	} else {
-		if len(rrset) < 0 {
-			t.Fatalf("Record set length=%d, expected >=0", len(rrset))
-		} else {
-			t.Logf("Got %d recordsets: %v", len(rrset), rrset)
-		}
-	}
-	return rrset
-}
-
 func getRrOrFail(t *testing.T, rrsets dnsprovider.ResourceRecordSets, name string) []dnsprovider.ResourceRecordSet {
 	rrsetList, err := rrsets.Get(name)
 	if err != nil {

dnsprovider/pkg/dnsprovider/providers/google/clouddns/clouddns_test.go

@@ -106,11 +106,6 @@ func getExampleRrs(zone dnsprovider.Zone) dnsprovider.ResourceRecordSet {
 	return rrsets.New("www11."+zone.Name(), []string{"10.10.10.10", "169.20.20.20"}, 180, rrstype.A)
 }
 
-func getInvalidRrs(zone dnsprovider.Zone) dnsprovider.ResourceRecordSet {
-	rrsets, _ := zone.ResourceRecordSets()
-	return rrsets.New("www12."+zone.Name(), []string{"rubbish", "rubbish"}, 180, rrstype.A)
-}
-
 func addRrsetOrFail(t *testing.T, rrsets dnsprovider.ResourceRecordSets, rrset dnsprovider.ResourceRecordSet) {
 	err := rrsets.StartChangeset().Add(rrset).Apply()
 	if err != nil {

dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal/clouddns.go

@@ -25,11 +25,8 @@ package internal
 import dns "google.golang.org/api/dns/v1"
 
 type (
-	Project struct{ impl *dns.Project }
-
-	ProjectsGetCall struct{ impl *dns.ProjectsGetCall }
-
+	Project         struct{}
+	ProjectsGetCall struct{}
 	ProjectsService struct{ impl *dns.ProjectsService }
-
-	Quota struct{ impl *dns.Quota }
+	Quota           struct{}
 )

dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal/stubs/BUILD.bazel

@@ -25,7 +25,6 @@ go_library(
     deps = [
         "//dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal/interfaces:go_default_library",
         "//dnsprovider/pkg/dnsprovider/rrstype:go_default_library",
-        "//vendor/google.golang.org/api/dns/v1:go_default_library",
         "//vendor/google.golang.org/api/googleapi:go_default_library",
     ],
 )

dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal/stubs/clouddns.go

@@ -22,12 +22,10 @@ package stubs
 // Only the parts of the API that we use are included.
 // Others can be added as needed.
 
-import dns "google.golang.org/api/dns/v1"
-
 type (
 	// TODO: We don't need these yet, so they remain unimplemented.  Add later as required.
-	Project         struct{ impl *dns.Project }
-	ProjectsGetCall struct{ impl *dns.ProjectsGetCall }
-	ProjectsService struct{ impl *dns.ProjectsService }
-	Quota           struct{ impl *dns.Quota }
+	Project         struct{}
+	ProjectsGetCall struct{}
+	ProjectsService struct{}
+	Quota           struct{}
 )

hack/.staticcheck_failures

@@ -1,38 +1,10 @@
 cloudmock/aws/mockelbv2
 cmd/kops
-dnsprovider/pkg/dnsprovider
-dnsprovider/pkg/dnsprovider/providers/aws/route53
-dnsprovider/pkg/dnsprovider/providers/coredns
-dnsprovider/pkg/dnsprovider/providers/google/clouddns
-dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal
-dnsprovider/pkg/dnsprovider/providers/google/clouddns/internal/stubs
-dnsprovider/pkg/dnsprovider/providers/openstack/designate
 node-authorizer/pkg/authorizers/aws
 node-authorizer/pkg/server
-nodeup/pkg/model
-pkg/apis/kops/v1alpha1
-pkg/apis/kops/v1alpha2
-pkg/apis/kops/validation
-pkg/instancegroups
-pkg/model/components
-pkg/resources/ali
-pkg/resources/aws
-pkg/resources/digitalocean
-pkg/resources/digitalocean/dns
-pkg/resources/gce
 pkg/resources/openstack
-pkg/sshcredentials
-protokube/pkg/gossip/dns/hosts
-protokube/pkg/gossip/mesh
-protokube/pkg/protokube
 upup/pkg/fi
-upup/pkg/fi/assettasks
 upup/pkg/fi/cloudup
 upup/pkg/fi/cloudup/awstasks
-upup/pkg/fi/cloudup/awsup
-upup/pkg/fi/cloudup/gcetasks
-upup/pkg/fi/cloudup/openstack
-upup/pkg/fi/cloudup/openstacktasks
-upup/pkg/fi/nodeup
 upup/pkg/kutil
 upup/tools/generators/pkg/codegen

images/dns-controller/Dockerfile

@@ -21,4 +21,6 @@ RUN apt-get update && apt-get install --yes ca-certificates \
 
 COPY /.build/artifacts/dns-controller /usr/bin/dns-controller
 
+USER 1000
+
 CMD /usr/bin/dns-controller

k8s/crds/kops.k8s.io_clusters.yaml

@@ -364,6 +364,37 @@ spec:
               description: ConfigStore is the VFS path to where the configuration
                 (Cluster, InstanceGroups etc) is stored
               type: string
+            containerRuntime:
+              description: Container runtime to use for Kubernetes
+              type: string
+            containerd:
+              description: Component configurations
+              properties:
+                address:
+                  description: Address of containerd's GRPC server (default "/run/containerd/containerd.sock")
+                  type: string
+                configOverride:
+                  description: Complete containerd config file provided by the user
+                  type: string
+                logLevel:
+                  description: Logging level [trace, debug, info, warn, error, fatal,
+                    panic] (default "warn")
+                  type: string
+                root:
+                  description: Directory for persistent data (default "/var/lib/containerd")
+                  type: string
+                skipInstall:
+                  description: Prevents kops from installing and modifying containerd
+                    in any way (default "false")
+                  type: boolean
+                state:
+                  description: Directory for execution state files (default "/run/containerd")
+                  type: string
+                version:
+                  description: Consumed by nodeup and used to pick the containerd
+                    version
+                  type: string
+              type: object
             dnsControllerGossipConfig:
               description: DNSControllerGossipConfig for the cluster assuming the
                 use of gossip DNS
@@ -387,7 +418,7 @@ spec:
                 of the zone (containing dots), or can be an identifier for the zone.
               type: string
             docker:
-              description: Component configurations
+              description: DockerConfig is the configuration for docker
               properties:
                 authorizationPlugins:
                   description: AuthorizationPlugins is a list of authorization plugins
@@ -774,8 +805,8 @@ spec:
                     - use insecure-bind-address and bind-address'
                   type: string
                 admissionControl:
-                  description: 'Deprecated: AdmissionControl is a list of admission
-                    controllers to use'
+                  description: 'AdmissionControl is a list of admission controllers
+                    to use: Deprecated - use enable-admission-plugins instead'
                   items:
                     type: string
                   type: array

nodeup/pkg/model/BUILD.bazel

@@ -5,6 +5,7 @@ go_library(
     srcs = [
         "architecture.go",
         "cloudconfig.go",
+        "containerd.go",
         "context.go",
         "convenience.go",
         "directories.go",
@@ -82,6 +83,7 @@ go_library(
 go_test(
     name = "go_default_test",
     srcs = [
+        "containerd_test.go",
         "docker_test.go",
         "kube_apiserver_test.go",
         "kube_proxy_test.go",