Update README to correspond to bootkube v0.11.0

Update pod-checkpointer image version
* No notable changes except a grace period flag we don't use * https://github.com/kubernetes-incubator/bootkube/pull/826
2026-01-27 18:20:40 +00:00 · 2018-02-22 21:48:30 -08:00 · 2018-02-15 08:03:16 -08:00 · 2018-02-11 11:25:02 -08:00 · 2018-02-11 11:22:52 -08:00 · 2018-02-10 13:04:13 -08:00
27 changed files with 168 additions and 62 deletions
--- a/README.md
+++ b/README.md
@@ -34,7 +34,7 @@ Find bootkube assets rendered to the `asset_dir` path. That's it.

 ### Comparison

-Render bootkube assets directly with bootkube v0.10.0.
+Render bootkube assets directly with bootkube v0.11.0.

 ```sh
 bootkube render --asset-dir=assets --api-servers=https://node1.example.com:443 --api-server-alt-names=DNS=node1.example.com --etcd-servers=https://node1.example.com:2379
--- a/resources/bootstrap-manifests/bootstrap-apiserver.yaml
+++ b/resources/bootstrap-manifests/bootstrap-apiserver.yaml
@@ -10,7 +10,7 @@ spec:
    command:
    - /hyperkube
    - apiserver
-    - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ValidatingAdmissionWebhook,ResourceQuota,DefaultTolerationSeconds,MutatingAdmissionWebhook
+    - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ValidatingAdmissionWebhook,ResourceQuota,DefaultTolerationSeconds,MutatingAdmissionWebhook
    - --advertise-address=$(POD_IP)
    - --allow-privileged=true
    - --authorization-mode=RBAC
@@ -19,7 +19,6 @@ spec:
    - --etcd-cafile=/etc/kubernetes/secrets/etcd-client-ca.crt
    - --etcd-certfile=/etc/kubernetes/secrets/etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/secrets/etcd-client.key
-    - --etcd-quorum-read=true
    - --etcd-servers=${etcd_servers}
    - --insecure-port=0
    - --kubelet-client-certificate=/etc/kubernetes/secrets/apiserver.crt
--- a/resources/calico/bgpconfigurations-crd.yaml
+++ b/resources/calico/bgpconfigurations-crd.yaml
@@ -0,0 +1,13 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+description: Calico BGP Configuration
+kind: CustomResourceDefinition
+metadata:
+  name: bgpconfigurations.crd.projectcalico.org
+spec:
+  scope: Cluster
+  group: crd.projectcalico.org
+  version: v1
+  names:
+    kind: BGPConfiguration
+    plural: bgpconfigurations
+    singular: bgpconfiguration
--- a/resources/calico/calico-bgp-peers.yaml
+++ b/resources/calico/calico-bgp-peers.yaml
--- a/resources/calico/calico-cluster-role.yaml
+++ b/resources/calico/calico-cluster-role.yaml
@@ -2,7 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: calico-node
-  namespace: kube-system
 rules:
  - apiGroups: [""]
    resources:
@@ -23,6 +22,17 @@ rules:
      - get
      - list
      - watch
+      - patch
+  - apiGroups: [""]
+    resources:
+      - services
+    verbs:
+      - get
+  - apiGroups: [""]
+    resources:
+      - endpoints
+    verbs:
+      - get
  - apiGroups: [""]
    resources:
      - nodes
@@ -41,10 +51,15 @@ rules:
  - apiGroups: ["crd.projectcalico.org"]
    resources:
      - globalfelixconfigs
+      - felixconfigurations
      - bgppeers
      - globalbgpconfigs
+      - bgpconfigurations
      - ippools
      - globalnetworkpolicies
+      - globalnetworksets
+      - networkpolicies
+      - clusterinformations
    verbs:
      - create
      - get
--- a/resources/calico/calico-config.yaml
+++ b/resources/calico/calico-config.yaml
@@ -4,6 +4,7 @@ metadata:
  name: calico-config
  namespace: kube-system
 data:
+  typha_service_name: "none"
  # The CNI network configuration to install on each node.
  cni_network_config: |-
    {
@@ -31,9 +32,8 @@ data:
        },
        {
          "type": "portmap",
-          "capabilities": {
-            "portMappings": true
-          }
+          "snat": true,
+          "capabilities": {"portMappings": true}
        }
      ]
    }
--- a/resources/calico/calico-gloabl-felix-configs.yaml
+++ b/resources/calico/calico-gloabl-felix-configs.yaml
@@ -1,13 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-description: Calico Global Felix Configuration
-kind: CustomResourceDefinition
-metadata:
-   name: globalfelixconfigs.crd.projectcalico.org
-spec:
-  scope: Cluster
-  group: crd.projectcalico.org
-  version: v1
-  names:
-    kind: GlobalFelixConfig
-    plural: globalfelixconfigs
-    singular: globalfelixconfig
--- a/resources/calico/calico-global-bgp-configs.yaml
+++ b/resources/calico/calico-global-bgp-configs.yaml
@@ -1,13 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-description: Calico Global BGP Configuration
-kind: CustomResourceDefinition
-metadata:
-  name: globalbgpconfigs.crd.projectcalico.org
-spec:
-  scope: Cluster
-  group: crd.projectcalico.org
-  version: v1
-  names:
-    kind: GlobalBGPConfig
-    plural: globalbgpconfigs
-    singular: globalbgpconfig
--- a/resources/calico/calico.yaml
+++ b/resources/calico/calico.yaml
@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: calico-node
@@ -10,9 +10,9 @@ spec:
    matchLabels:
      k8s-app: calico-node
  updateStrategy:
+    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
-    type: RollingUpdate
  template:
    metadata:
      labels:
@@ -21,9 +21,10 @@ spec:
      hostNetwork: true
      serviceAccountName: calico-node
      tolerations:
-        # Allow the pod to run on master nodes
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
+        - effect: NoSchedule
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists
      containers:
        - name: calico-node
          image: ${calico_image}
@@ -61,15 +62,20 @@ spec:
            # Enable IP-in-IP within Felix.
            - name: FELIX_IPINIPENABLED
              value: "true"
+            # Typha support: controlled by the ConfigMap.
+            - name: FELIX_TYPHAK8SSERVICENAME
+              valueFrom:
+                configMapKeyRef:
+                  name: calico-config
+                  key: typha_service_name
            # Set node name based on k8s nodeName.
            - name: NODENAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
+            # Auto-detect the BGP IP address.
            - name: IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
+              value: "autodetect"
            - name: FELIX_HEALTHENABLED
              value: "true"
          securityContext:
@@ -101,20 +107,22 @@ spec:
          image: ${calico_cni_image}
          command: ["/install-cni.sh"]
          env:
+            # Name of the CNI config file to create on each node.
            - name: CNI_CONF_NAME
-              value: 10-calico.conflist
+              value: "10-calico.conflist"
+            # Contents of the CNI config to create on each node.
            - name: CNI_NETWORK_CONFIG
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: cni_network_config
-            - name: CNI_NET_DIR
-              value: "/etc/kubernetes/cni/net.d"
            # Set node name based on k8s nodeName
            - name: KUBERNETES_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
+            - name: CNI_NET_DIR
+              value: "/etc/kubernetes/cni/net.d"
          volumeMounts:
            - mountPath: /host/opt/cni/bin
              name: cni-bin-dir
@@ -122,12 +130,14 @@ spec:
              name: cni-net-dir
      terminationGracePeriodSeconds: 0
      volumes:
+        # Used by calico/node
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - name: var-run-calico
          hostPath:
            path: /var/run/calico
+        # Used by install-cni
        - name: cni-bin-dir
          hostPath:
            path: /opt/cni/bin
--- a/resources/calico/clusterinformations-crd.yaml
+++ b/resources/calico/clusterinformations-crd.yaml
@@ -0,0 +1,13 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+description: Calico Cluster Information
+kind: CustomResourceDefinition
+metadata:
+  name: clusterinformations.crd.projectcalico.org
+spec:
+  scope: Cluster
+  group: crd.projectcalico.org
+  version: v1
+  names:
+    kind: ClusterInformation
+    plural: clusterinformations
+    singular: clusterinformation
--- a/resources/calico/felixconfigurations-crd.yaml
+++ b/resources/calico/felixconfigurations-crd.yaml
@@ -0,0 +1,13 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+description: Calico Felix Configuration
+kind: CustomResourceDefinition
+metadata:
+   name: felixconfigurations.crd.projectcalico.org
+spec:
+  scope: Cluster
+  group: crd.projectcalico.org
+  version: v1
+  names:
+    kind: FelixConfiguration
+    plural: felixconfigurations
+    singular: felixconfiguration
--- a/resources/calico/globalnetworkpolicies-crd.yaml
+++ b/resources/calico/globalnetworkpolicies-crd.yaml
--- a/resources/calico/globalnetworksets-crd.yaml
+++ b/resources/calico/globalnetworksets-crd.yaml
@@ -0,0 +1,13 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+description: Calico Global Network Sets
+kind: CustomResourceDefinition
+metadata:
+  name: globalnetworksets.crd.projectcalico.org
+spec:
+  scope: Cluster
+  group: crd.projectcalico.org
+  version: v1
+  names:
+    kind: GlobalNetworkSet
+    plural: globalnetworksets
+    singular: globalnetworkset
--- a/resources/calico/calico-ip-pools.yaml
+++ b/resources/calico/calico-ip-pools.yaml
--- a/resources/calico/networkpolicies-crd.yaml
+++ b/resources/calico/networkpolicies-crd.yaml
@@ -0,0 +1,13 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+description: Calico Network Policies
+kind: CustomResourceDefinition
+metadata:
+  name: networkpolicies.crd.projectcalico.org
+spec:
+  scope: Namespaced
+  group: crd.projectcalico.org
+  version: v1
+  names:
+    kind: NetworkPolicy
+    plural: networkpolicies
+    singular: networkpolicy
--- a/resources/flannel/kube-flannel-cfg.yaml
+++ b/resources/flannel/kube-flannel-cfg.yaml
--- a/resources/flannel/flannel-cluster-role-binding.yaml
+++ b/resources/flannel/flannel-cluster-role-binding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: flannel
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flannel
+subjects:
+- kind: ServiceAccount
+  name: flannel
+  namespace: kube-system
--- a/resources/flannel/flannel-cluster-role.yaml
+++ b/resources/flannel/flannel-cluster-role.yaml
@@ -0,0 +1,24 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: flannel
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes/status
+    verbs:
+      - patch
--- a/resources/flannel/flannel-sa.yaml
+++ b/resources/flannel/flannel-sa.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: flannel
+  namespace: kube-system
--- a/resources/flannel/kube-flannel.yaml
+++ b/resources/flannel/kube-flannel.yaml
@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: kube-flannel
@@ -17,6 +17,7 @@ spec:
        tier: node
        k8s-app: flannel
    spec:
+      serviceAccountName: flannel
      containers:
      - name: kube-flannel
        image: ${flannel_image}
@@ -59,9 +60,10 @@ spec:
          mountPath: /host/opt/cni/bin/
      hostNetwork: true
      tolerations:
-      - key: node-role.kubernetes.io/master
+      - effect: NoSchedule
+        operator: Exists
+      - effect: NoExecute
        operator: Exists
-        effect: NoSchedule
      volumes:
        - name: run
          hostPath:
--- a/resources/manifests/kube-apiserver.yaml
+++ b/resources/manifests/kube-apiserver.yaml
@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: kube-apiserver
@@ -25,7 +25,7 @@ spec:
        command:
        - /hyperkube
        - apiserver
-        - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ValidatingAdmissionWebhook,ResourceQuota,DefaultTolerationSeconds,MutatingAdmissionWebhook
+        - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ValidatingAdmissionWebhook,ResourceQuota,DefaultTolerationSeconds,MutatingAdmissionWebhook
        - --advertise-address=$(POD_IP)
        - --allow-privileged=true
        - --anonymous-auth=false
@@ -36,7 +36,6 @@ spec:
        - --etcd-cafile=/etc/kubernetes/secrets/etcd-client-ca.crt
        - --etcd-certfile=/etc/kubernetes/secrets/etcd-client.crt
        - --etcd-keyfile=/etc/kubernetes/secrets/etcd-client.key
-        - --etcd-quorum-read=true
        - --etcd-servers=${etcd_servers}
        - --insecure-port=0
        - --kubelet-client-certificate=/etc/kubernetes/secrets/apiserver.crt
--- a/resources/manifests/kube-controller-manager.yaml
+++ b/resources/manifests/kube-controller-manager.yaml
@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: kube-controller-manager
--- a/resources/manifests/kube-dns-deployment.yaml
+++ b/resources/manifests/kube-dns-deployment.yaml
@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: kube-dns
--- a/resources/manifests/kube-proxy.yaml
+++ b/resources/manifests/kube-proxy.yaml
@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: kube-proxy
@@ -47,9 +47,10 @@ spec:
      hostNetwork: true
      serviceAccountName: kube-proxy
      tolerations:
-      - key: node-role.kubernetes.io/master
+      - effect: NoSchedule
+        operator: Exists
+      - effect: NoExecute
        operator: Exists
-        effect: NoSchedule
      volumes:
      - name: lib-modules
        hostPath:
--- a/resources/manifests/kube-scheduler.yaml
+++ b/resources/manifests/kube-scheduler.yaml
@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: kube-scheduler
--- a/resources/manifests/pod-checkpointer.yaml
+++ b/resources/manifests/pod-checkpointer.yaml
@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: pod-checkpointer
--- a/variables.tf
+++ b/variables.tf
@@ -63,15 +63,15 @@ variable "container_images" {
  type        = "map"

  default = {
-    calico           = "quay.io/calico/node:v2.6.6"
-    calico_cni       = "quay.io/calico/cni:v1.11.2"
-    flannel          = "quay.io/coreos/flannel:v0.9.1-amd64"
+    calico           = "quay.io/calico/node:v3.0.2"
+    calico_cni       = "quay.io/calico/cni:v2.0.0"
+    flannel          = "quay.io/coreos/flannel:v0.10.0-amd64"
    flannel_cni      = "quay.io/coreos/flannel-cni:v0.3.0"
-    hyperkube        = "gcr.io/google_containers/hyperkube:v1.9.2"
+    hyperkube        = "gcr.io/google_containers/hyperkube:v1.9.3"
    kubedns          = "gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.8"
    kubedns_dnsmasq  = "gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.8"
    kubedns_sidecar  = "gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.8"
-    pod_checkpointer = "quay.io/coreos/pod-checkpointer:08fa021813231323e121ecca7383cc64c4afe888"
+    pod_checkpointer = "quay.io/coreos/pod-checkpointer:3cd08279c564e95c8b42a0b97c073522d4a6b965"
  }
 }
Author	SHA1	Message	Date
Dalton Hubble	13a20039f5	Update README to correspond to bootkube v0.11.0	2018-02-22 21:48:30 -08:00
Dalton Hubble	070d184644	Update pod-checkpointer image version * No notable changes except a grace period flag we don't use * https://github.com/kubernetes-incubator/bootkube/pull/826	2018-02-15 08:03:16 -08:00
Dalton Hubble	cd6f6fa20d	Remove PersistentVolumeLabel admission controller flag * PersistentVolumeLabel admission controller is deprecated in 1.9	2018-02-11 11:25:02 -08:00
Dalton Hubble	8159561165	Switch Deployments and DaemonSets to apps/v1	2018-02-11 11:22:52 -08:00
Dalton Hubble	203b90169e	Add Calico GlobalNetworkSet CRD	2018-02-10 13:04:13 -08:00
Dalton Hubble	72ab2b6aa8	Update Calico from v3.0.1 to v3.0.2 * https://github.com/projectcalico/calico/releases/tag/v3.0.2	2018-02-10 12:58:07 -08:00
Dalton Hubble	5d8a9e8986	Remove deprecated apiserver --etcd-quorum-read flag	2018-02-09 17:53:55 -08:00
Dalton Hubble	27857322df	Update hyperkube from v1.9.2 to v1.9.3	2018-02-09 16:44:54 -08:00
Dalton Hubble	27d5f62f6c	Change DaemonSets to tolerate NoSchedule and NoExecute taints * Change kube-proxy, flannel, and calico to tolerate any NoSchedule or NoExecute taint, not just allow running on masters * https://github.com/kubernetes-incubator/bootkube/pull/704	2018-02-03 05:58:23 +01:00
Dalton Hubble	20adb15d32	Add flannel service account and RBAC cluster role * Define a limited ClusterRole and service account for flannel * https://github.com/kubernetes-incubator/bootkube/pull/869	2018-02-03 05:46:31 +01:00
Dalton Hubble	8d40d6c64d	Update flannel from v0.9.0 to v0.10.0 * https://github.com/coreos/flannel/releases/tag/v0.10.0	2018-01-28 22:19:42 -08:00
Dalton Hubble	f4ccbeee10	Migrate from Calico v2.6.6 to to 3.0.1 * https://github.com/projectcalico/calico/releases/tag/v3.0.1	2018-01-19 23:04:57 -08:00