Update README to correspond to bootkube v0.10.0

Update Calico from v2.6.5 to v2.6.6
* https://github.com/projectcalico/calico/releases/tag/v2.6.6
2026-01-27 18:20:40 +00:00 · 2018-01-19 23:03:03 -08:00 · 2018-01-19 22:18:58 -08:00 · 2018-01-19 08:19:28 -08:00 · 2018-01-12 09:57:01 -08:00 · 2018-01-12 09:15:36 -08:00
14 changed files with 72 additions and 35 deletions
--- a/README.md
+++ b/README.md
@@ -34,13 +34,13 @@ Find bootkube assets rendered to the `asset_dir` path. That's it.

 ### Comparison

-Render bootkube assets directly with bootkube v0.9.1.
+Render bootkube assets directly with bootkube v0.10.0.

 ```sh
 bootkube render --asset-dir=assets --api-servers=https://node1.example.com:443 --api-server-alt-names=DNS=node1.example.com --etcd-servers=https://node1.example.com:2379
 ```

-Compare assets. The only diffs you should see are TLS credentials.
+Compare assets. Rendered assets may differ slightly from bootkube assets to reflect decisions made by the [Typhoon](https://github.com/poseidon/typhoon) distribution.

 ```sh
 pushd /home/core/mycluster
--- a/resources/bootstrap-manifests/bootstrap-apiserver.yaml
+++ b/resources/bootstrap-manifests/bootstrap-apiserver.yaml
@@ -10,7 +10,7 @@ spec:
    command:
    - /hyperkube
    - apiserver
-    - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds
+    - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ValidatingAdmissionWebhook,ResourceQuota,DefaultTolerationSeconds,MutatingAdmissionWebhook
    - --advertise-address=$(POD_IP)
    - --allow-privileged=true
    - --authorization-mode=RBAC
--- a/resources/calico/calico-config.yaml
+++ b/resources/calico/calico-config.yaml
@@ -7,23 +7,33 @@ data:
  # The CNI network configuration to install on each node.
  cni_network_config: |-
    {
-        "name": "k8s-pod-network",
-        "cniVersion": "0.3.0",
-        "type": "calico",
-        "log_level": "info",
-        "datastore_type": "kubernetes",
-        "nodename": "__KUBERNETES_NODE_NAME__",
-        "mtu": ${network_mtu},
-        "ipam": {
+      "name": "k8s-pod-network",
+      "cniVersion": "0.3.1",
+      "plugins": [
+        {
+          "type": "calico",
+          "log_level": "info",
+          "datastore_type": "kubernetes",
+          "nodename": "__KUBERNETES_NODE_NAME__",
+          "mtu": ${network_mtu},
+          "ipam": {
            "type": "host-local",
            "subnet": "usePodCidr"
-        },
-        "policy": {
+          },
+          "policy": {
            "type": "k8s",
            "k8s_auth_token": "__SERVICEACCOUNT_TOKEN__"
-        },
-        "kubernetes": {
+          },
+          "kubernetes": {
            "k8s_api_root": "https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__",
            "kubeconfig": "__KUBECONFIG_FILEPATH__"
+          }
+        },
+        {
+          "type": "portmap",
+          "capabilities": {
+            "portMappings": true
+          }
        }
+      ]
    }
--- a/resources/calico/calico.yaml
+++ b/resources/calico/calico.yaml
@@ -9,6 +9,10 @@ spec:
  selector:
    matchLabels:
      k8s-app: calico-node
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
  template:
    metadata:
      labels:
@@ -97,6 +101,8 @@ spec:
          image: ${calico_cni_image}
          command: ["/install-cni.sh"]
          env:
+            - name: CNI_CONF_NAME
+              value: 10-calico.conflist
            - name: CNI_NETWORK_CONFIG
              valueFrom:
                configMapKeyRef:
@@ -128,7 +134,3 @@ spec:
        - name: cni-net-dir
          hostPath:
            path: /etc/kubernetes/cni/net.d
-  updateStrategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
--- a/resources/manifests/kube-apiserver.yaml
+++ b/resources/manifests/kube-apiserver.yaml
@@ -25,7 +25,7 @@ spec:
        command:
        - /hyperkube
        - apiserver
-        - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds
+        - --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ValidatingAdmissionWebhook,ResourceQuota,DefaultTolerationSeconds,MutatingAdmissionWebhook
        - --advertise-address=$(POD_IP)
        - --allow-privileged=true
        - --anonymous-auth=false
--- a/resources/manifests/kube-controller-manager-role-binding.yaml
+++ b/resources/manifests/kube-controller-manager-role-binding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: controller-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:kube-controller-manager
+subjects:
+- kind: ServiceAccount
+  name: kube-controller-manager
+  namespace: kube-system
--- a/resources/manifests/kube-controller-manager-sa.yaml
+++ b/resources/manifests/kube-controller-manager-sa.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  namespace: kube-system
+  name: kube-controller-manager
--- a/resources/manifests/kube-controller-manager.yaml
+++ b/resources/manifests/kube-controller-manager.yaml
@@ -40,6 +40,7 @@ spec:
        command:
        - ./hyperkube
        - controller-manager
+        - --use-service-account-credentials
        - --allocate-node-cidrs=true
        - --cloud-provider=${cloud_provider}
        - --cluster-cidr=${pod_cidr}
@@ -66,6 +67,7 @@ spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
+      serviceAccountName: kube-controller-manager
      tolerations:
      - key: node-role.kubernetes.io/master
        operator: Exists
--- a/resources/manifests/kube-dns-deployment.yaml
+++ b/resources/manifests/kube-dns-deployment.yaml
@@ -140,8 +140,8 @@ spec:
        args:
        - --v=2
        - --logtostderr
-        - --probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.${cluster_domain_suffix},5,A
-        - --probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.${cluster_domain_suffix},5,A
+        - --probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.${cluster_domain_suffix},5,SRV
+        - --probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.${cluster_domain_suffix},5,SRV
        ports:
        - containerPort: 10054
          name: metrics
@@ -151,3 +151,4 @@ spec:
            memory: 20Mi
            cpu: 10m
      dnsPolicy: Default  # Don't use cluster DNS.
+      serviceAccountName: kube-dns
--- a/resources/manifests/kube-dns-sa.yaml
+++ b/resources/manifests/kube-dns-sa.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kube-dns
+  namespace: kube-system
--- a/resources/manifests/kube-proxy.yaml
+++ b/resources/manifests/kube-proxy.yaml
@@ -58,8 +58,8 @@ spec:
        hostPath:
          path: /usr/share/ca-certificates
      - name: kubeconfig
-        secret:
-          secretName: kubeconfig-in-cluster
+        configMap:
+          name: kubeconfig-in-cluster
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
--- a/resources/manifests/kubeconfig-in-cluster.yaml
+++ b/resources/manifests/kubeconfig-in-cluster.yaml
@@ -1,16 +1,16 @@
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
  name: kubeconfig-in-cluster
  namespace: kube-system
-stringData:
+data:
  kubeconfig: |
    apiVersion: v1
    clusters:
    - name: local
      cluster:
        server: ${server}
-        certificate-authority-data: ${ca_cert}
+        certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    users:
    - name: service-account
      user:
--- a/resources/manifests/pod-checkpointer.yaml
+++ b/resources/manifests/pod-checkpointer.yaml
@@ -58,8 +58,8 @@ spec:
        effect: NoSchedule
      volumes:
      - name: kubeconfig
-        secret:
-          secretName: kubeconfig-in-cluster
+        configMap:
+          name: kubeconfig-in-cluster
      - name: etc-kubernetes
        hostPath:
          path: /etc/kubernetes
--- a/variables.tf
+++ b/variables.tf
@@ -63,14 +63,14 @@ variable "container_images" {
  type        = "map"

  default = {
-    calico           = "quay.io/calico/node:v2.6.3"
-    calico_cni       = "quay.io/calico/cni:v1.11.1"
+    calico           = "quay.io/calico/node:v2.6.6"
+    calico_cni       = "quay.io/calico/cni:v1.11.2"
    flannel          = "quay.io/coreos/flannel:v0.9.1-amd64"
    flannel_cni      = "quay.io/coreos/flannel-cni:v0.3.0"
-    hyperkube        = "gcr.io/google_containers/hyperkube:v1.8.5"
-    kubedns          = "gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.5"
-    kubedns_dnsmasq  = "gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.5"
-    kubedns_sidecar  = "gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.5"
+    hyperkube        = "gcr.io/google_containers/hyperkube:v1.9.2"
+    kubedns          = "gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.8"
+    kubedns_dnsmasq  = "gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.8"
+    kubedns_sidecar  = "gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.8"
    pod_checkpointer = "quay.io/coreos/pod-checkpointer:08fa021813231323e121ecca7383cc64c4afe888"
  }
 }
Author	SHA1	Message	Date
Dalton Hubble	b339254ed5	Update README to correspond to bootkube v0.10.0	2018-01-19 23:03:03 -08:00
Dalton Hubble	9ccedf7b1e	Update Calico from v2.6.5 to v2.6.6 * https://github.com/projectcalico/calico/releases/tag/v2.6.6	2018-01-19 22:18:58 -08:00
Dalton Hubble	9795894004	Update hyperkube from v1.9.1 to v1.9.2	2018-01-19 08:19:28 -08:00
Dalton Hubble	bf07c3edad	Update kube-dns from v1.14.7 to v1.14.8 * https://github.com/kubernetes/kubernetes/pull/57918	2018-01-12 09:57:01 -08:00
Dalton Hubble	41a16db127	Add separate service account for kube-dns	2018-01-12 09:15:36 -08:00
Dalton Hubble	b83e321b35	Enable portmap plugin to fix hostPort with Calico * Ask the Calico sidecar to add a CNI conflist to each node (for calico and portmap plugins). Cleans up Switch from CNI conf to conflist * https://github.com/projectcalico/cni-plugin/blob/v1.11.2/k8s-install/scripts/install-cni.sh * Related https://github.com/kubernetes-incubator/bootkube/pull/711	2018-01-06 13:33:17 -08:00
Dalton Hubble	28333ec9da	Update Calico from v2.6.4 to 2.6.5	2018-01-06 13:17:46 -08:00
Dalton Hubble	891e88a70b	Update apiserver --admission-control for v1.9.x * https://kubernetes.io/docs/admin/admission-controllers	2018-01-06 13:16:27 -08:00
Dalton Hubble	5326239074	Update hyperkube from v1.9.0 to v1.9.1	2018-01-06 11:25:26 -08:00
Dalton Hubble	abe1f6dbf3	Update kube-dns from v1.14.6 to v1.14.7 * https://github.com/kubernetes/kubernetes/pull/54443	2018-01-06 11:24:55 -08:00
Dalton Hubble	4260d9ae87	Update kube-dns version and probe for SRV records * https://github.com/kubernetes/kubernetes/pull/51378	2018-01-06 11:24:55 -08:00
Dalton Hubble	84c86ed81a	Update hyperkube from v1.8.6 to v1.9.0	2018-01-06 11:24:55 -08:00
Dalton Hubble	a97f2ea8de	Use an isolated service account for controller-manager * https://github.com/kubernetes-incubator/bootkube/pull/795	2018-01-06 11:19:11 -08:00
Dalton Hubble	5072569bb7	Update calico/cni sidecar from v1.11.1 to v1.11.2	2017-12-21 11:16:55 -08:00
Dalton Hubble	7a52b30713	Update hyperkube image from v1.8.5 to v1.8.6	2017-12-21 10:26:06 -08:00
Dalton Hubble	73fcee2471	Switch kubeconfig-in-cluster from Secret to ConfigMap * kubeconfig-in-cluster doesn't contain secrets, just refernces to locations	2017-12-21 09:15:15 -08:00
Dalton Hubble	b25d802e3e	Update Calico from v2.6.3 to v2.6.4 * https://github.com/projectcalico/calico/releases/tag/v2.6.4	2017-12-21 08:57:02 -08:00