Test dependencies
Some checks failed
continuous-integration/drone Build is failing

This commit is contained in:
2023-02-22 21:24:42 +01:00
commit f2b0a5e7c7
429 changed files with 20330 additions and 0 deletions

View File

@ -0,0 +1,118 @@
# Copyright 2018 The Kubernetes Authors.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
common_rpms:
- audit
- ca-certificates
- conntrack-tools
- chrony
- curl
- jq
- python3-pip
- socat
- sysstat
- yum-utils
# Used for AmazonLinux-2 distributions
al2_rpms:
- ebtables
- python-netifaces
- python-requests
# Used for RedHat based distributions == 7 (ex. RHEL-7, CentOS-7 etc.)
rh7_rpms:
- ebtables
- python-netifaces
- python-requests
# Used for RedHat based distributions == 8 (ex. RHEL-8, RockyLinux-8 etc.)
rh8_rpms:
- nftables
- python3-netifaces
- python3-requests
common_debs:
- auditd
- apt-transport-https
- conntrack
- chrony
- curl
- ebtables
- jq
- gnupg
- libnetfilter-acct1
- libnetfilter-cttimeout1
- libnetfilter-log1
- python3-distutils
- python3-netifaces
- python3-pip
- socat
common_photon_rpms:
- audit
- apparmor-parser
- conntrack-tools
- chrony
- dbus-python3
- distrib-compat
- ebtables
- net-tools
- openssl-c_rehash
- python3-pygobject
- python3-pip
- rng-tools
- socat
- tar
- unzip
- curl
photon_3_rpms:
- python-netifaces
- python-requests
- jq
# Creating photon_4_rpms for adding future packages if needed.
# Since empty list errors out, jq is added.
photon_4_rpms:
- jq
common_virt_rpms:
- open-vm-tools
common_virt_debs:
- linux-cloud-tools-virtual
- linux-tools-virtual
- open-vm-tools
common_virt_photon_rpms:
- open-vm-tools
common_raw_rpms: []
common_raw_debs:
- linux-cloud-tools-generic
- linux-tools-generic
common_raw_photon_rpms: []
#photon does not have backward compatibility for legacy distro behavior for sysctl.conf by default
#as it uses systemd-sysctl. set this var so we can use for sysctl conf file value.
sysctl_conf_file: "{{ '/etc/sysctl.d/99-sysctl.conf' if ansible_os_family == 'VMware Photon OS' else '/etc/sysctl.conf' }}"
pause_image: "registry.k8s.io/pause:3.9"
containerd_additional_settings: null
leak_local_mdns_to_dns: false
build_target: "virt"
cloud_cfg_file: "/etc/cloud/cloud.cfg"
external_binary_path: "{{ '/opt/bin' if ansible_os_family == 'Flatcar' else '/usr/local/bin' }}"

View File

@ -0,0 +1,10 @@
-w /var/lib/containerd/ -p rwxa -k containerd
-w /etc/containerd/ -p rwxa -k containerd
-w /etc/systemd/system/containerd.service -p rwxa -k containerd
-w /etc/systemd/system/containerd.service.d/ -p rwxa -k containerd
-w /run/containerd/ -p rwxa -k containerd
-w /usr/local/bin/containerd-shim -p rwxa -k containerd
-w /usr/local/bin/containerd-shim-runc-v1 -p rwxa -k containerd
-w /usr/local/bin/containerd-shim-runc-v2 -p rwxa -k containerd
-w /usr/local/sbin/runc -p rwxa -k containerd
-w /usr/local/bin/containerd -p rwxa -k containerd

View File

@ -0,0 +1,10 @@
-w /var/lib/containerd/ -p rwxa -k containerd
-w /etc/containerd/ -p rwxa -k containerd
-w /etc/systemd/system/containerd.service -p rwxa -k containerd
-w /etc/systemd/system/containerd.service.d/ -p rwxa -k containerd
-w /run/containerd/ -p rwxa -k containerd
-w /opt/bin/containerd-shim -p rwxa -k containerd
-w /opt/bin/containerd-shim-runc-v1 -p rwxa -k containerd
-w /opt/bin/containerd-shim-runc-v2 -p rwxa -k containerd
-w /opt/bin/runc -p rwxa -k containerd
-w /opt/bin/containerd -p rwxa -k containerd

View File

@ -0,0 +1,38 @@
#!/bin/bash
# Copyright 2022 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
set -o errexit # exits immediately on any unexpected error (does not bypass traps)
set -o nounset # will error if variables are used without first being defined
set -o pipefail # any non-zero exit code in a piped command causes the pipeline to fail with that code
trap on_exit ERR
on_exit() {
echo "Error setting etcd network tuning parameters for interface: ${DEV}" | systemd-cat -p emerg -t etcd-tuning
}
if [ "$#" -ne 1 ]; then
echo "Error: Usage: $0 <dev>" | systemd-cat -p emerg -t etcd-tuning
exit 1
fi
DEV=$1
echo "Setting etcd network tuning parameters for interface: ${DEV}" | systemd-cat -p info -t etcd-tuning
tc qdisc add dev ${DEV} root handle 1: prio bands 3
tc filter add dev ${DEV} parent 1: protocol ip prio 1 u32 match ip sport 2380 0xffff flowid 1:1
tc filter add dev ${DEV} parent 1: protocol ip prio 1 u32 match ip dport 2380 0xffff flowid 1:1
tc filter add dev ${DEV} parent 1: protocol ip prio 2 u32 match ip sport 2379 0xffff flowid 1:1
tc filter add dev ${DEV} parent 1: protocol ip prio 2 u32 match ip dport 2379 0xffff flowid 1:1

View File

@ -0,0 +1,38 @@
# Copyright 2020 The Kubernetes Authors.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
dependencies:
- role: setup
vars:
rpms: "{{ common_rpms + al2_rpms + lookup('vars', 'common_' + build_target + '_rpms') }}"
debs: "{{ common_debs }}"
when: ansible_distribution == "Amazon"
- role: setup
vars:
rpms: "{{ common_rpms }}"
debs: "{{ common_debs }}"
when: packer_builder_type == "oracle-oci" and ansible_architecture == "aarch64"
- role: setup
vars:
rpms: "{{ ( common_photon_rpms + photon_3_rpms + lookup('vars', 'common_' + build_target + '_photon_rpms') ) if (ansible_os_family == 'VMware Photon OS' and ansible_distribution_major_version == '3') else (common_photon_rpms + photon_4_rpms + lookup('vars', 'common_' + build_target + '_photon_rpms')) }}"
when: ansible_distribution == "VMware Photon OS"
- role: setup
vars:
rpms: "{{ ( ( common_rpms + rh7_rpms + lookup('vars', 'common_' + build_target + '_rpms') ) if (ansible_os_family == 'RedHat' and ansible_distribution_major_version == '7') else ( common_rpms + rh8_rpms + lookup('vars', 'common_' + build_target + '_rpms') ) ) }}"
debs: "{{ common_debs + lookup('vars', 'common_' + build_target + '_debs') }}"
when: ansible_distribution != "VMware Photon OS" and ansible_distribution != "Amazon" and not (packer_builder_type == "oracle-oci" and ansible_architecture == "aarch64") and
not packer_builder_type is search('qemu')

View File

@ -0,0 +1,28 @@
# Copyright 2020 The Kubernetes Authors.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
- name: Ensure sysstat is running and comes on at reboot
service:
name: sysstat
state: started
enabled: yes
# images need to be immutable once built
# https://aws.amazon.com/amazon-linux-ami/faqs/
- name: Disable security updates on boot
lineinfile:
path: "{{ cloud_cfg_file }}"
regexp: "^repo_upgrade: security"
line: 'repo_upgrade: none'

View File

@ -0,0 +1,133 @@
# Copyright 2018 The Kubernetes Authors.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
- import_tasks: photon.yml
when: ansible_os_family == "VMware Photon OS"
- import_tasks: amazonLinux2.yml
when: ansible_distribution == "Amazon"
# This is required until https://github.com/ansible/ansible/issues/77537 is fixed and used.
- name: Override Flatcar's OS family
set_fact:
ansible_os_family: Flatcar
when: ansible_os_family == "Flatcar Container Linux by Kinvolk"
tags:
- facts
- name: Ensure overlay module is present
modprobe:
name: overlay
state: present
- name: Ensure br_netfilter module is present
modprobe:
name: br_netfilter
state: present
- name: Persist required kernel modules
copy:
content: |
overlay
br_netfilter
dest: /etc/modules-load.d/kubernetes.conf
mode: 0644
- name: Set and persist kernel params
sysctl:
name: "{{ item.param }}"
value: "{{ item.val }}"
state: present
sysctl_set: yes
sysctl_file: "{{ sysctl_conf_file }}"
reload: yes
loop:
- { param: net.bridge.bridge-nf-call-iptables, val: 1 }
- { param: net.bridge.bridge-nf-call-ip6tables, val: 1 }
- { param: net.ipv4.ip_forward, val: 1 }
- { param: net.ipv6.conf.all.forwarding, val: 1 }
- { param: net.ipv6.conf.all.disable_ipv6, val: 0 }
- { param: net.ipv4.tcp_congestion_control, val: bbr }
- { param: vm.overcommit_memory, val: 1 }
- { param: kernel.panic, val: 10 }
- { param: kernel.panic_on_oops, val: 1 }
- name: Disable swap memory
shell: |
swapoff -a
when: ansible_memory_mb.swap.total != 0
- name: Edit fstab file to disable swap
shell: sed -ri '/\sswap\s/s/^#?/#/' /etc/fstab
when: ansible_memory_mb.swap.total != 0
- name: Disable conntrackd service
systemd:
name: conntrackd
state: stopped
enabled: false
when: ansible_os_family != "Debian" and ansible_os_family != "Flatcar"
- name: Ensure auditd is running and comes on at reboot
service:
name: auditd
state: started
enabled: yes
- name: configure auditd rules for containerd
copy:
src: etc/audit/rules.d/containerd.rules
dest: /etc/audit/rules.d/containerd.rules
owner: root
group: root
mode: 0644
when: ansible_os_family != "Flatcar"
- name: configure auditd rules for containerd (Flatcar)
copy:
src: etc/audit/rules.d/containerd.rules-flatcar
dest: /etc/audit/rules.d/containerd.rules
owner: root
group: root
mode: 0644
when: ansible_os_family == "Flatcar"
- name: Ensure reverse packet filtering is set as strict
sysctl:
name: net.ipv4.conf.all.rp_filter
value: "1"
state: present
sysctl_set: yes
reload: yes
when: ansible_distribution == "Ubuntu"
- name: Set transparent huge pages to madvise
lineinfile:
path: /etc/default/grub
backrefs: yes
regexp: "^(?!.*transparent_hugepage=madvise)(GRUB_CMDLINE_LINUX=.*)(\"$)"
line: '\1 transparent_hugepage=madvise"'
when: ansible_os_family == "RedHat"
- name: Copy udev etcd network tuning rules
template:
src: etc/udev/rules.d/90-etcd-tuning.rules
dest: /etc/udev/rules.d/90-etcd-tuning.rules
mode: 0744
- name: Copy etcd network tuning script
copy:
src: usr/local/bin/etcd-network-tuning.sh
dest: "{{ external_binary_path }}/etcd-network-tuning.sh"
mode: 0755

View File

@ -0,0 +1,53 @@
# Copyright 2020 The Kubernetes Authors.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
- name: Leak mDNS to DNS (cloud-init-nics) (enable .local domain lookups)
ini_file:
path: /etc/systemd/network/10-cloud-init-nics.network
section: Network
option: Domains
value: "~local"
when: leak_local_mdns_to_dns
- name: Leak mDNS to DNS (dhcp) (enable .local domain lookups)
ini_file:
path: /etc/systemd/network/99-dhcp-en.network
section: Network
option: Domains
value: "~local"
when: leak_local_mdns_to_dns
- name: Double TCP small queue limit to be the same as Ubuntu
sysctl:
name: net.ipv4.tcp_limit_output_bytes
value: "524288"
state: present
sysctl_set: yes
reload: yes
sysctl_file: "{{ sysctl_conf_file }}"
- name: Disable Apparmor service
systemd:
name: apparmor
daemon_reload: yes
enabled: false
state: stopped
- name: Disable Apparmor in kernel
lineinfile:
path: /boot/photon.cfg
backrefs: yes
regexp: "^(?!.*apparmor=0)(photon_cmdline.*)"
line: '\1 apparmor=0'

View File

@ -0,0 +1,15 @@
# Copyright 2022 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
ACTION=="add", SUBSYSTEM=="net", SUBSYSTEMS=="pci|xen|vmbus" RUN+="{{ external_binary_path }}/etcd-network-tuning.sh $name"