Merge pull request #1437 from etungsten/k8s-1.20

Add aws-k8s-1.20 variant with Kubernetes 1.20 support

.github/workflows/build.yml

@@ -10,7 +10,7 @@ jobs:
     continue-on-error: ${{ matrix.supported }}
     strategy:
       matrix:
-        variant: [aws-k8s-1.16, aws-k8s-1.17, aws-k8s-1.18, aws-k8s-1.19, aws-ecs-1]
+        variant: [aws-k8s-1.16, aws-k8s-1.17, aws-k8s-1.18, aws-k8s-1.19, aws-k8s-1.20, aws-ecs-1]
         arch: [x86_64, aarch64]
         supported: [true]
         include:

README.md

@@ -54,6 +54,7 @@ The following variants support EKS, as described above:
 - `aws-k8s-1.17`
 - `aws-k8s-1.18`
 - `aws-k8s-1.19`
+- `aws-k8s-1.20`
 
 We also have a variant designed to work with ECS, currently in preview:
 

packages/kubernetes-1.20/0001-always-set-relevant-variables-for-cross-compiling.patch

@@ -0,0 +1,77 @@
+From f9efa76d8474cfe566179f5d5fa67f4e30b1db88 Mon Sep 17 00:00:00 2001
+From: Ben Cressey <bcressey@amazon.com>
+Date: Sat, 18 May 2019 16:57:12 +0000
+Subject: [PATCH] always set relevant variables for cross compiling
+
+Signed-off-by: Ben Cressey <bcressey@amazon.com>
+---
+ hack/lib/golang.sh | 52 ++++++++++++++++++++++++++--------------------
+ 1 file changed, 30 insertions(+), 22 deletions(-)
+
+diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
+index bef1d837703..204207e4fd3 100755
+--- a/hack/lib/golang.sh
++++ b/hack/lib/golang.sh
+@@ -393,29 +393,37 @@ kube::golang::set_platform_envs() {
+   export GOOS=${platform%/*}
+   export GOARCH=${platform##*/}
+
+-  # Do not set CC when building natively on a platform, only if cross-compiling from linux/amd64
+-  if [[ $(kube::golang::host_platform) == "linux/amd64" ]]; then
+-    # Dynamic CGO linking for other server architectures than linux/amd64 goes here
+-    # If you want to include support for more server platforms than these, add arch-specific gcc names here
+-    case "${platform}" in
+-      "linux/arm")
+-        export CGO_ENABLED=1
+-        export CC=${KUBE_LINUX_ARM_CC:-arm-linux-gnueabihf-gcc}
+-        ;;
+-      "linux/arm64")
+-        export CGO_ENABLED=1
+-        export CC=${KUBE_LINUX_ARM64_CC:-aarch64-linux-gnu-gcc}
+-        ;;
+-      "linux/ppc64le")
+-        export CGO_ENABLED=1
+-        export CC=${KUBE_LINUX_PPC64LE_CC:-powerpc64le-linux-gnu-gcc}
+-        ;;
+-      "linux/s390x")
+-        export CGO_ENABLED=1
+-        export CC=${KUBE_LINUX_S390X_CC:-s390x-linux-gnu-gcc}
+-        ;;
+-    esac
++  # Apply standard values for CGO_ENABLED and CC unless KUBE_BUILD_PLATFORMS is set.
++  if [ -z "${KUBE_BUILD_PLATFORMS}" ] ; then
++      export CGO_ENABLED=0
++      export CC=gcc
++      return
+   fi
++
++  # Dynamic CGO linking for other server architectures goes here
++  # If you want to include support for more server platforms than these, add arch-specific gcc names here
++  case "${platform}" in
++    "linux/amd64")
++      export CGO_ENABLED=1
++      export CC=x86_64-bottlerocket-linux-gnu-gcc
++      ;;
++    "linux/arm")
++      export CGO_ENABLED=1
++      export CC=arm-bottlerocket-linux-gnueabihf-gcc
++      ;;
++    "linux/arm64")
++      export CGO_ENABLED=1
++      export CC=aarch64-bottlerocket-linux-gnu-gcc
++      ;;
++    "linux/ppc64le")
++      export CGO_ENABLED=1
++      export CC=powerpc64le-bottlerocket-linux-gnu-gcc
++      ;;
++    "linux/s390x")
++      export CGO_ENABLED=1
++      export CC=s390x-bottlerocket-linux-gnu-gcc
++      ;;
++  esac
+ }
+
+ kube::golang::unset_platform_envs() {
+-- 
+2.17.1
+

packages/kubernetes-1.20/Cargo.toml

@@ -0,0 +1,28 @@
+[package]
+# "." is not allowed in crate names, but we want a friendlier name for the
+# directory and spec file, so we override it below.
+name = "kubernetes-1_20"
+version = "0.1.0"
+edition = "2018"
+publish = false
+build = "build.rs"
+
+[package.metadata.build-package]
+package-name = "kubernetes-1.20"
+
+[lib]
+path = "pkg.rs"
+
+[[package.metadata.build-package.external-files]]
+url = "/~https://github.com/kubernetes/kubernetes/archive/v1.20.6/kubernetes-1.20.6.tar.gz"
+sha512 = "b3df8266c597b3e2270e7caea24129ebc8fa258e32e747c1e48ede5ad0244c791f9da39bcaf7c08df8c1b314976742db23ecaa4623ab241f87a80d4834a0948f"
+
+# RPM BuildRequires
+[build-dependencies]
+glibc = { path = "../glibc" }
+
+# RPM Requires
+[dependencies]
+conntrack-tools = { path = "../conntrack-tools" }
+containerd = { path = "../containerd" }
+findutils = { path = "../findutils" }

packages/kubernetes-1.20/build.rs

@@ -0,0 +1,9 @@
+use std::process::{exit, Command};
+
+fn main() -> Result<(), std::io::Error> {
+    let ret = Command::new("buildsys").arg("build-package").status()?;
+    if !ret.success() {
+        exit(1);
+    }
+    Ok(())
+}

packages/kubernetes-1.20/clarify.toml

@@ -0,0 +1,62 @@
+[clarify."github.com/JeffAshton/win_pdh"]
+expression = "BSD-3-Clause"
+license-files = [
+    { path = "LICENSE", hash = 0xb221dcc9 },
+]
+
+[clarify."github.com/daviddengcn/go-colortext"]
+expression = "BSD-3-Clause AND MIT"
+license-files = [
+    { path = "LICENSE", hash = 0x9769fae1 },
+]
+
+[clarify."github.com/ghodss/yaml"]
+expression = "MIT AND BSD-3-Clause"
+license-files = [
+    { path = "LICENSE", hash = 0xcdf3ae00 },
+]
+
+[clarify."github.com/heketi/heketi"]
+# kubernetes only uses code that is under LGPLv3+/Apache 2.0, not the code that is GPLv2+/LGPLv3+
+expression = "LGPL-3.0-or-later OR Apache-2.0"
+license-files = [
+    { path = "LICENSE", hash = 0x3c4b96d1 },
+    { path = "LICENSE-APACHE2", hash = 0x438c8616 },
+    { path = "COPYING-LGPLV3", hash = 0xf0bccb3a },
+]
+skip-files = [ "COPYING-GPLV2" ]
+
+[clarify."github.com/go-bindata/go-bindata"]
+expression = "CC0-1.0"
+license-files = [
+    { path = "LICENSE", hash = 0x393fafd6 },
+]
+
+[clarify."github.com/miekg/dns"]
+expression = "BSD-3-Clause"
+license-files = [
+    { path = "COPYRIGHT", hash = 0xe41dd36c },
+    { path = "LICENSE", hash = 0xbd510d7b },
+]
+
+[clarify."sigs.k8s.io/yaml"]
+expression = "MIT AND BSD-3-Clause"
+license-files = [
+    { path = "LICENSE", hash = 0xcdf3ae00 },
+]
+
+[clarify."honnef.co/go/tools"]
+expression = "MIT AND BSD-3-Clause AND Apache-2.0"
+license-files = [
+    { path = "LICENSE", hash = 0xad378ed2 },
+    { path = "LICENSE-THIRD-PARTY", hash = 0x546425eb },
+    { path = "lint/LICENSE", hash = 0xc6b58232 },
+    { path = "ssa/LICENSE", hash = 0xe656fb62 },
+]
+
+[clarify."github.com/storageos/go-api"]
+expression = "MIT AND BSD-2-Clause"
+license-files = [
+    { path = "LICENCE", hash = 0x67a6861e },
+]
+skip-files = ["licence.go", "types/licence.go"]

packages/kubernetes-1.20/kubelet-bootstrap-kubeconfig

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Config
+clusters:
+- cluster:
+{{~#if settings.kubernetes.api-server}}
+    certificate-authority: "/etc/kubernetes/pki/ca.crt"
+    server: "{{settings.kubernetes.api-server}}"
+{{~/if}}
+  name: kubernetes
+contexts:
+- context:
+    cluster: kubernetes
+    user: kubelet
+  name: kubelet
+current-context: kubelet
+users:
+- name: kubelet
+{{~#if settings.kubernetes.bootstrap-token}}
+  user:
+    token: "{{settings.kubernetes.bootstrap-token}}"
+{{~/if}}

packages/kubernetes-1.20/kubelet-config

@@ -0,0 +1,71 @@
+---
+kind: KubeletConfiguration
+apiVersion: kubelet.config.k8s.io/v1beta1
+{{~#if settings.kubernetes.standalone-mode}}
+address: 127.0.0.1
+authentication:
+  anonymous:
+    enabled: true
+  webhook:
+    enabled: false
+authorization:
+  mode: AlwaysAllow
+{{~else}}
+address: 0.0.0.0
+authentication:
+  anonymous:
+    enabled: false
+  webhook:
+    cacheTTL: 2m0s
+    enabled: true
+  x509:
+    clientCAFile: "/etc/kubernetes/pki/ca.crt"
+authorization:
+  mode: Webhook
+  webhook:
+    cacheAuthorizedTTL: 5m0s
+    cacheUnauthorizedTTL: 30s
+{{~/if}}
+clusterDomain: {{settings.kubernetes.cluster-domain}}
+{{~#if settings.kubernetes.cluster-dns-ip}}
+clusterDNS:
+- {{settings.kubernetes.cluster-dns-ip}}
+{{~/if}}
+{{~#if settings.kubernetes.eviction-hard}}
+evictionHard:
+  {{~#each settings.kubernetes.eviction-hard}}
+  {{@key}}: "{{this}}"
+  {{~/each}}
+{{~/if}}
+{{~#if settings.kubernetes.allowed-unsafe-sysctls}}
+allowedUnsafeSysctls: {{settings.kubernetes.allowed-unsafe-sysctls}}
+{{~/if}}
+kubeReserved:
+  cpu: "{{kube_reserve_cpu settings.kubernetes.kube-reserved.cpu}}"
+  {{~#if settings.kubernetes.kube-reserved.memory}}
+  memory: "{{settings.kubernetes.kube-reserved.memory}}"
+  {{~else}}
+  {{~#if settings.kubernetes.max-pods}}
+  memory: "{{kube_reserve_memory settings.kubernetes.max-pods settings.kubernetes.kube-reserved.memory}}"
+  {{~/if}}
+  {{~/if}}
+  ephemeral-storage: "{{default "1Gi" settings.kubernetes.kube-reserved.ephemeral-storage}}"
+cpuManagerPolicy: "static"
+resolvConf: "/etc/resolv.conf"
+hairpinMode: hairpin-veth
+readOnlyPort: 0
+cgroupDriver: systemd
+cgroupRoot: "/"
+runtimeRequestTimeout: 15m
+featureGates:
+  RotateKubeletServerCertificate: true
+  CSIMigration: false
+protectKernelDefaults: true
+serializeImagePulls: false
+serverTLSBootstrap: {{settings.kubernetes.server-tls-bootstrap}}
+configMapAndSecretChangeDetectionStrategy: Cache
+tlsCipherSuites:
+- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+volumePluginDir: "/var/lib/kubelet/plugins/volume/exec"
+maxPods: {{default 110 settings.kubernetes.max-pods}}
+staticPodPath: "/etc/kubernetes/static-pods/"

packages/kubernetes-1.20/kubelet-env

@@ -0,0 +1,4 @@
+NODE_IP={{settings.kubernetes.node-ip}}
+NODE_LABELS={{join_map "=" "," "no-fail-if-missing" settings.kubernetes.node-labels}}
+NODE_TAINTS={{join_map "=" "," "no-fail-if-missing" settings.kubernetes.node-taints}}
+POD_INFRA_CONTAINER_IMAGE={{settings.kubernetes.pod-infra-container-image}}

packages/kubernetes-1.20/kubelet-exec-start-conf

@@ -0,0 +1,23 @@
+[Service]
+ExecStart=
+ExecStart=/usr/bin/kubelet \
+{{~#unless settings.kubernetes.standalone-mode}}
+    --cloud-provider {{default "external" settings.kubernetes.cloud-provider}} \
+    --kubeconfig /etc/kubernetes/kubelet/kubeconfig \
+{{~#if (eq settings.kubernetes.authentication-mode "tls")}}
+    --bootstrap-kubeconfig /etc/kubernetes/kubelet/bootstrap-kubeconfig \
+{{~/if}}
+{{~else}}
+    --cloud-provider "" \
+{{~/unless}}
+    --config /etc/kubernetes/kubelet/config \
+    --container-runtime=remote \
+    --container-runtime-endpoint=unix:///run/dockershim.sock \
+    --containerd=/run/dockershim.sock \
+    --network-plugin cni \
+    --root-dir /var/lib/kubelet \
+    --cert-dir /var/lib/kubelet/pki \
+    --node-ip ${NODE_IP} \
+    --node-labels "${NODE_LABELS}" \
+    --register-with-taints "${NODE_TAINTS}" \
+    --pod-infra-container-image ${POD_INFRA_CONTAINER_IMAGE}

packages/kubernetes-1.20/kubelet-kubeconfig

@@ -0,0 +1,35 @@
+---
+apiVersion: v1
+kind: Config
+clusters:
+- cluster:
+{{~#if settings.kubernetes.api-server}}
+    certificate-authority: "/etc/kubernetes/pki/ca.crt"
+    server: "{{settings.kubernetes.api-server}}"
+{{~/if}}
+  name: kubernetes
+contexts:
+- context:
+    cluster: kubernetes
+    user: kubelet
+  name: kubelet
+current-context: kubelet
+users:
+- name: kubelet
+{{~#if (eq settings.kubernetes.authentication-mode "aws")}}
+{{~#if settings.kubernetes.cluster-name}}
+  user:
+    exec:
+      apiVersion: client.authentication.k8s.io/v1alpha1
+      command: "/usr/bin/aws-iam-authenticator"
+      args:
+      - token
+      - "-i"
+      - "{{settings.kubernetes.cluster-name}}"
+{{~/if}}
+{{~/if}}
+{{~#if (eq settings.kubernetes.authentication-mode "tls")}}
+  user:
+    client-certificate: "/var/lib/kubelet/pki/kubelet-client-current.pem"
+    client-key: "/var/lib/kubelet/pki/kubelet-client-current.pem"
+{{~/if}}

packages/kubernetes-1.20/kubelet-sysctl.conf

@@ -0,0 +1,5 @@
+# Overcommit handling mode - 1: Always overcommit
+vm.overcommit_memory = 1
+
+# This is generally considered a safe ephemeral port range
+net.ipv4.ip_local_port_range = 32768 60999

packages/kubernetes-1.20/kubelet.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=Kubelet
+Documentation=/~https://github.com/kubernetes/kubernetes
+After=containerd.service configured.target
+Wants=configured.target
+BindsTo=containerd.service
+
+[Service]
+Type=notify
+EnvironmentFile=/etc/network/proxy.env
+EnvironmentFile=/etc/kubernetes/kubelet/env
+ExecStartPre=/sbin/iptables -P FORWARD ACCEPT
+# Pull the pause container image before starting `kubelet` so `containerd/cri` wouldn't have to
+ExecStartPre=/usr/bin/host-ctr \
+    --containerd-socket=/run/dockershim.sock \
+    --namespace=k8s.io \
+    pull-image \
+    --source=${POD_INFRA_CONTAINER_IMAGE}
+# Must be overridden by a drop-in file or `kubelet` won't start
+ExecStart=/usr/bin/false
+
+Restart=on-failure
+RestartForceExitStatus=SIGPIPE
+RestartSec=5
+Delegate=yes
+KillMode=process
+CPUAccounting=true
+MemoryAccounting=true
+
+[Install]
+WantedBy=multi-user.target