Configuring PodNodeSelector via variables #10456

titansmc · 2023-09-20T14:24:30Z

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind api-change
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test

/kind feature

/kind flake

What this PR does / why we need it:
Allows the users to configure the the clusterDefaultNodeSelector from the config file
Which issue(s) this PR fixes:

Fixes #10412

Special notes for your reviewer:

This will introduce a new variable `kube_apiserver_admission_plugins_podnodeselector_default_node_selector`  that can be used with `kube_apiserver_admission_plugins_needs_configuration: [PodNodeSelector]` defined. So allows the users to configure PodNodeSelector plugin.

linux-foundation-easycla · 2023-09-20T14:24:35Z

✅ login: titansmc / name: jandres - moscardo (3c5d98e, e97db00, 66721aa, 690dee4, f7a46a8, 248c460, 26c04ea, 3ae233b, 1d24053)
❌ The email address for the commit (8da1556) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please submit a support request ticket.

k8s-ci-robot · 2023-09-20T14:24:40Z

Hi @titansmc. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2023-09-20T14:24:48Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: titansmc
Once this PR has been reviewed and has the lgtm label, please assign mzaian for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

yankay · 2023-09-21T02:20:51Z

/ok-to-test

titansmc

replace kubeadm with Kubeadm uppercase

titansmc · 2023-09-29T10:15:56Z

@yankay can you review it, please ?

yankay · 2023-10-08T02:14:30Z

roles/kubernetes/control-plane/defaults/main/main.yml

@@ -138,6 +138,8 @@ kube_webhook_token_auth_url_skip_tls_verify: false
 kube_webhook_authorization: false
 kube_webhook_authorization_url_skip_tls_verify: false

+# Default podnodeselector
+kube_apiserver_admission_plugins_podnodeselector_default_node_selector: {}


The clusterDefaultNodeSelector is string not a dict.

It's better to use

# Define the default node selector, by default all the workloads will be scheduled on nodes, like "network=srv1" # kube_apiserver_admission_plugins_podnodeselector_default_node_selector: ""

yankay · 2023-10-08T02:17:49Z

docs/hardening.md

@@ -54,6 +54,11 @@ kube_apiserver_enable_admission_plugins:
  - PodNodeSelector
  - PodSecurity
 kube_apiserver_admission_control_config_file: true
+# Creates config file for PodNodeSelector
+kube_apiserver_admission_plugins_needs_configuration: [PodNodeSelector]


If it not must be required, it's better to use # comment the line.

yankay · 2023-10-08T02:17:54Z

docs/hardening.md

+kube_apiserver_admission_plugins_needs_configuration: [PodNodeSelector]
+# Define the default node selector, by default all the workloads will be scheduled on nodes
+# with label network=srv1
+kube_apiserver_admission_plugins_podnodeselector_default_node_selector: "network=srv1"


If it not must be required, it's better to use # comment the line.

yankay · 2023-10-08T02:19:04Z

roles/kubernetes/control-plane/tasks/kubeadm-setup.yml

+    dest: "{{ kube_config_dir }}/admission-controls/podnodeselector.yaml"
+    mode: 0640
+  when:
+    - kube_apiserver_admission_plugins_podnodeselector_default_node_selector


It's better changed to

when: - kube_apiserver_admission_plugins_podnodeselector_default_node_selector is defined - kube_apiserver_admission_plugins_podnodeselector_default_node_selector | length > 0

yankay · 2023-10-08T02:23:16Z

Thanks @titansmc

Nice PR, And the commit needs to be rebased to one commit :-)

The clusterDefaultNodeSelector is string not a dict.

If it not must be required, it's better to use # comment the line.

Update kubeadm-setup.yml with configuration for default podnodeselector Update hardening.md regarding podnodeselector Update kubeadm-setup.yml with upper case Kubeadm Update main.yml with default empty Update main.yml The clusterDefaultNodeSelector is string not a dict. Update hardening.md If it not must be required, it's better to use # comment the line. Update kubeadm-setup.yml

titansmc · 2023-10-09T11:15:15Z

I am not very familiar with the rebase and I think I screwed it up...

titansmc · 2023-10-09T11:31:48Z

#10509

titansmc added 3 commits September 20, 2023 16:09

Create podnodeselector.yaml.j2 template

3c5d98e

Update kubeadm-setup.yml with configuration for default podnodeselector

e97db00

Update hardening.md regarding podnodeselector

66721aa

k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Sep 20, 2023

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 20, 2023

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Sep 20, 2023

k8s-ci-robot requested review from cyclinder and holmsten September 20, 2023 14:24

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Sep 20, 2023

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 21, 2023

Update kubeadm-setup.yml with upper case Kubeadm

690dee4

titansmc commented Sep 21, 2023

View reviewed changes

Update main.yml with default empty

f7a46a8

yankay reviewed Oct 8, 2023

View reviewed changes

titansmc and others added 5 commits October 9, 2023 12:56

Update main.yml

248c460

The clusterDefaultNodeSelector is string not a dict.

Update hardening.md

26c04ea

If it not must be required, it's better to use # comment the line.

Update kubeadm-setup.yml

3ae233b

Merge branch 'master' of github.com:titansmc/kubespray

8da1556

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. and removed cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Oct 9, 2023

titansmc closed this by deleting the head repository Oct 9, 2023

titansmc mentioned this pull request Oct 9, 2023

Configuring PodNodeSelector via variables #10509

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Configuring PodNodeSelector via variables #10456

Configuring PodNodeSelector via variables #10456

titansmc commented Sep 20, 2023

linux-foundation-easycla bot commented Sep 20, 2023 •

edited

Loading

k8s-ci-robot commented Sep 20, 2023

k8s-ci-robot commented Sep 20, 2023

yankay commented Sep 21, 2023

titansmc left a comment

titansmc commented Sep 29, 2023

yankay Oct 8, 2023

yankay Oct 8, 2023

yankay Oct 8, 2023

yankay Oct 8, 2023

yankay commented Oct 8, 2023

titansmc commented Oct 9, 2023

titansmc commented Oct 9, 2023

Configuring PodNodeSelector via variables #10456

Configuring PodNodeSelector via variables #10456

Conversation

titansmc commented Sep 20, 2023

linux-foundation-easycla bot commented Sep 20, 2023 • edited Loading

k8s-ci-robot commented Sep 20, 2023

k8s-ci-robot commented Sep 20, 2023

yankay commented Sep 21, 2023

titansmc left a comment

Choose a reason for hiding this comment

titansmc commented Sep 29, 2023

yankay Oct 8, 2023

Choose a reason for hiding this comment

yankay Oct 8, 2023

Choose a reason for hiding this comment

yankay Oct 8, 2023

Choose a reason for hiding this comment

yankay Oct 8, 2023

Choose a reason for hiding this comment

yankay commented Oct 8, 2023

titansmc commented Oct 9, 2023

titansmc commented Oct 9, 2023

linux-foundation-easycla bot commented Sep 20, 2023 •

edited

Loading