Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Honor OS update policy at InstanceGroup level too #10913

Merged
merged 3 commits into from
Mar 13, 2021
Merged

Honor OS update policy at InstanceGroup level too #10913

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e39c985
Honor OS update policy at InstanceGroup level too
seh Feb 23, 2021
70e95fc
Copyedit the InstanceGroup-related documentation
seh Feb 23, 2021
2fc6856
Note new field's impact on OS package installation
seh Mar 5, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions k8s/crds/kops.k8s.io_clusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4070,10 +4070,10 @@ spec:
type: object
updatePolicy:
description: 'UpdatePolicy determines the policy for applying upgrades
automatically. Valid values: ''external'' do not apply updates
automatically - they are applied manually or by an external system missing:
default policy (currently OS security upgrades that do not require
a reboot)'
automatically. Valid values: ''automatic'' (default): apply updates
automatically (apply OS security upgrades, avoiding rebooting when
possible) ''external'': do not apply updates automatically; they
are applied manually or by an external system'
type: string
useHostCertificates:
description: UseHostCertificates will mount /etc/ssl/certs to inside
Expand Down
26 changes: 17 additions & 9 deletions k8s/crds/kops.k8s.io_instancegroups.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ spec:
metadata:
type: object
spec:
description: InstanceGroupSpec is the specification for an instanceGroup
description: InstanceGroupSpec is the specification for an InstanceGroup
properties:
additionalSecurityGroups:
description: AdditionalSecurityGroups attaches additional security
Expand Down Expand Up @@ -89,7 +89,7 @@ spec:
type: boolean
autoscale:
description: Autoscale determines if autoscaling will be enabled for
the group if cluster autoscaler is enabled
this instance group if cluster autoscaler is enabled
type: boolean
cloudLabels:
additionalProperties:
Expand All @@ -111,7 +111,7 @@ spec:
type: boolean
externalLoadBalancers:
description: ExternalLoadBalancers define loadbalancers that should
be attached to the instancegroup
be attached to this instance group
items:
description: LoadBalancer defines a load balancer
properties:
Expand Down Expand Up @@ -706,11 +706,11 @@ spec:
additionalProperties:
type: string
description: NodeLabels indicates the kubernetes labels for nodes
in this group
in this instance group
type: object
role:
description: 'Type determines the role of instances in this group:
masters or nodes'
description: 'Type determines the role of instances in this instance
group: masters or nodes'
type: string
rollingUpdate:
description: RollingUpdate defines the rolling-update behavior
Expand Down Expand Up @@ -817,13 +817,21 @@ spec:
type: array
taints:
description: Taints indicates the kubernetes taints for nodes in this
group
instance group
items:
type: string
type: array
tenancy:
description: Describes the tenancy of the instance group. Can be either
default or dedicated. Currently only applies to AWS.
description: Describes the tenancy of this instance group. Can be
either default or dedicated. Currently only applies to AWS.
type: string
updatePolicy:
description: 'UpdatePolicy determines the policy for applying upgrades
automatically. If specified, this value overrides a value specified
in the Cluster''s "spec.updatePolicy" field. Valid values: ''automatic''
(default): apply updates automatically (apply OS security upgrades,
avoiding rebooting when possible) ''external'': do not apply updates
automatically; they are applied manually or by an external system'
type: string
volumeMounts:
description: VolumeMounts a collection of volume mounts
Expand Down
24 changes: 20 additions & 4 deletions nodeup/pkg/model/update_service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,16 @@ func (b *UpdateServiceBuilder) Build(c *fi.ModelBuilderContext) error {
}

func (b *UpdateServiceBuilder) buildFlatcarSystemdService(c *fi.ModelBuilderContext) {
if b.Cluster.Spec.UpdatePolicy == nil || *b.Cluster.Spec.UpdatePolicy != kops.UpdatePolicyExternal {
klog.Infof("UpdatePolicy not set in Cluster Spec; skipping creation of %s", flatcarServiceName)
if b.InstanceGroup.Spec.UpdatePolicy != nil {
switch *b.InstanceGroup.Spec.UpdatePolicy {
case kops.UpdatePolicyAutomatic:
klog.Infof("UpdatePolicy set in InstanceGroup %q spec requests automatic updates; skipping creation of systemd unit %q", b.InstanceGroup.GetName(), flatcarServiceName)
return
case kops.UpdatePolicyExternal:
// Carry on with creating this systemd unit.
}
} else if fi.StringValue(b.Cluster.Spec.UpdatePolicy) != kops.UpdatePolicyExternal {
klog.Infof("UpdatePolicy in Cluster spec requests automatic updates; skipping creation of systemd unit %q", flatcarServiceName)
return
}

Expand Down Expand Up @@ -85,8 +93,16 @@ func (b *UpdateServiceBuilder) buildFlatcarSystemdService(c *fi.ModelBuilderCont
}

func (b *UpdateServiceBuilder) buildDebianPackage(c *fi.ModelBuilderContext) {
if b.Cluster.Spec.UpdatePolicy != nil && *b.Cluster.Spec.UpdatePolicy == kops.UpdatePolicyExternal {
klog.Infof("UpdatePolicy is External; skipping installation of %s", debianPackageName)
if b.InstanceGroup.Spec.UpdatePolicy != nil {
switch *b.InstanceGroup.Spec.UpdatePolicy {
case kops.UpdatePolicyAutomatic:
klog.Infof("UpdatePolicy set in InstanceGroup %q spec requests automatic updates; skipping installation of packagk %q", b.InstanceGroup.GetName(), debianPackageName)
return
case kops.UpdatePolicyExternal:
// Carry on with creating this systemd unit.
}
} else if fi.StringValue(b.Cluster.Spec.UpdatePolicy) != kops.UpdatePolicyExternal {
klog.Infof("UpdatePolicy in Cluster spec requests automatic updates; skipping installation of package %q", debianPackageName)
return
}

Expand Down
4 changes: 2 additions & 2 deletions pkg/apis/kops/cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,8 +133,8 @@ type ClusterSpec struct {
IsolateMasters *bool `json:"isolateMasters,omitempty"`
// UpdatePolicy determines the policy for applying upgrades automatically.
// Valid values:
// 'external' do not apply updates automatically - they are applied manually or by an external system
// missing: default policy (currently OS security upgrades that do not require a reboot)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this avoidance of reboots was and is not true for Flatcar Container Linux. It only installs updates by way of rebooting. It downloads and verifies them ahead of time, but only pivots to using the new files upon reboot.

// 'automatic' (default): apply updates automatically (apply OS security upgrades, avoiding rebooting when possible)
// 'external': do not apply updates automatically; they are applied manually or by an external system
UpdatePolicy *string `json:"updatePolicy,omitempty"`
// ExternalPolicies allows the insertion of pre-existing managed policies on IG Roles
ExternalPolicies *map[string][]string `json:"externalPolicies,omitempty"`
Expand Down
26 changes: 16 additions & 10 deletions pkg/apis/kops/instancegroup.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,17 +82,17 @@ var (
SupportedFilesystems = []string{BtfsFilesystem, Ext4Filesystem, XFSFilesystem}
)

// InstanceGroupSpec is the specification for a instanceGroup
// InstanceGroupSpec is the specification for an InstanceGroup
type InstanceGroupSpec struct {
// Type determines the role of instances in this group: masters or nodes
// Type determines the role of instances in this instance group: masters or nodes
Role InstanceGroupRole `json:"role,omitempty"`
// Image is the instance (ami etc) we should use
Image string `json:"image,omitempty"`
// MinSize is the minimum size of the pool
MinSize *int32 `json:"minSize,omitempty"`
// MaxSize is the maximum size of the pool
MaxSize *int32 `json:"maxSize,omitempty"`
// Autoscale determines if autoscaling will be enabled for the group if cluster autoscaler is enabled
// Autoscale determines if autoscaling will be enabled for this instance group if cluster autoscaler is enabled
Autoscale *bool `json:"autoscale,omitempty"`
// MachineType is the instance class
MachineType string `json:"machineType,omitempty"`
Expand All @@ -114,7 +114,7 @@ type InstanceGroupSpec struct {
RootVolumeEncryption *bool `json:"rootVolumeEncryption,omitempty"`
// RootVolumeEncryptionKey provides the key identifier for root volume encryption
RootVolumeEncryptionKey *string `json:"rootVolumeEncryptionKey,omitempty"`
// Volumes is a collection of additional volumes to create for instances within this InstanceGroup
// Volumes is a collection of additional volumes to create for instances within this instance group
Volumes []VolumeSpec `json:"volumes,omitempty"`
// VolumeMounts a collection of volume mounts
VolumeMounts []VolumeMountSpec `json:"volumeMounts,omitempty"`
Expand All @@ -123,7 +123,7 @@ type InstanceGroupSpec struct {
// Zones is the names of the Zones where machines in this instance group should be placed
// This is needed for regional subnets (e.g. GCE), to restrict placement to particular zones
Zones []string `json:"zones,omitempty"`
// Hooks is a list of hooks for this instanceGroup, note: these can override the cluster wide ones if required
// Hooks is a list of hooks for this instance group, note: these can override the cluster wide ones if required
Hooks []HookSpec `json:"hooks,omitempty"`
// MaxPrice indicates this is a spot-pricing group, with the specified value as our max-price bid
MaxPrice *string `json:"maxPrice,omitempty"`
Expand All @@ -137,23 +137,23 @@ type InstanceGroupSpec struct {
AdditionalSecurityGroups []string `json:"additionalSecurityGroups,omitempty"`
// CloudLabels defines additional tags or labels on cloud provider resources
CloudLabels map[string]string `json:"cloudLabels,omitempty"`
// NodeLabels indicates the kubernetes labels for nodes in this group
// NodeLabels indicates the kubernetes labels for nodes in this instance group
NodeLabels map[string]string `json:"nodeLabels,omitempty"`
// FileAssets is a collection of file assets for this instance group
FileAssets []FileAssetSpec `json:"fileAssets,omitempty"`
// Describes the tenancy of the instance group. Can be either default or dedicated. Currently only applies to AWS.
// Describes the tenancy of this instance group. Can be either default or dedicated. Currently only applies to AWS.
Tenancy string `json:"tenancy,omitempty"`
// Kubelet overrides kubelet config from the ClusterSpec
Kubelet *KubeletConfigSpec `json:"kubelet,omitempty"`
// Taints indicates the kubernetes taints for nodes in this group
// Taints indicates the kubernetes taints for nodes in this instance group
Taints []string `json:"taints,omitempty"`
// MixedInstancesPolicy defined a optional backing of an AWS ASG by a EC2 Fleet (AWS Only)
MixedInstancesPolicy *MixedInstancesPolicySpec `json:"mixedInstancesPolicy,omitempty"`
// AdditionalUserData is any additional user-data to be passed to the host
AdditionalUserData []UserData `json:"additionalUserData,omitempty"`
// SuspendProcesses disables the listed Scaling Policies
SuspendProcesses []string `json:"suspendProcesses,omitempty"`
// ExternalLoadBalancers define loadbalancers that should be attached to the instancegroup
// ExternalLoadBalancers define loadbalancers that should be attached to this instance group
ExternalLoadBalancers []LoadBalancer `json:"externalLoadBalancers,omitempty"`
// DetailedInstanceMonitoring defines if detailed-monitoring is enabled (AWS only)
DetailedInstanceMonitoring *bool `json:"detailedInstanceMonitoring,omitempty"`
Expand All @@ -176,6 +176,12 @@ type InstanceGroupSpec struct {
CompressUserData *bool `json:"compressUserData,omitempty"`
// InstanceMetadata defines the EC2 instance metadata service options (AWS Only)
InstanceMetadata *InstanceMetadataOptions `json:"instanceMetadata,omitempty"`
// UpdatePolicy determines the policy for applying upgrades automatically.
seh marked this conversation as resolved.
Show resolved Hide resolved
// If specified, this value overrides a value specified in the Cluster's "spec.updatePolicy" field.
// Valid values:
// 'automatic' (default): apply updates automatically (apply OS security upgrades, avoiding rebooting when possible)
// 'external': do not apply updates automatically; they are applied manually or by an external system
UpdatePolicy *string `json:"updatePolicy,omitempty"`
}

const (
Expand All @@ -190,7 +196,7 @@ const (
// SpotAllocationStrategies is a collection of supported strategies
var SpotAllocationStrategies = []string{SpotAllocationStrategyLowestPrices, SpotAllocationStrategyDiversified, SpotAllocationStrategyCapacityOptimized}

// InstanceMetadata defines the EC2 instance metadata service options (AWS Only)
// InstanceMetadataOptions defines the EC2 instance metadata service options (AWS Only)
type InstanceMetadataOptions struct {
// HTTPPutResponseHopLimit is the desired HTTP PUT response hop limit for instance metadata requests.
// The larger the number, the further instance metadata requests can travel. The default value is 1.
Expand Down
5 changes: 4 additions & 1 deletion pkg/apis/kops/labels.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@ const (
// AnnotationValueManagementImported is the annotation value that indicates a cluster was imported, typically as part of an upgrade
AnnotationValueManagementImported = "imported"

// UpdatePolicyExternal is a value for ClusterSpec.UpdatePolicy indicating that upgrades are done externally, and we should disable automatic upgrades
// UpdatePolicyAutomatic is a value for ClusterSpec.UpdatePolicy and InstanceGroup.UpdatePolicy indicating that upgrades are performed automatically
UpdatePolicyAutomatic = "automatic"

// UpdatePolicyExternal is a value for ClusterSpec.UpdatePolicy and InstanceGroup.UpdatePolicy indicating that upgrades are done externally, and we should disable automatic upgrades
UpdatePolicyExternal = "external"
)
4 changes: 2 additions & 2 deletions pkg/apis/kops/v1alpha2/cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,8 +132,8 @@ type ClusterSpec struct {
IsolateMasters *bool `json:"isolateMasters,omitempty"`
// UpdatePolicy determines the policy for applying upgrades automatically.
// Valid values:
// 'external' do not apply updates automatically - they are applied manually or by an external system
// missing: default policy (currently OS security upgrades that do not require a reboot)
// 'automatic' (default): apply updates automatically (apply OS security upgrades, avoiding rebooting when possible)
// 'external': do not apply updates automatically; they are applied manually or by an external system
UpdatePolicy *string `json:"updatePolicy,omitempty"`
// ExternalPolicies allows the insertion of pre-existing managed policies on IG Roles
ExternalPolicies *map[string][]string `json:"externalPolicies,omitempty"`
Expand Down
22 changes: 14 additions & 8 deletions pkg/apis/kops/v1alpha2/instancegroup.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,17 +79,17 @@ var (
SupportedFilesystems = []string{BtfsFilesystem, Ext4Filesystem, XFSFilesystem}
)

// InstanceGroupSpec is the specification for an instanceGroup
// InstanceGroupSpec is the specification for an InstanceGroup
type InstanceGroupSpec struct {
// Type determines the role of instances in this group: masters or nodes
// Type determines the role of instances in this instance group: masters or nodes
Role InstanceGroupRole `json:"role,omitempty"`
// Image is the instance (ami etc) we should use
Image string `json:"image,omitempty"`
// MinSize is the minimum size of the pool
MinSize *int32 `json:"minSize,omitempty"`
// MaxSize is the maximum size of the pool
MaxSize *int32 `json:"maxSize,omitempty"`
// Autoscale determines if autoscaling will be enabled for the group if cluster autoscaler is enabled
// Autoscale determines if autoscaling will be enabled for this instance group if cluster autoscaler is enabled
Autoscale *bool `json:"autoscale,omitempty"`
// MachineType is the instance class
MachineType string `json:"machineType,omitempty"`
Expand Down Expand Up @@ -134,24 +134,24 @@ type InstanceGroupSpec struct {
AdditionalSecurityGroups []string `json:"additionalSecurityGroups,omitempty"`
// CloudLabels defines additional tags or labels on cloud provider resources
CloudLabels map[string]string `json:"cloudLabels,omitempty"`
// NodeLabels indicates the kubernetes labels for nodes in this group
// NodeLabels indicates the kubernetes labels for nodes in this instance group
NodeLabels map[string]string `json:"nodeLabels,omitempty"`
// FileAssets is a collection of file assets for this instance group
FileAssets []FileAssetSpec `json:"fileAssets,omitempty"`
// Describes the tenancy of the instance group. Can be either default or dedicated.
// Describes the tenancy of this instance group. Can be either default or dedicated.
// Currently only applies to AWS.
Tenancy string `json:"tenancy,omitempty"`
// Kubelet overrides kubelet config from the ClusterSpec
Kubelet *KubeletConfigSpec `json:"kubelet,omitempty"`
// Taints indicates the kubernetes taints for nodes in this group
// Taints indicates the kubernetes taints for nodes in this instance group
Taints []string `json:"taints,omitempty"`
// MixedInstancesPolicy defined a optional backing of an AWS ASG by a EC2 Fleet (AWS Only)
MixedInstancesPolicy *MixedInstancesPolicySpec `json:"mixedInstancesPolicy,omitempty"`
// AdditionalUserData is any additional user-data to be passed to the host
AdditionalUserData []UserData `json:"additionalUserData,omitempty"`
// SuspendProcesses disables the listed Scaling Policies
SuspendProcesses []string `json:"suspendProcesses,omitempty"`
// ExternalLoadBalancers define loadbalancers that should be attached to the instancegroup
// ExternalLoadBalancers define loadbalancers that should be attached to this instance group
ExternalLoadBalancers []LoadBalancer `json:"externalLoadBalancers,omitempty"`
// DetailedInstanceMonitoring defines if detailed-monitoring is enabled (AWS only)
DetailedInstanceMonitoring *bool `json:"detailedInstanceMonitoring,omitempty"`
Expand All @@ -174,6 +174,12 @@ type InstanceGroupSpec struct {
CompressUserData *bool `json:"compressUserData,omitempty"`
// InstanceMetadata defines the EC2 instance metadata service options (AWS Only)
InstanceMetadata *InstanceMetadataOptions `json:"instanceMetadata,omitempty"`
// UpdatePolicy determines the policy for applying upgrades automatically.
seh marked this conversation as resolved.
Show resolved Hide resolved
// If specified, this value overrides a value specified in the Cluster's "spec.updatePolicy" field.
// Valid values:
// 'automatic' (default): apply updates automatically (apply OS security upgrades, avoiding rebooting when possible)
// 'external': do not apply updates automatically; they are applied manually or by an external system
UpdatePolicy *string `json:"updatePolicy,omitempty"`
}

const (
Expand All @@ -188,7 +194,7 @@ const (
// SpotAllocationStrategies is a collection of supported strategies
var SpotAllocationStrategies = []string{SpotAllocationStrategyLowestPrices, SpotAllocationStrategyDiversified, SpotAllocationStrategyCapacityOptimized}

// InstanceMetadata defines the EC2 instance metadata service options (AWS Only)
// InstanceMetadataOptions defines the EC2 instance metadata service options (AWS Only)
type InstanceMetadataOptions struct {
// HTTPPutResponseHopLimit is the desired HTTP PUT response hop limit for instance metadata requests.
// The larger the number, the further instance metadata requests can travel. The default value is 1.
Expand Down
2 changes: 2 additions & 0 deletions pkg/apis/kops/v1alpha2/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions pkg/apis/kops/validation/instancegroup.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,8 @@ func ValidateInstanceGroup(g *kops.InstanceGroup, cloud fi.Cloud) field.ErrorLis
allErrs = append(allErrs, validateExternalLoadBalancer(&lb, path)...)
}

allErrs = append(allErrs, IsValidValue(field.NewPath("spec", "updatePolicy"), g.Spec.UpdatePolicy, []string{kops.UpdatePolicyAutomatic, kops.UpdatePolicyExternal})...)
hakman marked this conversation as resolved.
Show resolved Hide resolved

return allErrs
}

Expand Down
Loading