Run pods needing control-plane instance credentials on hostNetwork

[johngmyers]

Allows setting IMDS hop limit to 1 on control-plane nodes.

[johngmyers]

many-addons broken due to cluster-autoscaler

[hakman]

/lgtm
/assign @olemarkus

[rifelpet]

I believe this has a side effect of preventing CiliumNetworkPolicies from restricting the network access for these pods

[johngmyers]

@olemarkus What is with the upgrade-ab test? It's failing because the PDB is not satisfied 5 seconds after the new manifest was applied. It takes time for a Deployment to roll out.

We probably need a loop around the ${CHANNELS} apply channel command, waiting for it to reconcile.

[johngmyers]

I don't see a problem with CiliumNetworkPolicies not applying to these pods. They are privileged, after all. If they care that much about restricting their access, they can enable IRSA.

[johngmyers]

upgrade-ab had been failing due to port conflicts.

[johngmyers]

/retest

[johngmyers]

/test pull-kops-e2e-aws-upgrade-126-ko126-to-klatest-kolatest-many-addons

[hakman]

This is only needed for AWS, no need to complicate other providers with it.

Suggested change

	// CloudCSIDriverPort is reserved for the cloud provider's primary CSI driver.
	CloudCSIDriverPort = 9808
	// AWSCSIDriverPort is reserved for the cloud provider's primary CSI driver.
	AWSCSIDriverPort = 9808

[johngmyers]

The OpenStack cinder daemonset runs on host network and uses a port.

The GCP PD controller also runs on host network, though it uses three ports.

@justinsb should we not try to share port assignments across the primary CSI drivers for cloud providers?

[hakman]

We should diverge from cloud provider default as little as possible.

[johngmyers]

We should be more proactive in avoiding port conflicts. We don't have the coverage to find them all through testing.

[olemarkus]

We probably should have a map of the ports in wellknownports.go and use that map in manifests that are using host networking. That would make it easier to discover any conflicts.

[johngmyers]

Making this PR minimal and leaving the avoidance of other port conflicts to future work.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hakman

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [hakman]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment