Update support for RHEL 8

[hakman]

RHEL/CentOS 8 support is broken for various reasons:

1. check for Debian family doesn't recognise the distro
2. iptables-setup cannot be run from home dir (probably some extra security)
3. python package needs to be more explicit (python2 or python3)
4. ntpd fails to install because it has been replaced with chronny

[k8s-ci-robot]

Hi @hakman. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[rifelpet]

This is great! do you think we could add an e2e job for this? It should be as easy as copying the centos7 one and changing the ami id that it uses.
/ok-to-test

[hakman]

@rifelpet was thinking the same thing about the e2e job.
The only catch here would be that somehow we need to enable calico.iptablesBackend: NFT. Wanted to ask you what would be the best place to add it.

[rifelpet]

For e2e tests the best we can do is kops' --set functionality to override specific fields in manifests that arent otherwise accessible by cli flags in kops create cluster.

See these here:

kops/cmd/kops/create_cluster.go

Lines 367 to 369 in 4621df3

	if featureflag.SpecOverrideFlag.Enabled() {
	cmd.Flags().StringSliceVar(&options.Overrides, "override", options.Overrides, "Directly configure values in the spec")
	}

each field needs to explicitly get added to this string->field mapping function:

kops/pkg/commands/set_cluster.go

Line 75 in 4621df3

func SetClusterFields(fields []string, cluster *api.Cluster, instanceGroups []*api.InstanceGroup) error {

and we'd set it in a test with this --kops-overrides flag: https://github.com/kubernetes/test-infra/blob/4beb96650aaee54c274a42fb0ca011333808b6f5/kubetest/kops.go#L74

Though if that field is required for centos8 to work, should kops just automatically set it somehow? I know that can be tricky to make an addon manifest's contents depend on an AMI (of which there can be many in a given cluster). maybe its worth discussing at office hours today.

[hakman]

@rifelpet good news. Not sure why I thought tests would run with Calico. Just did a quick test with Kubenet (default) and seems to work without any issue. So the test can be added without any extra changes.

[hakman]

/assign @granular-ryanbonham
/cc @rifelpet

[justinsb]

Is this not python for Centos7? Or is python an alias for python2?

[hakman]

On CenOS 7 python2 is an alias for python.

[justinsb]

We might have to create this directory explicitly, but I think it's a good idea to pick a more reasonable directory.

For immutable OSes, we might have to bind-mount these also, if we're seeing failures there.

I think we could also do /opt/kops/bin/iptables-setup

[hakman]

I chose the "helpers" dir because that was the dir chosen for the Docker healthcheck.
Will give this a try with CoreOS also when this is merged and check again.
Changing to /opt/kops/bin/iptables-setup sounds good to me.

[justinsb]

I guess we should get this in, and then double check if we broke centos7 and other immutable OSes like COS.

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hakman, justinsb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hakman]

Thanks @justinsb. This will make testing simpler for the tar.gz package for containerd.
Once #8172 gets checked we can enable the e2e test for containerd + rhel8.