Bottom turtle ha registry tests (#929)
* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,25 @@
|
||||
apiVersion: kubelet.config.k8s.io/v1
|
||||
kind: CredentialProviderConfig
|
||||
providers:
|
||||
- name: k8s-image-cred-spire-identity-exchange
|
||||
matchImages:
|
||||
- "zot.production.other"
|
||||
defaultCacheDuration: "0s"
|
||||
apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||
args:
|
||||
- "--username=zot"
|
||||
- "--mode=spire-identity-exchange"
|
||||
- "--url=https://spire-identity-exchange-rest-spiffe.production.other"
|
||||
- "--stack=image_pull"
|
||||
- "--registry-audience=zot"
|
||||
- "--spiffe-audience=spire-identity-exchange"
|
||||
- "--spiffe-hint=image-pull"
|
||||
- "--spiffe-id=spiffe://production.other/service/spire-identity-exchange"
|
||||
- "--timeout=10s"
|
||||
env:
|
||||
- name: SPIFFE_ENDPOINT_SOCKET
|
||||
value: unix:///var/run/spire/agent/sockets/main/public/api.sock
|
||||
tokenAttributes:
|
||||
serviceAccountTokenAudience: "spire-identity-exchange"
|
||||
cacheType: "Token"
|
||||
requireServiceAccount: true
|
||||
@@ -30,6 +30,39 @@ nodes:
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-2-b/public
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
|
||||
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
|
||||
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
|
||||
# package installed spire-ha-agent@main listens, so kubelet's configuration in
|
||||
# the node is the same one a real bare metal node would use.
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-2/public
|
||||
containerPath: /var/run/spire/agent/sockets/main/public
|
||||
- hostPath: ./.github/kind/conf/credential-providers
|
||||
containerPath: /credential-plugins
|
||||
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
|
||||
containerPath: /etc/kubernetes/credential-provider-config.yaml
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
apiVersion: kubeadm.k8s.io/v1beta3
|
||||
kind: JoinConfiguration
|
||||
nodeRegistration:
|
||||
kubeletExtraArgs:
|
||||
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
|
||||
image-credential-provider-bin-dir: /credential-plugins
|
||||
kubeadmConfigPatchesJSON6902:
|
||||
- group: kubeadm.k8s.io
|
||||
version: v1beta4
|
||||
kind: JoinConfiguration
|
||||
patch: |
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-config
|
||||
value: /etc/kubernetes/credential-provider-config.yaml
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-bin-dir
|
||||
value: /credential-plugins
|
||||
- role: worker
|
||||
extraMounts:
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
||||
@@ -40,6 +73,39 @@ nodes:
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-3-b/public
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
|
||||
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
|
||||
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
|
||||
# package installed spire-ha-agent@main listens, so kubelet's configuration in
|
||||
# the node is the same one a real bare metal node would use.
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-3/public
|
||||
containerPath: /var/run/spire/agent/sockets/main/public
|
||||
- hostPath: ./.github/kind/conf/credential-providers
|
||||
containerPath: /credential-plugins
|
||||
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
|
||||
containerPath: /etc/kubernetes/credential-provider-config.yaml
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
apiVersion: kubeadm.k8s.io/v1beta3
|
||||
kind: JoinConfiguration
|
||||
nodeRegistration:
|
||||
kubeletExtraArgs:
|
||||
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
|
||||
image-credential-provider-bin-dir: /credential-plugins
|
||||
kubeadmConfigPatchesJSON6902:
|
||||
- group: kubeadm.k8s.io
|
||||
version: v1beta4
|
||||
kind: JoinConfiguration
|
||||
patch: |
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-config
|
||||
value: /etc/kubernetes/credential-provider-config.yaml
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-bin-dir
|
||||
value: /credential-plugins
|
||||
- role: worker
|
||||
extraMounts:
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
||||
@@ -50,3 +116,36 @@ nodes:
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-4-b/public
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
|
||||
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
|
||||
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
|
||||
# package installed spire-ha-agent@main listens, so kubelet's configuration in
|
||||
# the node is the same one a real bare metal node would use.
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-4/public
|
||||
containerPath: /var/run/spire/agent/sockets/main/public
|
||||
- hostPath: ./.github/kind/conf/credential-providers
|
||||
containerPath: /credential-plugins
|
||||
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
|
||||
containerPath: /etc/kubernetes/credential-provider-config.yaml
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
apiVersion: kubeadm.k8s.io/v1beta3
|
||||
kind: JoinConfiguration
|
||||
nodeRegistration:
|
||||
kubeletExtraArgs:
|
||||
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
|
||||
image-credential-provider-bin-dir: /credential-plugins
|
||||
kubeadmConfigPatchesJSON6902:
|
||||
- group: kubeadm.k8s.io
|
||||
version: v1beta4
|
||||
kind: JoinConfiguration
|
||||
patch: |
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-config
|
||||
value: /etc/kubernetes/credential-provider-config.yaml
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-bin-dir
|
||||
value: /credential-plugins
|
||||
|
||||
Reference in New Issue
Block a user