kfox1111
2a8c1b63c4
* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
152 lines
7.2 KiB
YAML
152 lines
7.2 KiB
YAML
kind: Cluster
|
|
apiVersion: kind.x-k8s.io/v1alpha4
|
|
kubeadmConfigPatches:
|
|
- |
|
|
apiVersion: kubeadm.k8s.io/v1beta2
|
|
kind: ClusterConfiguration
|
|
metadata:
|
|
name: config
|
|
apiServer:
|
|
extraArgs:
|
|
service-account-key-file: /etc/kubernetes/pki/sa.pub
|
|
service-account-signing-key-file: /etc/kubernetes/pki/sa.key
|
|
service-account-issuer: api,spire-agent
|
|
api-audiences: api,spire-server
|
|
# admission-control-config-file: /etc/kubernetes/pki/admctrl/admission-control.yaml
|
|
nodes:
|
|
- role: control-plane
|
|
extraMounts:
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
|
|
- role: worker
|
|
extraMounts:
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-2-a/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-2-b/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
|
|
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
|
|
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
|
|
# package installed spire-ha-agent@main listens, so kubelet's configuration in
|
|
# the node is the same one a real bare metal node would use.
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-2/public
|
|
containerPath: /var/run/spire/agent/sockets/main/public
|
|
- hostPath: ./.github/kind/conf/credential-providers
|
|
containerPath: /credential-plugins
|
|
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
|
|
containerPath: /etc/kubernetes/credential-provider-config.yaml
|
|
kubeadmConfigPatches:
|
|
- |
|
|
apiVersion: kubeadm.k8s.io/v1beta3
|
|
kind: JoinConfiguration
|
|
nodeRegistration:
|
|
kubeletExtraArgs:
|
|
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
|
|
image-credential-provider-bin-dir: /credential-plugins
|
|
kubeadmConfigPatchesJSON6902:
|
|
- group: kubeadm.k8s.io
|
|
version: v1beta4
|
|
kind: JoinConfiguration
|
|
patch: |
|
|
- op: add
|
|
path: /nodeRegistration/kubeletExtraArgs/-
|
|
value:
|
|
name: image-credential-provider-config
|
|
value: /etc/kubernetes/credential-provider-config.yaml
|
|
- op: add
|
|
path: /nodeRegistration/kubeletExtraArgs/-
|
|
value:
|
|
name: image-credential-provider-bin-dir
|
|
value: /credential-plugins
|
|
- role: worker
|
|
extraMounts:
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-3-a/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-3-b/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
|
|
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
|
|
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
|
|
# package installed spire-ha-agent@main listens, so kubelet's configuration in
|
|
# the node is the same one a real bare metal node would use.
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-3/public
|
|
containerPath: /var/run/spire/agent/sockets/main/public
|
|
- hostPath: ./.github/kind/conf/credential-providers
|
|
containerPath: /credential-plugins
|
|
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
|
|
containerPath: /etc/kubernetes/credential-provider-config.yaml
|
|
kubeadmConfigPatches:
|
|
- |
|
|
apiVersion: kubeadm.k8s.io/v1beta3
|
|
kind: JoinConfiguration
|
|
nodeRegistration:
|
|
kubeletExtraArgs:
|
|
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
|
|
image-credential-provider-bin-dir: /credential-plugins
|
|
kubeadmConfigPatchesJSON6902:
|
|
- group: kubeadm.k8s.io
|
|
version: v1beta4
|
|
kind: JoinConfiguration
|
|
patch: |
|
|
- op: add
|
|
path: /nodeRegistration/kubeletExtraArgs/-
|
|
value:
|
|
name: image-credential-provider-config
|
|
value: /etc/kubernetes/credential-provider-config.yaml
|
|
- op: add
|
|
path: /nodeRegistration/kubeletExtraArgs/-
|
|
value:
|
|
name: image-credential-provider-bin-dir
|
|
value: /credential-plugins
|
|
- role: worker
|
|
extraMounts:
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-server-b/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-4-a/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-4-b/public
|
|
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
|
|
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
|
|
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
|
|
# package installed spire-ha-agent@main listens, so kubelet's configuration in
|
|
# the node is the same one a real bare metal node would use.
|
|
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-4/public
|
|
containerPath: /var/run/spire/agent/sockets/main/public
|
|
- hostPath: ./.github/kind/conf/credential-providers
|
|
containerPath: /credential-plugins
|
|
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
|
|
containerPath: /etc/kubernetes/credential-provider-config.yaml
|
|
kubeadmConfigPatches:
|
|
- |
|
|
apiVersion: kubeadm.k8s.io/v1beta3
|
|
kind: JoinConfiguration
|
|
nodeRegistration:
|
|
kubeletExtraArgs:
|
|
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
|
|
image-credential-provider-bin-dir: /credential-plugins
|
|
kubeadmConfigPatchesJSON6902:
|
|
- group: kubeadm.k8s.io
|
|
version: v1beta4
|
|
kind: JoinConfiguration
|
|
patch: |
|
|
- op: add
|
|
path: /nodeRegistration/kubeletExtraArgs/-
|
|
value:
|
|
name: image-credential-provider-config
|
|
value: /etc/kubernetes/credential-provider-config.yaml
|
|
- op: add
|
|
path: /nodeRegistration/kubeletExtraArgs/-
|
|
value:
|
|
name: image-credential-provider-bin-dir
|
|
value: /credential-plugins
|