Skip to content

Commit d7b84b9

Browse files
GSPattonGSPatton
authored
Merge pull request #599 from puppetlabs/maint-revert_hardening_changes
(MAINT) Revert hardening changes
2 parents a8a9343 + 4bdf2a8 commit d7b84b9

File tree

10 files changed

+37
-70
lines changed

10 files changed

+37
-70
lines changed

‎manifests/kube_addons.pp‎

Lines changed: 17 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -27,37 +27,26 @@
2727
$exec_onlyif = 'kubectl get nodes'
2828

2929
if $cni_rbac_binding {
30-
$binding_command = ['kubectl', 'apply', '-f', $cni_rbac_binding]
31-
$binding_unless = 'kubectl get clusterrole | grep calico'
32-
3330
exec { 'Install calico rbac bindings':
3431
environment => $env,
35-
command => $binding_command,
32+
command => ['kubectl', 'apply', '-f', $cni_rbac_binding],
3633
onlyif => $exec_onlyif,
37-
unless => $binding_unless,
34+
unless => 'kubectl get clusterrole | grep calico',
3835
}
3936
}
4037

4138
if $cni_network_provider {
4239
if $cni_provider == 'calico-tigera' {
4340
if $cni_network_preinstall {
44-
$preinstall_command = ['kubectl', 'apply', '-f', $cni_network_preinstall]
45-
$preinstall_unless = 'kubectl -n tigera-operator get deployments | egrep "^tigera-operator"'
46-
4741
exec { 'Install cni network (preinstall)':
48-
command => $preinstall_command,
42+
command => ['kubectl', 'apply', '-f', $cni_network_preinstall],
4943
onlyif => $exec_onlyif,
50-
unless => $preinstall_unless,
44+
unless => 'kubectl -n tigera-operator get deployments | egrep "^tigera-operator"',
5145
environment => $env,
5246
before => Exec['Install cni network provider'],
5347
}
5448
}
55-
# Removing Calico_installation_path variable as it doesnt seem to apport any extra value here.
56-
$calico_installation_path = '/etc/kubernetes/calico-installation.yaml'
57-
$path_command = 'kubectl apply -f /etc/kubernetes/calico-installation.yaml'
58-
$path_unless = 'kubectl -n calico-system get daemonset | egrep "^calico-node"'
59-
60-
file { $calico_installation_path:
49+
file { '/etc/kubernetes/calico-installation.yaml':
6150
ensure => 'present',
6251
group => 'root',
6352
mode => '0400',
@@ -66,51 +55,42 @@
6655
source => $cni_network_provider,
6756
} -> file_line { 'Configure calico ipPools.cidr':
6857
ensure => present,
69-
path => $calico_installation_path,
58+
path => '/etc/kubernetes/calico-installation.yaml',
7059
match => ' cidr:',
7160
line => " cidr: ${cni_pod_cidr}",
7261
multiple => false,
7362
replace => true,
7463
} -> exec { 'Install cni network provider':
75-
command => $path_command,
64+
command => 'kubectl apply -f /etc/kubernetes/calico-installation.yaml',
7665
onlyif => $exec_onlyif,
77-
unless => $path_unless,
66+
unless => 'kubectl -n calico-system get daemonset | egrep "^calico-node"',
7867
environment => $env,
7968
}
8069
} else {
81-
$provider_command = ['kubectl', 'apply', '-f', $cni_network_provider]
82-
$provider_unless = 'kubectl -n kube-system get daemonset | egrep "(flannel|weave|calico-node|cilium)"'
83-
8470
exec { 'Install cni network provider':
85-
command => $provider_command,
71+
command => ['kubectl', 'apply', '-f', $cni_network_provider],
8672
onlyif => $exec_onlyif,
87-
unless => $provider_unless,
73+
unless => 'kubectl -n kube-system get daemonset | egrep "(flannel|weave|calico-node|cilium)"',
8874
environment => $env,
8975
}
9076
}
9177
}
9278

9379
if $schedule_on_controller {
94-
$schedule_command = ['kubectl', 'taint', 'nodes', $node_name, 'node-role.kubernetes.io/master-']
95-
$schedule_onlyif = "kubectl describe nodes ${node_name} | tr -s ' ' | grep 'Taints: node-role.kubernetes.io/master:NoSchedule'"
96-
9780
exec { 'schedule on controller':
98-
command => $schedule_command,
99-
onlyif => $schedule_onlyif,
81+
command => "kubectl taint nodes ${node_name} node-role.kubernetes.io/master-",
82+
onlyif => "kubectl describe nodes ${node_name} | tr -s ' ' | grep 'Taints: node-role.kubernetes.io/master:NoSchedule'",
10083
}
10184
}
10285

10386
if $install_dashboard {
104-
$dashboard_command = ['kubectl', 'apply', '-f', $dashboard_url]
105-
$dashboard_unless = [
106-
'kubectl get pods --field-selector="status.phase=Running" -n kubernetes-dashboard | grep kubernetes-dashboard-',
107-
'kubectl get pods --field-selector="status.phase=Running" -n kube-system | grep kubernetes-dashboard-'
108-
]
109-
11087
exec { 'Install Kubernetes dashboard':
111-
command => $dashboard_command,
88+
command => ['kubectl', 'apply', '-f', $dashboard_url],
11289
onlyif => $exec_onlyif,
113-
unless => $dashboard_unless,
90+
unless => [
91+
'kubectl get pods --field-selector="status.phase=Running" -n kubernetes-dashboard | grep kubernetes-dashboard-',
92+
'kubectl get pods --field-selector="status.phase=Running" -n kube-system | grep kubernetes-dashboard-',
93+
],
11494
environment => $env,
11595
}
11696
}

‎manifests/kubeadm_init.pp‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,13 @@
1515
skip_phases => $skip_phases,
1616
})
1717

18-
$exec_init = ['kubeadm', 'init', $kubeadm_init_flags]
19-
$unless_init = "kubectl get nodes | grep ${node_name}"
2018
exec { 'kubeadm init':
21-
command => $exec_init,
19+
command => "kubeadm init ${kubeadm_init_flags}",
2220
environment => $env,
2321
path => $path,
2422
logoutput => true,
2523
timeout => 0,
26-
unless => $unless_init,
24+
unless => "kubectl get nodes | grep ${node_name}",
2725
}
2826

2927
# This prevents a known race condition https://github.com/kubernetes/kubernetes/issues/66689

‎manifests/kubeadm_join.pp‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,15 +43,12 @@
4343
}
4444
}
4545

46-
$exec_join = ['kubeadm', 'join', $kubeadm_join_flags]
47-
$unless_join = "kubectl get nodes | grep ${node_name}"
48-
4946
exec { 'kubeadm join':
50-
command => $exec_join,
47+
command => "kubeadm join ${kubeadm_join_flags}",
5148
environment => $env,
5249
path => $path,
5350
logoutput => true,
5451
timeout => 0,
55-
unless => $unless_join,
52+
unless => "kubectl get nodes | grep ${node_name}",
5653
}
5754
}

‎manifests/packages.pp‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,10 @@
6060
$kube_packages = ['kubelet', 'kubectl', 'kubeadm']
6161

6262
if $disable_swap {
63-
$command = ['swapoff', '-a']
64-
$unless = [['awk', '"{ if (NR > 1) exit 1}"', '/proc/swaps']]
65-
6663
exec { 'disable swap':
6764
path => ['/usr/sbin/', '/usr/bin', '/bin', '/sbin'],
68-
command => $command,
69-
unless => $unless,
65+
command => 'swapoff -a',
66+
unless => "awk '{ if (NR > 1) exit 1}' /proc/swaps",
7067
}
7168
file_line { 'remove swap in /etc/fstab':
7269
ensure => absent,

‎manifests/service.pp‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,9 @@
2020
ensure => directory,
2121
}
2222

23-
$exec_reload = ['systemctl', 'daemon-reload']
24-
2523
exec { 'kubernetes-systemd-reload':
2624
path => '/bin',
27-
command => $exec_reload,
25+
command => 'systemctl daemon-reload',
2826
refreshonly => true,
2927
}
3028

@@ -107,7 +105,7 @@
107105
if $etcd_install_method == 'wget' {
108106
exec { 'systemctl-daemon-reload-etcd':
109107
path => '/usr/bin:/bin:/usr/sbin:/sbin',
110-
command => $exec_reload,
108+
command => 'systemctl daemon-reload',
111109
refreshonly => true,
112110
subscribe => File['/etc/systemd/system/etcd.service'],
113111
notify => Service['etcd'],

‎manifests/wait_for_default_sa.pp‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,9 @@
1010
$safe_namespace = shell_escape($namespace)
1111

1212
# This prevents a known race condition https://github.com/kubernetes/kubernetes/issues/66689
13-
$cmd = ['kubectl', '-n', $safe_namespace, 'get', 'serviceaccount', 'default', '-o', 'name']
14-
$unless_cmd = [['kubectl', '-n', $safe_namespace, 'get', 'serviceaccount', 'default', '-o', 'name']]
15-
1613
exec { "wait for default serviceaccount creation in ${safe_namespace}":
17-
command => $cmd,
18-
unless => $unless_cmd,
14+
command => "kubectl -n ${safe_namespace} get serviceaccount default -o name",
15+
unless => ["kubectl -n ${safe_namespace} get serviceaccount default -o name"],
1916
path => $path,
2017
environment => $env,
2118
timeout => $timeout,

‎spec/classes/kube_addons_spec.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
when 'calico-tigera'
6565
it { is_expected.to contain_exec('Install cni network (preinstall)').with({
6666
'command': ['kubectl', 'apply', '-f', 'https://foo.test/tigera-operator'],
67-
'onlyif': ['kubectl get nodes'],
67+
'onlyif': 'kubectl get nodes',
6868
})
6969
}
7070
it { is_expected.to contain_file('/etc/kubernetes/calico-installation.yaml')}

‎spec/defines/kubeadm_init_spec.rb‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
}
3030
end
3131
it { is_expected.to compile.with_all_deps }
32-
it { is_expected.to contain_exec('kubeadm init').with_command(["kubeadm", "init", "--config '/etc/kubernetes/config.yaml'"])}
32+
it { is_expected.to contain_exec('kubeadm init').with_command("kubeadm init --config '/etc/kubernetes/config.yaml'")}
3333
it { is_expected.to contain_kubernetes__wait_for_default_sa('default')}
3434
end
3535

@@ -44,7 +44,7 @@
4444
}
4545
end
4646
it { is_expected.to compile.with_all_deps }
47-
it { is_expected.to contain_exec('kubeadm init').with_command(["kubeadm", "init", "--config '/etc/kubernetes/config.yaml' --dry-run"])}
47+
it { is_expected.to contain_exec('kubeadm init').with_command("kubeadm init --config '/etc/kubernetes/config.yaml' --dry-run")}
4848
it { is_expected.to contain_kubernetes__wait_for_default_sa('default')}
4949
end
5050

@@ -59,7 +59,7 @@
5959
}
6060
end
6161
it { is_expected.to compile.with_all_deps }
62-
it { is_expected.to contain_exec('kubeadm init').with_command(["kubeadm", "init", "--config '/etc/kubernetes/config.yaml' --ignore-preflight-errors='foo,bar'"])}
62+
it { is_expected.to contain_exec('kubeadm init').with_command("kubeadm init --config '/etc/kubernetes/config.yaml' --ignore-preflight-errors='foo,bar'")}
6363
it { is_expected.to contain_kubernetes__wait_for_default_sa('default')}
6464
end
6565
end

‎spec/defines/kubeadm_join_spec.rb‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
end
4040

4141
it { is_expected.to compile.with_all_deps }
42-
it { is_expected.to contain_exec('kubeadm join').with_command(["kubeadm", "join", "'10.0.0.1:6443' --discovery-token 'token' --discovery-token-ca-cert-hash 'sha256:hash' --node-name 'kube-node' --token 'token'"])}
42+
it { is_expected.to contain_exec('kubeadm join').with_command("kubeadm join '10.0.0.1:6443' --discovery-token 'token' --discovery-token-ca-cert-hash 'sha256:hash' --node-name 'kube-node' --token 'token'")}
4343
end
4444

4545
context 'with kubernetes_version => 1.12.3 and controller_address => 10.0.0.1:6443' do
@@ -48,7 +48,7 @@
4848
end
4949

5050
it { is_expected.to compile.with_all_deps }
51-
it { is_expected.to contain_exec('kubeadm join').with_command(["kubeadm", "join", "--config '/etc/kubernetes/config.yaml'"])}
51+
it { is_expected.to contain_exec('kubeadm join').with_command("kubeadm join --config '/etc/kubernetes/config.yaml'")}
5252
end
5353

5454
context 'with kubernetes_version => 1.12.3 and ignore_preflight_errors => [foo, bar]' do
@@ -60,7 +60,7 @@
6060
end
6161

6262
it { is_expected.to compile.with_all_deps }
63-
it { is_expected.to contain_exec('kubeadm join').with_command(["kubeadm", "join", "--config '/etc/kubernetes/config.yaml' --ignore-preflight-errors 'foo,bar'"])}
63+
it { is_expected.to contain_exec('kubeadm join').with_command("kubeadm join --config '/etc/kubernetes/config.yaml' --ignore-preflight-errors 'foo,bar'")}
6464
end
6565

6666
context 'with kubernetes_version => 1.12.3 and discovery_file => /etc/kubernetes/admin.conf' do
@@ -72,6 +72,6 @@
7272
end
7373

7474
it { is_expected.to compile.with_all_deps }
75-
it { is_expected.to contain_exec('kubeadm join').with_command(["kubeadm", "join", "--discovery-file '/etc/kubernetes/admin.conf'"])}
75+
it { is_expected.to contain_exec('kubeadm join').with_command("kubeadm join --discovery-file '/etc/kubernetes/admin.conf'")}
7676
end
7777
end

‎spec/defines/wait_for_default_sa_spec.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
end
2828
it { is_expected.to compile.with_all_deps }
2929
it { is_expected.to contain_exec('wait for default serviceaccount creation in default')
30-
.with_command(['kubectl', '-n', 'default', 'get', 'serviceaccount', 'default', '-o', 'name'])}
30+
.with_command('kubectl -n default get serviceaccount default -o name')}
3131
end
3232

3333
context 'with namespace foo and path /bar' do
@@ -39,7 +39,7 @@
3939
end
4040
it { is_expected.to compile.with_all_deps }
4141
it { is_expected.to contain_exec('wait for default serviceaccount creation in foo')
42-
.with_command(['kubectl', '-n', 'foo', 'get', 'serviceaccount', 'default', '-o', 'name'])
42+
.with_command('kubectl -n foo get serviceaccount default -o name')
4343
.with_path(['/bar'])}
4444
end
4545
end

0 commit comments

Comments
 (0)