Skip to content

Commit 1e98b43

Browse files
linkilinki
authored
Merge branch 'dev' into 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller
2 parents 7bf7faa + 3327b92 commit 1e98b43

File tree

116 files changed

+3556
-627
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

116 files changed

+3556
-627
lines changed

‎cluster/cluster.yaml

Lines changed: 1139 additions & 322 deletions
Large diffs are not rendered by default.

‎cluster/config-defaults.yaml

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -695,10 +695,10 @@ teapot_admission_controller_configmap_deletion_protection_factories_enabled: "tr
695695
# enable the rolebinding admission-controller webhook which validates rolebindings and clusterrolebindings
696696
teapot_admission_controller_enable_rolebinding_webhook: "true"
697697

698-
# enable the generic deny-all admission webhook which rejects all requests it receives
699-
teapot_admission_controller_enable_write_protection_webhook: "false"
700-
# configure the behaviour of the deny-all admission webhook, `true` blocks everything, `false` allows everything
701-
teapot_admission_controller_prevent_write_operations: "false"
698+
# enable the resource protection admission webhook which prevents users from accessing system resources
699+
teapot_admission_controller_enable_write_protection_webhook: "true"
700+
# configure the behaviour of the resource protection admission webhook, `true` blocks, `false` allows
701+
teapot_admission_controller_prevent_write_operations: "true"
702702

703703
# Enable and configure Pod Security Policy rules implemented in admission-controller.
704704
teapot_admission_controller_pod_security_policy_enabled: "true"
@@ -1244,7 +1244,27 @@ wiz_sensor_cpu: "300m"
12441244
wiz_sensor_memory: "300Mi"
12451245
wiz_connector_cpu: "300m"
12461246
wiz_connector_memory: "300Mi"
1247+
wiz_priority: "false"
12471248
# Please note when this is set to true it allows the use of the node selector feature
12481249
# to deploy the sensor and connector on specific nodes, by manually setting the node selector label on the nodes.
12491250
# This is useful when you want to deploy the sensor and connector on specific nodes.
12501251
wiz_node_feature_rollout : "false"
1252+
1253+
# EKS specific configuration
1254+
eks_control_plane_logging: "false"
1255+
eks_ip_family: "ipv4"
1256+
eks_zalando_iam_aws_proxy_cpu: "100m"
1257+
eks_zalando_iam_aws_proxy_memory: "512Mi"
1258+
eks_zalando_iam_aws_proxy_hpa_max_replicas: "10"
1259+
eks_zalando_iam_aws_proxy_hpa_cpu_target: "80"
1260+
eks_zalando_iam_aws_proxy_hpa_memory_target: "80"
1261+
eks_okta_identity_provider: "true"
1262+
eks_fis_support_enabled: "false"
1263+
eks_fis_namespaces: "default"
1264+
1265+
# prefix delegation can only be configured for ipv4. For ipv6 it can only be true.
1266+
aws_vpc_cni_prefix_delegation: "false"
1267+
# enable network policy enforcement in the cluster.
1268+
aws_vpc_cni_enable_network_policy: "false"
1269+
# specify the network policy enforcement mode.
1270+
aws_vpc_cni_network_policy_enforcing_mode: "standard"

‎cluster/manifests/01-aws-node/config.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{- if eq .Cluster.Provider "zalando-eks" }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: amazon-vpc-cni
6+
namespace: kube-system
7+
labels:
8+
app.kubernetes.io/instance: aws-vpc-cni
9+
app.kubernetes.io/name: aws-node
10+
app.kubernetes.io/version: v1.19.0
11+
k8s-app: aws-node
12+
application: kubernetes
13+
component: aws-node
14+
data:
15+
branch-eni-cooldown: "60"
16+
enable-network-policy-controller: "{{.Cluster.ConfigItems.aws_vpc_cni_enable_network_policy}}"
17+
enable-windows-ipam: "false"
18+
enable-windows-prefix-delegation: "false"
19+
minimum-ip-target: "3"
20+
warm-ip-target: "1"
21+
warm-prefix-target: "0"
22+
{{- end }}

‎cluster/manifests/01-aws-node/daemonset.yaml

Lines changed: 261 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,261 @@
1+
{{- if eq .Cluster.Provider "zalando-eks" }}
2+
apiVersion: apps/v1
3+
kind: DaemonSet
4+
metadata:
5+
labels:
6+
app.kubernetes.io/instance: aws-vpc-cni
7+
app.kubernetes.io/name: aws-node
8+
app.kubernetes.io/version: v1.19.0
9+
k8s-app: aws-node
10+
application: kubernetes
11+
component: aws-node
12+
name: aws-node
13+
namespace: kube-system
14+
spec:
15+
selector:
16+
matchLabels:
17+
k8s-app: aws-node
18+
template:
19+
metadata:
20+
labels:
21+
app.kubernetes.io/instance: aws-vpc-cni
22+
app.kubernetes.io/name: aws-node
23+
k8s-app: aws-node
24+
application: kubernetes
25+
component: aws-node
26+
spec:
27+
affinity:
28+
nodeAffinity:
29+
requiredDuringSchedulingIgnoredDuringExecution:
30+
nodeSelectorTerms:
31+
- matchExpressions:
32+
- key: kubernetes.io/os
33+
operator: In
34+
values:
35+
- linux
36+
- key: kubernetes.io/arch
37+
operator: In
38+
values:
39+
- amd64
40+
- arm64
41+
- key: eks.amazonaws.com/compute-type
42+
operator: NotIn
43+
values:
44+
- fargate
45+
- hybrid
46+
- auto
47+
containers:
48+
- env:
49+
- name: ADDITIONAL_ENI_TAGS
50+
value: '{}'
51+
- name: ANNOTATE_POD_IP
52+
value: "false"
53+
- name: AWS_VPC_CNI_NODE_PORT_SUPPORT
54+
value: "true"
55+
- name: AWS_VPC_ENI_MTU
56+
value: "9001"
57+
- name: AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG
58+
value: "false"
59+
- name: AWS_VPC_K8S_CNI_EXTERNALSNAT
60+
value: "false"
61+
- name: AWS_VPC_K8S_CNI_LOGLEVEL
62+
value: DEBUG
63+
- name: AWS_VPC_K8S_CNI_LOG_FILE
64+
value: /host/var/log/aws-routed-eni/ipamd.log
65+
- name: AWS_VPC_K8S_CNI_RANDOMIZESNAT
66+
value: prng
67+
- name: AWS_VPC_K8S_CNI_VETHPREFIX
68+
value: eni
69+
- name: AWS_VPC_K8S_PLUGIN_LOG_FILE
70+
value: /var/log/aws-routed-eni/plugin.log
71+
- name: AWS_VPC_K8S_PLUGIN_LOG_LEVEL
72+
value: DEBUG
73+
- name: CLUSTER_NAME
74+
value: "{{ .Cluster.Name }}"
75+
- name: DISABLE_INTROSPECTION
76+
value: "false"
77+
- name: DISABLE_METRICS
78+
value: "false"
79+
- name: DISABLE_NETWORK_RESOURCE_PROVISIONING
80+
value: "false"
81+
- name: ENABLE_IPv4
82+
value: "{{ if eq .Cluster.ConfigItems.eks_ip_family "ipv4" }}true{{else}}false{{end}}"
83+
- name: ENABLE_IPv6
84+
value: "{{ if eq .Cluster.ConfigItems.eks_ip_family "ipv4" }}false{{else}}true{{end}}"
85+
- name: ENABLE_POD_ENI
86+
value: "false"
87+
- name: ENABLE_PREFIX_DELEGATION
88+
value: "{{ if eq .Cluster.ConfigItems.eks_ip_family "ipv4" }}{{.Cluster.ConfigItems.aws_vpc_cni_prefix_delegation}}{{else}}true{{end}}"
89+
- name: ENABLE_SUBNET_DISCOVERY
90+
value: "true"
91+
- name: NETWORK_POLICY_ENFORCING_MODE
92+
value: "{{.Cluster.ConfigItems.aws_vpc_cni_network_policy_enforcing_mode}}"
93+
- name: VPC_CNI_VERSION
94+
value: v1.19.0
95+
- name: VPC_ID
96+
value: "{{ .Cluster.ConfigItems.vpc_id }}"
97+
- name: WARM_ENI_TARGET
98+
value: "1"
99+
- name: WARM_PREFIX_TARGET
100+
value: "1"
101+
- name: MY_NODE_NAME
102+
valueFrom:
103+
fieldRef:
104+
apiVersion: v1
105+
fieldPath: spec.nodeName
106+
- name: MY_POD_NAME
107+
valueFrom:
108+
fieldRef:
109+
apiVersion: v1
110+
fieldPath: metadata.name
111+
image: 602401143452.dkr.ecr.{{.Cluster.Region}}.amazonaws.com/amazon-k8s-cni:v1.19.0-eksbuild.1
112+
imagePullPolicy: IfNotPresent
113+
livenessProbe:
114+
exec:
115+
command:
116+
- /app/grpc-health-probe
117+
- -addr=:50051
118+
- -connect-timeout=5s
119+
- -rpc-timeout=5s
120+
failureThreshold: 3
121+
initialDelaySeconds: 60
122+
periodSeconds: 10
123+
successThreshold: 1
124+
timeoutSeconds: 10
125+
name: aws-node
126+
ports:
127+
- containerPort: 61678
128+
hostPort: 61678
129+
name: metrics
130+
protocol: TCP
131+
readinessProbe:
132+
exec:
133+
command:
134+
- /app/grpc-health-probe
135+
- -addr=:50051
136+
- -connect-timeout=5s
137+
- -rpc-timeout=5s
138+
failureThreshold: 3
139+
initialDelaySeconds: 1
140+
periodSeconds: 10
141+
successThreshold: 1
142+
timeoutSeconds: 10
143+
resources:
144+
requests:
145+
cpu: 25m
146+
securityContext:
147+
capabilities:
148+
add:
149+
- NET_ADMIN
150+
- NET_RAW
151+
terminationMessagePath: /dev/termination-log
152+
terminationMessagePolicy: File
153+
volumeMounts:
154+
- mountPath: /host/opt/cni/bin
155+
name: cni-bin-dir
156+
- mountPath: /host/etc/cni/net.d
157+
name: cni-net-dir
158+
- mountPath: /host/var/log/aws-routed-eni
159+
name: log-dir
160+
- mountPath: /var/run/aws-node
161+
name: run-dir
162+
- mountPath: /run/xtables.lock
163+
name: xtables-lock
164+
- args:
165+
- --enable-ipv6={{ if eq .Cluster.ConfigItems.eks_ip_family "ipv4" }}false{{else}}true{{end}}
166+
- --enable-network-policy={{.Cluster.ConfigItems.aws_vpc_cni_enable_network_policy}}
167+
- --enable-cloudwatch-logs=false
168+
- --enable-policy-event-logs=false
169+
- --log-file=/var/log/aws-routed-eni/network-policy-agent.log
170+
- --metrics-bind-addr=:8162
171+
- --health-probe-bind-addr=:8163
172+
- --conntrack-cache-cleanup-period=300
173+
env:
174+
- name: MY_NODE_NAME
175+
valueFrom:
176+
fieldRef:
177+
apiVersion: v1
178+
fieldPath: spec.nodeName
179+
image: 602401143452.dkr.ecr.{{.Cluster.Region}}.amazonaws.com/amazon/aws-network-policy-agent:v1.1.5-eksbuild.1
180+
imagePullPolicy: IfNotPresent
181+
name: aws-eks-nodeagent
182+
resources:
183+
requests:
184+
cpu: 25m
185+
securityContext:
186+
capabilities:
187+
add:
188+
- NET_ADMIN
189+
privileged: true
190+
terminationMessagePath: /dev/termination-log
191+
terminationMessagePolicy: File
192+
volumeMounts:
193+
- mountPath: /host/opt/cni/bin
194+
name: cni-bin-dir
195+
- mountPath: /sys/fs/bpf
196+
name: bpf-pin-path
197+
- mountPath: /var/log/aws-routed-eni
198+
name: log-dir
199+
- mountPath: /var/run/aws-node
200+
name: run-dir
201+
dnsPolicy: ClusterFirst
202+
hostNetwork: true
203+
initContainers:
204+
- env:
205+
- name: DISABLE_TCP_EARLY_DEMUX
206+
value: "false"
207+
- name: ENABLE_IPv6
208+
value: "{{ if eq .Cluster.ConfigItems.eks_ip_family "ipv4" }}false{{else}}true{{end}}"
209+
image: 602401143452.dkr.ecr.{{.Cluster.Region}}.amazonaws.com/amazon-k8s-cni-init:v1.19.0-eksbuild.1
210+
imagePullPolicy: IfNotPresent
211+
name: aws-vpc-cni-init
212+
resources:
213+
requests:
214+
cpu: 25m
215+
securityContext:
216+
privileged: true
217+
terminationMessagePath: /dev/termination-log
218+
terminationMessagePolicy: File
219+
volumeMounts:
220+
- mountPath: /host/opt/cni/bin
221+
name: cni-bin-dir
222+
priorityClassName: system-node-critical
223+
restartPolicy: Always
224+
schedulerName: default-scheduler
225+
securityContext: {}
226+
serviceAccount: aws-node
227+
serviceAccountName: aws-node
228+
terminationGracePeriodSeconds: 10
229+
tolerations:
230+
- operator: Exists
231+
volumes:
232+
- hostPath:
233+
path: /sys/fs/bpf
234+
type: ""
235+
name: bpf-pin-path
236+
- hostPath:
237+
path: /opt/cni/bin
238+
type: ""
239+
name: cni-bin-dir
240+
- hostPath:
241+
path: /etc/cni/net.d
242+
type: ""
243+
name: cni-net-dir
244+
- hostPath:
245+
path: /var/log/aws-routed-eni
246+
type: DirectoryOrCreate
247+
name: log-dir
248+
- hostPath:
249+
path: /var/run/aws-node
250+
type: DirectoryOrCreate
251+
name: run-dir
252+
- hostPath:
253+
path: /run/xtables.lock
254+
type: FileOrCreate
255+
name: xtables-lock
256+
updateStrategy:
257+
rollingUpdate:
258+
maxSurge: 0
259+
maxUnavailable: 10%
260+
type: RollingUpdate
261+
{{- end }}

‎cluster/manifests/01-aws-node/sa.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if eq .Cluster.Provider "zalando-eks"}}
2+
---
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
name: aws-node
7+
namespace: kube-system
8+
labels:
9+
application: kubernetes
10+
component: aws-node
11+
{{- end}}

‎cluster/manifests/coredns-local/configmap-local.yaml renamed to ‎cluster/manifests/01-coredns-local/configmap-local.yaml

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,20 +70,34 @@ data:
7070
log
7171
{{ end }}
7272
template IN A {
73+
{{- if and (eq .Cluster.Provider "zalando-eks") (eq .Cluster.ConfigItems.eks_ip_family "ipv6") }}
74+
rcode NOERROR
75+
{{- else}}
7376
match "^.*[.]ingress[.]cluster[.]local"
77+
{{- if eq .Cluster.Provider "zalando-eks" }}
78+
answer "{{"{{"}} .Name {{"}}"}} 60 IN A {{ nthAddressFromCIDR .Cluster.ConfigItems.service_cidr 50 }}"
79+
{{- else}}
7480
answer "{{"{{"}} .Name {{"}}"}} 60 IN A 10.5.99.99"
81+
{{- end}}
7582
fallthrough
83+
{{- end}}
7684
}
7785
template IN AAAA {
86+
{{- if and (eq .Cluster.Provider "zalando-eks") (eq .Cluster.ConfigItems.eks_ip_family "ipv6") }}
87+
match "^.*[.]ingress[.]cluster[.]local"
88+
answer "{{"{{"}} .Name {{"}}"}} 60 IN AAAA {{ nthAddressFromCIDR .Cluster.ConfigItems.service_cidr 50 }}"
89+
fallthrough
90+
{{- else}}
7891
rcode NOERROR
92+
{{- end}}
7993
}
8094
prometheus :9153
8195
ready :9155
8296
}
8397

8498
# Defines that this server is authority for reverse
8599
# lookups for these ranges.
86-
cluster.local:9254 10.2.0.0/15:9254 10.5.0.0/16:9254 {{ if eq .Cluster.ConfigItems.tracing_coredns_route_traces_to_local_zone "true"}}{{ range $src := split .Cluster.ConfigItems.tracing_coredns_global_traces_endpoint "," }}{{ $src }}:9254 {{ end }} {{ end }} {
100+
cluster.local:9254 {{if eq .Cluster.Provider "zalando-eks"}}in-addr.arpa:9254 ip6.arpa:9254{{else}}10.2.0.0/15:9254 10.5.0.0/16:9254{{end}} {{ if eq .Cluster.ConfigItems.tracing_coredns_route_traces_to_local_zone "true"}}{{ range $src := split .Cluster.ConfigItems.tracing_coredns_global_traces_endpoint "," }}{{ $src }}:9254 {{ end }} {{ end }} {
87101
errors
88102
{{ if eq .Cluster.ConfigItems.tracing_coredns_route_traces_to_local_zone "true"}}
89103
{{- with $cluster := .Cluster }}
@@ -94,6 +108,9 @@ data:
94108
{{ end }}
95109
kubernetes {
96110
pods insecure
111+
{{- if eq .Cluster.Provider "zalando-eks"}}
112+
fallthrough in-addr.arpa ip6.arpa
113+
{{- end}}
97114
}
98115
cache 30
99116
{{ if eq .Cluster.ConfigItems.coredns_log_svc_names "true"}}
@@ -118,7 +135,7 @@ data:
118135
{{ else }}
119136
forward . /etc/resolv.conf
120137
{{ end }}
121-
pprof 127.0.0.1:9156
138+
pprof :9156
122139
cache 30
123140
reload
124141
}

0 commit comments

Comments
 (0)