Skip to content
This repository has been archived by the owner on Jul 30, 2021. It is now read-only.

Disable Kubelet read-only port 10255 #1025

Closed
wants to merge 1 commit into from
Closed

Disable Kubelet read-only port 10255 #1025

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Documentation/network-requirements.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,5 +24,5 @@ The information below describes a minimum set of port allocations used by Kubern
| TCP | 4194 | Master & Worker Nodes | The port of the localhost cAdvisor endpoint |
| UDP | 4789 | Master & Worker Nodes | flannel overlay network - *vxlan backend* |
| TCP | 10250 | Master Nodes | Worker node Kubelet API for exec and logs. |
| TCP | 10255 | Master & Worker Nodes | Worker node read-only Kubelet API (Heapster). |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should leave this network requirement in but label it 'optional'. otherwise this lgtm and tests are passing.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated

| TCP | 10255 | Master & Worker Nodes | (Optional) Worker node read-only Kubelet API (Heapster). |
| TCP | 30000-32767 | External Application Consumers | Default port range for [external service][https://kubernetes.io/docs/concepts/services-networking/service] ports. Typically, these ports would need to be exposed to external load-balancers, or other external consumers of the application itself. |
1 change: 1 addition & 0 deletions hack/multi-node/user-data.sample
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ coreos:
--network-plugin=cni \
--node-labels=node-role.kubernetes.io/master \
--pod-manifest-path=/etc/kubernetes/manifests \
--read-only-port=0 \
--register-with-taints=node-role.kubernetes.io/master=:NoSchedule \
--rotate-certificates
ExecStop=-/usr/bin/rkt stop --uuid-file=/var/cache/kubelet-pod.uuid
Expand Down
1 change: 1 addition & 0 deletions hack/quickstart/kubelet.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ ExecStart=/usr/lib/coreos/kubelet-wrapper \
--network-plugin=cni \
--node-labels=${node_label} \
--pod-manifest-path=/etc/kubernetes/manifests \
--read-only-port=0 \
--register-with-taints=${node_taint} \
--rotate-certificates
ExecStop=-/usr/bin/rkt stop --uuid-file=/var/cache/kubelet-pod.uuid
Expand Down
1 change: 1 addition & 0 deletions hack/single-node/user-data.sample
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ coreos:
--network-plugin=cni \
--node-labels=node-role.kubernetes.io/master \
--pod-manifest-path=/etc/kubernetes/manifests \
--read-only-port=0 \
--rotate-certificates
ExecStop=-/usr/bin/rkt stop --uuid-file=/var/cache/kubelet-pod.uuid
Restart=always
Expand Down
2 changes: 2 additions & 0 deletions pkg/asset/asset.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ const (
AssetPathCheckpointerSA = "manifests/pod-checkpointer-sa.yaml"
AssetPathCheckpointerRole = "manifests/pod-checkpointer-role.yaml"
AssetPathCheckpointerRoleBinding = "manifests/pod-checkpointer-role-binding.yaml"
AssetPathCheckpointerClusterRole = "manifests/pod-checkpointer-cluster-role.yaml"
AssetPathCheckpointerClusterRoleBinding = "manifests/pod-checkpointer-cluster-role-binding.yaml"
AssetPathEtcdClientSecret = "manifests/etcd-client-tls.yaml"
AssetPathEtcdPeerSecret = "manifests/etcd-peer-tls.yaml"
AssetPathEtcdServerSecret = "manifests/etcd-server-tls.yaml"
Expand Down
24 changes: 24 additions & 0 deletions pkg/asset/internal/templates.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -373,6 +373,30 @@ subjects:
namespace: kube-system
`)

var CheckpointerClusterRole = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: pod-checkpointer
rules:
- apiGroups: [""]
resources: ["nodes", "nodes/proxy"]
verbs: ["get"]
`)

var CheckpointerClusterRoleBinding = []byte(`apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: pod-checkpointer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: pod-checkpointer
subjects:
- kind: ServiceAccount
name: pod-checkpointer
namespace: kube-system
`)

var ControllerManagerTemplate = []byte(`apiVersion: apps/v1
kind: Deployment
metadata:
Expand Down
2 changes: 2 additions & 0 deletions pkg/asset/k8s.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ func newStaticAssets(imageVersions ImageVersions) Assets {
MustCreateAssetFromTemplate(AssetPathCheckpointerSA, internal.CheckpointerServiceAccount, conf),
MustCreateAssetFromTemplate(AssetPathCheckpointerRole, internal.CheckpointerRole, conf),
MustCreateAssetFromTemplate(AssetPathCheckpointerRoleBinding, internal.CheckpointerRoleBinding, conf),
MustCreateAssetFromTemplate(AssetPathCheckpointerClusterRole, internal.CheckpointerClusterRole, conf),
MustCreateAssetFromTemplate(AssetPathCheckpointerClusterRoleBinding, internal.CheckpointerClusterRoleBinding, conf),
MustCreateAssetFromTemplate(AssetPathCSRApproverRoleBinding, internal.CSRApproverRoleBindingTemplate, conf),
MustCreateAssetFromTemplate(AssetPathCSRBootstrapRoleBinding, internal.CSRNodeBootstrapTemplate, conf),
MustCreateAssetFromTemplate(AssetPathCSRRenewalRoleBinding, internal.CSRRenewalRoleBindingTemplate, conf),
Expand Down