Merge pull request #905 from coresolve/fix_hostnet

bootkube/pkg/recovery/recover fix hostNetwork
kubernetes-retired · Feb 22, 2018 · c718cef · c718cef
2 parents 7b30ed1 + 506f4fb
commit c718cef
Show file tree

Hide file tree

Showing 2 changed files with 52 additions and 1 deletion.
diff --git a/pkg/recovery/recover.go b/pkg/recovery/recover.go
@@ -195,7 +195,10 @@ func fixUpBootstrapPods(pods []v1.Pod) (requiredConfigMaps, requiredSecrets map[
 			pod.Spec.SecurityContext.RunAsNonRoot = nil
 			pod.Spec.SecurityContext.RunAsUser = nil
 		}
-
+		// Fix hostNetwork: true because bootstrap assets can not rely on overlay networks.
+		if pod.Spec.HostNetwork == false {
+			pod.Spec.HostNetwork = true
+		}
 		// Change secret volumes to point to file mounts.
 		for i := range pod.Spec.Volumes {
 			vol := &pod.Spec.Volumes[i]

diff --git a/pkg/recovery/recover_test.go b/pkg/recovery/recover_test.go
@@ -197,6 +197,23 @@ func TestFixUpBootstrapPods(t *testing.T) {
 				VolumeSource: v1.VolumeSource{Secret: &v1.SecretVolumeSource{SecretName: "kube-apiserver"}},
 			}},
 		},
+	}, {
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Pod",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "bootstrap-kube-controller-manager",
+			Namespace: "kube-system",
+		},
+		Spec: v1.PodSpec{
+			SecurityContext: &v1.PodSecurityContext{RunAsNonRoot: boolPtr(true), RunAsUser: int64Ptr(65543)},
+			Containers: []v1.Container{{
+				Name:    "kube-controller-manager",
+				Image:   "quay.io/coreos/hyperkube:v1.6.4_coreos.0",
+				Command: []string{"/hyperkube", "controller-manager"},
+			}},
+		},
 	}, {
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "Pod",
@@ -215,6 +232,8 @@ func TestFixUpBootstrapPods(t *testing.T) {
 			}},
 		},
 	}}
+
+	// assertions go here:
 	wantPods := []v1.Pod{{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "Pod",
@@ -243,6 +262,7 @@ func TestFixUpBootstrapPods(t *testing.T) {
 					ReadOnly:  true,
 				}},
 			}},
+			HostNetwork: true,
 			Volumes: []v1.Volume{{
 				Name:         "ssl-certs-host",
 				VolumeSource: v1.VolumeSource{HostPath: &v1.HostPathVolumeSource{Path: "/usr/share/ca-certificates"}},
@@ -257,6 +277,33 @@ func TestFixUpBootstrapPods(t *testing.T) {
 				VolumeSource: v1.VolumeSource{HostPath: &v1.HostPathVolumeSource{Path: "/etc/kubernetes"}},
 			}},
 		},
+	}, {
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Pod",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "bootstrap-kube-controller-manager",
+			Namespace: "kube-system",
+		},
+		Spec: v1.PodSpec{
+			SecurityContext: &v1.PodSecurityContext{},
+			Containers: []v1.Container{{
+				Name:    "kube-controller-manager",
+				Image:   "quay.io/coreos/hyperkube:v1.6.4_coreos.0",
+				Command: []string{"/hyperkube", "controller-manager", "--kubeconfig=/kubeconfig/kubeconfig"},
+				VolumeMounts: []v1.VolumeMount{{
+					Name:      "kubeconfig",
+					MountPath: "/kubeconfig",
+					ReadOnly:  true,
+				}},
+			}},
+			HostNetwork: true,
+			Volumes: []v1.Volume{{
+				Name:         "kubeconfig",
+				VolumeSource: v1.VolumeSource{HostPath: &v1.HostPathVolumeSource{Path: "/etc/kubernetes"}},
+			}},
+		},
 	}, {
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "Pod",
@@ -278,6 +325,7 @@ func TestFixUpBootstrapPods(t *testing.T) {
 					ReadOnly:  true,
 				}},
 			}},
+			HostNetwork: true,
 			Volumes: []v1.Volume{{
 				Name:         "kubeconfig",
 				VolumeSource: v1.VolumeSource{HostPath: &v1.HostPathVolumeSource{Path: "/etc/kubernetes"}},