zalando-incubator · mikkeloscar · Sep 12, 2018 · Jun 26, 2018 · Jun 28, 2018 · Jul 3, 2018
diff --git a/cluster/cluster.yaml b/cluster/cluster.yaml
@@ -135,10 +135,6 @@ Resources:
           FromPort: 30080
           IpProtocol: tcp
           ToPort: 30080
-        - CidrIp: "{{.Values.vpc_ipv4_cidr}}"
-          FromPort: 4194
-          IpProtocol: tcp
-          ToPort: 4194
         - CidrIp: "{{.Values.vpc_ipv4_cidr}}"
           FromPort: 9054
           IpProtocol: tcp

diff --git a/cluster/config-defaults.yaml b/cluster/config-defaults.yaml
@@ -10,6 +10,13 @@ autoscaling_buffer_pods: "1"
 autoscaling_buffer_pods: "0"
 {{end}}
 
+# lightstep
+{{if eq .Environment "production"}}
+lightstep_token: "aws:kms:AQICAHgrx06TPoR1aNmcPHJjFu5mmoICT5KJkx2fsTJpmXmbNAH+8Ml18b8ZkUO/0KAwtIZTAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMSf79AuT/RI5rvWWjAgEQgDuN7obV7JD4iBMnOJ4Th93DfM5j572dXjf+gWmHx4JKMTTJPX2w6hgfQXX3LjI49l0p479a6IXIlZJOSg=="
+{{else}}
+lightstep_token: "aws:kms:AQICAHgrx06TPoR1aNmcPHJjFu5mmoICT5KJkx2fsTJpmXmbNAHvvYXdV1r7NviF5S+Jyx5zAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMQBqSQk/2TuQOsHGOAgEQgDsrNbCwF4AxoQXZuxXUOPnuQhFCY02EhWcB4xqmjFy8DelZtiCldRtxRdLyDL4uXiEyV8vOFyhxgqso/A=="
+{{end}}
+
 # tokeninfo
 {{if eq .Environment "production"}}
 tokeninfo_url: "https://info.services.auth.zalando.com/oauth2/tokeninfo"

diff --git a/cluster/manifests/cadvisor/daemonset.yaml b/cluster/manifests/cadvisor/daemonset.yaml
@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: cadvisor
+  namespace: kube-system
+  labels:
+    application: cadvisor
+    version: v0.30.2
+spec:
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      application: cadvisor
+  template:
+    metadata:
+      labels:
+        application: cadvisor
+        version: v0.30.2
+    spec:
+      priorityClassName: system-node-critical
+      containers:
+      - name: cadvisor
+        image: registry.opensource.zalan.do/teapot/cadvisor:v0.30.2
+        args:
+        - --housekeeping_interval=10s
+        - --max_housekeeping_interval=15s
+        - --event_storage_event_limit=default=0
+        - --event_storage_age_limit=default=0
+        - --disable_metrics=percpu,tcp,udp
+        - --docker_only
+        resources:
+          requests:
+            memory: 150Mi
+            cpu: 150m
+          limits:
+            memory: 150Mi
+            cpu: 150m
+        volumeMounts:
+        - name: rootfs
+          mountPath: /rootfs
+          readOnly: true
+        - name: var-run
+          mountPath: /var/run
+          readOnly: true
+        - name: sys
+          mountPath: /sys
+          readOnly: true
+        - name: docker
+          mountPath: /var/lib/docker
+          readOnly: true
+        ports:
+        - name: http
+          containerPort: 8080
+          protocol: TCP
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: rootfs
+        hostPath:
+          path: /
+      - name: var-run
+        hostPath:
+          path: /var/run
+      - name: sys
+        hostPath:
+          path: /sys
+      - name: docker
+        hostPath:
+          path: /var/lib/docker
+      tolerations:
+      - operator: Exists
+        effect: NoSchedule
+      - operator: Exists
+        effect: NoExecute
diff --git a/cluster/manifests/cadvisor/service.yaml b/cluster/manifests/cadvisor/service.yaml
@@ -0,0 +1,15 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: cadvisor
+  namespace: kube-system
+  labels:
+    application: cadvisor
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    application: cadvisor
diff --git a/cluster/manifests/coredns/deployment-coredns.yaml b/cluster/manifests/coredns/deployment-coredns.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: coredns
-    version: v1.1.3
+    version: v1.2.0
     kubernetes.io/cluster-service: "true"
     kubernetes.io/name: "CoreDNS"
     component: cluster-dns
@@ -22,7 +22,7 @@ spec:
     metadata:
       labels:
         application: coredns
-        version: v1.1.3
+        version: v1.2.0
         component: cluster-dns
     spec:
       affinity:
@@ -48,7 +48,7 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers:
       - name: coredns
-        image: registry.opensource.zalan.do/teapot/coredns:1.1.3
+        image: registry.opensource.zalan.do/teapot/coredns:1.2.0
         resources:
           requests:
             cpu: 250m

diff --git a/cluster/manifests/etcd-backup/cronjob.yaml b/cluster/manifests/etcd-backup/cronjob.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: etcd-backup
-    version: "master-5"
+    version: "master-9"
 spec:
   schedule: "23 * * * *"
   concurrencyPolicy: Forbid
@@ -16,15 +16,15 @@ spec:
         metadata:
           labels:
             application: etcd-backup
-            version: "master-5"
+            version: "master-9"
           annotations:
             iam.amazonaws.com/role: "{{ .LocalID }}-etcd-backup"
         spec:
           priorityClassName: system-cluster-critical
           restartPolicy: Never
           containers:
           - name: etcd-backup
-            image: pierone.stups.zalan.do/teapot/etcd-backup:master-5
+            image: pierone.stups.zalan.do/teapot/etcd-backup:master-9
             env:
             - name: ETCD_S3_BACKUP_BUCKET
               value: "{{ .ConfigItems.etcd_s3_backup_bucket }}"

diff --git a/cluster/manifests/heapster/deployment.yaml b/cluster/manifests/heapster/deployment.yaml
@@ -6,7 +6,7 @@ metadata:
   labels:
     application: heapster
     kubernetes.io/cluster-service: "true"
-    version: v1.5.2
+    version: v1.5.4
 spec:
   replicas: 1
   selector:
@@ -16,12 +16,12 @@ spec:
     metadata:
       labels:
         application: heapster
-        version: v1.5.2
+        version: v1.5.4
     spec:
       priorityClassName: system-cluster-critical
       serviceAccountName: system
       containers:
-        - image: registry.opensource.zalan.do/teapot/heapster:v1.5.2
+        - image: registry.opensource.zalan.do/teapot/heapster:v1.5.4
           name: heapster
           livenessProbe:
             httpGet:

diff --git a/cluster/manifests/ingress-controller/deployment.yaml b/cluster/manifests/ingress-controller/deployment.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: kube-ingress-aws-controller
-    version: v0.7.3
+    version: v0.7.4
 spec:
   replicas: 1
   selector:
@@ -15,15 +15,15 @@ spec:
     metadata:
       labels:
         application: kube-ingress-aws-controller
-        version: v0.7.3
+        version: v0.7.4
       annotations:
         iam.amazonaws.com/role: "{{ .LocalID }}-app-ingr-ctrl"
     spec:
       priorityClassName: system-cluster-critical
       serviceAccountName: system
       containers:
       - name: controller
-        image: registry.opensource.zalan.do/teapot/kube-ingress-aws-controller:v0.7.3
+        image: registry.opensource.zalan.do/teapot/kube-ingress-aws-controller:v0.7.4
         args:
         - -stack-termination-protection
         env:

diff --git a/cluster/manifests/kube-cluster-autoscaler/daemonset.yaml b/cluster/manifests/kube-cluster-autoscaler/daemonset.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: kube-cluster-autoscaler
-    version: v1.2.2-teapot14
+    version: v1.3.1-teapot16
 spec:
   selector:
     matchLabels:
@@ -16,7 +16,7 @@ spec:
     metadata:
       labels:
         application: kube-cluster-autoscaler
-        version: v1.2.2-teapot14
+        version: v1.3.1-teapot16
       annotations:
         iam.amazonaws.com/role: "{{ .LocalID }}-app-autoscaler"
         config/pool-sizes: "{{range .NodePools}}{{.Name}}-{{.MinSize}}-{{.MaxSize}} {{end}}"
@@ -29,7 +29,7 @@ spec:
         effect: NoSchedule
       containers:
       - name: cluster-autoscaler
-        image: registry.opensource.zalan.do/teapot/kube-cluster-autoscaler-custom:v1.2.2-teapot14
+        image: registry.opensource.zalan.do/teapot/kube-cluster-autoscaler-custom:v1.3.1-teapot16
         command:
           - ./cluster-autoscaler
           - --v=4

diff --git a/cluster/manifests/kube-proxy/configmap.yaml b/cluster/manifests/kube-proxy/configmap.yaml
@@ -24,9 +24,7 @@ data:
       tcpEstablishedTimeout: 24h0m0s
     enableProfiling: false
     featureGates:
-      ExperimentalCriticalPodAnnotation: true
       TaintBasedEvictions: true
-      PodPriority: true
     healthzBindAddress: 0.0.0.0:10256
     hostnameOverride: ""
     iptables:
@@ -44,4 +42,4 @@ data:
     oomScoreAdj: -999
     portRange: ""
     resourceContainer: /kube-proxy
-    udpTimeoutMilliseconds: 250ms
+    udpIdleTimeout: 250ms
diff --git a/cluster/manifests/kube-proxy/daemonset.yaml b/cluster/manifests/kube-proxy/daemonset.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: kube-proxy
-    version: v1.10.5
+    version: v1.11.3
 spec:
   selector:
     matchLabels:
@@ -17,7 +17,7 @@ spec:
       name: kube-proxy
       labels:
         application: kube-proxy
-        version: v1.10.5
+        version: v1.11.3
       annotations:
         config/hash: {{"configmap.yaml" | manifestHash}}
     spec:
@@ -30,7 +30,7 @@ spec:
       hostNetwork: true
       containers:
       - name: kube-proxy
-        image: registry.opensource.zalan.do/teapot/hyperkube:v1.10.5
+        image: registry.opensource.zalan.do/teapot/hyperkube:v1.11.3
         command:
         - /hyperkube
         - proxy

diff --git a/cluster/manifests/prometheus/configmap.yaml b/cluster/manifests/prometheus/configmap.yaml
@@ -92,21 +92,40 @@ data:
       - action: replace
         source_labels: ['__meta_kubernetes_pod_node_name']
         target_label: node_name
-    - job_name: 'kubelet-cadvisor'
+    - job_name: 'cadvisor'
+      scheme: http
+      honor_labels: true
       kubernetes_sd_configs:
-      - role: node
+      - role: endpoints
+        namespaces:
+          names:
+            - kube-system
+      relabel_configs:
+      - source_labels: [__meta_kubernetes_endpoints_name]
+        action: keep
+        regex: cadvisor
+      - action: replace
+        source_labels: ['__meta_kubernetes_pod_node_name']
+        target_label: node_name
       metric_relabel_configs:
+      - action: replace
+        source_labels: ['container_label_application']
+        target_label: application
+      - action: replace
+        source_labels: ['container_label_io_kubernetes_container_name']
+        target_label: container_name
+      - action: replace
+        source_labels: ['container_label_io_kubernetes_pod_name']
+        target_label: pod_name
+      - action: replace
+        source_labels: ['container_label_io_kubernetes_pod_namespace']
+        target_label: namespace
+      - action: replace
+        source_labels: ['container_label_io_kubernetes_pod_uid']
+        target_label: uid
       - source_labels: [__name__]
         action: keep
         regex: '(container_cpu_cfs_throttled_seconds_total|container_cpu_usage_seconds_total|container_memory_working_set_bytes|container_network_receive_bytes_total|container_network_transmit_bytes_total)'
-      relabel_configs:
-      - source_labels: [__meta_kubernetes_node_address_InternalIP]
-        target_label: __address__
-        regex: (.*)
-        replacement: $1:4194
-      - action: replace
-        source_labels: [instance]
-        target_label: node_name
     - job_name: 'kubelet-metrics'
       kubernetes_sd_configs:
       - role: node

diff --git a/cluster/manifests/skipper/daemonset.yaml b/cluster/manifests/skipper/daemonset.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
   labels:
     application: skipper-ingress
-    version: v0.10.59
+    version: v0.10.80
     component: ingress
 spec:
   selector:
@@ -18,7 +18,7 @@ spec:
       name: skipper-ingress
       labels:
         application: skipper-ingress
-        version: v0.10.59
+        version: v0.10.80
         component: ingress
       annotations:
         kubernetes-log-watcher/scalyr-parser: |
@@ -33,13 +33,18 @@ spec:
       hostNetwork: true
       containers:
       - name: skipper-ingress
-        image: registry.opensource.zalan.do/pathfinder/skipper:v0.10.59
+        image: registry.opensource.zalan.do/pathfinder/skipper-lightstep:v0.10.80
         ports:
         - name: ingress-port
           containerPort: 9999
           hostPort: 9999
+        env:
+        - name: LIGHTSTEP_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: skipper-ingress
+              key: lightstep-token
         args:
-          - "skipper"
           - "-kubernetes"
           - "-kubernetes-in-cluster"
           - "-kubernetes-path-mode=path-prefix"
@@ -55,6 +60,7 @@ spec:
           - "-enable-connection-metrics"
           - "-oauth2-tokeninfo-url={{ .ConfigItems.tokeninfo_url }}"
           - "-histogram-metric-buckets=.01,.025,.05,.075,.1,.2,.3,.4,.5,.75,1,2,3,4,5,7,10,15,20,30,60,120,300,600"
+          - "-opentracing=tracing_lightstep component-name=skipper-ingress token=$(LIGHTSTEP_TOKEN) collector=tracing.zmon.zalan.do:8444 cmd-line=skipper-ingress max-buffered-spans=4096"
         resources:
           limits:
             memory: 200Mi