Skip to content
  1. Mar 01, 2017
    • Artem Panchenko's avatar
      Allow connections from pods to local endpoints · fa05d150
      Artem Panchenko authored
      By default Calico blocks traffic from endpoints
      to the host itself by using an iptables DROP
      action. It could lead to a situation when service
      has one alive endpoint, but pods which run on
      the same node can not access it. Changed the action
      to RETURN.
      fa05d150
  2. Feb 28, 2017
  3. Feb 26, 2017
  4. Feb 23, 2017
  5. Feb 18, 2017
  6. Feb 17, 2017
  7. Feb 16, 2017
    • Matthew Mosesohn's avatar
      Add graceful upgrade process · 97ebbb96
      Matthew Mosesohn authored
      Based on #718 introduced by rsmitty.
      
      Includes all roles and all options to support deployment of
      new hosts in case they were added to inventory.
      
      Main difference here is that master role is evaluated first
      so that master components get upgraded first.
      
      Fixes #694
      97ebbb96
  8. Feb 15, 2017
  9. Feb 14, 2017
  10. Feb 10, 2017
  11. Feb 09, 2017
  12. Feb 07, 2017
  13. Feb 06, 2017
  14. Feb 05, 2017
  15. Jan 20, 2017
    • Bogdan Dobrelya's avatar
      Drop linux capabilities and rework users/groups · cb2e5ac7
      Bogdan Dobrelya authored
      
      
      * Drop linux capabilities for unprivileged containerized
        worlkoads Kargo configures for deployments.
      * Configure required securityContext/user/group/groups for kube
        components' static manifests, etcd, calico-rr and k8s apps,
        like dnsmasq daemonset.
      * Rework cloud-init (etcd) users creation for CoreOS.
      * Fix nologin paths, adjust defaults for addusers role and ensure
        supplementary groups membership added for users.
      * Add netplug user for network plugins (yet unused by privileged
        networking containers though).
      * Grant the kube and netplug users read access for etcd certs via
        the etcd certs group.
      * Grant group read access to kube certs via the kube cert group.
      * Remove priveleged mode for calico-rr and run it under its uid/gid
        and supplementary etcd_cert group.
      * Adjust docs.
      * Align cpu/memory limits and dropped caps with added rkt support
        for control plane.
      
      Signed-off-by: default avatarBogdan Dobrelya <bogdando@mail.ru>
      cb2e5ac7
  16. Jan 19, 2017
    • Matthew Mosesohn's avatar
      Add scale thresholds to split etcd and k8s-masters · f742fc3d
      Matthew Mosesohn authored
      Also adds calico-rr group if there are standalone etcd nodes.
      Now if there are 50 or more nodes, 3 etcd nodes will be standalone.
      If there are 200 or more nodes, 2 kube-masters will be standalone.
      If thresholds are exceeded, kube-node group cannot add nodes that
      belong to etcd or kube-master groups (according to above statements).
      f742fc3d
  17. Jan 17, 2017
  18. Jan 11, 2017
  19. Jan 10, 2017
  20. Jan 09, 2017
  21. Jan 06, 2017
  22. Jan 02, 2017
  23. Dec 29, 2016
  24. Dec 28, 2016
  25. Dec 23, 2016
  26. Dec 22, 2016
  27. Dec 21, 2016
  28. Dec 20, 2016
Loading