Add support for Calico, use RBAC and secrets encryption.

21repierre commented 11 months ago

Add support for Calico (#152)
Starts kube-apiserver with RBAC (#166)
Use secretbox encryption for secrets by default

Tested with a single node cluster on Centos 9.

AkihiroSuda commented 11 months ago

Do you plan to add a test? https://github.com/rootless-containers/usernetes/pull/283#discussion_r1268955129

21repierre commented 10 months ago

Do you plan to add a test? #283 (comment)

I have tried to work on that by making a similar test to the flannel one (replacing flannel by calico in the docker-compose file and publishing ports according to the calico requirements), however I wasn't able to make it work. It seems that the nodes can't reach the master:

Logs from calico-kube-controller running on node-crio: 2023-08-18 08:48:29.468 [INFO][1] main.go 138: Failed to initialize datastore error=Get "https://10.0.0.1:443/apis/crd.projectcalico.org/v1/clusterinformations/default": dial tcp 10.0.0.1:443: i/o timeout
Logs from coredns running on node-containerd: [ERROR] plugin/errors: 2 6277665988150219199.6938599929280645902. HINFO: read udp 10.0.100.194:37370->10.0.102.3:53: i/o timeout
Trying to curl the kubernetes API from a node also results on a timeout: curl: (7) Failed to connect to 10.0.100.100 port 6443 after 94953 ms: Couldn't connect to server

I'm not sure where the issue might come from.

rootless-containers / usernetes

Add support for Calico, use RBAC and secrets encryption. #283