{"action":"closed","number":336,"pull_request":{"url":"https://api.github.com/repos/gardener/gardener/pulls/336","id":210495983,"node_id":"MDExOlB1bGxSZXF1ZXN0MjEwNDk1OTgz","html_url":"https://github.com/gardener/gardener/pull/336","diff_url":"https://github.com/gardener/gardener/pull/336.diff","patch_url":"https://github.com/gardener/gardener/pull/336.patch","issue_url":"https://api.github.com/repos/gardener/gardener/issues/336","number":336,"state":"closed","locked":false,"title":"Deploy Kubernetes cloud controller manager as part of a Shoot's control plane","user":{"login":"rfranzke","id":19169361,"node_id":"MDQ6VXNlcjE5MTY5MzYx","avatar_url":"https://avatars1.githubusercontent.com/u/19169361?v=4","gravatar_id":"","url":"https://api.github.com/users/rfranzke","html_url":"https://github.com/rfranzke","followers_url":"https://api.github.com/users/rfranzke/followers","following_url":"https://api.github.com/users/rfranzke/following{/other_user}","gists_url":"https://api.github.com/users/rfranzke/gists{/gist_id}","starred_url":"https://api.github.com/users/rfranzke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfranzke/subscriptions","organizations_url":"https://api.github.com/users/rfranzke/orgs","repos_url":"https://api.github.com/users/rfranzke/repos","events_url":"https://api.github.com/users/rfranzke/events{/privacy}","received_events_url":"https://api.github.com/users/rfranzke/received_events","type":"User","site_admin":false},"body":"**What this PR does / why we need it**: With this PR Gardener will deploy the Kubernetes cloud-controller-manager next to the other control plane components of a Shoot cluster into the Seed. We can now block access to the metadata service for the kube-apiserver pod as it does no longer talk to the cloud API anymore.\r\nUnfortunately, we cannot restrict access for the kube-controller-manager and the kubelet yet:\r\n* The kube-controller-manager needs to talk to the cloud provider for provisioning/deprovisioning and attaching/detaching volumes (as we do not have CSI yet). However, the service, route, and node controller was moved from KCM to CCM.\r\n* The kubelet needs to talk to the cloud provider for mounting the volumes properly (as we do not have CSI yet).\r\n\r\nIn the future, when we have CSI, we can hopefully also restrict the kube-controller-manager and the kubelet from talking to the cloud API.\r\n\r\n**Which issue(s) this PR fixes**:\r\nFixes #325 \r\n\r\n**Special notes for your reviewer**:\r\nI've verified the functionality for all cloud providers (AWS, Azure, GCP, OpenStack) for Kubernetes 1.9 - 1.11.\r\n\r\n**Release note**:\r\n<!--  Write your release note:\r\n1. Enter your release note in the below block.\r\n2. If no release note is required, just write \"NONE\" within the block.\r\n\r\nFormat of block header: <category> <target_group>\r\nPossible values:\r\n- category:       improvement|noteworthy\r\n- target_group:   user|operator\r\n-->\r\n```noteworthy operator\r\nThe Kubernetes cloud controller manager gets now deployed as part of a Shoot's control plane in the Seed cluster. It is responsible for provisioning load balancers and routes, sets cloud-specific labels on persistent volumes, and initializes nodes. The kube-apiserver of a Shoot is now completely blocked from accessing the cloud's metadata service IP and does no longer mount the customer's cloud provider secret.\r\n```\r\n","created_at":"2018-08-23T15:53:31Z","updated_at":"2018-09-10T16:13:07Z","closed_at":"2018-09-10T16:13:07Z","merged_at":"2018-09-10T16:13:07Z","merge_commit_sha":"fdf5d099140ca1f186edaa43d1700980698431a0","assignee":null,"assignees":[],"requested_reviewers":[{"login":"dkistner","id":4513134,"node_id":"MDQ6VXNlcjQ1MTMxMzQ=","avatar_url":"https://avatars3.githubusercontent.com/u/4513134?v=4","gravatar_id":"","url":"https://api.github.com/users/dkistner","html_url":"https://github.com/dkistner","followers_url":"https://api.github.com/users/dkistner/followers","following_url":"https://api.github.com/users/dkistner/following{/other_user}","gists_url":"https://api.github.com/users/dkistner/gists{/gist_id}","starred_url":"https://api.github.com/users/dkistner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkistner/subscriptions","organizations_url":"https://api.github.com/users/dkistner/orgs","repos_url":"https://api.github.com/users/dkistner/repos","events_url":"https://api.github.com/users/dkistner/events{/privacy}","received_events_url":"https://api.github.com/users/dkistner/received_events","type":"User","site_admin":false},{"login":"mvladev","id":33343952,"node_id":"MDQ6VXNlcjMzMzQzOTUy","avatar_url":"https://avatars1.githubusercontent.com/u/33343952?v=4","gravatar_id":"","url":"https://api.github.com/users/mvladev","html_url":"https://github.com/mvladev","followers_url":"https://api.github.com/users/mvladev/followers","following_url":"https://api.github.com/users/mvladev/following{/other_user}","gists_url":"https://api.github.com/users/mvladev/gists{/gist_id}","starred_url":"https://api.github.com/users/mvladev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mvladev/subscriptions","organizations_url":"https://api.github.com/users/mvladev/orgs","repos_url":"https://api.github.com/users/mvladev/repos","events_url":"https://api.github.com/users/mvladev/events{/privacy}","received_events_url":"https://api.github.com/users/mvladev/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":943543523,"node_id":"MDU6TGFiZWw5NDM1NDM1MjM=","url":"https://api.github.com/repos/gardener/gardener/labels/area/scalability","name":"area/scalability","color":"0052cc","default":false},{"id":943532103,"node_id":"MDU6TGFiZWw5NDM1MzIxMDM=","url":"https://api.github.com/repos/gardener/gardener/labels/area/security","name":"area/security","color":"0052cc","default":false},{"id":943541331,"node_id":"MDU6TGFiZWw5NDM1NDEzMzE=","url":"https://api.github.com/repos/gardener/gardener/labels/exp/expert","name":"exp/expert","color":"d4c5f9","default":false},{"id":803913465,"node_id":"MDU6TGFiZWw4MDM5MTM0NjU=","url":"https://api.github.com/repos/gardener/gardener/labels/kind/enhancement","name":"kind/enhancement","color":"c7def8","default":false},{"id":943540312,"node_id":"MDU6TGFiZWw5NDM1NDAzMTI=","url":"https://api.github.com/repos/gardener/gardener/labels/platform/all","name":"platform/all","color":"006b75","default":false},{"id":943546562,"node_id":"MDU6TGFiZWw5NDM1NDY1NjI=","url":"https://api.github.com/repos/gardener/gardener/labels/priority/normal","name":"priority/normal","color":"4cceb8","default":false},{"id":943541096,"node_id":"MDU6TGFiZWw5NDM1NDEwOTY=","url":"https://api.github.com/repos/gardener/gardener/labels/size/m","name":"size/m","color":"bfdadc","default":false},{"id":943538324,"node_id":"MDU6TGFiZWw5NDM1MzgzMjQ=","url":"https://api.github.com/repos/gardener/gardener/labels/status/accepted","name":"status/accepted","color":"fef2c0","default":false},{"id":943547346,"node_id":"MDU6TGFiZWw5NDM1NDczNDY=","url":"https://api.github.com/repos/gardener/gardener/labels/topology/seed","name":"topology/seed","color":"009f76","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/gardener/gardener/pulls/336/commits","review_comments_url":"https://api.github.com/repos/gardener/gardener/pulls/336/comments","review_comment_url":"https://api.github.com/repos/gardener/gardener/pulls/comments{/number}","comments_url":"https://api.github.com/repos/gardener/gardener/issues/336/comments","statuses_url":"https://api.github.com/repos/gardener/gardener/statuses/c976a5ec635f45c21c1dc39a9bbbd4aadf9a1e46","head":{"label":"rfranzke:feature/cloud-controller-manager","ref":"feature/cloud-controller-manager","sha":"c976a5ec635f45c21c1dc39a9bbbd4aadf9a1e46","user":{"login":"rfranzke","id":19169361,"node_id":"MDQ6VXNlcjE5MTY5MzYx","avatar_url":"https://avatars1.githubusercontent.com/u/19169361?v=4","gravatar_id":"","url":"https://api.github.com/users/rfranzke","html_url":"https://github.com/rfranzke","followers_url":"https://api.github.com/users/rfranzke/followers","following_url":"https://api.github.com/users/rfranzke/following{/other_user}","gists_url":"https://api.github.com/users/rfranzke/gists{/gist_id}","starred_url":"https://api.github.com/users/rfranzke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfranzke/subscriptions","organizations_url":"https://api.github.com/users/rfranzke/orgs","repos_url":"https://api.github.com/users/rfranzke/repos","events_url":"https://api.github.com/users/rfranzke/events{/privacy}","received_events_url":"https://api.github.com/users/rfranzke/received_events","type":"User","site_admin":false},"repo":{"id":117505930,"node_id":"MDEwOlJlcG9zaXRvcnkxMTc1MDU5MzA=","name":"gardener","full_name":"rfranzke/gardener","owner":{"login":"rfranzke","id":19169361,"node_id":"MDQ6VXNlcjE5MTY5MzYx","avatar_url":"https://avatars1.githubusercontent.com/u/19169361?v=4","gravatar_id":"","url":"https://api.github.com/users/rfranzke","html_url":"https://github.com/rfranzke","followers_url":"https://api.github.com/users/rfranzke/followers","following_url":"https://api.github.com/users/rfranzke/following{/other_user}","gists_url":"https://api.github.com/users/rfranzke/gists{/gist_id}","starred_url":"https://api.github.com/users/rfranzke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfranzke/subscriptions","organizations_url":"https://api.github.com/users/rfranzke/orgs","repos_url":"https://api.github.com/users/rfranzke/repos","events_url":"https://api.github.com/users/rfranzke/events{/privacy}","received_events_url":"https://api.github.com/users/rfranzke/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rfranzke/gardener","description":"Kubernetes extension which manages Shoot (Kubernetes) clusters on various Cloud infrastructure providers.","fork":true,"url":"https://api.github.com/repos/rfranzke/gardener","forks_url":"https://api.github.com/repos/rfranzke/gardener/forks","keys_url":"https://api.github.com/repos/rfranzke/gardener/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rfranzke/gardener/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rfranzke/gardener/teams","hooks_url":"https://api.github.com/repos/rfranzke/gardener/hooks","issue_events_url":"https://api.github.com/repos/rfranzke/gardener/issues/events{/number}","events_url":"https://api.github.com/repos/rfranzke/gardener/events","assignees_url":"https://api.github.com/repos/rfranzke/gardener/assignees{/user}","branches_url":"https://api.github.com/repos/rfranzke/gardener/branches{/branch}","tags_url":"https://api.github.com/repos/rfranzke/gardener/tags","blobs_url":"https://api.github.com/repos/rfranzke/gardener/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rfranzke/gardener/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rfranzke/gardener/git/refs{/sha}","trees_url":"https://api.github.com/repos/rfranzke/gardener/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rfranzke/gardener/statuses/{sha}","languages_url":"https://api.github.com/repos/rfranzke/gardener/languages","stargazers_url":"https://api.github.com/repos/rfranzke/gardener/stargazers","contributors_url":"https://api.github.com/repos/rfranzke/gardener/contributors","subscribers_url":"https://api.github.com/repos/rfranzke/gardener/subscribers","subscription_url":"https://api.github.com/repos/rfranzke/gardener/subscription","commits_url":"https://api.github.com/repos/rfranzke/gardener/commits{/sha}","git_commits_url":"https://api.github.com/repos/rfranzke/gardener/git/commits{/sha}","comments_url":"https://api.github.com/repos/rfranzke/gardener/comments{/number}","issue_comment_url":"https://api.github.com/repos/rfranzke/gardener/issues/comments{/number}","contents_url":"https://api.github.com/repos/rfranzke/gardener/contents/{+path}","compare_url":"https://api.github.com/repos/rfranzke/gardener/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rfranzke/gardener/merges","archive_url":"https://api.github.com/repos/rfranzke/gardener/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rfranzke/gardener/downloads","issues_url":"https://api.github.com/repos/rfranzke/gardener/issues{/number}","pulls_url":"https://api.github.com/repos/rfranzke/gardener/pulls{/number}","milestones_url":"https://api.github.com/repos/rfranzke/gardener/milestones{/number}","notifications_url":"https://api.github.com/repos/rfranzke/gardener/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rfranzke/gardener/labels{/name}","releases_url":"https://api.github.com/repos/rfranzke/gardener/releases{/id}","deployments_url":"https://api.github.com/repos/rfranzke/gardener/deployments","created_at":"2018-01-15T06:27:02Z","updated_at":"2018-09-10T15:33:27Z","pushed_at":"2018-09-10T15:33:25Z","git_url":"git://github.com/rfranzke/gardener.git","ssh_url":"git@github.com:rfranzke/gardener.git","clone_url":"https://github.com/rfranzke/gardener.git","svn_url":"https://github.com/rfranzke/gardener","homepage":"","size":15707,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"gardener:master","ref":"master","sha":"7db79eb6dd16dede89fce75433a9f2e770ed0c81","user":{"login":"gardener","id":33683699,"node_id":"MDEyOk9yZ2FuaXphdGlvbjMzNjgzNjk5","avatar_url":"https://avatars2.githubusercontent.com/u/33683699?v=4","gravatar_id":"","url":"https://api.github.com/users/gardener","html_url":"https://github.com/gardener","followers_url":"https://api.github.com/users/gardener/followers","following_url":"https://api.github.com/users/gardener/following{/other_user}","gists_url":"https://api.github.com/users/gardener/gists{/gist_id}","starred_url":"https://api.github.com/users/gardener/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gardener/subscriptions","organizations_url":"https://api.github.com/users/gardener/orgs","repos_url":"https://api.github.com/users/gardener/repos","events_url":"https://api.github.com/users/gardener/events{/privacy}","received_events_url":"https://api.github.com/users/gardener/received_events","type":"Organization","site_admin":false},"repo":{"id":117377862,"node_id":"MDEwOlJlcG9zaXRvcnkxMTczNzc4NjI=","name":"gardener","full_name":"gardener/gardener","owner":{"login":"gardener","id":33683699,"node_id":"MDEyOk9yZ2FuaXphdGlvbjMzNjgzNjk5","avatar_url":"https://avatars2.githubusercontent.com/u/33683699?v=4","gravatar_id":"","url":"https://api.github.com/users/gardener","html_url":"https://github.com/gardener","followers_url":"https://api.github.com/users/gardener/followers","following_url":"https://api.github.com/users/gardener/following{/other_user}","gists_url":"https://api.github.com/users/gardener/gists{/gist_id}","starred_url":"https://api.github.com/users/gardener/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gardener/subscriptions","organizations_url":"https://api.github.com/users/gardener/orgs","repos_url":"https://api.github.com/users/gardener/repos","events_url":"https://api.github.com/users/gardener/events{/privacy}","received_events_url":"https://api.github.com/users/gardener/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/gardener/gardener","description":"Kubernetes API server extension and controller manager managing the full lifecycle of conformant Kubernetes clusters (Shoots) as a service on AWS, Azure, GCP, and OpenStack.","fork":false,"url":"https://api.github.com/repos/gardener/gardener","forks_url":"https://api.github.com/repos/gardener/gardener/forks","keys_url":"https://api.github.com/repos/gardener/gardener/keys{/key_id}","collaborators_url":"https://api.github.com/repos/gardener/gardener/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/gardener/gardener/teams","hooks_url":"https://api.github.com/repos/gardener/gardener/hooks","issue_events_url":"https://api.github.com/repos/gardener/gardener/issues/events{/number}","events_url":"https://api.github.com/repos/gardener/gardener/events","assignees_url":"https://api.github.com/repos/gardener/gardener/assignees{/user}","branches_url":"https://api.github.com/repos/gardener/gardener/branches{/branch}","tags_url":"https://api.github.com/repos/gardener/gardener/tags","blobs_url":"https://api.github.com/repos/gardener/gardener/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/gardener/gardener/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/gardener/gardener/git/refs{/sha}","trees_url":"https://api.github.com/repos/gardener/gardener/git/trees{/sha}","statuses_url":"https://api.github.com/repos/gardener/gardener/statuses/{sha}","languages_url":"https://api.github.com/repos/gardener/gardener/languages","stargazers_url":"https://api.github.com/repos/gardener/gardener/stargazers","contributors_url":"https://api.github.com/repos/gardener/gardener/contributors","subscribers_url":"https://api.github.com/repos/gardener/gardener/subscribers","subscription_url":"https://api.github.com/repos/gardener/gardener/subscription","commits_url":"https://api.github.com/repos/gardener/gardener/commits{/sha}","git_commits_url":"https://api.github.com/repos/gardener/gardener/git/commits{/sha}","comments_url":"https://api.github.com/repos/gardener/gardener/comments{/number}","issue_comment_url":"https://api.github.com/repos/gardener/gardener/issues/comments{/number}","contents_url":"https://api.github.com/repos/gardener/gardener/contents/{+path}","compare_url":"https://api.github.com/repos/gardener/gardener/compare/{base}...{head}","merges_url":"https://api.github.com/repos/gardener/gardener/merges","archive_url":"https://api.github.com/repos/gardener/gardener/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/gardener/gardener/downloads","issues_url":"https://api.github.com/repos/gardener/gardener/issues{/number}","pulls_url":"https://api.github.com/repos/gardener/gardener/pulls{/number}","milestones_url":"https://api.github.com/repos/gardener/gardener/milestones{/number}","notifications_url":"https://api.github.com/repos/gardener/gardener/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/gardener/gardener/labels{/name}","releases_url":"https://api.github.com/repos/gardener/gardener/releases{/id}","deployments_url":"https://api.github.com/repos/gardener/gardener/deployments","created_at":"2018-01-13T20:57:47Z","updated_at":"2018-09-10T14:27:33Z","pushed_at":"2018-09-10T16:13:07Z","git_url":"git://github.com/gardener/gardener.git","ssh_url":"git@github.com:gardener/gardener.git","clone_url":"https://github.com/gardener/gardener.git","svn_url":"https://github.com/gardener/gardener","homepage":"","size":15649,"stargazers_count":630,"watchers_count":630,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":71,"mirror_url":null,"archived":false,"open_issues_count":66,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":71,"open_issues":66,"watchers":630,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/gardener/gardener/pulls/336"},"html":{"href":"https://github.com/gardener/gardener/pull/336"},"issue":{"href":"https://api.github.com/repos/gardener/gardener/issues/336"},"comments":{"href":"https://api.github.com/repos/gardener/gardener/issues/336/comments"},"review_comments":{"href":"https://api.github.com/repos/gardener/gardener/pulls/336/comments"},"review_comment":{"href":"https://api.github.com/repos/gardener/gardener/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/gardener/gardener/pulls/336/commits"},"statuses":{"href":"https://api.github.com/repos/gardener/gardener/statuses/c976a5ec635f45c21c1dc39a9bbbd4aadf9a1e46"}},"author_association":"MEMBER","merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"rfranzke","id":19169361,"node_id":"MDQ6VXNlcjE5MTY5MzYx","avatar_url":"https://avatars1.githubusercontent.com/u/19169361?v=4","gravatar_id":"","url":"https://api.github.com/users/rfranzke","html_url":"https://github.com/rfranzke","followers_url":"https://api.github.com/users/rfranzke/followers","following_url":"https://api.github.com/users/rfranzke/following{/other_user}","gists_url":"https://api.github.com/users/rfranzke/gists{/gist_id}","starred_url":"https://api.github.com/users/rfranzke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfranzke/subscriptions","organizations_url":"https://api.github.com/users/rfranzke/orgs","repos_url":"https://api.github.com/users/rfranzke/repos","events_url":"https://api.github.com/users/rfranzke/events{/privacy}","received_events_url":"https://api.github.com/users/rfranzke/received_events","type":"User","site_admin":false},"comments":3,"review_comments":15,"maintainer_can_modify":false,"commits":3,"additions":653,"deletions":63,"changed_files":47}}
{"actor":{"display_login":"rfranzke"}}