{"push_id":2829802890,"size":71,"distinct_size":7,"ref":"refs/heads/generate_tls","head":"81629def63e06f495391756a29da34756b54afba","before":"2cc5b28a75efa72e892b58e27fb6beddd7a16032","commits":[{"sha":"6f0b886a98bf9cc0f712790aecd116801ce4695e","author":{"name":"W. Trevor King","email":"f75897670c17327c42ab201733fb8a81ff9f4c34@tremily.us"},"message":"tests/run: Shift \"Generating SSH key-pair...\" message into if block\n\n37f623c5 (*: unify handling of ssh keys, 2018-08-14, #127) replaced\nour old key-pair upload with the TF_VAR_tectonic_admin_ssh_key export,\nand updated the message from \"Uploading SSH key-pair to AWS...\" to our\ncurrent \"Generation SSH key-pair...\" message.  But while we used to\n*always* upload a key to AWS, we've only ever generated a new key if\n~/.ssh/id_rsa.pub was missing.  This commit moves the\nGenerating... mesage into the if block to avoid freaking out callers\nwho may think we're clobbering their SSH key ;).\n\nWhile I'm in the area, I've also dropped the SSH variable and its\nassociated SC2034 (unused variable) disable.  The output of ssh-keygen\nisn't particularly interesting, so I've just set -q to quiet it\ninstead.  We'd had the old SSH and SC2034 disable since the script\nlanded in a2405e4d (run smoke tests with bash script, 2018-06-18,\ncoreos/tectonic-installer#3284).","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/6f0b886a98bf9cc0f712790aecd116801ce4695e"},{"sha":"24af3e7df2e4948006bac0f5a26712b5b41ceba4","author":{"name":"W. Trevor King","email":"f75897670c17327c42ab201733fb8a81ff9f4c34@tremily.us"},"message":"config: Remove gcloudsdk\n\nThe last consumer was removed in b2e0bcf2 (Don't upload /generated to\nS3 - only use Ignition, 2018-04-13, coreos/tectonic-installer#3183).","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/24af3e7df2e4948006bac0f5a26712b5b41ceba4"},{"sha":"c64eaffec70ae4f96152eb31b4cd8c3441e2021f","author":{"name":"Eric Paris","email":"b0b36e3cd9ea4e5739ff430a3056fabf2fdb0376@redhat.com"},"message":"Create a pty by default\n\nRHCOS defaults to use ttyS0 (the first serial port) as the console for init\n(and things after init). Since our domains do not have a pty defined these\ngo into the void. With this change one can use `virsh console` and see the\nmessages.  (If RHCOS can figure out how to send output to both tty0 and ttyS0\nwe wouldn't need this)","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/c64eaffec70ae4f96152eb31b4cd8c3441e2021f"},{"sha":"446e9f18f17b60cf5705d567c3f785a25b008e4f","author":{"name":"W. Trevor King","email":"f75897670c17327c42ab201733fb8a81ff9f4c34@tremily.us"},"message":"modules/aws: Drop auto-scaling groups\n\nCurrently, the installer creates an ASG for both masters and workers.\nWhile this is okay for workers, this causes quite a few headaches for\nmasters.  For example, etcd will be run on the master nodes, but this\nwill be unstable if Amazon is free to delete nodes and recreate them\nwithout etcd knowing about it.  Additionally, this makes bootstrap\ntricky because every master needs to be identical.  In order to break\nthe dependency loop between the MachineConfigController (TNC) and the\nmaster nodes, a CNAME is currently used to temporarily redirect\nIgnition's requests to an S3 bucket with a pre-computed bootstrap\nconfig.\n\nThis commit drops the use of ASG for both masters and workers and\ninstead creates individual machines. Once we adopt the use of\nMachineSets and MachineControllers, we'll regain the functionality we\nlost by dropping ASGs.\n\nWhile renaming the previous *-asg modules, I've also renamed the main\nTerraform files to main.tf to comply with the standard module\nstructure [1].\n\nThe new main.tf follow the example set by modules/aws/etcd/nodes.tf,\nwhich is why the instance resource declarations have moved to the end\nof the file.  I've also adjusted the master policy to more closely\nmatch the more-restrictive etcd policy, because I don't think the\nmasters will need to push S3 resources, etc.\n\nI've also dropped some redundant names (e.g. \"master_profile\" ->\n\"master\"), because the profile-ness is already covered in the resource\nname (e.g. \"aws_iam_instance_profile.master\").\n\nThe worker load balancer (previously\naws_autoscaling_attachment.workers, now aws_elb_attachment.workers) is\na bit more complicated now, since we have to loop over both the\nprovided load balancers and the created worker instances to set up\nassociations.  There are also similar master load balancer\nassociations in aws_elb_attachment.masters, replacing the old\nload_balancers entry in aws_autoscaling_group.masters.\n\n[1]: https://www.terraform.io/docs/modules/create.html#standard-module-structure","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/446e9f18f17b60cf5705d567c3f785a25b008e4f"},{"sha":"ae7eaa5445cb869a94ceb43bdfc91f093ec6e9e9","author":{"name":"Eric Paris","email":"b0b36e3cd9ea4e5739ff430a3056fabf2fdb0376@redhat.com"},"message":"Create a dependancy between the libvirt network and virsh command adding a dns record\n\nSince we used the variable name in both places terraform tried to run both at\nthe same time. We could have created an explicit dep, or done this via an\nimplicit dep.","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/ae7eaa5445cb869a94ceb43bdfc91f093ec6e9e9"},{"sha":"2fd9c9266da1ad9ba25a26a4a97da4832d3f6ec1","author":{"name":"W. Trevor King","email":"f75897670c17327c42ab201733fb8a81ff9f4c34@tremily.us"},"message":"modules/aws/vpc/sg-elb: Fix name for TNC security group\n\nIn 251147eb (TNC bootstrapping, 2018-02-13,\ncoreos/tectonic-installer#3053), the resource was renamed from 'ncg'\nto 'tnc', but the name property wasn't updated to match.","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/2fd9c9266da1ad9ba25a26a4a97da4832d3f6ec1"},{"sha":"ba373bb535c545be246c54289d12f3bd14f8595b","author":{"name":"W. Trevor King","email":"f75897670c17327c42ab201733fb8a81ff9f4c34@tremily.us"},"message":"modules/aws/vpc/sg-elb: Split out aws_security_group_rule\n\nThis happend for masters and workers in b620c16f (modules/aws: tighten\nsecurity groups, 2017-04-19, coreos/tectonic-installer#264, where:\n\n* Master ingress/egress rules moved from inline entries in\n  modules/aws/master-asg/master.tf to stand-alone rules in\n  modules/aws/vpc/sg-master.tf.\n\n* Worker ingress/egress rules moved from inline entries in\n  modules/aws/worker-asg/security-groups.tf to stand-alone rules in\n  modules/aws/vpc/sg-worker.tf.\n\nThis commit catches up for consistency with the other node classes.\nFrom the Terraform docs [1]:\n\n  Terraform currently provides both a standalone Security Group Rule\n  resource (a single ingress or egress rule), and a Security Group\n  resource with ingress and egress rules defined in-line.  At this\n  time you cannot use a Security Group with in-line rules in\n  conjunction with any Security Group Rule resources.  Doing so will\n  cause a conflict of rule settings and will overwrite rules.\n\nWe can also use the rule name to hint at the purpose of a rule\n(e.g. tnc_ingress_http), while with inline rules we just have port\nnumbers.\n\nThis also drops some 'self' properties from egress rules, which didn't\nmake sense.  'self' and 'cidr_blocks' are incompatible, resulting in\n[2]:\n\n  3 error(s) occurred:\n\n  * module.vpc.aws_security_group_rule.api_egress: 1 error(s) occurred:\n\n  * aws_security_group_rule.api_egress: 'self': conflicts with 'cidr_blocks' ([]interface {}{\"0.0.0.0/0\"})\n  * module.vpc.aws_security_group_rule.tnc_egress: 1 error(s) occurred:\n\n  * aws_security_group_rule.tnc_egress: 'self': conflicts with 'cidr_blocks' ([]interface {}{\"0.0.0.0/0\"})\n  * module.vpc.aws_security_group_rule.console_egress: 1 error(s) occurred:\n\n  * aws_security_group_rule.console_egress: 'self': conflicts with 'cidr_blocks' ([]interface {}{\"0.0.0.0/0\"})\n\nAnd these are supposed to be generic egress blocks anyway.  The\nerroneous use of 'self' and 'cidr_blocks' together dates back to\ne2709ba8 (Build VPC and ETCD cluster, 2017-02-21).\n\n[1]: https://www.terraform.io/docs/providers/aws/r/security_group_rule.html\n[2]: https://storage.googleapis.com/origin-ci-test/pr-logs/pull/openshift_installer/151/pull-ci-origin-installer-e2e-aws/552/build-log.txt","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/ba373bb535c545be246c54289d12f3bd14f8595b"},{"sha":"547e8cbedd2a9d7919c9037876169080fec054dc","author":{"name":"Yifan Gu","email":"8bb630cb819df855a836d85a765ad9b9fc21612a@coreos.com"},"message":"dep: Update resource dependency.\n\nCorrect the dependency of kubeconfigs:\n- Worker node doesn't depende on the short-lived kubelet client cert\n- Both kubeconfigs depend on install config for cluster name and\n  API server URL.","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/547e8cbedd2a9d7919c9037876169080fec054dc"},{"sha":"00066a96ddf772d68a31b7aba317ce7dee7160ca","author":{"name":"OpenShift Merge Robot","email":"dd8cc73a9fcbc4f2f987fe818c87bd17f8347a2c@users.noreply.github.com"},"message":"Merge pull request #159 from yifan-gu/update_dependency\n\ndep: Update resource dependency.","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/00066a96ddf772d68a31b7aba317ce7dee7160ca"},{"sha":"0fa4eb13e95d8c60805456ccaa7760031d3e73f2","author":{"name":"Derek Carr","email":"d800573394d256a195d45028b21a6497aae57664@redhat.com"},"message":"Fix perm errors with selinux enabled","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/0fa4eb13e95d8c60805456ccaa7760031d3e73f2"},{"sha":"06ceaee0f2acb86941ced8c9a65ba039348e648a","author":{"name":"Alex Crawford","email":"5a0274159e6e73a4029208d348020f724a235da5@redhat.com"},"message":"config.tf: bump operator images\n\nThis includes the fixes needed to work with SELinux.","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/06ceaee0f2acb86941ced8c9a65ba039348e648a"},{"sha":"beac99e2a592c06e33b71a227cb42c1e62128c2b","author":{"name":"Seth Jennings","email":"527af9e7c640877508ac9f4ddd8647c066bca6c6@redhat.com"},"message":"libvirt: hardcode memory and vcpus, boost vcpu default from 1 to 2","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/beac99e2a592c06e33b71a227cb42c1e62128c2b"},{"sha":"9cdd615f602b9b5aa98417e774d5b2de429e4df1","author":{"name":"W. Trevor King","email":"f75897670c17327c42ab201733fb8a81ff9f4c34@tremily.us"},"message":"modules/aws/vpc/sg-etcd: Split out aws_security_group_rule for etcd\n\nThis happend for masters and workers in b620c16f (modules/aws: tighten\nsecurity groups, 2017-04-19, coreos/tectonic-installer#264, where:\n\n* Master ingress/egress rules moved from inline entries in\n  modules/aws/master-asg/master.tf to stand-alone rules in\n  modules/aws/vpc/sg-master.tf.\n\n* Worker ingress/egress rules moved from inline entries in\n  modules/aws/worker-asg/security-groups.tf to stand-alone rules in\n  modules/aws/vpc/sg-worker.tf.\n\nFor some reason, b620c16f moved the etcd security group from\nmodules/aws/etcd/network.tf to modules/aws/vpc/sg-etcd.tf without\nsplitting out the inline rules, so this commit catches up for\nconsistency with the other node classes.  From the Terraform docs [1]:\n\n  Terraform currently provides both a standalone Security Group Rule\n  resource (a single ingress or egress rule), and a Security Group\n  resource with ingress and egress rules defined in-line.  At this\n  time you cannot use a Security Group with in-line rules in\n  conjunction with any Security Group Rule resources.  Doing so will\n  cause a conflict of rule settings and will overwrite rules.\n\nWe can also use the rule name to hint at the purpose of a rule, while\nwith inline rules we just have port numbers.  In this case, the *_etcd\nand *_peer suffixes are based on [2]:\n\n  The official etcd ports are 2379 for client requests, and 2380 for\n  peer communication.\n\n[1]: https://www.terraform.io/docs/providers/aws/r/security_group_rule.html\n[2]: https://github.com/coreos/etcd/tree/v3.3.9#etcd-tcp-ports","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/9cdd615f602b9b5aa98417e774d5b2de429e4df1"},{"sha":"9504f48db0af2a8d6c467c7371eb93595adc1caa","author":{"name":"W. Trevor King","email":"f75897670c17327c42ab201733fb8a81ff9f4c34@tremily.us"},"message":"modules/aws/vpc: Wide-open master <-> etcd TCP\n\nThis should address issues with masters retrieving information from\nthe etcd nodes, which was resulting in:\n\n  $ curl -s https://storage.googleapis.com/origin-ci-test/pr-logs/pull/openshift_installer/150/pull-ci-origin-installer-e2e-aws/546/build-log.txt | grep Ginkgo\n    |  Ginkgo timed out waiting for all parallel nodes to report back!  |\n  Ginkgo ran 1 suite in 10m6.626061944s\n\nClayton suspects the e2e-aws tests are trying to get metrics from the\nkubelets, and hanging on the etcd kubelet because this rule was\nmissing.  I'm not clear why we've only been seeing this issue for the\nlast week though.\n\nThe wide TCP range weakens security, but we're about to move etcd onto\nthe master nodes anyway, so it won't be a long-term issue.  I've also\nopened UDP flannel between the masters and etcd, mirroring the setup\nbetween masters and workers.  I dunno if the etcd nodes are using\nflannel, and if they are, I don't know if we need etcd <-> worker\nopenings as well.","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/9504f48db0af2a8d6c467c7371eb93595adc1caa"},{"sha":"faafe8795109c62ae2e54ecd16de284008f2a589","author":{"name":"W. Trevor King","email":"f75897670c17327c42ab201733fb8a81ff9f4c34@tremily.us"},"message":"modules/aws/vpc: Wide-open worker <-> etcd TCP\n\nThis should address issues with masters retrieving information from\nthe etcd nodes, which was resulting in:\n\n1. The metrics API server not coming up:\n\n     W0823 00:33:12.343932    1 manager.go:102] Failed to get kubelet_summary:10.0.136.116:10255 response in time\n     E0823 00:33:12.343892    1 summary.go:97] error while getting metrics summary from Kubelet ip-10-0-146-142.ec2.internal(10.0.146.142:10255): Get http://10.0.146.142:10255/stats/summary/: dial tcp 10.0.146.142:10255: getsockopt: connection timed out\n     W0823 00:33:12.343955    1 manager.go:102] Failed to get kubelet_summary:10.0.146.142:10255 response in time\n     W0823 00:33:25.000470    1 manager.go:147] Failed to get all responses in time (got 4/7)\n\n2. Namespace deletion blocked on the metrics API.\n3. e2e jobs hang trying to clean up namespaces.\n\nClayton points out that the metrics API server not being able to reach\na node should not break namespace deletion, but that's where we are at\nthe moment.","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/faafe8795109c62ae2e54ecd16de284008f2a589"},{"sha":"e735e382c77d02706812262ef45afba1c6a37d3b","author":{"name":"staebler","email":"b49b1ec815177ed068e3fd6cbfc8b45fbf28f4ea@redhat.com"},"message":"Add unit tests for installconfig assets","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/e735e382c77d02706812262ef45afba1c6a37d3b"},{"sha":"b67f809bba49a78c7707ca2a8dc2ec9fa05bc92b","author":{"name":"W. Trevor King","email":"f75897670c17327c42ab201733fb8a81ff9f4c34@tremily.us"},"message":"installer/pkg/config/cluster.go: Default to Flannel\n\nWe're having trouble accessing service IPs from pods with host network\nnamespaces, which was keeping the metrics API from coming up (I think\nthat's what the problem is ;) and eventually blocking namespace\ndeletion.  Defaulting to Flannel fixes that issue.","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/b67f809bba49a78c7707ca2a8dc2ec9fa05bc92b"},{"sha":"b8bf8cacd92c4f63eca615218b3362cb51312b83","author":{"name":"OpenShift Merge Robot","email":"dd8cc73a9fcbc4f2f987fe818c87bd17f8347a2c@users.noreply.github.com"},"message":"Merge pull request #151 from wking/etcd-kublet-ingress\n\n*: Assorted fixes to get e2e-aws working again (Calico -> Flannel, etc.)","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/b8bf8cacd92c4f63eca615218b3362cb51312b83"},{"sha":"27fb94702782a2c3e289f926e26d97a285f58bff","author":{"name":"OpenShift Merge Robot","email":"dd8cc73a9fcbc4f2f987fe818c87bd17f8347a2c@users.noreply.github.com"},"message":"Merge pull request #150 from eparis/libvirt-dns-dep\n\nCreate a dependancy between the libvirt network and virsh command adding a dns record","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/27fb94702782a2c3e289f926e26d97a285f58bff"},{"sha":"2f3cde6d0db2fda933f3033c4d196e105250e1ea","author":{"name":"OpenShift Merge Robot","email":"dd8cc73a9fcbc4f2f987fe818c87bd17f8347a2c@users.noreply.github.com"},"message":"Merge pull request #163 from sjenning/libvirt-vcpu-vars\n\nlibvirt: hardcode memory and vcpus, boost vcpu default from 1 to 2","distinct":false,"url":"https://api.github.com/repos/yifan-gu/installer/commits/2f3cde6d0db2fda933f3033c4d196e105250e1ea"}]}
{"actor":{"display_login":"yifan-gu"}}