Merge pull request #100438 from dims/fix-providerless-kubelet

Ensure providerless kubelet does not pull cloud providers

cmd/kubelet/app/plugins.go

@@ -18,11 +18,6 @@ package app
 
 // This file exists to force the desired plugin implementations to be linked.
 import (
-	// Credential providers
-	_ "k8s.io/kubernetes/pkg/credentialprovider/aws"
-	_ "k8s.io/kubernetes/pkg/credentialprovider/azure"
-	_ "k8s.io/kubernetes/pkg/credentialprovider/gcp"
-
 	"k8s.io/component-base/featuregate"
 	"k8s.io/utils/exec"
 

cmd/kubelet/app/plugins_providers.go

@@ -19,6 +19,11 @@ limitations under the License.
 package app
 
 import (
+	// Credential providers
+	_ "k8s.io/kubernetes/pkg/credentialprovider/aws"
+	_ "k8s.io/kubernetes/pkg/credentialprovider/azure"
+	_ "k8s.io/kubernetes/pkg/credentialprovider/gcp"
+
 	"k8s.io/component-base/featuregate"
 	"k8s.io/csi-translation-lib/plugins"
 	"k8s.io/klog/v2"

hack/verify-typecheck-dockerless.sh

@@ -22,4 +22,13 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 cd "${KUBE_ROOT}"
 # verify the dockerless build
+# https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/1547-building-kubelet-without-docker/README.md
 hack/verify-typecheck.sh --skip-test --tags=dockerless --ignore-dirs=test
+
+# verify using go list
+if _out="$(go list -mod=readonly -tags "dockerless" -e -json  k8s.io/kubernetes/cmd/kubelet/... \
+  | grep -e dockershim)"; then
+    echo "${_out}" >&2
+    echo "Verify typecheck for dockerless tag failed. Found restricted packages." >&2
+    exit 1
+fi

hack/verify-typecheck-providerless.sh

@@ -27,3 +27,11 @@ cd "${KUBE_ROOT}"
 # verify the providerless build
 # https://github.com/kubernetes/enhancements/blob/master/keps/sig-cloud-provider/1179-building-without-in-tree-providers/README.md
 hack/verify-typecheck.sh --skip-test --tags=providerless --ignore-dirs=test
+
+# verify using go list
+if _out="$(go list -mod=readonly -tags "providerless" -e -json  k8s.io/kubernetes/cmd/kubelet/... \
+  | grep -e Azure/azure-sdk-for-go -e github.com/aws/aws-sdk-go -e google.golang.org/api)"; then
+    echo "${_out}" >&2
+    echo "Verify typecheck for providerless tag failed. Found restricted packages." >&2
+    exit 1
+fi

pkg/kubelet/cadvisor/cadvisor_cloudproviders.go

@@ -0,0 +1,28 @@
+// +build linux
+// +build !providerless
+
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cadvisor
+
+import (
+	// Register cloud info providers.
+	// TODO(#68522): Remove this in 1.20+ once the cAdvisor endpoints are removed.
+	_ "github.com/google/cadvisor/utils/cloudinfo/aws"
+	_ "github.com/google/cadvisor/utils/cloudinfo/azure"
+	_ "github.com/google/cadvisor/utils/cloudinfo/gce"
+)

pkg/kubelet/cadvisor/cadvisor_linux.go

@@ -31,12 +31,6 @@ import (
 	_ "github.com/google/cadvisor/container/crio/install"
 	_ "github.com/google/cadvisor/container/systemd/install"
 
-	// Register cloud info providers.
-	// TODO(#68522): Remove this in 1.20+ once the cAdvisor endpoints are removed.
-	_ "github.com/google/cadvisor/utils/cloudinfo/aws"
-	_ "github.com/google/cadvisor/utils/cloudinfo/azure"
-	_ "github.com/google/cadvisor/utils/cloudinfo/gce"
-
 	"github.com/google/cadvisor/cache/memory"
 	cadvisormetrics "github.com/google/cadvisor/container"
 	"github.com/google/cadvisor/events"