Angus Lees

Add/restore openapi schema for CRD

4

See discussion during PR #73. We had to remove the schema due to upstream k8s limitations that left us with no option to keep the schema _and_ allow an object...

We should use the certificates.k8s.io API to get the k8s server to sign the sealing certificate. This would allow the client to verify it has been given a valid cert...

Add support for running the controller with replicas>1

32

We need to ensure that the controller doesn't do the wrong thing with replicas>1, since that can happen during transient events like node/partition recovery, mis-configured upgrades, etc. Replicas>1 is a...

Add `importbin` statement

5

Add `importbin`. Like `importstr` but returns an array of numbers (integers 0-255). Note! This changes the `JsonnetImportCallback` function type signature, and requires modification to existing code that uses custom import...

CA rotation: controller-manager needs a separate ca.crt file

33

## What happened? I tried to (manually) rotate my cluster's CA key over the weekend. I discovered that `/etc/kubernetes/pki/ca.crt` can actually include _multiple_ CA keys, and this is key (hah!)...

config.rootfs is superfluous and should be removed

18

I think config.rootfs effectively[*] duplicates the manifest.layers information available elsewhere, and thus config.rootfs can/should be removed from the image spec. This makes image generation slightly simpler, removes an extra checksum...

wishlist: easy way to pull/push manifestlist (multi-arch) images

2

If I have an existing manifestlist (multi-arch) image, like the [standard "busybox" image](https://hub.docker.com/_/busybox), it would be nice if this was easy to "republish" in its full manifestlist-form via ipdr/IPFS. If...

Add a /health endpoint which does not require authentication

6

Trying to deploy restic/rest-server:0.10.0 in k8s. I want a URL endpoint that I can use for "livenessProbe" (GET, should return 200). As far as I can see from some testing,...

Kubernetes/client-go now surfaces warnings, by writing directly to stderr by default. This looks a bit ugly: ``` INFO Updating clusterrolebindings system:metrics-server W0831 14:02:35.085715 269861 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in...

gc-tag should use label, not annotation

3

Garbage collection works by listing everything with the gc-tag. In a busy cluster, we really want that filter to happen server-side and ideally using an index of some sort. That...