func (r *Reconciler) Reconcile(request reconcile.Request) (reconcile.Result, err }  func (r *Reconciler) reconcile(ctx context.Context, cluster *kubermaticv1.Cluster) (*reconcile.Result, error) {-+	// If cluster is not healthy yet there is nothing to do.+	// If it gets healthy we'll get notified by the event. No need to requeue. 	if !cluster.Status.ExtendedHealth.AllHealthy() {-		// Cluster not healthy yet. Nothing to do.-		// If it gets healthy we'll get notified by the event. No need to requeue 		return nil, nil 	} -	clusterType := v1.KubernetesClusterType-	if cluster.IsOpenshift() {-		clusterType = v1.OpenShiftClusterType+	clusterType := getClusterType(cluster)++	// Check if cluster has non-empty initial machine deployment request serialized+	// into its annotations and create it if its there.+	if request, ok := cluster.Annotations[v1.InitialMachineDeploymentRequestAnnotation]; ok && request != "" {+		var nodeDeployment *v1.NodeDeployment+		if err := json.Unmarshal([]byte(request), &nodeDeployment); err != nil {+			return nil, fmt.Errorf("cannot unmarshal initial machine deployment request for %s cluster: %v", cluster.Name, err)+		}++		if !r.isInitialMachineDeploymentCreated() {+			if err := r.createInitialMachineDeployment(nodeDeployment); err != nil {+				return nil, fmt.Errorf("cannot create initial machine deployment for %s cluster: %v", cluster.Name, err)+			} else {+				r.recorder.Eventf(cluster, corev1.EventTypeNormal, "InitialMachineDeployment", "Created initial machine deployment")+				if err := r.removeInitialMachineDeploymentRequestAnnotation(cluster); err != nil {+					return nil, fmt.Errorf("cannot remove initial machine deployment request from %s cluster: %v", cluster.Name, err)+				}+			}+		} else {+			if err := r.removeInitialMachineDeploymentRequestAnnotation(cluster); err != nil {+				return nil, fmt.Errorf("cannot remove initial machine deployment request from %s cluster: %v", cluster.Name, err)+			}+		}

 func (r *Reconciler) Reconcile(request reconcile.Request) (reconcile.Result, err }  func (r *Reconciler) reconcile(ctx context.Context, cluster *kubermaticv1.Cluster) (*reconcile.Result, error) {-+	// If cluster is not healthy yet there is nothing to do.+	// If it gets healthy we'll get notified by the event. No need to requeue. 	if !cluster.Status.ExtendedHealth.AllHealthy() {-		// Cluster not healthy yet. Nothing to do.-		// If it gets healthy we'll get notified by the event. No need to requeue 		return nil, nil 	} -	clusterType := v1.KubernetesClusterType-	if cluster.IsOpenshift() {-		clusterType = v1.OpenShiftClusterType+	clusterType := getClusterType(cluster)++	// Check if cluster has non-empty initial machine deployment request serialized+	// into its annotations and create it if its there.

+/*+Copyright 2020 The Kubermatic Kubernetes Platform contributors.++Licensed under the Apache License, Version 2.0 (the "License");+you may not use this file except in compliance with the License.+You may obtain a copy of the License at++    http://www.apache.org/licenses/LICENSE-2.0++Unless required by applicable law or agreed to in writing, software+distributed under the License is distributed on an "AS IS" BASIS,+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+See the License for the specific language governing permissions and+limitations under the License.+*/++package constrainttemplatecontroller++import (+	"context"+	"fmt"+	"net"+	"os"+	"time"++	"github.com/open-policy-agent/frameworks/constraint/pkg/apis/templates/v1beta1"+	"go.uber.org/zap"++	kubermaticapiv1 "k8c.io/kubermatic/v2/pkg/api/v1"+	clusterclient "k8c.io/kubermatic/v2/pkg/cluster/client"+	controllerutil "k8c.io/kubermatic/v2/pkg/controller/util"+	kubermaticv1 "k8c.io/kubermatic/v2/pkg/crd/kubermatic/v1"+	kuberneteshelper "k8c.io/kubermatic/v2/pkg/kubernetes"+	"k8c.io/kubermatic/v2/pkg/resources/reconciling"+	"k8c.io/kubermatic/v2/pkg/util/workerlabel"++	kerrors "k8s.io/apimachinery/pkg/api/errors"+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"+	"k8s.io/apimachinery/pkg/labels"+	"k8s.io/apimachinery/pkg/types"+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"+	"k8s.io/client-go/rest"+	"sigs.k8s.io/controller-runtime/pkg/client"+	ctrlruntimeclient "sigs.k8s.io/controller-runtime/pkg/client"+	"sigs.k8s.io/controller-runtime/pkg/controller"+	"sigs.k8s.io/controller-runtime/pkg/handler"+	"sigs.k8s.io/controller-runtime/pkg/manager"+	"sigs.k8s.io/controller-runtime/pkg/reconcile"+	"sigs.k8s.io/controller-runtime/pkg/source"+)++const (+	// This controller syncs the kubermatic constraint templates to gatekeeper constraint templates on the user cluster.+	ControllerName = "gatekeeper_constraint_template_controller"+)++// UserClusterClientProvider provides functionality to get a user cluster client+type UserClusterClientProvider interface {+	GetClient(c *kubermaticv1.Cluster, options ...clusterclient.ConfigOption) (ctrlruntimeclient.Client, error)+}++type reconciler struct {+	ctx                     context.Context+	log                     *zap.SugaredLogger+	workerNameLabelSelector labels.Selector+	masterClient            ctrlruntimeclient.Client+	seedClientProviders     map[string]*SeedClientProvider+	userClusterClients      map[string]ctrlruntimeclient.Client+}++type SeedClientProvider struct {+	seedClient                ctrlruntimeclient.Client+	userClusterClientProvider UserClusterClientProvider+}++func Add(ctx context.Context,+	mgr manager.Manager,+	seedManagers map[string]manager.Manager,+	log *zap.SugaredLogger,+	workerName string,+	numWorkers int) error {++	workerSelector, err := workerlabel.LabelSelector(workerName)+	if err != nil {+		return fmt.Errorf("failed to build worker-name selector: %v", err)+	}++	reconciler := &reconciler{+		ctx:                     ctx,+		log:                     log.Named(ControllerName),+		workerNameLabelSelector: workerSelector,+		masterClient:            mgr.GetClient(),+		seedClientProviders:     map[string]*SeedClientProvider{},+		userClusterClients:      map[string]ctrlruntimeclient.Client{},+	}++	c, err := controller.New(ControllerName, mgr, controller.Options{Reconciler: reconciler, MaxConcurrentReconciles: numWorkers})+	if err != nil {+		return fmt.Errorf("failed to construct controller: %v", err)+	}++	for seedName, seedManager := range seedManagers {+		seedClient := seedManager.GetClient()++		userClusterClientProvider, err := getUserClusterClientProvider(seedManager)+		if err != nil {+			return fmt.Errorf("failed to get cluster client provider for seed %s: %w", seedName, err)+		}+		reconciler.seedClientProviders[seedName] = &SeedClientProvider{+			seedClient:                seedClient,+			userClusterClientProvider: userClusterClientProvider,+		}++		clusterSource := &source.Kind{Type: &kubermaticv1.Cluster{}}+		if err := clusterSource.InjectCache(mgr.GetCache()); err != nil {+			return fmt.Errorf("failed to inject cache into clusterSource for seed %s: %v", seedName, err)+		}+		if err := c.Watch(+			clusterSource,+			enqueueAllConstraintTemplates(reconciler.masterClient, reconciler.log),+			workerlabel.Predicates(workerName),+		); err != nil {+			return fmt.Errorf("failed to establish watch for clusters in seed %s: %v", seedName, err)+		}+	}++	if err := c.Watch(+		&source.Kind{Type: &kubermaticv1.ConstraintTemplate{}},+		&handler.EnqueueRequestForObject{},+	); err != nil {+		return fmt.Errorf("failed to create watch for constraintTemplates: %v", err)+	}++	return nil+}++// Reconcile reconciles the kubermatic constraint template on the master cluster to all seed cluster user clusters+// which have opa integration enabled+func (r *reconciler) Reconcile(request reconcile.Request) (reconcile.Result, error) {+	log := r.log.With("ConstraintTemplate", request)

+/*+Copyright 2020 The Kubermatic Kubernetes Platform contributors.++Licensed under the Apache License, Version 2.0 (the "License");+you may not use this file except in compliance with the License.+You may obtain a copy of the License at++    http://www.apache.org/licenses/LICENSE-2.0++Unless required by applicable law or agreed to in writing, software+distributed under the License is distributed on an "AS IS" BASIS,+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+See the License for the specific language governing permissions and+limitations under the License.+*/++package constrainttemplatecontroller++import (+	"context"+	"fmt"+	"net"+	"os"+	"time"++	"github.com/open-policy-agent/frameworks/constraint/pkg/apis/templates/v1beta1"+	"go.uber.org/zap"++	kubermaticapiv1 "k8c.io/kubermatic/v2/pkg/api/v1"+	clusterclient "k8c.io/kubermatic/v2/pkg/cluster/client"+	controllerutil "k8c.io/kubermatic/v2/pkg/controller/util"+	kubermaticv1 "k8c.io/kubermatic/v2/pkg/crd/kubermatic/v1"+	kuberneteshelper "k8c.io/kubermatic/v2/pkg/kubernetes"+	"k8c.io/kubermatic/v2/pkg/resources/reconciling"+	"k8c.io/kubermatic/v2/pkg/util/workerlabel"++	kerrors "k8s.io/apimachinery/pkg/api/errors"+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"+	"k8s.io/apimachinery/pkg/labels"+	"k8s.io/apimachinery/pkg/types"+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"+	"k8s.io/client-go/rest"+	"sigs.k8s.io/controller-runtime/pkg/client"+	ctrlruntimeclient "sigs.k8s.io/controller-runtime/pkg/client"+	"sigs.k8s.io/controller-runtime/pkg/controller"+	"sigs.k8s.io/controller-runtime/pkg/handler"+	"sigs.k8s.io/controller-runtime/pkg/manager"+	"sigs.k8s.io/controller-runtime/pkg/reconcile"+	"sigs.k8s.io/controller-runtime/pkg/source"+)++const (+	// This controller syncs the kubermatic constraint templates to gatekeeper constraint templates on the user cluster.+	ControllerName = "gatekeeper_constraint_template_controller"+)++// UserClusterClientProvider provides functionality to get a user cluster client+type UserClusterClientProvider interface {+	GetClient(c *kubermaticv1.Cluster, options ...clusterclient.ConfigOption) (ctrlruntimeclient.Client, error)+}++type reconciler struct {+	ctx                     context.Context+	log                     *zap.SugaredLogger+	workerNameLabelSelector labels.Selector+	masterClient            ctrlruntimeclient.Client+	seedClientProviders     map[string]*SeedClientProvider+	userClusterClients      map[string]ctrlruntimeclient.Client+}++type SeedClientProvider struct {+	seedClient                ctrlruntimeclient.Client+	userClusterClientProvider UserClusterClientProvider+}++func Add(ctx context.Context,+	mgr manager.Manager,+	seedManagers map[string]manager.Manager,+	log *zap.SugaredLogger,+	workerName string,+	numWorkers int) error {++	workerSelector, err := workerlabel.LabelSelector(workerName)+	if err != nil {+		return fmt.Errorf("failed to build worker-name selector: %v", err)+	}++	reconciler := &reconciler{+		ctx:                     ctx,+		log:                     log.Named(ControllerName),+		workerNameLabelSelector: workerSelector,+		masterClient:            mgr.GetClient(),+		seedClientProviders:     map[string]*SeedClientProvider{},+		userClusterClients:      map[string]ctrlruntimeclient.Client{},+	}++	c, err := controller.New(ControllerName, mgr, controller.Options{Reconciler: reconciler, MaxConcurrentReconciles: numWorkers})+	if err != nil {+		return fmt.Errorf("failed to construct controller: %v", err)+	}++	for seedName, seedManager := range seedManagers {+		seedClient := seedManager.GetClient()++		userClusterClientProvider, err := getUserClusterClientProvider(seedManager)+		if err != nil {+			return fmt.Errorf("failed to get cluster client provider for seed %s: %w", seedName, err)+		}+		reconciler.seedClientProviders[seedName] = &SeedClientProvider{+			seedClient:                seedClient,+			userClusterClientProvider: userClusterClientProvider,+		}++		clusterSource := &source.Kind{Type: &kubermaticv1.Cluster{}}+		if err := clusterSource.InjectCache(mgr.GetCache()); err != nil {+			return fmt.Errorf("failed to inject cache into clusterSource for seed %s: %v", seedName, err)+		}+		if err := c.Watch(+			clusterSource,+			enqueueAllConstraintTemplates(reconciler.masterClient, reconciler.log),+			workerlabel.Predicates(workerName),+		); err != nil {+			return fmt.Errorf("failed to establish watch for clusters in seed %s: %v", seedName, err)+		}+	}++	if err := c.Watch(+		&source.Kind{Type: &kubermaticv1.ConstraintTemplate{}},+		&handler.EnqueueRequestForObject{},+	); err != nil {+		return fmt.Errorf("failed to create watch for constraintTemplates: %v", err)+	}++	return nil+}++// Reconcile reconciles the kubermatic constraint template on the master cluster to all seed cluster user clusters+// which have opa integration enabled+func (r *reconciler) Reconcile(request reconcile.Request) (reconcile.Result, error) {+	log := r.log.With("ConstraintTemplate", request)+	log.Debug("Reconciling")++	constraintTemplate := &kubermaticv1.ConstraintTemplate{}+	if err := r.masterClient.Get(r.ctx, request.NamespacedName, constraintTemplate); err != nil {+		if kerrors.IsNotFound(err) {+			log.Debugw("constraint template not found, returning", "constraint-name", constraintTemplate.Name)

 else fi pushElapsed kind_kubermatic_setup_duration_milliseconds $beforeKubermaticSetup -echodate "Done setting up Kubermatic in kind"- echodate "Running conformance tests"-KUBERMATIC_NO_WORKER_NAME=true ./hack/ci/run-conformance-tests.sh

+++++title = "Custom Registry"+date = 2020-10-27T12:00:00+02:00+weight = 4++++++## RegistryConfiguration++It's possible to configure the central docker image registry to pull images from using `registryConfiguration` config.

+#!/usr/bin/env bash++# Copyright 2019 The KubeOne Authors.+#+# Licensed under the Apache License, Version 2.0 (the "License");+# you may not use this file except in compliance with the License.+# You may obtain a copy of the License at+#+#     http://www.apache.org/licenses/LICENSE-2.0+#+# Unless required by applicable law or agreed to in writing, software+# distributed under the License is distributed on an "AS IS" BASIS,+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+# See the License for the specific language governing permissions and+# limitations under the License.++# The image-loader script is used to pull all Docker images used by KubeOne,+# Kubeadm, and Kubernetes, and push them to the the specified private registry.++# WARNING: This script heavily depends on KubeOne and Kubernetes versions.+# You must use the script coming the KubeOne release you've downloaded.++set -euo pipefail++KUBERNETES_VERSION=${KUBERNETES_VERSION:-}++TARGET_REGISTRY=${TARGET_REGISTRY:-127.0.0.1:5000}+PULL_OPTIONAL_IMAGES=${PULL_OPTIONAL_IMAGES:-true}++# Wrapper around echo to include time+function echodate() {+  # do not use -Is to keep this compatible with macOS+  echo "[$(date +%Y-%m-%dT%H:%M:%S%:z)]" "$@"+}++function fail() {+  echodate "$@"+  exit 1+}++function retag() {+  local image="$1"++  # Trim registry+  local local_image+  local name+  local tag++  local_image="$(echo "${image}" | cut -d/ -f1 --complement)"+  # Split into name and tag+  name="$(echo "${local_image}" | cut -d: -f1)"+  tag="$(echo "${local_image}" | cut -d: -f2)"++  # Build target image name+  local target_image="${TARGET_REGISTRY}/${name}:${tag}"++  echodate "Retagging \"${image}\" => \"${target_image}\"..."++  docker pull "${image}"+  docker tag "${image}" "${target_image}"+  docker push "${target_image}"++  echodate "Done retagging \"${image}\"."+}++# The script is only supported on Linux because it depends on Kubeadm.+# You can run this script in a Docker container.+if [[ "$OSTYPE" != "linux-gnu"* ]]; then

+#!/usr/bin/env bash++# Copyright 2019 The KubeOne Authors.+#+# Licensed under the Apache License, Version 2.0 (the "License");+# you may not use this file except in compliance with the License.+# You may obtain a copy of the License at+#+#     http://www.apache.org/licenses/LICENSE-2.0+#+# Unless required by applicable law or agreed to in writing, software+# distributed under the License is distributed on an "AS IS" BASIS,+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+# See the License for the specific language governing permissions and+# limitations under the License.++# The image-loader script is used to pull all Docker images used by KubeOne,+# Kubeadm, and Kubernetes, and push them to the the specified private registry.++# WARNING: This script heavily depends on KubeOne and Kubernetes versions.+# You must use the script coming the KubeOne release you've downloaded.++set -euo pipefail++KUBERNETES_VERSION=${KUBERNETES_VERSION:-}++TARGET_REGISTRY=${TARGET_REGISTRY:-127.0.0.1:5000}+PULL_OPTIONAL_IMAGES=${PULL_OPTIONAL_IMAGES:-true}++# Wrapper around echo to include time+function echodate() {+  # do not use -Is to keep this compatible with macOS+  echo "[$(date +%Y-%m-%dT%H:%M:%S%:z)]" "$@"+}++function fail() {+  echodate "$@"+  exit 1+}++function retag() {+  local image="$1"++  # Trim registry+  local local_image+  local name+  local tag++  local_image="$(echo "${image}" | cut -d/ -f1 --complement)"+  # Split into name and tag+  name="$(echo "${local_image}" | cut -d: -f1)"+  tag="$(echo "${local_image}" | cut -d: -f2)"++  # Build target image name+  local target_image="${TARGET_REGISTRY}/${name}:${tag}"++  echodate "Retagging \"${image}\" => \"${target_image}\"..."++  docker pull "${image}"+  docker tag "${image}" "${target_image}"+  docker push "${target_image}"++  echodate "Done retagging \"${image}\"."+}++# The script is only supported on Linux because it depends on Kubeadm.+# You can run this script in a Docker container.+if [[ "$OSTYPE" != "linux-gnu"* ]]; then

+#!/usr/bin/env bash++# Copyright 2019 The KubeOne Authors.+#+# Licensed under the Apache License, Version 2.0 (the "License");+# you may not use this file except in compliance with the License.+# You may obtain a copy of the License at+#+#     http://www.apache.org/licenses/LICENSE-2.0+#+# Unless required by applicable law or agreed to in writing, software+# distributed under the License is distributed on an "AS IS" BASIS,+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+# See the License for the specific language governing permissions and+# limitations under the License.++# The image-loader script is used to pull all Docker images used by KubeOne,+# Kubeadm, and Kubernetes, and push them to the the specified private registry.

 set -euo pipefail cd $(dirname $0)/../../.. source api/hack/lib.sh -GITHUB_TOKEN="${GITHUB_TOKEN:-$(cat /etc/github/oauth | tr -d '\n')}"+DRY_RUN=${DRY_RUN:-false} -# err can be used to print logs to stderr-err(){-  echo "E: $*" >>/dev/stderr-}+GITHUB_TOKEN="${GITHUB_TOKEN:-$(cat /etc/github/oauth | tr --delete '\n')}"+export GITHUB_AUTH="Authorization: token $GITHUB_TOKEN"++# this stops execution when GIT_TAG is not overriden and+# we are not on a tagged revision+export GIT_TAG="${GIT_TAG:-$(git describe --tags --exact-match)}"+export GIT_BRANCH="${GIT_BRANCH:-$(git rev-parse --abbrev-ref HEAD)}"+export GIT_HEAD="${GIT_HEAD:-$(git rev-parse HEAD)}"+export GIT_REPO="${GIT_REPO:-kubermatic/kubermatic}"+export RELEASE_PLATFORMS="${RELEASE_PLATFORMS:-linux-amd64 darwin-amd64 windows-amd64}"++# By default, this script is used to released tagged revisions,+# for which a matching tag must exist in the dashboard repository.+export DASHBOARD_GIT_TAG="${DASHBOARD_GIT_TAG:-$GIT_TAG}"++# RELEASE_NAME allows to customize the tag that is used to create the+# Github release for, while the Helm charts and things will still+# point to GIT_TAG+export RELEASE_NAME="${RELEASE_NAME:-$GIT_TAG}"  # utility function setting some curl default values for calling the github API # first argument is the URL, the rest of the arguments is used as curl # arguments. function github_cli {-  local url=${1}+  local url="$1"   curl \     --retry 5 \     --connect-timeout 10 \-    -H "Authorization: token ${GITHUB_TOKEN}" \-    "${@:2}" "${url}"+    --header "$GITHUB_AUTH" \+    "${@:2}" "$url" }  # creates a new github release function create_release {-  local tag="${1}"-  local name="${2}"-  local prerelease="${3}"-  data=$(cat << EOF-{-  "tag_name": "$tag",-  "name": "$name",-  "prerelease": $prerelease-}-EOF-)+  local tag="$1"+  local name="$2"+  local prerelease="$3"+  local body="${4:-}"+  local data++  # using named arguments is a nice way to ensure special+  # characters in the body survive the JSON encoding+  data="$(+    jq --null-input \+       --arg tag_name "$tag" \+       --arg name "$name" \+       --argjson prerelease "$prerelease" \+       --arg body "$body" \+       '{"tag_name":$tag_name,"name":$name,"prerelease":$prerelease,"body":$body}'+  )"+   github_cli \-    "https://api.github.com/repos/${repo}/releases" \-    -f --data "${data}"+    "https://api.github.com/repos/$GIT_REPO/releases" \+    --fail --data "$data" }  # upload an archive from a file function upload_archive {-  local file="${1}"+  local file="$1"   res=$(github_cli \-    "https://uploads.github.com/repos/$repo/releases/$releaseID/assets?name=${file}" \-    -H "Accept: application/json" \-    -H 'Content-Type: application/gzip' \-    -s --data-binary "@${file}")-  if echo "${res}" | jq -e '.'; then-    # it the response contain errors-    if echo "${res}" | jq -e '.errors[0]'; then-      for err in $(echo "${res}" | jq -r '.errors[0].code'); do+    "https://uploads.github.com/repos/$GIT_REPO/releases/$releaseID/assets?name=$(basename "$file")" \