sys-cluster/kubernetes: 1.16.13 1.17.9 1.18.6 security bump

Bug: https://bugs.gentoo.org/732762
Closes: https://github.com/gentoo/gentoo/pull/9963
Signed-off-by: William Hubbs <williamh@gentoo.org>

4 files changed, 273 insertions, 0 deletions

diff --git a/sys-cluster/kubernetes/Manifest b/sys-cluster/kubernetes/Manifest
index 8ad721976610..b2c73c7af6c9 100644
--- a/sys-cluster/kubernetes/Manifest
+++ b/sys-cluster/kubernetes/Manifest
@@ -1,6 +1,9 @@
 DIST kubernetes-1.16.11.tar.gz 31766900 BLAKE2B a3a099eaf82b7b818a237752885358752176bb1eade5f1623a1bd8920f37a43283fc0a712197153143b6d166bb0ecb45d9d1148cc766681f67f36281473b26e0 SHA512 153a44ce61d70074462c157ffbdb8c58a8807d205a315c2be3aabee80253cba362915f93c31fcbdbfcdc25161b9bc3ca0260b1cdab8f4d562fc69aa465fc476e
 DIST kubernetes-1.16.12.tar.gz 31772280 BLAKE2B 623a0dc387e911f603ae1f5111a30d43d57a3d8be49a02326077b6264d3cd683ef9b8b0bf9be2685aaade5b831b7fbd49426758aa5817ae7bc6b0cc6f934da2c SHA512 6c72998aa540adec40dc3b78167b2c9e3dfe1ff7d799fd9752676862dfdbdc5a8303b5f4267d132d4c115c5482b8f27140191bcdd74ad7a63f87cafe76cb9f9e
+DIST kubernetes-1.16.13.tar.gz 31778355 BLAKE2B 81cfa9a2885577e16cc01f8ecd3e21991be388e129d46c2d8b4d6282eb8d46cc7c530394f743888767426874001619801e7b70feec93cf0142f4117d7d33ea34 SHA512 c4f1d39fb9c16e2bcd2ebd0f8e8dbc889e02c4c28814132fc3856b3bf68aa4867828802e9ff48ce18f2c9c0fc246c6fbf2d9e55ca5956b4aef9cf7b4ad15b225
 DIST kubernetes-1.17.7.tar.gz 31808806 BLAKE2B b8c2d64bb2e307ca866465039a4e8d62f0f73d26ed7fe3e6906784369c214037672b80c0adf617c3b47abe213f4ee5e55af72943e742aaba645b0c7f69b984c1 SHA512 12ad9de52ac2028ace8b605ccf14b98c94363f17b56da6d5efbb63617d40898384ff88d88a33d47393c3e7b529f17d41c526340ddfbd4cc0eddb5341789436a4
 DIST kubernetes-1.17.8.tar.gz 31815475 BLAKE2B a949e85610c4eb78bb79d2290ff50477fda4406f212869a2d23ba5a4e134be7bbcf327398f82cff86adfc3e9554fc2ca32f1de2667b3fb0187732dab4474f5a0 SHA512 0bf42da5162d91afe7be4cc9e2ca989e22d768b82b0e7b9d2ddc6bac9583fa73f22f4b755fd9cdd215d4c5023b5a349efc3f3b1a944048a329ba657b05b95f0b
+DIST kubernetes-1.17.9.tar.gz 31821854 BLAKE2B 62dffaa7ab671987aba9a477497dfa02943488d43ac42259706e21aa0d0520d76a6d0795db39b5025b23678ad0d36e0367e0bdda4b3e7c0c6a2ad409c29d02ad SHA512 c6c1c27a534b5b6dbbc3be34d9f8f321b0289e9032ad11549e1f028cd4cf6ba288cdc54283f5263b5e9cef017d535db911b5f7e5cbaccd2bee7d955ce2039696
 DIST kubernetes-1.18.4.tar.gz 32605319 BLAKE2B 4cf10cadd2b45418f45517a0191d3650a2e36bd3dc69e3f472ac59735712261eebb38eccf7da4f8496ac60701602dbf4730176236486abae6279b1f71bae831f SHA512 b2a6f76b4b933012e39aa3df2510a6dd3a2d64452799fdd32b9d7c461930d273b0cacd46550aa963d809d7b075d6076a6d1a370322870204e1298811c14122a1
 DIST kubernetes-1.18.5.tar.gz 32609318 BLAKE2B 68a2571eb1c956484a288b2d379c4a81b1ce7924fe20500ea1b0c4ff925c52d5d2f52c58bce535827e90d6ba1863f88b3dc0c2e74261325ef335a423a193e8c6 SHA512 894c7a8c84b5a416b6699a962a657667885ecb7f2f38fc645239d53039149f439515922b10ffd4e66c3ca24b801f3d316ed3ee1b4e07bfbe792ddffbfb286ac8
+DIST kubernetes-1.18.6.tar.gz 32619242 BLAKE2B 7db8410b33b3748e2f391efa78fab2bff51c2f5cf9bc54ba74d5c0044f2ee453b1038f4edb206597be6cb0da7c9264988865bd94f1b99c308c350f04eaa232af SHA512 8715b5738ae13455e5f91f58d8922e7e87ed9441a5caf1233426df7dac552ddf2c4242d217d50b65ee264b8b55e6cc4e33081bf70dd74c47870c0eff682a9545
diff --git a/sys-cluster/kubernetes/kubernetes-1.16.13.ebuild b/sys-cluster/kubernetes/kubernetes-1.16.13.ebuild
new file mode 100644
index 000000000000..08ecc8821c16
--- /dev/null
+++ b/sys-cluster/kubernetes/kubernetes-1.16.13.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit bash-completion-r1 go-module systemd
+
+DESCRIPTION="production-grade container orchestration"
+HOMEPAGE="https://kubernetes.io"
+SRC_URI="https://github.com/kubernetes/kubernetes/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64"
+
+AGENT="kubelet"
+CLI="kubeadm kubectl"
+SERVICES="kube-apiserver kube-controller-manager kube-proxy kube-scheduler"
+IUSE="hardened"
+for x in ${AGENT} ${CLI} ${SERVICES}; do
+	IUSE+=" +${x}"
+done
+
+BDEPEND=">=dev-lang/go-1.13"
+COMMON_DEPEND="
+	kube-apiserver? (
+		acct-group/kube-apiserver
+		acct-user/kube-apiserver
+	)
+	kube-controller-manager? (
+		acct-group/kube-controller-manager
+		acct-user/kube-controller-manager
+	)
+	kube-scheduler? (
+		acct-group/kube-scheduler
+		acct-user/kube-scheduler
+	)"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	kube-proxy? ( net-firewall/conntrack-tools )
+	!sys-cluster/kubeadm
+	!sys-cluster/kubectl
+	!sys-cluster/kubelet
+	!sys-cluster/kube-apiserver
+	!sys-cluster/kube-controller-manager
+	!sys-cluster/kube-proxy
+	!sys-cluster/kube-scheduler"
+
+RESTRICT+=" test"
+
+src_compile() {
+	local x
+	for x in ${AGENT} ${CLI} ${SERVICES}; do
+		use $x || continue
+		CGO_LDFLAGS="$(usex hardened '-fno-PIC ' '')" \
+			emake -j1 GOFLAGS=-v GOLDFLAGS="" LDFLAGS="" WHAT=cmd/${x}
+	done
+}
+
+src_install() {
+	local x
+	for x in ${AGENT} ${CLI} ${SERVICES}; do
+		use $x || continue
+		dobin _output/bin/${x}
+		if has ${x} ${CLI}; then
+		_output/bin/${x} completion bash > ${x}.bash || die
+		_output/bin/${x} completion zsh > ${x}.zsh || die
+			newbashcomp ${x}.bash ${x}
+			insinto /usr/share/zsh/site-functions
+			newins ${x}.zsh _${x}
+			continue
+		fi
+		newinitd "${FILESDIR}"/${x}.initd ${x}
+		newconfd "${FILESDIR}"/${x}.confd ${x}
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}"/${x}.logrotated ${x}
+		keepdir /var/log/${x}
+		if [[ "$x" =~ kubelet ]]; then
+			systemd_dounit "${FILESDIR}"/${x}.service
+			insinto /etc/kubernetes
+			newins "${FILESDIR}"/${x}.env ${x}.env
+			keepdir /etc/kubernetes/manifests
+		fi
+		if [[ $x =~ kubelet|kube-proxy ]]; then
+			keepdir /var/lib/${x}
+		fi
+		if [[ $x =~ .*apiserver|.*controller-manager|.*scheduler ]]; then
+			fowners ${x}:${x} /var/log/${x}
+		fi
+	done
+}
diff --git a/sys-cluster/kubernetes/kubernetes-1.17.9.ebuild b/sys-cluster/kubernetes/kubernetes-1.17.9.ebuild
new file mode 100644
index 000000000000..08ecc8821c16
--- /dev/null
+++ b/sys-cluster/kubernetes/kubernetes-1.17.9.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit bash-completion-r1 go-module systemd
+
+DESCRIPTION="production-grade container orchestration"
+HOMEPAGE="https://kubernetes.io"
+SRC_URI="https://github.com/kubernetes/kubernetes/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64"
+
+AGENT="kubelet"
+CLI="kubeadm kubectl"
+SERVICES="kube-apiserver kube-controller-manager kube-proxy kube-scheduler"
+IUSE="hardened"
+for x in ${AGENT} ${CLI} ${SERVICES}; do
+	IUSE+=" +${x}"
+done
+
+BDEPEND=">=dev-lang/go-1.13"
+COMMON_DEPEND="
+	kube-apiserver? (
+		acct-group/kube-apiserver
+		acct-user/kube-apiserver
+	)
+	kube-controller-manager? (
+		acct-group/kube-controller-manager
+		acct-user/kube-controller-manager
+	)
+	kube-scheduler? (
+		acct-group/kube-scheduler
+		acct-user/kube-scheduler
+	)"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	kube-proxy? ( net-firewall/conntrack-tools )
+	!sys-cluster/kubeadm
+	!sys-cluster/kubectl
+	!sys-cluster/kubelet
+	!sys-cluster/kube-apiserver
+	!sys-cluster/kube-controller-manager
+	!sys-cluster/kube-proxy
+	!sys-cluster/kube-scheduler"
+
+RESTRICT+=" test"
+
+src_compile() {
+	local x
+	for x in ${AGENT} ${CLI} ${SERVICES}; do
+		use $x || continue
+		CGO_LDFLAGS="$(usex hardened '-fno-PIC ' '')" \
+			emake -j1 GOFLAGS=-v GOLDFLAGS="" LDFLAGS="" WHAT=cmd/${x}
+	done
+}
+
+src_install() {
+	local x
+	for x in ${AGENT} ${CLI} ${SERVICES}; do
+		use $x || continue
+		dobin _output/bin/${x}
+		if has ${x} ${CLI}; then
+		_output/bin/${x} completion bash > ${x}.bash || die
+		_output/bin/${x} completion zsh > ${x}.zsh || die
+			newbashcomp ${x}.bash ${x}
+			insinto /usr/share/zsh/site-functions
+			newins ${x}.zsh _${x}
+			continue
+		fi
+		newinitd "${FILESDIR}"/${x}.initd ${x}
+		newconfd "${FILESDIR}"/${x}.confd ${x}
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}"/${x}.logrotated ${x}
+		keepdir /var/log/${x}
+		if [[ "$x" =~ kubelet ]]; then
+			systemd_dounit "${FILESDIR}"/${x}.service
+			insinto /etc/kubernetes
+			newins "${FILESDIR}"/${x}.env ${x}.env
+			keepdir /etc/kubernetes/manifests
+		fi
+		if [[ $x =~ kubelet|kube-proxy ]]; then
+			keepdir /var/lib/${x}
+		fi
+		if [[ $x =~ .*apiserver|.*controller-manager|.*scheduler ]]; then
+			fowners ${x}:${x} /var/log/${x}
+		fi
+	done
+}
diff --git a/sys-cluster/kubernetes/kubernetes-1.18.6.ebuild b/sys-cluster/kubernetes/kubernetes-1.18.6.ebuild
new file mode 100644
index 000000000000..08ecc8821c16
--- /dev/null
+++ b/sys-cluster/kubernetes/kubernetes-1.18.6.ebuild
@@ -0,0 +1,90 @@
+# Copyright 2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit bash-completion-r1 go-module systemd
+
+DESCRIPTION="production-grade container orchestration"
+HOMEPAGE="https://kubernetes.io"
+SRC_URI="https://github.com/kubernetes/kubernetes/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64"
+
+AGENT="kubelet"
+CLI="kubeadm kubectl"
+SERVICES="kube-apiserver kube-controller-manager kube-proxy kube-scheduler"
+IUSE="hardened"
+for x in ${AGENT} ${CLI} ${SERVICES}; do
+	IUSE+=" +${x}"
+done
+
+BDEPEND=">=dev-lang/go-1.13"
+COMMON_DEPEND="
+	kube-apiserver? (
+		acct-group/kube-apiserver
+		acct-user/kube-apiserver
+	)
+	kube-controller-manager? (
+		acct-group/kube-controller-manager
+		acct-user/kube-controller-manager
+	)
+	kube-scheduler? (
+		acct-group/kube-scheduler
+		acct-user/kube-scheduler
+	)"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	kube-proxy? ( net-firewall/conntrack-tools )
+	!sys-cluster/kubeadm
+	!sys-cluster/kubectl
+	!sys-cluster/kubelet
+	!sys-cluster/kube-apiserver
+	!sys-cluster/kube-controller-manager
+	!sys-cluster/kube-proxy
+	!sys-cluster/kube-scheduler"
+
+RESTRICT+=" test"
+
+src_compile() {
+	local x
+	for x in ${AGENT} ${CLI} ${SERVICES}; do
+		use $x || continue
+		CGO_LDFLAGS="$(usex hardened '-fno-PIC ' '')" \
+			emake -j1 GOFLAGS=-v GOLDFLAGS="" LDFLAGS="" WHAT=cmd/${x}
+	done
+}
+
+src_install() {
+	local x
+	for x in ${AGENT} ${CLI} ${SERVICES}; do
+		use $x || continue
+		dobin _output/bin/${x}
+		if has ${x} ${CLI}; then
+		_output/bin/${x} completion bash > ${x}.bash || die
+		_output/bin/${x} completion zsh > ${x}.zsh || die
+			newbashcomp ${x}.bash ${x}
+			insinto /usr/share/zsh/site-functions
+			newins ${x}.zsh _${x}
+			continue
+		fi
+		newinitd "${FILESDIR}"/${x}.initd ${x}
+		newconfd "${FILESDIR}"/${x}.confd ${x}
+		insinto /etc/logrotate.d
+		newins "${FILESDIR}"/${x}.logrotated ${x}
+		keepdir /var/log/${x}
+		if [[ "$x" =~ kubelet ]]; then
+			systemd_dounit "${FILESDIR}"/${x}.service
+			insinto /etc/kubernetes
+			newins "${FILESDIR}"/${x}.env ${x}.env
+			keepdir /etc/kubernetes/manifests
+		fi
+		if [[ $x =~ kubelet|kube-proxy ]]; then
+			keepdir /var/lib/${x}
+		fi
+		if [[ $x =~ .*apiserver|.*controller-manager|.*scheduler ]]; then
+			fowners ${x}:${x} /var/log/${x}
+		fi
+	done
+}