-
Notifications
You must be signed in to change notification settings - Fork 40k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
federation: Updating federation-controller-manager to use secret to get federation-apiserver's kubeconfig #26819
federation: Updating federation-controller-manager to use secret to get federation-apiserver's kubeconfig #26819
Conversation
…n-apiserver's kubeconfig
53f0768
to
98c9fbb
Compare
LGTM. Thanks @nikhiljindal! |
@k8s-bot test this [submit-queue is verifying that this PR is safe to merge] |
GCE e2e build/test passed for commit 98c9fbb. |
Automatic merge from submit-queue |
@nikhiljindal I am a little confused for this change, per my understand we did not support secret in federation-apiserver right? how can you create the secret and retrieve it? are we going to add the support?
|
By reading the e2e code, it seems now we already require a bootstrap k8s cluster to boot federation? and the code is load the info from the bootstrap cluster. sorry for the noise as my info is out-of-date. |
Yes you are right. We need a bootstrap k8s cluster. The secret containing kubeconfig for federation-apiserver is stored in the bootstrap k8s apiserver. But it is not intuitive. We will move it to federation-apiserver when we start supporting secrets in federation-apiserver. |
Yeah, it's super important to move those secrets into the ubernetes control On Mon, Jun 6, 2016 at 10:37 AM, Nikhil Jindal notifications@github.com
|
@nikhiljindal Does this PR require action by the user when upgrading from 1.2.x to 1.3.0? (Think about non-developer users.) If so, please edit your first comment to have a release-note block, like in #28132. If it is just an optional feature, please change the label to just release-note. If it is not a complete feature by itself, then apply "release-note-none" label instead. |
@erictune Changed the label to release-note-none @nikhiljindal and others who might be interested. Thought: we should consider maintaining a federation change log (or keep the federation release note compiled) to make the life of release czar easier. |
Fixing the credentials problem: #26762 (comment).
Admin will create a secret with the name "federation-apiserver-secret" in the k8s cluster hosting the federation control plane. This secret will contain the kubeconfig to access federation-apiserver.
federation-controller-manager will use this secret to contact the federation-apiserver.
This flow is same as the one used by all federation-controllers to contact k8s apiservers that are part of the federation.
cc @kubernetes/sig-cluster-federation @lavalamp @erictune @colhom