Allow a flag that forces kubelet to have a valid kubeconfig #30798

smarterclayton · 2016-08-17T19:09:24Z

--require-kubeconfig forces the kubelet to use the kubeconfig for all
APIserver communication, and exit cleanly. Allows cluster lifecycle to loop waiting for config to be available.

Fixes #30515

A follow up PR will handle the issue discovered where the DefaultCluster rules applied to kubeconfig allow a malicious party who can bind to localhost:8080 to take advantage of an admin misconfiguration.

@lukemarsden @mikedanese

This change is

The Kubelet now supports the `--require-kubeconfig` option which reads all client config from the provided `--kubeconfig` file and will cause the Kubelet to exit with error code 1 on error.  It also forces the Kubelet to use the server URL from the kubeconfig file rather than the  `--api-servers` flag.  Without this flag set, a failure to read the kubeconfig file would only result in a warning message.

In a future release, the value of this flag will be defaulted to `true`.

smarterclayton · 2016-08-17T19:14:12Z

Matching priority of issue.

lukemarsden · 2016-08-17T19:44:27Z

Thanks @smarterclayton, LGTM!

smarterclayton · 2016-08-17T19:54:08Z

cmd/kubelet/app/server.go

+			}
+		}
+
+		cfg, err := UnsecuredKubeletConfig(s)


We want the bootstrapping path to return a single error, so I moved this below so we don't get extraneous output from this part before we check the config (in bootstrapping it'll be common not to have a kube config)

--require-kubeconfig forces the kubelet to use the kubeconfig for all APIserver communication, and exit cleanly.

mikedanese · 2016-08-17T20:46:49Z

cmd/kubelet/app/server.go

@@ -314,9 +313,6 @@ func run(s *options.KubeletServer, kcfg *KubeletConfig) (err error) {
 	if s.ExitOnLockContention && s.LockFilePath == "" {
 		return errors.New("cannot exit on lock file contention: no lock file specified")
 	}
-	if err := checkPermissions(); err != nil {


why move this?

Just to get the error message to be below the kubeconfig message, so that if we are in a crash loop we don't print that message before we exit.

mikedanese · 2016-08-17T20:49:26Z

Please add a release note.

mikedanese · 2016-08-17T20:49:50Z

@k8s-bot ok to test, issue: #IGNORE

tests never started.

smarterclayton · 2016-08-17T22:13:20Z

@k8s-bot test this issue #30462

smarterclayton · 2016-08-17T22:52:13Z

@k8s-bot test this issue #30462

mikedanese · 2016-08-17T22:55:15Z

cmd/kubelet/app/options/options.go

+	fs.Var(&s.AuthPath, "auth-path", "Path to .kubernetes_auth file, specifying how to authenticate to API server.")
+	fs.MarkDeprecated("auth-path", "will be removed in a future version")
+	fs.StringSliceVar(&s.APIServerList, "api-servers", []string{}, "List of Kubernetes API servers for publishing events, and reading pods and services. (ip:port), comma separated.")
+	fs.MarkDeprecated("api-servers", "Use --kubeconfig instead. Will be removed in a future version.")


Last I checked auth-path has been deprecated since 1.2 (two releases). Can we just remove it in 1.4? (I already did this in #29216, let me know if I shouldn't).

Ok will do.

k8s-bot · 2016-08-18T00:12:51Z

GCE e2e build/test passed for commit a66828d.

k8s-github-robot · 2016-08-18T04:30:54Z

@k8s-bot test this [submit-queue is verifying that this PR is safe to merge]

k8s-bot · 2016-08-18T05:06:39Z

GCE e2e build/test passed for commit a66828d.

k8s-github-robot · 2016-08-18T05:07:07Z

Automatic merge from submit-queue

lukemarsden · 2016-08-18T07:57:32Z

@smarterclayton the release note calls it --force-kubeconfig but the flag is called --require-kubeconfig, you may want to update the release note.

lukemarsden · 2016-08-18T07:57:41Z

Thanks for doing this btw!

Automatic merge from submit-queue Do not go into standalone mode when `--require-kubeconfig` is passed **What this PR does / why we need it**: We have change how missing `--api-servers` is treated with introduction of `--require-kubeconfig` (#30798), however we haven't introduced explicit `--standalone` flag for backwards-compatibility reasons. Right now, setting `--kubeconfig` and`--require-kubeconfig` still gets kubelet into standalone mode. In practice this means that it doesn't get to update `nodeInfo` and thereby may refuse to admit pods which had been assigned to it by the scheduler. For example, if you update labels for that given node, and try to use affinity or `NodeLabels` on a pod, it won't get to run. **Which issue this PR fixes**: fixes #32085 **Special notes for your reviewer**: This fix is only until we introduce `--standalone` flag. **Release note**:  ```release-note NONE ```

googlebot added the cla: yes label Aug 17, 2016

smarterclayton force-pushed the fix_kubeconfig branch from 3b023aa to 77ac7e1 Compare August 17, 2016 19:10

k8s-github-robot assigned yujuhong Aug 17, 2016

k8s-github-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. release-note-label-needed labels Aug 17, 2016

smarterclayton added the priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. label Aug 17, 2016

smarterclayton force-pushed the fix_kubeconfig branch from 77ac7e1 to bd84689 Compare August 17, 2016 19:28

smarterclayton assigned mikedanese Aug 17, 2016

smarterclayton reviewed Aug 17, 2016
View reviewed changes

Allow a flag that forces kubelet to have a valid kubeconfig

a66828d

--require-kubeconfig forces the kubelet to use the kubeconfig for all APIserver communication, and exit cleanly.

smarterclayton force-pushed the fix_kubeconfig branch from bd84689 to a66828d Compare August 17, 2016 20:27

k8s-github-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 17, 2016

mikedanese reviewed Aug 17, 2016
View reviewed changes

mikedanese added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 17, 2016

k8s-github-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 17, 2016

mtaufen mentioned this pull request Aug 17, 2016

kubelet with --kubeconfig=... still requires --api-servers=... #30515

Closed

smarterclayton added release-note Denotes a PR that will be considered when it comes time to generate release notes. lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed release-note-label-needed labels Aug 17, 2016

k8s-github-robot mentioned this pull request Aug 17, 2016

[k8s.io] Probing container should *not* be restarted with a /healthz http liveness probe [Conformance] {E2eNode Suite} #30714

Closed

mikedanese reviewed Aug 17, 2016
View reviewed changes

liggitt mentioned this pull request Aug 18, 2016

Implement TLS bootstrap for kubelet using --bootstrap-auth-token #30094

Closed

k8s-github-robot merged commit ec4d645 into kubernetes:master Aug 18, 2016

bgrant0607 mentioned this pull request Aug 18, 2016

Add --wait-for-kubeconfig (fix #30515) #30616

Closed

errordeveloper mentioned this pull request Sep 6, 2016

Do not go into standalone mode when --require-kubeconfig is passed #32102

Merged

dims mentioned this pull request Nov 14, 2016

Kubelet won't read apiserver from kubeconfig #36745

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow a flag that forces kubelet to have a valid kubeconfig #30798

Allow a flag that forces kubelet to have a valid kubeconfig #30798

smarterclayton commented Aug 17, 2016 •

edited

Loading

smarterclayton commented Aug 17, 2016

lukemarsden commented Aug 17, 2016

smarterclayton Aug 17, 2016

mikedanese Aug 17, 2016

smarterclayton Aug 17, 2016

mikedanese Aug 17, 2016

mikedanese commented Aug 17, 2016

mikedanese commented Aug 17, 2016

smarterclayton commented Aug 17, 2016

smarterclayton commented Aug 17, 2016

mikedanese Aug 17, 2016

mtaufen Aug 18, 2016 •

edited

Loading

smarterclayton Aug 18, 2016 via email

mtaufen Aug 18, 2016

k8s-bot commented Aug 18, 2016

k8s-github-robot commented Aug 18, 2016

k8s-bot commented Aug 18, 2016

k8s-github-robot commented Aug 18, 2016

lukemarsden commented Aug 18, 2016

lukemarsden commented Aug 18, 2016

Allow a flag that forces kubelet to have a valid kubeconfig #30798

Allow a flag that forces kubelet to have a valid kubeconfig #30798

Conversation

smarterclayton commented Aug 17, 2016 • edited Loading

smarterclayton commented Aug 17, 2016

lukemarsden commented Aug 17, 2016

smarterclayton Aug 17, 2016

Choose a reason for hiding this comment

mikedanese Aug 17, 2016

Choose a reason for hiding this comment

smarterclayton Aug 17, 2016

Choose a reason for hiding this comment

mikedanese Aug 17, 2016

Choose a reason for hiding this comment

mikedanese commented Aug 17, 2016

mikedanese commented Aug 17, 2016

smarterclayton commented Aug 17, 2016

smarterclayton commented Aug 17, 2016

mikedanese Aug 17, 2016

Choose a reason for hiding this comment

mtaufen Aug 18, 2016 • edited Loading

Choose a reason for hiding this comment

smarterclayton Aug 18, 2016 via email

Choose a reason for hiding this comment

mtaufen Aug 18, 2016

Choose a reason for hiding this comment

k8s-bot commented Aug 18, 2016

k8s-github-robot commented Aug 18, 2016

k8s-bot commented Aug 18, 2016

k8s-github-robot commented Aug 18, 2016

lukemarsden commented Aug 18, 2016

lukemarsden commented Aug 18, 2016

smarterclayton commented Aug 17, 2016 •

edited

Loading

mtaufen Aug 18, 2016 •

edited

Loading