Let CCM reach API server through k8s svc to avoid bad TLS cert #226
Conversation
Currently, our example CCM uses the host IP address for the Kubernetes service host. This is problematic for cases where the original master node disappears (through, say, an initial upscale and subsequent downscale of the control plane) since the certificate won't be valid for that IP address anymore. Example output showing the problem: E1215 23:06:20.726439 1 leaderelection.go:330] error retrieving resource lock kube-system/cloud-controller-manager: Get https://10.116.0.44:6443/api/v1/namespaces/kube-system/endpoints/cloud-controller-manager: x509: certificate is valid for 10.96.0.1, 67.205.137.20, 138.197.227.228, not 10.116.0.44 The solution is to not overwrite the Kubernetes service host environment variable and let CCM use the `kubernetes` service normally. This is guaranteed to work because API servers advertise their own IP address on startup, which then becomes part of the continuously reconciled `kubernetes` service's endpoint set.
k8s-ci-robot
added
release-note-none
|
Hi @timoreimann. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
k8s-ci-robot
added
the
size/XS
|
/assign @prksu |
|
/ok-to-test |
k8s-ci-robot
added
ok-to-test
|
/test pull-cluster-api-provider-digitalocean-e2e |
|
/test all |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cpanato, timoreimann The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
lgtm
What this PR does / why we need it:
Currently, our example CCM uses the host IP address for the Kubernetes service host. This is problematic for cases where the original master node disappears (through, say, an initial upscale and subsequent downscale of the control plane) since the certificate won't be valid for that IP address anymore. Example output showing the problem:
The solution is to not overwrite the Kubernetes service host environment variable and let CCM use the
kubernetesservice normally. This is guaranteed to work because API servers advertise their own IP address on startup, which then becomes part of the continuously reconciledkubernetesservice's endpoint set.Release note: