Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: use super-admin.conf for kube-vip on first master when it exists #11422

Merged
merged 4 commits into from
Aug 11, 2024
Merged

fix: use super-admin.conf for kube-vip on first master when it exists #11422

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e37e5b0
fix: use super-admin.conf for kube-vip when it exists
Seljuke Aug 7, 2024
e4e8682
Mathieu Parent add as co-author
Seljuke Aug 7, 2024
c620534
template change for readability
Seljuke Aug 7, 2024
00c94f1
fix lint error
Seljuke Aug 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions roles/kubernetes/node/tasks/loadbalancer/kube-vip.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,32 @@
- kube_proxy_mode == 'ipvs' and not kube_proxy_strict_arp
- kube_vip_arp_enabled

- name: Kube-vip | Check if super-admin.conf exists
stat:
path: "{{ kube_config_dir }}/super-admin.conf"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

super-admin.conf will be created in each cp node?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it does't get created on each cp node and only on first node, after first cp node initialize RBAC fully configured and we can use the admin.conf on other nodes.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The kube-vip pod run on all the cp node, right? you mean that the kube-vip pod on the first cp node is use the super-admin.conf, and the kube-vip pod on the other cp nodes is use the admin.conf, right?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cyclinder Yes.

NB: But this is only necessary on bootstrap, i.e before admin.conf has cluster-admin privileges.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got, thank you for your clarification!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

failed_when: false
changed_when: false
register: stat_kube_vip_super_admin

- name: Kube-vip | Check if kubeadm has already run
stat:
path: "/var/lib/kubelet/config.yaml"
get_attributes: no
get_checksum: no
get_mime: no
register: kubeadm_already_run

- name: Kube-vip | Set admin.conf
set_fact:
kube_vip_admin_conf: admin.conf

- name: Kube-vip | Set admin.conf for first Control Plane
set_fact:
kube_vip_admin_conf: super-admin.conf
when:
- inventory_hostname == groups['kube_control_plane'] | first
- (stat_kube_vip_super_admin.stat.exists and stat_kube_vip_super_admin.stat.isreg) or (not kubeadm_already_run.stat.exists )

- name: Kube-vip | Write static pod
template:
src: manifests/kube-vip.manifest.j2
Expand Down
2 changes: 1 addition & 1 deletion roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,6 @@ spec:
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes/admin.conf
path: /etc/kubernetes/{{kube_vip_admin_conf}}
name: kubeconfig
status: {}