Etcd certs: use symlink in kubeadm config #12044
Conversation
k8s-ci-robot
added
release-note
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ant31 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
approved
|
/label ci-extended |
|
/ok-to-test |
k8s-ci-robot
added
the
ok-to-test
ant31
force-pushed
the
symlinketcd
branch
5 times, most recently
from
5988197 to
5ef28e0
Compare
|
/cherrypick release-2.27 Review comments are not taken into account by the cherrypicker apparently... |
|
@VannTen: once the present PR merges, I will cherry-pick it on top of In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
ant31
force-pushed
the
symlinketcd
branch
2 times, most recently
from
d608ac8 to
dd1b894
Compare
|
/lgtm |
k8s-ci-robot
added
the
lgtm
| # Symlinks to etcd certs | ||
| kube_etcd_cacert_file: "kube-client-ca.pem" | ||
| kube_etcd_cert_file: "kube-client-cert.pem" | ||
| kube_etcd_key_file: "kube-client-key.pem" |
There was a problem hiding this comment.
Seems to conflict with cilium / calico (with etcd datatstore presumably), given the test results.
There was a problem hiding this comment.
yes, I'll have to dig a bit more here. maybe need to run the symlink tasks from the calico/cilium roles
There was a problem hiding this comment.
yes, I'll have to dig a bit more here. maybe need to run the symlink tasks from the calico/cilium roles
Was going to suggest this. Currently calico and cilium both use state: hard instead of state: link, not sure if they need to be hard links, but I'd prefer to convert them to symbolic links (state: link) if possible as symbolic has fewer limitations, such as the ability to create the link under mount paths with destinations backed by different devices.
What type of PR is this?
/kind bug
What this PR does / why we need it:
kubeadm is fetching the configuration from the cluster instead of reading the file locally.
The configuration must be valid on every nodes, this PR creates symbolic link to the etcd certs and use the symbolic link inside the kubeadm-config.
Introduce a new variable
etcd_cert_pathsthat keep track of the absolute path to certs.Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?: