chore: backup the original ETCD encryption keys#203
Merged
IceCodeNew merged 3 commits intomasterfrom Sep 17, 2025
Merged
Conversation
Contributor
|
Caution Review failedThe pull request is closed. WalkthroughAdds a primary control-plane backup step, merges a standby encryption key into the primary encryption-provider.conf (now showing two keys), renumbers steps, restricts the apply loop to primary nodes, updates per-node remote install/backup/cleanup steps, and broadens Istio prerequisite wording. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Admin
participant PrimaryCP as Primary CP (1.1.1.1)
participant Primaries as Primary nodes (other primaries)
participant Node as Target node
participant Kube as kubelet/kube-apiserver
Admin->>PrimaryCP: Backup /etc/kubernetes/encryption-provider.conf -> encryption-provider.conf.bak
Admin->>PrimaryCP: Merge standby key -> updated encryption-provider.conf (key1,key2)
Admin->>Primaries: Push merged encryption-provider.conf
loop for each primary node
Primaries->>Node: cp /etc/kubernetes/encryption-provider.conf /etc/kubernetes/encryption-provider.conf.bak
Node->>Node: install /tmp/encryption-provider.conf -> /etc/kubernetes/encryption-provider.conf
Node->>Node: rm /tmp/encryption-provider.conf
Node->>Kube: remove kube-apiserver pod (if present) to trigger restart
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/en/install/global_dr.mdx (1)
335-343: Fix backticks in echo, handle multiple crictl IDs, and avoid hard-failing when none foundBackticks in the quoted echo trigger command substitution; crictl can return multiple IDs — remove them individually and WARN instead of exiting. Replace the block with the diff below.
- _pod_name="kube-apiserver" - _pod_id=$(sudo crictl ps --name "${_pod_name}" --no-trunc --quiet) - if [[ -z "${_pod_id}" ]]; then - echo "FATAL: could not find pod `kube-apiserver` on node $(hostname)" - exit 1 - fi - sudo crictl rm --force "${_pod_id}" - sudo systemctl restart kubelet.service + _pod_name="kube-apiserver" + _pod_ids=$(sudo crictl ps --name "${_pod_name}" --quiet) + if [[ -z "${_pod_ids}" ]]; then + echo "WARN: kube-apiserver container not found on node $(hostname)" + else + xargs -r -t -- sudo crictl rm --force <<< "${_pod_ids}" + fi + sudo systemctl restart kubelet.serviceConfirm control-plane uses crictl/containerd (or CRI-O); adjust commands if not.
🧹 Nitpick comments (5)
docs/en/install/global_dr.mdx (5)
297-299: Call out write-key ordering (first key is used for writes).Make the invariant explicit to prevent accidental write-key flips.
-3. Merge the ETCD encryption key of the standby cluster into the `/etc/kubernetes/encryption-provider.conf` file on node `1.1.1.1`, ensuring the key names are unique. +3. Merge the ETCD encryption key of the standby cluster into the `/etc/kubernetes/encryption-provider.conf` file on node `1.1.1.1`, ensuring key names are unique. + NOTE: Kubernetes uses the first key in the list for writes. Keep the current primary-cluster key first to avoid re-encrypting new data with the standby key.
315-316: Grammar: “every replica”.Minor wording fix.
-4. Make sure the new `/etc/kubernetes/encryption-provider.conf` file overwrites EVERY replicas on the control plane nodes of both clusters: +4. Make sure the new `/etc/kubernetes/encryption-provider.conf` file overwrites every replica on the control plane nodes of both clusters:
321-323: Grammar: remove the article before an IP.-# Since the 1.1.1.1 has already been configured to use both of the ETCD encryption keys, +# Since 1.1.1.1 has already been configured to use both ETCD encryption keys,
332-334: Deterministic backup perms; ensure target dir exists.Guarantee 600 perms on the backup and create the directory defensively.
- sudo /bin/cp -f /etc/kubernetes/encryption-provider.conf /etc/kubernetes/encryption-provider.conf.bak - sudo install -o root -g root -m 600 /tmp/encryption-provider.conf /etc/kubernetes/encryption-provider.conf + sudo mkdir -p /etc/kubernetes + sudo install -o root -g root -m 600 /etc/kubernetes/encryption-provider.conf /etc/kubernetes/encryption-provider.conf.bak + sudo install -o root -g root -m 600 /tmp/encryption-provider.conf /etc/kubernetes/encryption-provider.conf sudo rm -f /tmp/encryption-provider.conf
347-358: Duplicate step number; same backtick bug here.Renumber and apply the same robust restart snippet.
-4. Restart the kube-apiserver on node 1.1.1.1 +5. Restart the kube-apiserver on node 1.1.1.1 @@ - _pod_name="kube-apiserver" - _pod_id=$(sudo crictl ps --name "${_pod_name}" --no-trunc --quiet) - if [[ -z "${_pod_id}" ]]; then - echo "FATAL: could not find pod `kube-apiserver` on node $(hostname)" - exit 1 - fi - sudo crictl rm --force "${_pod_id}" - sudo systemctl restart kubelet.service + _pod_name="kube-apiserver" + _pod_ids=$(sudo crictl ps --name "${_pod_name}" --quiet) + if [[ -z "${_pod_ids}" ]]; then + echo "WARN: kube-apiserver container not found on node $(hostname)" + else + xargs -r -t -- sudo crictl rm --force <<< "${_pod_ids}" + fi + sudo systemctl restart kubelet.service
IceCodeNew
added a commit
that referenced
this pull request
Sep 17, 2025
* chore: backup the original ETCD encryption keys * chore * chore: apply the suggestions of CodeRabbit
IceCodeNew
added a commit
that referenced
this pull request
Sep 17, 2025
IceCodeNew
added a commit
that referenced
this pull request
Sep 17, 2025
* chore: backup the original ETCD encryption keys * chore * chore: apply the suggestions of CodeRabbit
IceCodeNew
added a commit
that referenced
this pull request
Sep 17, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit