Kubernetes: pods insecure

[chrisohaver]

Should we add pods insecure to te manifest here?

Things to consider:

• it’s an insecure option, so for new installs probably not.
• for upgrades of a k8s cluster that already already uses it, we need to include it ( or pods verified)
• I think this behavior is deprecated, per the dns spec

[fturib]

We added this option in kubeadm manifest to be on parity with kube-dns behavior.

Currently that will impact all installations : new and maybe upgrades (upgrade without translation of configmap).

[fturib]

I guess we can plan to remove it if we think that is more secure ...
but we need to find the path:

• explain the use cases impacted and the choice to not use it
• prepare to change the default manifest kubeadm/kube-up/etc ... for v1.10
• change appropriately the e2e tests of k8s that will fail if that option is not on.

[chrisohaver]

Oh. I thought the idea was only to make it affect upgrades (kubadm upgrade) and not new installs (kubeadm init) ... I recall discussing that, perhaps we decided to do it for both?

[chrisohaver]

Yes, I suppose we should add it, even for new installs for the sake of parity. The spec says ...

“This behavior is deprecated but is required to satisfy this specification. It will be removed from a future version of the specification.”

... so we will remove it as an option at some time in the future.

Perhaps we should consider making ‘pods insecure’ the default coredns pod mode... since it will effectively be the default configuration for all deployments now (upgrade and install).