-
Notifications
You must be signed in to change notification settings - Fork 20
kube-hunter CI job is flaky #145
Comments
So we can investigate, why kube-hunter job is sometimes taking long time to finish. Refs #145 Signed-off-by: Mateusz Gozdek <mateusz@kinvolk.io>
So we can investigate, why kube-hunter job is sometimes taking long time to finish. Refs #145 Signed-off-by: Mateusz Gozdek <mateusz@kinvolk.io>
So we can investigate, why kube-hunter job is sometimes taking long time to finish. Refs kinvolk-archives#145 Signed-off-by: Mateusz Gozdek <mateusz@kinvolk.io>
The job is killed with following logs:
I wonder there is some timeout missing for this last task... Just need to figure out a way to reproduce it, probably patch kube-hunter to figure out which task it is and then look into that. CC @surajssd |
The last task eventually finished with following result, when I tried to reproduce it:
|
It seems that Also the kube-hunter runtime doesn't seem to be deterministic:
|
Seems that some servers which
I think HTTP probe should timeout earlier than 5 minutes... |
Do you think we are missing any pre requisite checks that we should be doing before installing? |
Can you elaborate? What checks do you have in mind for example? I'm not sure if I understand. |
Created following issues in upstream:
And one PR: I also tested, that when added timeout to the discovery, then |
Which contains patch, which adds timeout when discovering kube-apiserver instances, updates kube-hunter to latest version, but has reversed patches, which breaks debug logging. The image is build from source stored in https://github.com/kinvolk/kube-hunter/tree/kinvolk-master Closes #145 Signed-off-by: Mateusz Gozdek <mateusz@kinvolk.io>
Before we deploy kube-hunter we do following checks (not extensive) but to make sure cluster is responsive: I meant do we need to add anything more here? |
No, I think those checks are fine. I believe the issue is in |
Which contains patch, which adds timeout when discovering kube-apiserver instances, updates kube-hunter to latest version, but has reversed patches, which breaks debug logging. The image is build from source stored in https://github.com/kinvolk/kube-hunter/tree/kinvolk-master Closes #145 Signed-off-by: Mateusz Gozdek <mateusz@kinvolk.io>
Which contains patch, which adds timeout when discovering kube-apiserver instances, updates kube-hunter to latest version, but has reversed patches, which breaks debug logging. The image is build from source stored in https://github.com/kinvolk/kube-hunter/tree/kinvolk-master Closes #145 Signed-off-by: Mateusz Gozdek <mateusz@kinvolk.io>
So we can investigate, why kube-hunter job is sometimes taking long time to finish. Refs #145 Signed-off-by: Mateusz Gozdek <mateusz@kinvolk.io>
It sometimes doesn't finish within 7 minutes for some reason, which makes CI job to fail. We should investigate that.
The text was updated successfully, but these errors were encountered: