-
Notifications
You must be signed in to change notification settings - Fork 4.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cannot enable IRSA on existing cluster #13101
Comments
Most likely that would be possible to workaround if // Identifier of the service account token issuer. The issuer will assert this identifier
// in "iss" claim of issued tokens. This value is a string or URI.
ServiceAccountIssuer *string `json:"serviceAccountIssuer,omitempty" flag:"service-account-issuer"` in https://pkg.go.dev/k8s.io/kops/pkg/apis/kops#KubeAPIServerConfig would be
In that case specifying both old and new issuer would probably allow to rollout cluster without breaking all existing service accounts tokens |
I have not had much luck with that approach, unfortunately. But if you can make it work, I would be very happy to help adding support for a graceful migration path. |
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
@dmitriishaburov I'm curious to know if you've solved this problem. I'm also trying to enable IRSA on a cluster running v1.21.5 |
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle rotten |
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /close |
@k8s-triage-robot: Closing this issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/kind bug
1. What
kops
version are you running? The commandkops version
, will displaythis information.
Version 1.21.2
2. What Kubernetes version are you running?
kubectl version
will print theversion if a cluster is running or provide the Kubernetes version specified as
a
kops
flag.Client Version: v1.22.3
Server Version: v1.21.6
3. What cloud provider are you using?
AWS
4. What commands did you run? What is the simplest way to reproduce this issue?
On existing cluster:
5. What happened after the commands executed?
Cluster failed to update, was forced to rollback changes with verification disabled.
6. What did you expect to happen?
Cluster updated successfuly and I'm able to configure IRSA
7. Please provide your cluster manifest. Execute
kops get --name my.example.com -o yaml
to display your cluster manifest.You may want to remove your cluster name and other sensitive information.
The text was updated successfully, but these errors were encountered: