Node mode controllers #5867
Node mode controllers #5867
Conversation
k8s-ci-robot
added
cncf-cla: yes
| // @check if the node authorization is enabled and if so enable the tokencleaner controller (disabled by default) | ||
| // This is responsible for cleaning up bootstrap tokens which have expired | ||
| if b.Context.IsKubernetesGTE("1.10") { | ||
| if fi.BoolValue(clusterSpec.KubeAPIServer.EnableBootstrapAuthToken) && len(kcm.Controllers) <= 0 { |
There was a problem hiding this comment.
If a user has enabled bootstrap tokens for their cluster and provides a list of KCM controllers (excluding the tokencleaner), should we still append to the list here, or just take their literal set of controllers to apply?
There was a problem hiding this comment.
A list of controllers to enable. '*' enables all on-by-default controllers, 'foo' enables the controller named 'foo', '-foo' disables the controller named 'foo'.
All controllers: attachdetach, bootstrapsigner, clusterrole-aggregation, cronjob, csrapproving, csrcleaner, csrsigning, daemonset, deployment, disruption, endpoint, garbagecollector, horizontalpodautoscaling, job, namespace, nodeipam, nodelifecycle, persistentvolume-binder, persistentvolume-expander, podgc, pv-protection, pvc-protection, replicaset, replicationcontroller, resourcequota, route, service, serviceaccount, serviceaccount-token, statefulset, tokencleaner, ttl, ttl-after-finished
Disabled-by-default controllers: bootstrapsigner, tokencleanerSo only two controllers are actually disabled by default .. I'm going on the basis that if they are setting the controllers flag they know what they are doing, or at the very least taking responsibility for it ..
There was a problem hiding this comment.
If we do that: documentation should be very clear on what and how this is going to affect the results. Also: needs to be backwards compatible to not break things as “know what you are doing” is good, but so many people implement it in pipelines and scripts - especially if they get this deep into the parameters.
|
Ah sorry I missed this in the last PR! Looks good, just one minor comment and will wait for tests to finish. :) |
|
Once the NodeAuthorizer / Bootstrap tokens work is moved to a more stable release within kops, will need to make sure enabling the KCM tokencleaner controller is highlighted in the docs. |
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: gambol99, KashifSaadat The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
controllersflag to a[]string, not the last PR wouldn't have worked as theflagbuilderdoes not handle pointers to a string slice.