Cherry pick of #9069 onto release-1.17 #9092
Conversation
k8s-ci-robot
added
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: justinsb The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
|
kube-apiserver doesn't expose the healthcheck via a dedicated endpoint, instead relying on anonyomous-access being enabled. That has previously forced us to enable the unauthenticated endpoint on 127.0.0.1:8080. Instead we now run a small sidecar container, which proxies /healthz and /readyz requests (only) adding appropriate authentication using a client certificate. This will also enable better load balancer checks in future, as these have previously been hampered by the custom CA certificate. Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>
justinsb
force-pushed
the
cherrypick_9069_release-1.17
branch
from
0710605
to
3f19ca6
Compare
k8s-ci-robot
removed
the
lgtm
|
Thanks for the heads up! Hopefully it'll pass this time. It wasn't a totally clean cherry-pick, e.g. I had to add wellknownusers. |
|
Yes, I noticed that during review. |
k8s-ci-robot
added
the
lgtm
|
Any ideas if this change could have affected the containerd periodic e2e? |
|
I'm seeing that the failed e2e test is having a problem pulling the new sidecar container. Perhaps the e2e test config or somesuch needs to be tweaked to use the locally built container? I'm also seeing kops-controller isn't starting. |
Cherry pick of #9069