Kubeadm HA ( high availability ) checklist

[timothysc]

The following is a checklist for kubeadm support for deploying HA-clusters. This a distillation of action items from:
https://docs.google.com/document/d/1lH9OKkFZMSqXCApmSXemEDuy9qlINdm5MfWWGrK3JYc/edit#heading=h.8hdxw3quu67g

but there may be more.

New Features:

• Option enable active<>passive locking via ConfigMaps RFE: Option allow components(sched+cm) to lock on ConfigMaps on startup kubernetes#44857
  PR: Allow kcm and scheduler to lock on ConfigMaps. kubernetes#45739
  • Enable support to ComponentsConfigs to be loaded from ConfigMaps
    https://docs.google.com/document/d/1arP4T9Qkp2SovlJZ_y790sBeiWXDO6SG10pZ_UUU-Lc/edit?ts=59110d75#heading=h.xgjl2srtytjt
• Add support to standup etcd operator RFE: Boot-strapping etcd cluster + operator #254
  PR: Add etcd-operator to kubeadm kubernetes#45665
• Define exact initialization flow (remove explicit migration step)

Contentious:

• Handle the smart client vs. endpoints/proxy/apiserver discovery. ("don't require a load balancer between cluster and control plane and still be HA" kubernetes#18174 & more)

Extending Support & Documentation:

• Update documentation to list supported best practices on LB configuration Document best practices on LB configuration(s).  website#3607
• Allow input options to standup HA cluster using existing etcd bootstrap endpoint
  • Kubeadm multi master support and bug fixes. kubernetes#44793
• Make secrets more secure so we can pass secrets (see sig-auth) Add an AEAD encrypting transformer for storing secrets encrypted at rest kubernetes#41939

Cleanup cruft:

• Remove docs and contrib references to older HA.

/cc @kubernetes/sig-cluster-lifecycle-feature-requests

[timothysc]

/assign @timothysc @jamiehannaford

[jamiehannaford]

@timothysc In order to do Enable support to ComponentsConfigs to be loaded from ConfigMaps, doesn't both the controller-manager and scheduler need to be able to boot their config from a configmap first? Or is the plan just to add in the configmap manifests to kubeadm so that we can use the new leadership election feature, and pave the way for future configmap use as and when it's implemented?

[timothysc]

@jamiehannaford There are 2 parts.

1. Part is to just load Controller Manager and Scheduler from a file. The plan of record is to use a serialized ComponentConfig object for this. Once that work is done.. ~ 1.8 @mikedanese ? Combined with @ncdc 's example on the proxy we should be able to transition the other components.

2. From there just volume mounting a ConfigMap will allow this load and also provide the locking location.

[ncdc]

I do hope to have time to work on ComponentConfig for all the remaining components over the next couple of releases.

[jamiehannaford]

@ncdc @timothysc Is there a wider epic issue for the componentconfig stuff?

[timothysc]

@jamiehannaford Yes - https://docs.google.com/document/d/1arP4T9Qkp2SovlJZ_y790sBeiWXDO6SG10pZ_UUU-Lc/edit?ts=59110d75#heading=h.xgjl2srtytjt

[jamiehannaford]

@timothysc I've seen the Google doc, I meant a Github issue for tracking work across different components