Add a kubeadm verify command

[mikedanese]

From @luxas on October 3, 2016 19:41

We probably want kubeadm verify command that users may run easily in order to check if their node satisfies the requirements kubelet has on the node.

Something like this, but maybe bundled into kubeadm for ease of use: kubernetes/kubernetes#32427

Copied from original issue: kubernetes/kubernetes#33962

[mikedanese]

From @luxas on October 3, 2016 19:42

cc @kubernetes/sig-cluster-lifecycle

[mikedanese]

Can you explain what this should do in the issue description?

[mikedanese]

From @luxas on October 3, 2016 20:23

Updated the description.
I converted it from a note in the kubeadm project, seems like I couldn't add a description when doing that.
Now fixed.

[mikedanese]

Thanks. How is this going to ineract with the nodespec verification that @kubernetes/sig-node has been working on? We should make sure this work is aligned. cc @Random-Liu

[mikedanese]

From @luxas on October 3, 2016 20:34

I thought about if we could just include it in the binary in order to get a consistent experience :)
Or if we could kubeadm just spawn the node e2e test the right way...

[mikedanese]

Linking what they've been doing and exposing it as a subcommand in kubeadm sounds good to me.

[mikedanese]

From @Random-Liu on October 4, 2016 22:10

Sorry for the delay, just saw this issue. :) This is related to kubernetes/kubernetes#28408.

The system verification will be a simple package which could be integrated into kubeadm easily. Just import and call system.Validate(). Currently, we are working on defining the list of required kernel configurations. After that, we can get #32427 in.

One question is: Where should we place the system verification logic? Should it be part of kubeadm UX or not?

1. kubeadm verify? (This issue)
2. kubelet verify? (#28408)
3. or SEPARATE_VERIFY_TOOL verify?

@dchen1107
/cc @kubernetes/sig-node

[mikedanese]

From @euank on October 4, 2016 22:34

Could kubeadm verify exist as a superset of kubelet verify? e.g. we could implement kubelet verify and test it on the node side, but we could document for users to use kubeadm verify.
IIUC the kubelet binary should exist alongside kubeadm (or if not be installed by it?) anyways.

kubeadm verify could then follow the flow of

1. Validate kubelet binary exists
2. Run kubelet verify and make sure it's happy
3. Do the above steps for any other validation tools (e.g. "cloud-provider validate" or what have you)

I think that sort of separation of concerns makes some sense, but it might be premature if there won't be any additional tools.

I do think that the less a user interacts directly with kubelet, as opposed to tools that abstract over it, the better.

[mikedanese]

From @pires on October 5, 2016 10:52

I agree with @euank, add the logic to kubelet and have kubeadm feed from there.

I also don't think it's premature but I am concerned with the ETA for kubelet verify.

[pires]

Leaving a gentle reminder that the kubelet may not be present as a binary but rather as a hyperkube container, e.g. on CoreOS.

[luxas]

Closing this since the functionality described here won't be exactly as described, instead the system verification check will go into the preflight checks in kubernetes/kubernetes#36334 and we will design another command than verify for cluster-wide conformance testing