Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DaemonSets don't handle service account secret rotation well #62915

Closed
mikedanese opened this issue Apr 20, 2018 · 7 comments
Closed

DaemonSets don't handle service account secret rotation well #62915

mikedanese opened this issue Apr 20, 2018 · 7 comments
Assignees
@awly @mikedanese
Labels
kind/feature Categorizes issue or PR as related to a new feature. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/auth Categorizes an issue or PR as relevant to SIG Auth.

Comments

@mikedanese
Copy link
Member

No description provided.

@k8s-ci-robot k8s-ci-robot added the needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label Apr 20, 2018
@mikedanese mikedanese added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Apr 20, 2018
@k8s-ci-robot k8s-ci-robot removed the needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label Apr 20, 2018
@mikedanese mikedanese self-assigned this Apr 20, 2018
@liggitt
Copy link
Member

liggitt commented Apr 21, 2018

Any details about how this differs from the other workload controllers?

@liggitt liggitt added the sig/apps Categorizes an issue or PR as relevant to SIG Apps. label May 3, 2018
@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 1, 2018
@fejta-bot
Copy link

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

@k8s-ci-robot k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Aug 31, 2018
@mikedanese mikedanese removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Aug 31, 2018
@mikedanese mikedanese mentioned this issue Sep 1, 2018
Closed
@liggitt liggitt added the kind/feature Categorizes issue or PR as related to a new feature. label Oct 18, 2018
@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 16, 2019
@awly
Copy link
Contributor

awly commented Jan 18, 2019

/remove-lifecycle stale

@liggitt or @mikedanese could you add some specifics?
What exactly are DaemonSets missing during rotation?

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 18, 2019
@mikedanese
Copy link
Member Author

This is fixed by new service account token volumes.

@mikedanese
Copy link
Member Author

mikedanese commented Feb 2, 2019 •
edited
Loading

What exactly are DaemonSets missing during rotation?

The problem is that many DaemonSets do not get evicted during node upgrades. Credential rotation + node upgrade works for rotating anything that gets evicted, but some critical daemons lie around with secret volumes that reference secrets that don't exist.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@awly awly

@mikedanese mikedanese

Labels
kind/feature Categorizes issue or PR as related to a new feature. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/auth Categorizes an issue or PR as relevant to SIG Auth.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@liggitt @awly @mikedanese @k8s-ci-robot @fejta-bot