let standalone npd use kubelet credentials #85014

dekkagaijin · 2019-11-08T21:29:18Z

This will allow for the NODE_PROBLEM_DETECTOR_TOKEN to be removed from GCE metadata, while retaining the increased visibility offered by a standalone NPD.

/kind feature
/kind cleanup
/sig cloud-provider
/area provider/gcp
/release-note-none
/priority important-soon

NONE

k8s-ci-robot · 2019-11-08T21:29:20Z

@dekkagaijin: The label(s) sig/gcp cannot be applied. These labels are supported: api-review, community/discussion, community/maintenance, community/question, cuj/build-train-deploy, cuj/multi-user, platform/aws, platform/azure, platform/gcp, platform/minikube, platform/other

In response to this:

This will allow for the NODE_PROBLEM_DETECTOR_TOKEN to be removed from GCE metadata, while retaining the increased visibility offered by a standalone NPD.

/kind feature
/sig gcp
/release-note-none
/priority important-soon

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2019-11-08T21:29:44Z

@dekkagaijin: The label(s) sig/platform/gcp cannot be applied. These labels are supported: api-review, community/discussion, community/maintenance, community/question, cuj/build-train-deploy, cuj/multi-user, platform/aws, platform/azure, platform/gcp, platform/minikube, platform/other

In response to this:

This will allow for the NODE_PROBLEM_DETECTOR_TOKEN to be removed from GCE metadata, while retaining the increased visibility offered by a standalone NPD.

/kind feature
/sig platform/gcp
/release-note-none
/priority important-soon

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2019-11-08T21:33:55Z

@dekkagaijin: The label(s) area/platform/gcp cannot be applied. These labels are supported: api-review, community/discussion, community/maintenance, community/question, cuj/build-train-deploy, cuj/multi-user, platform/aws, platform/azure, platform/gcp, platform/minikube, platform/other

In response to this:

This will allow for the NODE_PROBLEM_DETECTOR_TOKEN to be removed from GCE metadata, while retaining the increased visibility offered by a standalone NPD.

/kind feature
/kind cleanup
/sig cloud-provider
/area platform/gcp
/release-note-none
/priority important-soon

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2019-11-08T21:37:03Z

@dekkagaijin: The label(s) area/platform/gcp cannot be applied. These labels are supported: api-review, community/discussion, community/maintenance, community/question, cuj/build-train-deploy, cuj/multi-user, platform/aws, platform/azure, platform/gcp, platform/minikube, platform/other

In response to this:

This will allow for the NODE_PROBLEM_DETECTOR_TOKEN to be removed from GCE metadata, while retaining the increased visibility offered by a standalone NPD.

/kind feature
/kind cleanup
/sig cloud-provider
/area platform/gcp
/priority important-soon
NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dekkagaijin · 2019-11-08T21:44:16Z

/assign awly

awly · 2019-11-08T22:37:00Z

cluster/addons/node-problem-detector/kubelet-user-standalone/npd-binding.yaml

+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:node-problem-detector


where is this role defined?

in the parent directory's npd.yaml

awly · 2019-11-08T22:38:39Z

cluster/gce/gci/configure-helper.sh

@@ -1245,6 +1245,12 @@ current-context: service-account-context
 EOF
 }

+function setup-kubelet-user-npd-creds {


how about create-node-problem-detector-kubeconfig-from-kubelet

wangzhen127 · 2019-11-08T22:48:22Z

/assign @cheftako

Signed-off-by: Jake Sanders <jsand@google.com>

awly · 2019-11-08T23:08:11Z

/lgtm

dekkagaijin · 2019-11-08T23:28:25Z

/test pull-kubernetes-integration

dekkagaijin · 2019-11-11T19:27:23Z

@cheftako any concerns? would be helpful to get this merged in 1.17

cjcullen · 2019-11-11T23:52:31Z

/approve

dekkagaijin · 2019-11-12T17:15:58Z

Ping @wangzhen127 @cheftako

mikedanese · 2019-11-13T05:54:10Z

cluster/addons/node-problem-detector/kubelet-user-standalone/npd-binding.yaml

+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: kubelet


Why is this needed? What did it fix?

It makes sure that the kubelet user has all the permissions that NPD requires

mikedanese · 2019-11-13T05:54:57Z

cluster/gce/gci/configure-helper.sh

+function create-node-problem-detector-kubeconfig-from-kubelet {
+  echo "Creating node-problem-detector kubeconfig from /var/lib/kubelet/kubeconfig"
+  mkdir -p /var/lib/node-problem-detector
+  cp /var/lib/kubelet/kubeconfig /var/lib/node-problem-detector/kubeconfig


Why copy? Why not just configure NPD to read the kubelet's kubeconfig directly?

I figured that it'd be a larger, more confusing/fragile change. This way the used kubeconfig is always in the same location, regardless of NPD configuration

mikedanese · 2019-11-13T05:56:29Z

cluster/gce/gci/configure-helper.sh

@@ -2781,7 +2790,14 @@ function main() {
      create-kubeproxy-user-kubeconfig
    fi
    if [[ "${ENABLE_NODE_PROBLEM_DETECTOR:-}" == "standalone" ]]; then
-      create-node-problem-detector-kubeconfig ${KUBERNETES_MASTER_NAME}
+      if [[ -n "${NODE_PROBLEM_DETECTOR_TOKEN:-}" ]]; then


I'm pro just removing NODE_PROBLEM_DETECTOR_TOKEN in one swoosh and not supporting both.

IIUC that'd break this script on plain GCE

mikedanese · 2019-11-14T23:50:31Z

/approve

k8s-ci-robot · 2019-11-14T23:50:45Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cjcullen, dekkagaijin, mikedanese

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~cluster/addons/node-problem-detector/OWNERS~~ [mikedanese]
~~cluster/gce/gci/OWNERS~~ [cjcullen,mikedanese]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. labels Nov 8, 2019

k8s-ci-robot added sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Nov 8, 2019

k8s-ci-robot requested review from cjcullen and wangzhen127 November 8, 2019 21:32

k8s-ci-robot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. labels Nov 8, 2019

k8s-ci-robot added the release-note-none Denotes a PR that doesn't merit a release note. label Nov 8, 2019

k8s-ci-robot assigned awly Nov 8, 2019

awly reviewed Nov 8, 2019

View reviewed changes

k8s-ci-robot assigned cheftako Nov 8, 2019

dekkagaijin force-pushed the master branch from 58d3d03 to 9aee2ab Compare November 8, 2019 22:49

let standalone npd use kubelet credentials

42a06f5

Signed-off-by: Jake Sanders <jsand@google.com>

dekkagaijin force-pushed the master branch from 9aee2ab to 42a06f5 Compare November 8, 2019 22:50

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 8, 2019

mikedanese reviewed Nov 13, 2019

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 14, 2019

mikedanese added this to the v1.17 milestone Nov 14, 2019

k8s-ci-robot merged commit c213196 into kubernetes:master Nov 15, 2019

dekkagaijin mentioned this pull request May 11, 2020

let static kube-proxy use the kubelet's credentials #90864

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

let standalone npd use kubelet credentials #85014

let standalone npd use kubelet credentials #85014

dekkagaijin commented Nov 8, 2019 •

edited

k8s-ci-robot commented Nov 8, 2019

k8s-ci-robot commented Nov 8, 2019

k8s-ci-robot commented Nov 8, 2019

k8s-ci-robot commented Nov 8, 2019

dekkagaijin commented Nov 8, 2019

awly Nov 8, 2019

dekkagaijin Nov 8, 2019

awly Nov 8, 2019

dekkagaijin Nov 8, 2019

wangzhen127 commented Nov 8, 2019

awly commented Nov 8, 2019

dekkagaijin commented Nov 8, 2019

dekkagaijin commented Nov 11, 2019 •

edited

cjcullen commented Nov 11, 2019

dekkagaijin commented Nov 12, 2019

mikedanese Nov 13, 2019

dekkagaijin Nov 13, 2019

mikedanese Nov 13, 2019

dekkagaijin Nov 13, 2019

mikedanese Nov 13, 2019

dekkagaijin Nov 13, 2019

mikedanese commented Nov 14, 2019

k8s-ci-robot commented Nov 14, 2019

let standalone npd use kubelet credentials #85014

let standalone npd use kubelet credentials #85014

Conversation

dekkagaijin commented Nov 8, 2019 • edited

k8s-ci-robot commented Nov 8, 2019

k8s-ci-robot commented Nov 8, 2019

k8s-ci-robot commented Nov 8, 2019

k8s-ci-robot commented Nov 8, 2019

dekkagaijin commented Nov 8, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wangzhen127 commented Nov 8, 2019

awly commented Nov 8, 2019

dekkagaijin commented Nov 8, 2019

dekkagaijin commented Nov 11, 2019 • edited

cjcullen commented Nov 11, 2019

dekkagaijin commented Nov 12, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikedanese commented Nov 14, 2019

k8s-ci-robot commented Nov 14, 2019

dekkagaijin commented Nov 8, 2019 •

edited

dekkagaijin commented Nov 11, 2019 •

edited