Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

refactor(apiserver): disable insecure port #95856

Merged
merged 1 commit into from Oct 29, 2020
Merged

refactor(apiserver): disable insecure port #95856

merged 1 commit into from Oct 29, 2020

Conversation

knight42
Copy link
Member

@knight42 knight42 commented Oct 25, 2020 •
edited

What type of PR is this?

/kind cleanup
/kind deprecation

What this PR does / why we need it:

As @liggitt suggests #91506 (comment):

Also, I would recommend leaving the inert flag in place for a few releases even after the insecure serving code is removed. I want to avoid accidents where people stop setting --insecure-port=0 too early in response to warnings about the flag being removed, and accidentally opt back into the default behavior of enabling the insecure port.

I decide to leave the insecure flags intact but make apiserver stop serving on insecure port.

Which issue(s) this PR fixes:

xref: #91506

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

ACTION REQUIRED: The kube-apiserver ability to serve on an insecure port, deprecated since v1.10, has been removed. The insecure address flags `--address` and `--insecure-bind-address` have no effect in kube-apiserver and will be removed in v1.24. The insecure port flags `--port` and `--insecure-port` may only be set to 0 and will be removed in v1.24.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Oct 25, 2020
@knight42
Copy link
Member Author

/cc @tallclair

@k8s-ci-robot k8s-ci-robot added area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Oct 25, 2020
@knight42 knight42 force-pushed the refactor/disable-apiserver-insecure-port branch from 498668c to 9560174 Compare October 25, 2020 10:09
@knight42 knight42 changed the title refactor(apiserver): insecure port is disabled by default refactor(apiserver): disable insecure port by default Oct 25, 2020
@k8s-ci-robot k8s-ci-robot added area/provider/gcp Issues or PRs related to gcp provider sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. labels Oct 25, 2020
@knight42
Copy link
Member Author

/priority important-soon

@k8s-ci-robot k8s-ci-robot added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Oct 25, 2020
@liggitt
Copy link
Member

liggitt commented Oct 26, 2020

It might be better to disable insecure port by default first, and then completely remove it after a few releases.

I don't think we want a multi-stage rollout of this... that will lead people to flip their invocations to explicitly enable the insecure port, which is not desired.

@dims
Copy link
Member

dims commented Oct 26, 2020

+1 to what @liggitt said!

@knight42 knight42 force-pushed the refactor/disable-apiserver-insecure-port branch from e525823 to 4273e50 Compare October 26, 2020 15:32
@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. area/test sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. labels Oct 26, 2020
@knight42
refactor(apiserver): ignore the insecure flags
cfc2b33 
Leave the insecure flags intact but stop serving on insecure port.
@knight42 knight42 force-pushed the refactor/disable-apiserver-insecure-port branch from 62c3c3d to cfc2b33 Compare October 29, 2020 15:21
@liggitt
Copy link
Member

liggitt commented Oct 29, 2020

Updated release note

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 29, 2020
@k8s-ci-robot k8s-ci-robot merged commit 1968e96 into kubernetes:master Oct 29, 2020
@k8s-ci-robot k8s-ci-robot added this to the v1.20 milestone Oct 29, 2020
@knight42 knight42 deleted the refactor/disable-apiserver-insecure-port branch October 29, 2020 22:46
@knight42 knight42 mentioned this pull request Oct 30, 2020
Closed
@github-actions github-actions bot mentioned this pull request Nov 3, 2020
Open
@xing-yang xing-yang mentioned this pull request Nov 3, 2020
Closed
@liggitt liggitt mentioned this pull request Nov 5, 2020
Closed
@neolit123
Copy link
Member

@liggitt i think we should prefix the release note with action required.

@liggitt liggitt added release-note-action-required Denotes a PR that introduces potentially breaking changes that require user action. and removed release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Nov 5, 2020
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-action-required Denotes a PR that introduces potentially breaking changes that require user action. labels Nov 5, 2020
@liggitt
Copy link
Member

liggitt commented Nov 5, 2020

weird... I did with release-note-action-required but the bot didn't add the right label

@k8s-ci-robot k8s-ci-robot added release-note-action-required Denotes a PR that introduces potentially breaking changes that require user action. and removed release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Nov 5, 2020
@knight42
Copy link
Member Author

knight42 commented Nov 5, 2020

looks like we have to modify the release note.

@wilsonehusin wilsonehusin mentioned this pull request Dec 3, 2020
Merged
@liggitt liggitt mentioned this pull request Jan 7, 2021
Closed
@neolit123 neolit123 mentioned this pull request Jan 8, 2021
Closed
@floryut floryut mentioned this pull request Jan 18, 2021
Merged
airshipbot pushed a commit to airshipit/promenade that referenced this pull request Apr 23, 2021
@philsphicas
Stop using kube-apiserver insecure-port
fd9f3d6 
The tiller container in the armada bootstrap pod relies on the insecure
port that kube-apiserver once listened on by default. The kube-apiserver
ability to serve on an insecure port, deprecated since v1.10, has been
removed in v1.20. [0]

This change updates the armada bootstrap pod to use the secure port
instead.

0: kubernetes/kubernetes#95856

Change-Id: I6a37fa4e7f97c7aaa3cd0f61b56214483a7dc217
@hidalgopl hidalgopl mentioned this pull request Aug 9, 2021
Closed
@liggitt liggitt mentioned this pull request Aug 24, 2021
Closed
@pacoxu pacoxu mentioned this pull request Dec 24, 2021
Closed
@sebrandon1 sebrandon1 mentioned this pull request Sep 13, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tallclair tallclair Awaiting requested review from tallclair

@cheftako cheftako Awaiting requested review from cheftako

@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr

@deads2k deads2k Awaiting requested review from deads2k

@lavalamp lavalamp Awaiting requested review from lavalamp

@mfojtik mfojtik Awaiting requested review from mfojtik

@liggitt liggitt Awaiting requested review from liggitt

Assignees

@liggitt liggitt

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note-action-required Denotes a PR that introduces potentially breaking changes that require user action. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/node Categorizes an issue or PR as relevant to SIG Node. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
v1.20
Development

Successfully merging this pull request may close these issues.

None yet
8 participants
@knight42 @liggitt @dims @cheftako @fedebongio @deads2k @k8s-ci-robot @neolit123