kubeadm: kube-proxy needs to know the pod subnet CIDR

[pires]

What this PR does / why we need it: kube-proxy 1.5 has a new flag cluster-cidr that isn't specified by kubeadm, thus resulting in bug kubernetes/kubeadm#102.

Which issue this PR fixes: fixes kubernetes/kubeadm#102

Special notes for your reviewer:
/cc @luxas @dmmcquay

[k8s-reviewable]

This change is 

[amacneil]

This might be a noob question, but should the kube-proxy --cluster-cidr be set to match the kubeadm --pod-network-cidr or --service-cidr?

[pires]

@amacneil the pod network. Let me remind you the service network is already known to the API server.

[pires]

@luxas ping

[pires]

ping @luxas

[luxas]

As I mentioned on Slack, this doesn't fix the issue in most cases.

kubeadm has no idea about the pod subnet except when using flannel in k8s api backed mode.
In all other cases, kubeadm don't know what the CIDR is gonna be, e.g. Weave has 10.32.0.0/16 IIRC, Calico and Canal has something else, flannel defaults to 10.244.0.0/16 etc.

We just don't know this and never will. I'm curious exactly what the issue with kube-proxy is when it does not know this, I've never encountered it.

@thockin (feel free to ping somebody else that knows) why does kube-proxy have this flag? At a first glance it seems like bad design for this particular flag, but on the other hand I don't have the full context on this.

TL;DR; This PR does not solve the issue, but we should discuss how we can solve the issue anyway.

[thockin]

cmd/kube-proxy/app/options/options.go

84: fs.StringVar(&s.ClusterCIDR, "cluster-cidr", s.ClusterCIDR, "The CIDR range of pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, no off-cluster bridging will be performed.")

[pires]

@luxas all checks are green, ping.

[luxas]

We discussed this during the sig meeting, and will do an other approach than we initially thought.

We'll encourage (and maybe even require) the user to setting this Pod CIDR value on kubeadm init time, and the cni daemonset yaml manifest as well. Even though it's suboptimal to start the subnet allocation feature of the controller-manager for network vendors like weave that uses something else, we chose to not expose that boolean because it would be a too detailed thing to expose to the normal user.

So we will encourage setting both the CNI network manifest and this Pod CIDR, which also allows us to do what this PR implements, namely pass that Pod CIDR to kube-proxy.

/lgtm
/approve

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

The following people have approved this PR: luxas, pires

Needs approval from an approver in each of these OWNERS Files:

• cmd/kubeadm/OWNERS [luxas]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

Automatic merge from submit-queue (batch tested with PRs 40574, 40806, 40308, 40771, 39440)