Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Federation][kubefed]: Set apiserver to bind securely to 8443 instead of 443 #44639

Merged
merged 1 commit into from
Apr 19, 2017
Merged

[Federation][kubefed]: Set apiserver to bind securely to 8443 instead of 443 #44639

merged 1 commit into from
Apr 19, 2017

Conversation

marun
Copy link
Contributor

@marun marun commented Apr 18, 2017

On platforms like OpenShift that don't run containers as root by default, binding to ports < 1000 is not permitted. Having the apiserver bind to a high port means it can run with reduced privileges. The service will still expose the apiserver on 443, so this change shouldn't impact clients of the federation api.

cc: @kubernetes/sig-federation-pr-reviews @perotinus

@marun marun requested a review from madhusudancs April 18, 2017 22:44
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 18, 2017
@k8s-github-robot k8s-github-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. release-note-label-needed labels Apr 18, 2017
@marun
Copy link
Contributor Author

marun commented Apr 18, 2017

@madhusudancs Does this change require a release note?

@marun marun changed the title kubefed: Set apiserver pod to bind securely to 8443 instead of 443 [Federation][kubefed]: Set apiserver pod to bind securely to 8443 instead of 443 Apr 18, 2017
@marun marun changed the title [Federation][kubefed]: Set apiserver pod to bind securely to 8443 instead of 443 [Federation][kubefed]: Set apiserver to bind securely to 8443 instead of 443 Apr 18, 2017
@k8s-reviewable
Copy link

This change is Reviewable

@marun marun force-pushed the kubefed-apiserver-on-high-port branch from c03fccd to 4125006 Compare April 18, 2017 22:57
@marun
Copy link
Contributor Author

marun commented Apr 18, 2017

@perotinus Your help would be greatly appreciated debugging the unit test failure.

@marun marun force-pushed the kubefed-apiserver-on-high-port branch from 4125006 to 7d94c39 Compare April 18, 2017 23:56
@madhusudancs
Copy link
Contributor

Review status: 0 of 3 files reviewed at latest revision, 1 unresolved discussion, some commit checks failed.

federation/pkg/kubefed/init/init_test.go, line 841 at r1 (raw file):

		"--bind-address=0.0.0.0",
		"--etcd-servers=http://localhost:2379",
		fmt.Sprintf("--secure-port=%s", apiServerSecurePort),

This is the source of the test failure. You need %d here.

Comments from Reviewable

@marun
kubefed: Set apiserver pod to bind securely to 8443 instead of 443
767ebf8 
On platforms like OpenShift that don't run containers as root by
default, binding to ports < 1000 is not permitted.  Having the
apiserver bind to a high port means it can run with reduced
privileges.  The service will still expose the apiserver on 443, so
this change shouldn't impact clients of the federation api.
@marun marun force-pushed the kubefed-apiserver-on-high-port branch from 7d94c39 to 767ebf8 Compare April 19, 2017 02:12
@marun
Copy link
Contributor Author

marun commented Apr 19, 2017

@madhusudancs Thank you!

@madhusudancs
Copy link
Contributor

@marun Thanks for the PR. I don't think a release note is necessary here.

Also, FYI, you can request/assign reviewers by using the /assign command, who can then LGTM/approve your PRs.

/assign

Reviewed 2 of 3 files at r1, 1 of 1 files at r2.
Review status: all files reviewed at latest revision, 1 unresolved discussion, some commit checks failed.

Comments from Reviewable

@madhusudancs
Copy link
Contributor

/lgtm
/approve

Review status: all files reviewed at latest revision, 1 unresolved discussion, some commit checks failed.

Comments from Reviewable

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 19, 2017
@madhusudancs
Copy link
Contributor

@k8s-bot gce etcd3 e2e test this

@k8s-github-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: madhusudancs, marun

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@k8s-github-robot k8s-github-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. labels Apr 19, 2017
@madhusudancs
Copy link
Contributor

/release-note-none

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed release-note-label-needed labels Apr 19, 2017
@madhusudancs madhusudancs removed the do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. label Apr 19, 2017
@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 44645, 44639, 43510)

@k8s-github-robot k8s-github-robot merged commit 8144a11 into kubernetes:master Apr 19, 2017
@marun marun deleted the kubefed-apiserver-on-high-port branch April 19, 2017 17:59
@marun marun mentioned this pull request May 9, 2017
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@madhusudancs madhusudancs Awaiting requested review from madhusudancs

Assignees

@madhusudancs madhusudancs

@irfanurrehman irfanurrehman

@mwielgus mwielgus

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesn't merit a release note. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@marun @k8s-reviewable @madhusudancs @k8s-github-robot @irfanurrehman @mwielgus @k8s-ci-robot