Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

local-up-cluster.sh always fail with "Timed out waiting for apiserver" #49319

Closed
mtanino opened this issue Jul 20, 2017 · 4 comments · Fixed by #49323
Closed

local-up-cluster.sh always fail with "Timed out waiting for apiserver" #49319

mtanino opened this issue Jul 20, 2017 · 4 comments · Fixed by #49323
Labels
kind/bug Categorizes issue or PR as related to a bug. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle.

Comments

@mtanino
Copy link

mtanino commented Jul 20, 2017

Is this a BUG REPORT or FEATURE REQUEST?:

/kind bug
#49072

What happened:

After this commit was introduced, local-up-cluster.sh always fail with "Timed out waiting for apiserver" error.

commit 413ab26df92c3da66bc6eb60c1d1105f6ac267fc
    use https to check healthz in hack/local-up-cluster.sh

I'm not sure the reason but the local-up-cluster.sh successfully start if I specify ENABLE_RBAC=true option to local-up-cluster.sh.

What you expected to happen:

The local-up-cluster.sh will successfully start without any additional options.

How to reproduce it (as minimally and precisely as possible):

% hack/local-up-cluster.sh
@k8s-ci-robot k8s-ci-robot added the kind/bug Categorizes issue or PR as related to a bug. label Jul 20, 2017
@k8s-github-robot
Copy link

@mtanino
There are no sig labels on this issue. Please add a sig label by:

  1. mentioning a sig: @kubernetes/sig-<group-name>-<group-suffix>
    e.g., @kubernetes/contributor-experience-<group-suffix> to notify the contributor experience sig, OR

  2. specifying the label manually: /sig <label>
    e.g., /sig scalability to apply the sig/scalability label

Note: Method 1 will trigger an email to the group. You can find the group list here and label list here.
The <group-suffix> in the method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals

@k8s-github-robot k8s-github-robot added the needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label Jul 20, 2017
@RenaudWasTaken
Copy link
Contributor

RenaudWasTaken commented Jul 20, 2017 •
edited

I've noticed that If you revert the change, once the cluster is started curling the healthz in https works

$ curl https://127.0.0.1:6443/healthz:6443/
healthz
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

It might be a waiting problem? Maybe the API server takes longer to setup

@mtanino
Copy link
Author

mtanino commented Jul 20, 2017

@RenaudWasTaken

The patch applied following two fixes. Seems extending wait time fixes my original problem on #47739, but I'm not sure why API endpoint was changed to https.

  • Wait 20 sec for starting API server
  • Change API server's endpoint from http to https.

mtanino pushed a commit to mtanino/kubernetes that referenced this issue Jul 20, 2017
Enable RBAC by default in hack/local-up-cluster.sh
f1351e3 
Since hack/local-up-cluster.sh checks https API port
after commit 413ab26,
RBAC should be enabled by default to avoid TLS port
access denied.

Fixes kubernetes#49319
@mtanino mtanino mentioned this issue Jul 20, 2017
Merged
@castrojo
Copy link
Member

/sig cluster-lifecycle

@k8s-ci-robot k8s-ci-robot added the sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. label Jul 20, 2017
@k8s-github-robot k8s-github-robot removed the needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label Jul 20, 2017
k8s-github-robot pushed a commit that referenced this issue Jul 21, 2017
Merge pull request #49323 from mtanino/issue/49319
74ce80f 
Automatic merge from submit-queue (batch tested with PRs 49316, 46117, 49064, 48073, 49323)

Enable RBAC by default in hack/local-up-cluster.sh

**What this PR does / why we need it**:

Since hack/local-up-cluster.sh checks https API port after commit 413ab26, RBAC should be enabled by default to avoid TLS port access denied.




**Which issue this PR fixes** : Fixes #49319

**Special notes for your reviewer**:

@liggitt 

**Release note**:

```release-note
hack/local-up-cluster.sh now enables RBAC authorization by default
```
runcom pushed a commit to runcom/kubernetes that referenced this issue Sep 8, 2017
@runcom
Enable RBAC by default in hack/local-up-cluster.sh
02b6610 
Since hack/local-up-cluster.sh checks https API port
after commit 413ab26,
RBAC should be enabled by default to avoid TLS port
access denied.

Fixes kubernetes#49319
mrunalp pushed a commit to mrunalp/kubernetes that referenced this issue Nov 3, 2017
@mrunalp
Enable RBAC by default in hack/local-up-cluster.sh
8e8b987 
Since hack/local-up-cluster.sh checks https API port
after commit 413ab26,
RBAC should be enabled by default to avoid TLS port
access denied.

Fixes kubernetes#49319
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/bug Categorizes issue or PR as related to a bug. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Enable RBAC by default in hack/local-up-cluster.sh mtanino/kubernetes
5 participants
@castrojo @RenaudWasTaken @k8s-github-robot @mtanino @k8s-ci-robot