Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add env var to enable kubelet rotation in kube-up.sh. #52115

Merged
merged 1 commit into from
Sep 15, 2017
Merged

Add env var to enable kubelet rotation in kube-up.sh. #52115

merged 1 commit into from
Sep 15, 2017

Conversation

jcbsmpsn
Copy link
Contributor

@jcbsmpsn jcbsmpsn commented Sep 7, 2017 •
edited
Loading

Fixes #52114

Adds ROTATE_CERTIFICATES environment variable to kube-up.sh script for GCE
clusters. When that var is set to true, the command line flag enabling kubelet
client certificate rotation will be added to the kubelet command line.

@jcbsmpsn jcbsmpsn force-pushed the flag-enable-kubelet-certificate-rotation branch from 841390a to 4d27b46 Compare September 7, 2017 21:33
@k8s-github-robot k8s-github-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Sep 7, 2017
@k8s-ci-robot k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Sep 7, 2017
@eparis
Copy link
Contributor

eparis commented Sep 7, 2017 •
edited
Loading

/approve no-issue

@k8s-github-robot k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 7, 2017
gmarek
gmarek reviewed Sep 11, 2017
View reviewed changes
cluster/gce/config-test.sh Outdated
@@ -377,3 +377,6 @@ ENABLE_POD_PRIORITY="${ENABLE_POD_PRIORITY:-}"
if [[ "${ENABLE_POD_PRIORITY}" == "true" ]]; then
FEATURE_GATES="${FEATURE_GATES},PodPriority=true"
fi

# Optional: enable certificate rotation of the kubelet certificates.
ROTATE_CERTIFICATES="${ROTATE_CERTIFICATES:-true}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not a fan of having vastly different default config in -default and -test. We want to test things that we ship, not some other config. Please disable it by default in test config and create a special test suite to test certificate rotation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

@jcbsmpsn jcbsmpsn force-pushed the flag-enable-kubelet-certificate-rotation branch from 4d27b46 to 0ac3478 Compare September 14, 2017 18:30
@jcbsmpsn jcbsmpsn mentioned this pull request Sep 14, 2017
Closed
@ericchiang
Copy link
Contributor

cc @kubernetes/sig-auth-pr-reviews

Change is disable by default and we want this to help test kubernetes/enhancements#266

/lgtm

Assigning to the 1.8 milestone.

@k8s-ci-robot k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. sig/auth Categorizes an issue or PR as relevant to SIG Auth. labels Sep 14, 2017
@ericchiang ericchiang added this to the v1.8 milestone Sep 14, 2017
@k8s-github-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eparis, ericchiang, jcbsmpsn

Associated issue: 52114

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to @fejta).

Review the full test history for this PR.

@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Sep 15, 2017 •
edited
Loading

@jcbsmpsn: The following test failed, say /retest to rerun them all:

Test name Commit Details Rerun command
pull-kubernetes-e2e-gce-bazel 0ac3478 link /test pull-kubernetes-e2e-gce-bazel

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 52452, 52115, 52260, 52290)

@k8s-github-robot k8s-github-robot merged commit 0c1dcb0 into kubernetes:master Sep 15, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gmarek gmarek gmarek left review comments

Assignees

@gmarek gmarek

@ericchiang ericchiang

@eparis eparis

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
v1.8
Development

Successfully merging this pull request may close these issues.
7 participants
@jcbsmpsn @eparis @ericchiang @k8s-github-robot @fejta-bot @k8s-ci-robot @gmarek