Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

kubeadm: use the secure ports for kube-scheduler and kcm health checks #85043

Merged
merged 1 commit into from Nov 10, 2019
Merged

kubeadm: use the secure ports for kube-scheduler and kcm health checks #85043

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 4 additions & 6 deletions cmd/kubeadm/app/constants/constants.go
View file
Open in desktop
Expand Up @@ -361,14 +361,12 @@ const (
// KubeletPort is the default port for the kubelet server on each host machine.
// May be overridden by a flag at startup.
KubeletPort = 10250
// InsecureSchedulerPort is the default port for the scheduler status server.
// KubeSchedulerPort is the default port for the scheduler status server.
// May be overridden by a flag at startup.
// Deprecated: use the secure KubeSchedulerPort instead.
InsecureSchedulerPort = 10251
// InsecureKubeControllerManagerPort is the default port for the controller manager status server.
KubeSchedulerPort = 10259
// KubeControllerManagerPort is the default port for the controller manager status server.
// May be overridden by a flag at startup.
// Deprecated: use the secure KubeControllerManagerPort instead.
InsecureKubeControllerManagerPort = 10252
KubeControllerManagerPort = 10257

// Mode* constants were copied from pkg/kubeapiserver/authorizer/modes
// to avoid kubeadm dependency on the internal module
Expand Down
4 changes: 2 additions & 2 deletions cmd/kubeadm/app/phases/controlplane/manifests.go
View file
Open in desktop
Expand Up @@ -66,7 +66,7 @@ func GetStaticPodSpecs(cfg *kubeadmapi.ClusterConfiguration, endpoint *kubeadmap
ImagePullPolicy: v1.PullIfNotPresent,
Command: getControllerManagerCommand(cfg),
VolumeMounts: staticpodutil.VolumeMountMapToSlice(mounts.GetVolumeMounts(kubeadmconstants.KubeControllerManager)),
LivenessProbe: staticpodutil.LivenessProbe(staticpodutil.GetControllerManagerProbeAddress(cfg), "/healthz", kubeadmconstants.InsecureKubeControllerManagerPort, v1.URISchemeHTTP),
LivenessProbe: staticpodutil.LivenessProbe(staticpodutil.GetControllerManagerProbeAddress(cfg), "/healthz", kubeadmconstants.KubeControllerManagerPort, v1.URISchemeHTTPS),
Resources: staticpodutil.ComponentResources("200m"),
Env: kubeadmutil.GetProxyEnvVars(),
}, mounts.GetVolumes(kubeadmconstants.KubeControllerManager)),
Expand All @@ -76,7 +76,7 @@ func GetStaticPodSpecs(cfg *kubeadmapi.ClusterConfiguration, endpoint *kubeadmap
ImagePullPolicy: v1.PullIfNotPresent,
Command: getSchedulerCommand(cfg),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC, we don't explicitly set --port 0 to explicitly disable insecure serving.

If we do it would break insecure serving of metrics for the scheduler and controller-manager, that could be mitigated by an action required

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are you suggesting adding --port=0 for both with an action required as part of this PR?

the components are binding on localhost so they are not exposed to external consumers. but i can see that there may be cases where metrics are proxied to an external consumer.

the alternative is to keep the insecure serving supported and wait for the action-required to come from the components them self when --port is removed.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That’s fine by me. I’ll open an issue to discuss secure defaults

VolumeMounts: staticpodutil.VolumeMountMapToSlice(mounts.GetVolumeMounts(kubeadmconstants.KubeScheduler)),
LivenessProbe: staticpodutil.LivenessProbe(staticpodutil.GetSchedulerProbeAddress(cfg), "/healthz", kubeadmconstants.InsecureSchedulerPort, v1.URISchemeHTTP),
LivenessProbe: staticpodutil.LivenessProbe(staticpodutil.GetSchedulerProbeAddress(cfg), "/healthz", kubeadmconstants.KubeSchedulerPort, v1.URISchemeHTTPS),
Resources: staticpodutil.ComponentResources("100m"),
Env: kubeadmutil.GetProxyEnvVars(),
}, mounts.GetVolumes(kubeadmconstants.KubeScheduler)),
Expand Down
16 changes: 8 additions & 8 deletions cmd/kubeadm/app/phases/selfhosting/selfhosting_test.go
View file
Open in desktop
Expand Up @@ -230,8 +230,8 @@ spec:
httpGet:
host: 127.0.0.1
path: /healthz
port: 10252
scheme: HTTP
port: 10257
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-controller-manager
Expand Down Expand Up @@ -307,8 +307,8 @@ spec:
httpGet:
host: 127.0.0.1
path: /healthz
port: 10252
scheme: HTTP
port: 10257
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-controller-manager
Expand Down Expand Up @@ -379,8 +379,8 @@ spec:
httpGet:
host: 127.0.0.1
path: /healthz
port: 10251
scheme: HTTP
port: 10259
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-scheduler
Expand Down Expand Up @@ -431,8 +431,8 @@ spec:
httpGet:
host: 127.0.0.1
path: /healthz
port: 10251
scheme: HTTP
port: 10259
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-scheduler
Expand Down
4 changes: 2 additions & 2 deletions cmd/kubeadm/app/preflight/checks.go
View file
Open in desktop
Expand Up @@ -886,8 +886,8 @@ func RunInitNodeChecks(execer utilsexec.Interface, cfg *kubeadmapi.InitConfigura
KubernetesVersionCheck{KubernetesVersion: cfg.KubernetesVersion, KubeadmVersion: kubeadmversion.Get().GitVersion},
FirewalldCheck{ports: []int{int(cfg.LocalAPIEndpoint.BindPort), kubeadmconstants.KubeletPort}},
PortOpenCheck{port: int(cfg.LocalAPIEndpoint.BindPort)},
PortOpenCheck{port: kubeadmconstants.InsecureSchedulerPort},
PortOpenCheck{port: kubeadmconstants.InsecureKubeControllerManagerPort},
PortOpenCheck{port: kubeadmconstants.KubeSchedulerPort},
PortOpenCheck{port: kubeadmconstants.KubeControllerManagerPort},
FileAvailableCheck{Path: kubeadmconstants.GetStaticPodFilepath(kubeadmconstants.KubeAPIServer, manifestsDir)},
FileAvailableCheck{Path: kubeadmconstants.GetStaticPodFilepath(kubeadmconstants.KubeControllerManager, manifestsDir)},
FileAvailableCheck{Path: kubeadmconstants.GetStaticPodFilepath(kubeadmconstants.KubeScheduler, manifestsDir)},
Expand Down