Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tap APIService causes shortname conflict warnings with kubectl 1.29 #11784

Closed
siggy opened this issue Dec 18, 2023 · 0 comments · Fixed by #11816 or #11922
Closed

Tap APIService causes shortname conflict warnings with kubectl 1.29 #11784

siggy opened this issue Dec 18, 2023 · 0 comments · Fixed by #11816 or #11922
Assignees
Labels

Comments

@siggy
Copy link
Member

siggy commented Dec 18, 2023

What is the issue?

When running with Kubectl 1.29 with a cluster with linkerd-viz, I get these warnings when running kubectl commands:

Warning: short name "deploy" could also match lower priority resource deployments.tap.linkerd.io

The TAP APIService uses shortnames that collide with other Kubernetes resources (e.g. deploy, po, etc):

resources = []struct {
name string
shortname string
namespaced bool
}{
{"namespaces", "ns", false},
{"pods", "po", true},
{"replicationcontrollers", "rc", true},
{"services", "svc", true},
{"daemonsets", "ds", true},
{"deployments", "deploy", true},
{"replicasets", "rs", true},
{"statefulsets", "sts", true},
{"jobs", "", true},
{"cronjobs", "cj", true},
}
)

How can it be reproduced?

With kubectl 1.29+ on a cluster with linkerd-viz installed, run kubectl get deploy.

Logs, error output, etc

$ kubectl version
Client Version: v1.29.0
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.3

$ kubectl get deploy
Warning: short name "deploy" could also match lower priority resource deployments.tap.linkerd.io
NAME      READY   UP-TO-DATE   AVAILABLE   AGE
hello     3/3     3            3           650d
traffic   1/1     1            1           640d

output of linkerd check -o short

$ linkerd check -o short
linkerd-identity
----------------
‼ issuer cert is valid for at least 60 days
    issuer certificate will expire on 2024-01-08T00:00:24Z
    see https://linkerd.io/2/checks/#l5d-identity-issuer-cert-not-expiring-soon for hints

Status check results are √

Environment

  • Kubernetes Version: v1.28.3
  • Cluster Environment: AKS
  • Host OS: Ubuntu
  • Linkerd version: edge-23.12.2

Possible solution

Remove or modify the shortnames in the Tap APIService:

resources = []struct {
name string
shortname string
namespaced bool
}{
{"namespaces", "ns", false},
{"pods", "po", true},
{"replicationcontrollers", "rc", true},
{"services", "svc", true},
{"daemonsets", "ds", true},
{"deployments", "deploy", true},
{"replicasets", "rs", true},
{"statefulsets", "sts", true},
{"jobs", "", true},
{"cronjobs", "cj", true},
}
)

Additional context

Relates to kubernetes/kubernetes#108573

Would you like to work on fixing this bug?

yes

@siggy siggy added the bug label Dec 18, 2023
siggy added a commit that referenced this issue Dec 22, 2023
The Tap API resource shortnames were colliding with existing Kubernetes
resources (e.g. `po`, `deploy`, etc), causing warnings from kubectl
v1.29.0+.

Remove the shortnames from the Tap APIService handlers.

Fixes #11784

Signed-off-by: Andrew Seigner <siggy@buoyant.io>
siggy added a commit that referenced this issue Dec 22, 2023
The Tap API resource shortnames were colliding with existing Kubernetes
resources (e.g. `po`, `deploy`, etc), causing warnings from kubectl
v1.29.0+.

Remove the shortnames from the Tap APIService handlers.

To validate:
```bash
bin/k3d cluster create

curl https://run.linkerd.io/install-edge | sh
linkerd install --crds | kubectl apply -f -
linkerd install        | kubectl apply -f -
linkerd check
linkerd viz install    | kubectl apply -f -
linkerd check

kubectl api-resources --api-group=tap.linkerd.io

kubectl get po

TAP_IMAGE=$(bin/docker-build-tap)
bin/k3d image load $TAP_IMAGE
kubectl -n linkerd-viz set image deploy/tap tap=$TAP_IMAGE

kubectl api-resources --api-group=tap.linkerd.io

kubectl get po
```

Fixes #11784

Signed-off-by: Andrew Seigner <siggy@buoyant.io>
siggy added a commit that referenced this issue Dec 22, 2023
The Tap API resource shortnames were colliding with existing Kubernetes
resources (e.g. `po`, `deploy`, etc), causing warnings from kubectl
v1.29.0+.

Remove the shortnames from the Tap APIService handlers.

To validate:
```bash
bin/k3d cluster create

curl https://run.linkerd.io/install-edge | sh
linkerd install --crds | kubectl apply -f -
linkerd install        | kubectl apply -f -
linkerd check
linkerd viz install    | kubectl apply -f -
linkerd check

kubectl api-resources --api-group=tap.linkerd.io

kubectl get po

TAP_IMAGE=$(bin/docker-build-tap)
bin/k3d image load $TAP_IMAGE
kubectl -n linkerd-viz set image deploy/tap tap=$TAP_IMAGE

kubectl api-resources --api-group=tap.linkerd.io

kubectl get po
```

Fixes #11784

Signed-off-by: Andrew Seigner <siggy@buoyant.io>
siggy added a commit that referenced this issue Dec 22, 2023
The Tap API resource shortnames were colliding with existing Kubernetes
resources (e.g. `po`, `deploy`, etc), causing warnings from kubectl
v1.29.0+.

Remove the shortnames from the Tap APIService handlers.

To validate:
```bash
bin/k3d cluster create

# install latest edge
curl https://run.linkerd.io/install-edge | sh
linkerd install --crds | kubectl apply -f -
linkerd install        | kubectl apply -f -
linkerd check
linkerd viz install    | kubectl apply -f -
linkerd check

# show shortnames
kubectl api-resources --api-group=tap.linkerd.io

# with kubectl v1.29.0+, observe "Warning: short name..."
kubectl get po

# replace tap image
TAP_IMAGE=$(bin/docker-build-tap)
bin/k3d image load $TAP_IMAGE
kubectl -n linkerd-viz set image deploy/tap tap=$TAP_IMAGE

# verify shortnames are no longer present
kubectl api-resources --api-group=tap.linkerd.io

# with kubectl v1.29.0+, observe no warning
kubectl get po
```

Fixes #11784

Signed-off-by: Andrew Seigner <siggy@buoyant.io>
siggy added a commit that referenced this issue Dec 22, 2023
The Tap API resource shortnames were colliding with existing Kubernetes
resources (e.g. `po`, `deploy`, etc), causing warnings from kubectl
v1.29.0+.

Remove the shortnames from the Tap APIService handlers.

To validate:
```bash
bin/k3d cluster create

# install latest edge
curl https://run.linkerd.io/install-edge | sh
linkerd install --crds | kubectl apply -f -
linkerd install        | kubectl apply -f -
linkerd check
linkerd viz install    | kubectl apply -f -
linkerd check

# observe shortnames
kubectl api-resources --api-group=tap.linkerd.io

# with kubectl v1.29.0+, observe "Warning: short name..."
kubectl get po

# replace tap image
TAP_IMAGE=$(bin/docker-build-tap)
bin/k3d image load $TAP_IMAGE
kubectl -n linkerd-viz set image deploy/tap tap=$TAP_IMAGE

# verify shortnames are no longer present
kubectl api-resources --api-group=tap.linkerd.io

# with kubectl v1.29.0+, observe no warning
kubectl get po
```

Fixes #11784

Signed-off-by: Andrew Seigner <siggy@buoyant.io>
@alpeb alpeb closed this as completed in ff25a71 Jan 4, 2024
mateiidavid added a commit that referenced this issue Jan 12, 2024
This edge release introduces a number of different fixes and improvements. More
notably, it introduces a new `cni-repair-controller` binary to the CNI plugin
image. The controller will automatically restart pods that have not received
their iptables configuration.

* Removed shortnames from Tap API resources to avoid colliding with existing
  Kubernetes resources ([#11816]; fixes [#11784])
* Introduced a new ExternalWorkload CRD to support upcoming mesh expansion
  feature ([#11805])
* Changed `MeshTLSAuthentication` resource validation to allow SPIFFE URI
  identities ([#11882])
* Introduced a new `cni-repair-controller` to the `linkerd-cni` DaemonSet to
  automatically restart misconfigured pods that are missing iptables rules
  ([#11699]; fixes [#11073])
* Fixed a `"duplicate metrics"` warning in the multicluster service-mirror
  component ([#11875]; fixes [#11839])
* Added metric labels and weights to `linkerd diagnostics endpoints` json
  output ([#11889])
* Changed how `Server` updates are handled in the destination service. The
  change will ensure that during a cluster resync, consumers won't be
  overloaded by redundant updates ([#11907])
* Changed `linkerd install` error output to add a newline when a Kubernetes
  client cannot be successfully initialised

[#11816]: #11816
[#11784]: #11784
[#11805]: #11805
[#11882]: #11882
[#11699]: #11699
[#11073]: #11073
[#11875]: #11875
[#11839]: #11839
[#11889]: #11889
[#11907]: #11907
[#11917]: #11917

Signed-off-by: Matei David <matei@buoyant.io>
mateiidavid added a commit that referenced this issue Jan 12, 2024
This edge release introduces a number of different fixes and improvements. More
notably, it introduces a new `cni-repair-controller` binary to the CNI plugin
image. The controller will automatically restart pods that have not received
their iptables configuration.

* Removed shortnames from Tap API resources to avoid colliding with existing
  Kubernetes resources ([#11816]; fixes [#11784])
* Introduced a new ExternalWorkload CRD to support upcoming mesh expansion
  feature ([#11805])
* Changed `MeshTLSAuthentication` resource validation to allow SPIFFE URI
  identities ([#11882])
* Introduced a new `cni-repair-controller` to the `linkerd-cni` DaemonSet to
  automatically restart misconfigured pods that are missing iptables rules
  ([#11699]; fixes [#11073])
* Fixed a `"duplicate metrics"` warning in the multicluster service-mirror
  component ([#11875]; fixes [#11839])
* Added metric labels and weights to `linkerd diagnostics endpoints` json
  output ([#11889])
* Changed how `Server` updates are handled in the destination service. The
  change will ensure that during a cluster resync, consumers won't be
  overloaded by redundant updates ([#11907])
* Changed `linkerd install` error output to add a newline when a Kubernetes
  client cannot be successfully initialised ([#11917])

[#11816]: #11816
[#11784]: #11784
[#11805]: #11805
[#11882]: #11882
[#11699]: #11699
[#11073]: #11073
[#11875]: #11875
[#11839]: #11839
[#11889]: #11889
[#11907]: #11907
[#11917]: #11917

Signed-off-by: Matei David <matei@buoyant.io>
mateiidavid added a commit that referenced this issue Jan 12, 2024
This edge release introduces a number of different fixes and improvements. More
notably, it introduces a new `cni-repair-controller` binary to the CNI plugin
image. The controller will automatically restart pods that have not received
their iptables configuration.

* Removed shortnames from Tap API resources to avoid colliding with existing
  Kubernetes resources ([#11816]; fixes [#11784])
* Introduced a new ExternalWorkload CRD to support upcoming mesh expansion
  feature ([#11805])
* Changed `MeshTLSAuthentication` resource validation to allow SPIFFE URI
  identities ([#11882])
* Introduced a new `cni-repair-controller` to the `linkerd-cni` DaemonSet to
  automatically restart misconfigured pods that are missing iptables rules
  ([#11699]; fixes [#11073])
* Fixed a `"duplicate metrics"` warning in the multicluster service-mirror
  component ([#11875]; fixes [#11839])
* Added metric labels and weights to `linkerd diagnostics endpoints` json
  output ([#11889])
* Changed how `Server` updates are handled in the destination service. The
  change will ensure that during a cluster resync, consumers won't be
  overloaded by redundant updates ([#11907])
* Changed `linkerd install` error output to add a newline when a Kubernetes
  client cannot be successfully initialised ([#11917])

[#11816]: #11816
[#11784]: #11784
[#11805]: #11805
[#11882]: #11882
[#11699]: #11699
[#11073]: #11073
[#11875]: #11875
[#11839]: #11839
[#11889]: #11889
[#11907]: #11907
[#11917]: #11917

Signed-off-by: Matei David <matei@buoyant.io>
adleong pushed a commit that referenced this issue Jan 18, 2024
The Tap API resource shortnames were colliding with existing Kubernetes
resources (e.g. `po`, `deploy`, etc), causing warnings from kubectl
v1.29.0+.

Remove the shortnames from the Tap APIService handlers.

To validate:
```bash
bin/k3d cluster create

# install latest edge
curl https://run.linkerd.io/install-edge | sh
linkerd install --crds | kubectl apply -f -
linkerd install        | kubectl apply -f -
linkerd check
linkerd viz install    | kubectl apply -f -
linkerd check

# observe shortnames
kubectl api-resources --api-group=tap.linkerd.io

# with kubectl v1.29.0+, observe "Warning: short name..."
kubectl get po

# replace tap image
TAP_IMAGE=$(bin/docker-build-tap)
bin/k3d image load $TAP_IMAGE
kubectl -n linkerd-viz set image deploy/tap tap=$TAP_IMAGE

# verify shortnames are no longer present
kubectl api-resources --api-group=tap.linkerd.io

# with kubectl v1.29.0+, observe no warning
kubectl get po
```

Fixes #11784

Signed-off-by: Andrew Seigner <siggy@buoyant.io>
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Feb 4, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant