Bug 1821720: Move haproxy listening port due to conflict #59
Conversation
The "Recovering from expired control plane certificates" procedure [1] stands up a recovery API server on port 7443 [2], conflicting with the port the haproxy process is listening on. This patch moves the haproxy port to 9443 instead. [1] https://docs.openshift.com/container-platform/4.3/backup_and_restore/disaster_recovery/scenario-3-expired-certs.html [2] https://github.com/openshift/cluster-kube-apiserver-operator/blob/3161546a248f20eb67231017d0ae43c245bfa4cb/pkg/recovery/apiserver.go#L307
openshift-ci-robot
added
bugzilla/severity-medium
|
@mandre: This pull request references Bugzilla bug 1821720, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/retest |
|
/lgtm Job failed deploying masters, which seems unlikely to be related to this. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cybertron, mandre The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
|
@mandre: All pull requests linked via external trackers have merged: openshift/baremetal-runtimecfg#59. Bugzilla bug 1821720 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cherry-pick release-4.4 |
|
@mandre: #59 failed to apply on top of branch "release-4.4": In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
PR[1] added logic for checking port availability in recovery-controller. PR[2] change the port of HAProxy to 9443, due to yet another port conflict. Both of the PRs cause the kube-controller-manager-recovery-controller to crash loop on on-prem platforms such as oVirt, baremetal and openstack. This PR changes the port ov the recovery controller. [1] openshift#421 [2] openshift/baremetal-runtimecfg#59 Signed-off-by: Gal-Zaidman <gzaidman@redhat.com>
… KCM HAProxy port was moved on [1] to 9443, this cinflicted with KCM recovery container which is using 9443 since 4.3. on [2] KCM added a check that the port is free which caused a conflict and a crashlooping pod. [1] openshift#59 [2] openshift/cluster-kube-controller-manager-operator#421 Signed-off-by: Gal-Zaidman <gzaidman@redhat.com>
… KCM HAProxy port was moved on [1] to 9443, this cinflicted with KCM recovery container which is using 9443 since 4.3. on [2] KCM added a check that the port is free which caused a conflict and a crashlooping pod. [1] openshift#59 [2] openshift/cluster-kube-controller-manager-operator#421 Signed-off-by: Gal-Zaidman <gzaidman@redhat.com>
The "Recovering from expired control plane certificates" procedure [1]
stands up a recovery API server on port 7443 [2], conflicting with the
port the haproxy process is listening on.
This patch moves the haproxy port to 9443 instead.
[1] https://docs.openshift.com/container-platform/4.3/backup_and_restore/disaster_recovery/scenario-3-expired-certs.html
[2] https://github.com/openshift/cluster-kube-apiserver-operator/blob/3161546a248f20eb67231017d0ae43c245bfa4cb/pkg/recovery/apiserver.go#L307