pkg/start: use loopback kubeconfig to talk to API

[jhixson74]

This code modifies cluster-bootstrap to use a kubeconfig configured for localhost API access.

This is necessary due to a limitation with Azure internal load balancers. See limitation #2 here: https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview#limitations

"Unlike public Load Balancers which provide outbound connections when transitioning from private IP addresses inside the virtual network to public IP addresses, internal Load Balancers do not translate outbound originated connections to the frontend of an internal Load Balancer as both are in private IP address space. This avoids potential for SNAT port exhaustion inside unique internal IP address space where translation is not required. The side effect is that if an outbound flow from a VM in the backend pool attempts a flow to frontend of the internal Load Balancer in which pool it resides and is mapped back to itself, both legs of the flow don't match and the flow will fail."

kubeconfig-loopback is generated by the installer.

https://jira.coreos.com/browse/CORS-1094

[abhinavdahiya]

Somethings i noticed was...

The cluster-bootstrap already uses the the localhost to talk to the bootstrap-api-server

cluster-bootstrap/pkg/start/start.go

Lines 90 to 102 in c040eb0

	// We don't want the client contact the API servers via load-balancer, but only talk to the local API server.
	// This will speed up the initial "where is working API server" process.
	localClientConfig := rest.CopyConfig(restConfig)
	localClientConfig.Host = "localhost:6443"
	// Set the ServerName to original hostname so we pass the certificate check.
	hostURL, err := url.Parse(restConfig.Host)
	if err != nil {
	return err
	}
	localClientConfig.ServerName, _, err = net.SplitHostPort(hostURL.Host)
	if err != nil {
	return err
	}

and switches to using the load balancer when the bootstapping is finished.

So we could maybe add the feature to copy the kubeconfig-local to the secrets so the objects created by the cluster-bootstrap (static pods) can use that.

[jhixson74]

Somethings i noticed was...

The cluster-bootstrap already uses the the localhost to talk to the bootstrap-api-server

cluster-bootstrap/pkg/start/start.go

Lines 90 to 102 in c040eb0

	// We don't want the client contact the API servers via load-balancer, but only talk to the local API server.
	// This will speed up the initial "where is working API server" process.
	localClientConfig := rest.CopyConfig(restConfig)
	localClientConfig.Host = "localhost:6443"
	// Set the ServerName to original hostname so we pass the certificate check.
	hostURL, err := url.Parse(restConfig.Host)
	if err != nil {
	return err
	}
	localClientConfig.ServerName, _, err = net.SplitHostPort(hostURL.Host)
	if err != nil {
	return err
	}

and switches to using the load balancer when the bootstapping is finished.

So we could maybe add the feature to copy the kubeconfig-local to the secrets so the objects created by the cluster-bootstrap (static pods) can use that.

Doesn't this do that?

https://github.com/openshift/cluster-bootstrap/pull/28/files#diff-d32f9bfe59296f6d39f436924d7bb03aR37

(sorry, I don't know how to make it show inline)

[sttts]

and switches to using the load balancer when the bootstapping is finished.
So we could maybe add the feature to copy the kubeconfig-local to the secrets so the objects created by the cluster-bootstrap (static pods) can use that.

We intentionally use the LB after bootstrapping because we want to take down the bootstrap apiserver as soon as possible because it is not consuming configuration created by the operators. Switching the second phase to loopback as well will destroy this.

[sttts]

/hold

[abhinavdahiya]

So the goal is to make sure the bootstrap-control-plane is using local host to talk to the apisever.
openshift/cluster-kube-controller-manager-operator#270
openshift/cluster-kube-scheduler-operator#156

So rather than changing the kubeconfig useg by the cluster-bootstrap, what if we copy the loopback one to bootstrap-secrets so that bootstrap-{kcm,ks} are talking to the bootstrap-apiserver on localhost..?

or do you think we should use the env variables like https://github.com/openshift/cluster-version-operator/blob/210264aea17b9d6e278435a371775c8eb507568e/bootstrap/bootstrap-pod.yaml#L30-L33 for bootstrap-{kcm,ks} are talking to the bootstrap-apiserver on localhost..?

cc @sttts @jhixson74

[sttts]

/hold cancel

It think this is actually fine.

[sttts]

/retest

[sttts]

/approve

[abhinavdahiya]

/test e2e-aws

[jhixson74]

/test e2e-aws

[abhinavdahiya]

/lgtm

[openshift-ci-robot]

@abhinavdahiya: changing LGTM is restricted to collaborators

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sttts]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abhinavdahiya, jhixson74, sttts

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sttts]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-bot]

/retest

Please review the full test history for this PR and help us cut down flakes.