Bug 1963730: kube-apiserver failed to load SNI cert and key #610
Conversation
|
/retest |
1 similar comment
|
/retest |
p0lyn0mial
force-pushed
the
atomic-certs
branch
3 times, most recently
from
5106fac
to
d39f518
Compare
|
Moved upgrade to GCP where I saw green in 4.8 rehearsal openshift/release#19168 /test e2e-agnostic-upgrade |
p0lyn0mial
changed the title
openshift-ci
bot
added
bugzilla/severity-low
|
@p0lyn0mial: This pull request references Bugzilla bug 1963730, which is valid. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@p0lyn0mial: This pull request references Bugzilla bug 1963730, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/lgtm |
openshift-ci
bot
added
lgtm
|
skip known disruptive failures /override ci/prow/e2e-gcp-disruptive-five-control-plane-replicas |
|
@hexfusion: Overrode contexts on behalf of hexfusion: ci/prow/e2e-aws-disruptive, ci/prow/e2e-aws-disruptive-ovn, ci/prow/e2e-gcp-disruptive, ci/prow/e2e-gcp-disruptive-five-control-plane-replicas, ci/prow/e2e-gcp-disruptive-ovn In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hexfusion, p0lyn0mial The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/override ci/prow/e2e-gcp-disruptive-five-control-plane-replicas |
|
@hexfusion: Overrode contexts on behalf of hexfusion: ci/prow/e2e-aws-disruptive, ci/prow/e2e-aws-disruptive-ovn, ci/prow/e2e-gcp-disruptive, ci/prow/e2e-gcp-disruptive-five-control-plane-replicas, ci/prow/e2e-gcp-disruptive-ovn In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/retest Please review the full test history for this PR and help us cut down flakes. |
|
@p0lyn0mial: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
@p0lyn0mial: Some pull requests linked via external trackers have merged: The following pull requests linked via external trackers have not merged: These pull request must merge or be unlinked from the Bugzilla bug in order for it to move to the next state. Once unlinked, request a bug refresh with Bugzilla bug 1963730 has not been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
As of today, the dynamic certificates i.e.
kube-apiserver-certsare accessed by at least two processes, namely the installer pod and the cert-syncer.Up until now, there was no coordination between these processes that might have lead to many unexpected errors, like https://bugzilla.redhat.com/show_bug.cgi?id=1963730
This PR writes all certificates in an atomic way by first creating a temporary file, writing the content to it, and then renaming it to the original file.
os.Renamecallssyscall.Renamewhich in turn uses the rename syscall (Linux) which provides atomicity (https://man7.org/linux/man-pages/man2/rename.2.html)The previous attempt didn't work as it would break the DR scripts - openshift/library-go#1098