Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

scheduler: enable secure port and authn/z #69663

Merged
merged 5 commits into from
Nov 9, 2018
Merged

scheduler: enable secure port and authn/z #69663

merged 5 commits into from
Nov 9, 2018

Conversation

sttts
Copy link
Contributor

@sttts sttts commented Oct 11, 2018 •
edited
Loading

Completes #67192.

This PR adds a secure port 10259 to the scheduler

  • enabled by default as for the controller manager
  • deprecates the old insecure port
  • adds exhaustive delegated authn/z tests.
Add secure port 10259 to the kube-scheduler (enabled by default) and deprecate old insecure port 10251. Without further flags self-signed certs are created on startup in memory.

Fixes #58983.

@k8s-ci-robot k8s-ci-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Oct 11, 2018
@k8s-ci-robot k8s-ci-robot added area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. sig/scheduling Categorizes an issue or PR as relevant to SIG Scheduling. sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Oct 11, 2018
@sttts sttts added the kind/feature Categorizes issue or PR as related to a new feature. label Oct 11, 2018
@k8s-ci-robot k8s-ci-robot removed the needs-kind Indicates a PR lacks a `kind/foo` label and requires one. label Oct 11, 2018
@sttts sttts added this to the v1.13 milestone Oct 11, 2018
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Oct 11, 2018
@sttts sttts mentioned this pull request Oct 11, 2018
Closed
@sttts sttts force-pushed the sttts-scheduler-secure-serving branch 2 times, most recently from 29b783a to 08cdef5 Compare October 11, 2018 10:23
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 11, 2018
@sttts sttts force-pushed the sttts-scheduler-secure-serving branch 2 times, most recently from de80b08 to c440032 Compare October 11, 2018 11:45
@sttts
Copy link
Contributor Author

sttts commented Oct 11, 2018

/retest

@k8s-ci-robot
Copy link
Contributor

New changes are detected. LGTM label has been removed.

@sttts sttts added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 8, 2018
@sttts sttts force-pushed the sttts-scheduler-secure-serving branch from de64334 to 1588af4 Compare November 8, 2018 15:44
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 8, 2018
@k8s-ci-robot
Copy link
Contributor

New changes are detected. LGTM label has been removed.

@sttts sttts added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 8, 2018
@aveshagarwal
Copy link
Member

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aveshagarwal, liggitt, sttts

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 8, 2018
@AishSundar
Copy link
Contributor

/cc @mengqiy

Adding @mengqiy who is the GKE oncall. @mengqiy this PR is failing on pull-kubernetes-e2e-gke presubmits. can you plz help @sttts get the right GLKE CI logs to investigate why. Thanks

@k8s-ci-robot k8s-ci-robot requested a review from mengqiy November 8, 2018 17:03
@sttts
Copy link
Contributor Author

sttts commented Nov 8, 2018

/retest

@sttts
Copy link
Contributor Author

sttts commented Nov 8, 2018 •
edited
Loading

Adding @mengqiy who is the GKE oncall. @mengqiy this PR is failing on pull-kubernetes-e2e-gke presubmits. can you plz help @sttts get the right GLKE CI logs to investigate why. Thanks

Note that we moved the commit which breaks GKE into #70800

@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Nov 8, 2018 •
edited
Loading

@sttts: The following test failed, say /retest to rerun them all:

Test name Commit Details Rerun command
pull-kubernetes-e2e-gke e56fd05f110bd83825d0883bc8736353e5b17cc7 link /test pull-kubernetes-e2e-gke

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@roycaihw roycaihw mentioned this pull request Nov 8, 2018
Closed
@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel comment for consistent failures.

@k8s-ci-robot k8s-ci-robot merged commit be800e6 into kubernetes:master Nov 9, 2018
@furkanmustafa
Copy link

deprecates the old insecure port

@sttts I want to learn about the motivations behind deprecating the plain http (insecure!?) port. Can you point me to any related discussions about this?

@yue9944882 yue9944882 mentioned this pull request Dec 5, 2018
Closed
liggitt
liggitt reviewed Dec 5, 2018
View reviewed changes
cmd/kube-scheduler/app/options/options.go
Deprecated: &DeprecatedOptions{
UseLegacyPolicyConfig: false,
PolicyConfigMapNamespace: metav1.NamespaceSystem,
},
}

o.Authentication.RemoteKubeConfigFileOptional = true
o.Authorization.RemoteKubeConfigFileOptional = true
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in addition to tolerating missing kubeconfig, this needed to tolerate forbidden failures in lookupMissingConfigInCluster... nothing granted the scheduler delegated authentication permissions by default

xref #71743

@mrIncompetent mrIncompetent mentioned this pull request Dec 5, 2018
Closed
This was referenced Dec 18, 2018
Closed
Closed
@YujiEda YujiEda mentioned this pull request Jan 25, 2019
Merged
@neolit123 neolit123 mentioned this pull request Nov 9, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@aveshagarwal aveshagarwal aveshagarwal left review comments

@tossmilestone tossmilestone tossmilestone left review comments

@liggitt liggitt liggitt left review comments

@dcbw dcbw Awaiting requested review from dcbw

@yliaog yliaog Awaiting requested review from yliaog

@mengqiy mengqiy Awaiting requested review from mengqiy

Assignees

@simonswine simonswine

@liggitt liggitt

@aveshagarwal aveshagarwal

@bsalamat bsalamat

@tanshanshan tanshanshan

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. sig/scheduling Categorizes an issue or PR as relevant to SIG Scheduling. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Milestone
v1.13
Development

Successfully merging this pull request may close these issues.