Disable Kubelet read-only port 10255

[dghubble]

• We can finally disable the Kubelet read-only port 10255!
• The lengthy background on getting to this milestone: Disable Kubelet unauthenticated read-only port #322 (comment)

Closes: #322

[sbv-trueenergy]

As you've noticed in kubernetes-retired/bootkube#1025 the pod-checkpointer still depends on the insecurePort.

For now this makes a lot of noise:

E1122 09:28:41.566220       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused
E1122 09:28:46.591077       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused
E1122 09:28:51.623905       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused
E1122 09:28:56.661652       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused
E1122 09:29:01.691568       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused
E1122 09:29:06.716961       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused
E1122 09:29:11.749546       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused
E1122 09:29:16.779674       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused
E1122 09:29:21.848972       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused
E1122 09:29:26.874059       1 kubelet.go:54] failed to list local parent pods, assuming none are running: Get http://127.0.0.1:10255/pods/: dial tcp 127.0.0.1:10255: connect: connection refused

Should I just filter this in my papertrail destination for now or should I be worried?

[dghubble]

Yep, those logs are in my clusters too. Its noisy, but shouldn't be concerning, recovery through power-cycles has been exercised a bunch and that's where pod-checkpointer is used. I've found no issues.

Going forward, this should be resolved whenever bootkube#1027 merges and a new checkpointer image gets released.

If you're wanting something in the short term, you could try 55f0b95cf1471d8179b083c031f43a3a3bcabd0a from here being tested via terraform-render-bookube patch and typhoon patch or building it yourself. Although I'm planning to wait for the upstream image and not merge those linked patches, since a Typhoon cluster shouldn't require any trust in images I've built.