Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

refactor(apiserver): remove the insecure flags #106859

Merged
merged 3 commits into from
Dec 9, 2021
Merged

refactor(apiserver): remove the insecure flags #106859

merged 3 commits into from
Dec 9, 2021
+14 −88

Conversation

knight42
Copy link
Member

@knight42 knight42 commented Dec 8, 2021 •
edited by liggitt
Loading

Signed-off-by: Jian Zeng anonymousknight96@gmail.com

What type of PR is this?

/kind cleanup
/kind deprecation

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

kube-apiserver: the insecure address flags `--address`, `--insecure-bind-address`, `--port` and `--insecure-port` (inert since 1.20) are removed

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Dec 8, 2021
@knight42
Copy link
Member Author

knight42 commented Dec 8, 2021

/cc @liggitt

@k8s-ci-robot k8s-ci-robot added area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Dec 8, 2021
@knight42
refactor(apiserver): remove the insecure flags
9573b4a 
Signed-off-by: Jian Zeng <anonymousknight96@gmail.com>
@knight42 knight42 force-pushed the refactor/remove-apiserver-insecure-port branch from 2ce7a0e to 9573b4a Compare December 8, 2021 02:53
@jonyhy96 jonyhy96 mentioned this pull request Dec 8, 2021
Closed
@jonyhy96
Copy link
Contributor

jonyhy96 commented Dec 8, 2021

hi @knight42 i found that i issued a duplicate pr on that, maybe u can checkout my pr which is barely same as ur's but remove some in kubeadm test files. would be grateful if u add me as a co-author on this

@liggitt
Copy link
Member

liggitt commented Dec 8, 2021

change looks good, but is the e2e bringup failure legitimate? is that invocation setting one of the deprecated flags?

@aojea
Copy link
Member

aojea commented Dec 8, 2021

https://storage.googleapis.com/kubernetes-jenkins/pr-logs/pull/106859/pull-kubernetes-e2e-gce-ubuntu-containerd/1468413601273352192/artifacts/e2e-ba468f5940-a7d53-master/kube-apiserver.log

Error: unknown flag: --address

@jonyhy96 @knight42
cleanup: remove insecure flag
cd3bafc 
Signed-off-by: haoyun <yun.hao@daocloud.io>
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. area/kubeadm area/provider/gcp Issues or PRs related to gcp provider sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Dec 9, 2021
@knight42
fix: remove insecure flag from configure-kubeapiserver.sh
fe44878 
Signed-off-by: Jian Zeng <anonymousknight96@gmail.com>
@knight42 knight42 force-pushed the refactor/remove-apiserver-insecure-port branch from b488573 to fe44878 Compare December 9, 2021 07:07
@knight42
Copy link
Member Author

knight42 commented Dec 9, 2021

@liggitt Hi! All tests passed now.

@liggitt
Copy link
Member

liggitt commented Dec 9, 2021

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 9, 2021
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: knight42, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 9, 2021
@k8s-ci-robot k8s-ci-robot merged commit 8cc7d14 into kubernetes:master Dec 9, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.24 milestone Dec 9, 2021
@knight42 knight42 deleted the refactor/remove-apiserver-insecure-port branch December 9, 2021 18:04
@fedebongio
Copy link
Contributor

/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Dec 9, 2021
@hakman hakman mentioned this pull request Dec 11, 2021
Merged
acumino added a commit to gardener/gardener that referenced this pull request May 19, 2022
@acumino
Drop removed flag --insecure-port
c64053a 
ref kubernetes/kubernetes#106859
acumino added a commit to gardener/gardener that referenced this pull request May 23, 2022
@acumino
Drop removed flag --insecure-port for v1.24
6bf5799 
ref kubernetes/kubernetes#106859
acumino added a commit to gardener/gardener that referenced this pull request May 26, 2022
@acumino
Drop removed flag --insecure-port for v1.24
559fec6 
ref kubernetes/kubernetes#106859
acumino added a commit to gardener/gardener that referenced this pull request May 26, 2022
@acumino
Drop removed flag --insecure-port for v1.24
0a1d195 
ref kubernetes/kubernetes#106859
gardener-prow bot pushed a commit to gardener/gardener that referenced this pull request May 27, 2022
@acumino
Support for Kubernetes v1.24 (#6023)
bf03408 
* Extend docs to support kubernetes v1.24 and allow client creation

* Adapt kubernetes feature gates

./hack/compare-k8s-feature-gates.sh 1.23 1.24                                                                                                    ✔
Feature gates added in 1.24 compared to 1.23:
CSIMigrationRBD
CronJobTimeZone
LegacyServiceAccountTokenNoAutoGeneration
MaxUnavailableStatefulSet
MinDomainsInPodTopologySpread
NetworkPolicyStatus
NodeOutOfServiceVolumeDetach
ServiceIPStaticSubrange

Feature gates removed in 1.24 compared to 1.23:
HugePageStorageMediumSize
ImmutableEphemeralVolumes
MigrationRBD
NamespaceDefaultLabelName
RuntimeClass
SetHostnameAsFQDN
StreamingProxyRedirects
ValidateProxyRedirects
WarningHeaders

Feature gates locked to default in 1.24 compared to 1.23:
CSIMigrationOpenStack
CSIStorageCapacity
CSRDuration
ControllerManagerLeaderMigration
DefaultPodTopologySpread
EfficientWatchResumption
IndexedJob
NonPreemptingPriority
PodAffinityNamespaceSelector
PodOverhead
PreferNominatedNode
RemoveSelfLink
ServiceLBNodePortControl
ServiceLoadBalancerClass
SuspendJob

* Use 1.24 for local shoot

* Drop removed flag --insecure-port for v1.24

ref kubernetes/kubernetes#106859

* Drop removed flag --port for v1.24

ref kubernetes/kubernetes#106860

* Remove deprecated usages of metadata.Selflink

* Use 1.24 e2e test

* Bump kindest/node image to v1.24

* Adapt changes for with k/k v1.24 Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount

ref kubernetes/kubernetes#108309

* Add unit test
krgostev pushed a commit to krgostev/gardener that referenced this pull request Jul 5, 2022
@acumino
Support for Kubernetes v1.24 (gardener#6023)
80491c1 
* Extend docs to support kubernetes v1.24 and allow client creation

* Adapt kubernetes feature gates

./hack/compare-k8s-feature-gates.sh 1.23 1.24                                                                                                    ✔
Feature gates added in 1.24 compared to 1.23:
CSIMigrationRBD
CronJobTimeZone
LegacyServiceAccountTokenNoAutoGeneration
MaxUnavailableStatefulSet
MinDomainsInPodTopologySpread
NetworkPolicyStatus
NodeOutOfServiceVolumeDetach
ServiceIPStaticSubrange

Feature gates removed in 1.24 compared to 1.23:
HugePageStorageMediumSize
ImmutableEphemeralVolumes
MigrationRBD
NamespaceDefaultLabelName
RuntimeClass
SetHostnameAsFQDN
StreamingProxyRedirects
ValidateProxyRedirects
WarningHeaders

Feature gates locked to default in 1.24 compared to 1.23:
CSIMigrationOpenStack
CSIStorageCapacity
CSRDuration
ControllerManagerLeaderMigration
DefaultPodTopologySpread
EfficientWatchResumption
IndexedJob
NonPreemptingPriority
PodAffinityNamespaceSelector
PodOverhead
PreferNominatedNode
RemoveSelfLink
ServiceLBNodePortControl
ServiceLoadBalancerClass
SuspendJob

* Use 1.24 for local shoot

* Drop removed flag --insecure-port for v1.24

ref kubernetes/kubernetes#106859

* Drop removed flag --port for v1.24

ref kubernetes/kubernetes#106860

* Remove deprecated usages of metadata.Selflink

* Use 1.24 e2e test

* Bump kindest/node image to v1.24

* Adapt changes for with k/k v1.24 Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount

ref kubernetes/kubernetes#108309

* Add unit test
@rancher-max rancher-max mentioned this pull request Jul 15, 2022
Closed
kl52752 pushed a commit to kl52752/kubernetes that referenced this pull request Dec 23, 2022
@liggitt @kl52752
gke/cluster: kube-apiserver: Drop removed insecure --address and --in…
1f8cf78 
…secure-port flags

GKE config script version of kubernetes#106859

Bug: 209962139
Change-Id: I551cfc12fd94a927383fcff89013a3a78fb61592
@christinalau0 christinalau0 mentioned this pull request Mar 16, 2023
Merged
8 tasks
aojea pushed a commit to aojea/kubernetes that referenced this pull request Jun 14, 2023
@tosi3k @aojea
kube-apiserver: manifest and config updates
29ea358 
kube-apiserver: Change kube-apiserver liveness probe config setup
Prior OSS attempt: kubernetes#94076
Bug: b/164955956
Change-Id: Ia2f75ac5e97f4eb6aa4dc9b00fc2bb3112db9360

kube-apiserver: Set profiling false for kube-apiserver
Change-Id: I052a53d72acfc3c5aa8d03f695beb93cadc0be87

kube-apiserver: allow adding memory limit to kube-apiserver via the KUBE_APISERVER_MEMORY_LIMIT environment variable
bug: 181991030
Change-Id: I1a01766e6f2415eba31d6d865f7f39d7855f969e

kube-apiserver: Drop removed insecure --address and --insecure-port flags
GKE config script version of kubernetes#106859
Bug: 209962139
Change-Id: I551cfc12fd94a927383fcff89013a3a78fb61592

kube-apiserver: Readd KUBE_APISERVER_EVENT_TTL_SEC env for kube-apiserver --event-ttl
Bug: b/176806841
Change-Id: I5c651a555287af0e891e9592dfb7c172b6bb24a2

kube-apiserver: Re-enable the deprecated behavior of CommonName on X.509 as a diagnoser to detect the fleet level impact on the deprecation
Change-Id: If4962b6ecb3294878bfa37ab0ebcd4441fae7140

kube-apiserver: Update permissions of /etc/srv/kubernetes/abac-authz-policy.jsonl if kube-apiserver is running as non-root.
BUG=199669294
Change-Id: Ic9ae9add0a35b7df99781e470c917b2427bee289

kube-apiserver: Remove reference to deleted target-ram-mb flag
Change-Id: I57d0c80eb2285ec9d93b075b1845f1805e0fd748

kube-apiserver: Re-enable SHA1 signatures with GODEBUG=x509sha1=1
Bug: b/227456358
Bug: b/226424430
Change-Id: I5165e6c2fe73e8e1b2a617ced591133228b6d275
serathius pushed a commit to serathius/kubernetes that referenced this pull request Mar 14, 2024
@tosi3k
kube-apiserver: manifest and config updates
077dcab 
kube-apiserver: Change kube-apiserver liveness probe config setup
Prior OSS attempt: kubernetes#94076
Bug: b/164955956
Change-Id: Ia2f75ac5e97f4eb6aa4dc9b00fc2bb3112db9360

kube-apiserver: Set profiling false for kube-apiserver
Change-Id: I052a53d72acfc3c5aa8d03f695beb93cadc0be87

kube-apiserver: allow adding memory limit to kube-apiserver via the KUBE_APISERVER_MEMORY_LIMIT environment variable
bug: 181991030
Change-Id: I1a01766e6f2415eba31d6d865f7f39d7855f969e

kube-apiserver: Drop removed insecure --address and --insecure-port flags
GKE config script version of kubernetes#106859
Bug: 209962139
Change-Id: I551cfc12fd94a927383fcff89013a3a78fb61592

kube-apiserver: Readd KUBE_APISERVER_EVENT_TTL_SEC env for kube-apiserver --event-ttl
Bug: b/176806841
Change-Id: I5c651a555287af0e891e9592dfb7c172b6bb24a2

kube-apiserver: Re-enable the deprecated behavior of CommonName on X.509 as a diagnoser to detect the fleet level impact on the deprecation
Change-Id: If4962b6ecb3294878bfa37ab0ebcd4441fae7140

kube-apiserver: Update permissions of /etc/srv/kubernetes/abac-authz-policy.jsonl if kube-apiserver is running as non-root.
BUG=199669294
Change-Id: Ic9ae9add0a35b7df99781e470c917b2427bee289

kube-apiserver: Remove reference to deleted target-ram-mb flag
Change-Id: I57d0c80eb2285ec9d93b075b1845f1805e0fd748

kube-apiserver: Re-enable SHA1 signatures with GODEBUG=x509sha1=1
Bug: b/227456358
Bug: b/226424430
Change-Id: I5165e6c2fe73e8e1b2a617ced591133228b6d275

kube-apiserver: use --api-audiences as --service-account-api-audiences is deprecated

Copy of kubernetes#103078

Change-Id: I88c2f2eb8bde4378b115e01cbbe9700c27f03955

Expose UDS with profiling data for kube-apiserver.

Added in kubernetes#114191.

See go/no-gke-tcp-pprof for policy.

Refs b/273485199

Change-Id: Ic772c9249468fdf7f516d62bd2a0bfbfe933c1bb

Allow specifying terminationGracePeriodSeconds for kube-apiserver.

Refs b/252987333

Change-Id: I20699501f429630fe74531cb086091eb9ed3611c
hoskeri pushed a commit to hoskeri/kubernetes that referenced this pull request Jul 23, 2024
@tosi3k @hoskeri
kube-apiserver: manifest and config updates
9386ac1 
kube-apiserver: Change kube-apiserver liveness probe config setup
Prior OSS attempt: kubernetes#94076
Bug: b/164955956
Change-Id: Ia2f75ac5e97f4eb6aa4dc9b00fc2bb3112db9360

kube-apiserver: Set profiling false for kube-apiserver
Change-Id: I052a53d72acfc3c5aa8d03f695beb93cadc0be87

kube-apiserver: allow adding memory limit to kube-apiserver via the KUBE_APISERVER_MEMORY_LIMIT environment variable
bug: 181991030
Change-Id: I1a01766e6f2415eba31d6d865f7f39d7855f969e

kube-apiserver: Drop removed insecure --address and --insecure-port flags
GKE config script version of kubernetes#106859
Bug: 209962139
Change-Id: I551cfc12fd94a927383fcff89013a3a78fb61592

kube-apiserver: Readd KUBE_APISERVER_EVENT_TTL_SEC env for kube-apiserver --event-ttl
Bug: b/176806841
Change-Id: I5c651a555287af0e891e9592dfb7c172b6bb24a2

kube-apiserver: Re-enable the deprecated behavior of CommonName on X.509 as a diagnoser to detect the fleet level impact on the deprecation
Change-Id: If4962b6ecb3294878bfa37ab0ebcd4441fae7140

kube-apiserver: Update permissions of /etc/srv/kubernetes/abac-authz-policy.jsonl if kube-apiserver is running as non-root.
BUG=199669294
Change-Id: Ic9ae9add0a35b7df99781e470c917b2427bee289

kube-apiserver: Remove reference to deleted target-ram-mb flag
Change-Id: I57d0c80eb2285ec9d93b075b1845f1805e0fd748

kube-apiserver: Re-enable SHA1 signatures with GODEBUG=x509sha1=1
Bug: b/227456358
Bug: b/226424430
Change-Id: I5165e6c2fe73e8e1b2a617ced591133228b6d275

kube-apiserver: use --api-audiences as --service-account-api-audiences is deprecated

Copy of kubernetes#103078

Change-Id: I88c2f2eb8bde4378b115e01cbbe9700c27f03955

Expose UDS with profiling data for kube-apiserver.

Added in kubernetes#114191.

See go/no-gke-tcp-pprof for policy.

Refs b/273485199

Change-Id: Ic772c9249468fdf7f516d62bd2a0bfbfe933c1bb

Allow specifying terminationGracePeriodSeconds for kube-apiserver.

Refs b/252987333

Change-Id: I20699501f429630fe74531cb086091eb9ed3611c

Run kube-apiserver with cloud-provider=external

Bug: 299159412
Change-Id: I8db8e72377f1c63a3874ee9f0567be264c40ba58
hoskeri pushed a commit to hoskeri/kubernetes that referenced this pull request Jul 23, 2024
@tosi3k @hoskeri
kube-apiserver: manifest and config updates
f4d6020 
kube-apiserver: Change kube-apiserver liveness probe config setup
Prior OSS attempt: kubernetes#94076
Bug: b/164955956
Change-Id: Ia2f75ac5e97f4eb6aa4dc9b00fc2bb3112db9360

kube-apiserver: Set profiling false for kube-apiserver
Change-Id: I052a53d72acfc3c5aa8d03f695beb93cadc0be87

kube-apiserver: allow adding memory limit to kube-apiserver via the KUBE_APISERVER_MEMORY_LIMIT environment variable
bug: 181991030
Change-Id: I1a01766e6f2415eba31d6d865f7f39d7855f969e

kube-apiserver: Drop removed insecure --address and --insecure-port flags
GKE config script version of kubernetes#106859
Bug: 209962139
Change-Id: I551cfc12fd94a927383fcff89013a3a78fb61592

kube-apiserver: Readd KUBE_APISERVER_EVENT_TTL_SEC env for kube-apiserver --event-ttl
Bug: b/176806841
Change-Id: I5c651a555287af0e891e9592dfb7c172b6bb24a2

kube-apiserver: Re-enable the deprecated behavior of CommonName on X.509 as a diagnoser to detect the fleet level impact on the deprecation
Change-Id: If4962b6ecb3294878bfa37ab0ebcd4441fae7140

kube-apiserver: Update permissions of /etc/srv/kubernetes/abac-authz-policy.jsonl if kube-apiserver is running as non-root.
BUG=199669294
Change-Id: Ic9ae9add0a35b7df99781e470c917b2427bee289

kube-apiserver: Remove reference to deleted target-ram-mb flag
Change-Id: I57d0c80eb2285ec9d93b075b1845f1805e0fd748

kube-apiserver: Re-enable SHA1 signatures with GODEBUG=x509sha1=1
Bug: b/227456358
Bug: b/226424430
Change-Id: I5165e6c2fe73e8e1b2a617ced591133228b6d275

kube-apiserver: use --api-audiences as --service-account-api-audiences is deprecated

Copy of kubernetes#103078

Change-Id: I88c2f2eb8bde4378b115e01cbbe9700c27f03955

Expose UDS with profiling data for kube-apiserver.

Added in kubernetes#114191.

See go/no-gke-tcp-pprof for policy.

Refs b/273485199

Change-Id: Ic772c9249468fdf7f516d62bd2a0bfbfe933c1bb

Allow specifying terminationGracePeriodSeconds for kube-apiserver.

Refs b/252987333

Change-Id: I20699501f429630fe74531cb086091eb9ed3611c

Run kube-apiserver with cloud-provider=external

Bug: 299159412
Change-Id: I8db8e72377f1c63a3874ee9f0567be264c40ba58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt Awaiting requested review from liggitt

@caesarxuchao caesarxuchao Awaiting requested review from caesarxuchao

@mikedanese mikedanese Awaiting requested review from mikedanese

Assignees

@liggitt liggitt

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver area/kubeadm area/provider/gcp Issues or PRs related to gcp provider cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
v1.24
Development

Successfully merging this pull request may close these issues.
6 participants
@knight42 @jonyhy96 @liggitt @aojea @k8s-ci-robot @fedebongio