-
Notifications
You must be signed in to change notification settings - Fork 233
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Create a dedicated vSphere CCM secret #1128
Conversation
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: xmudrii The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
LGTM label has been added. Git tree hash: d0f1952a8cc74243a92fbbbde7575870ac48a7fd
|
/cherrypick release/v1.0 |
@kron4eg: once the present PR merges, I will cherry-pick it on top of release/v1.0 in a new PR and assign it to you. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
@kron4eg: new pull request created: #1129 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
What this PR does / why we need it:
Currently, we're creating a single secret to be used for both machine-controller and vSphere CCM. The vSphere CCM requires that the secret data is in the format of
<vcenter-address>.username
and<vcenter-address>.password
, while the machine-controller requires the secret data in the format ofVSPHERE_*
.The problem is that the vSphere CCM fails to parse the secret if there are any other fields than
<vcenter-address>.username
and<vcenter-address>.password
. That causes authorization failures, so node metadata would not be populated from the API, as well as, it would not be possible to use volumes.To fix this issue, this PR introduces another secret, that would be used only for the vSphere CCM. The secret is called
vsphere-ccm-credentials
and is located in the kube-system namespace.Both in-tree CCM and the external CCM are affected.
Reference: https://github.com/kubernetes/kubernetes/blob/e0aeb1b17d6bfc180de62c1adce39b38238176fc/staging/src/k8s.io/legacy-cloud-providers/vsphere/credentialmanager.go#L137-L169
Does this PR introduce a user-facing change?:
/assign @kron4eg