Fix CSR approving issue for existing nodes with already approved and GCed CSRs #1894
Conversation
Signed-off-by: Artiom Diomin <kron82@gmail.com>
kron4eg
force-pushed
the
1893-csr-approve
branch
from
0ddc627
to
75f6867
Compare
kubermatic-bot
added
kind/bug
|
/cherrypick release/v1.4 |
|
@kron4eg: once the present PR merges, I will cherry-pick it on top of release/v1.4 in a new PR and assign it to you. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
LGTM label has been added. Git tree hash: f8f96293e1f1a3080cc725ec4892778a41b64087
|
|
/hold |
kubermatic-bot
added
the
do-not-merge/hold
pkg/tasks/certs.go
Outdated
| @@ -244,7 +243,11 @@ func approvePendingCSR(s *state.State, node *kubeoneapi.HostConfig, conn ssh.Con | |||
| } | |||
| } | |||
|
|
|||
| return approveErr | |||
| if !csrFound { | |||
| s.Logger.Info("no CSR found for node %q, assuming it was garbage-collected", node.Hostname) | |||
There was a problem hiding this comment.
Nit: uppercase log messages.
| s.Logger.Info("no CSR found for node %q, assuming it was garbage-collected", node.Hostname) | |
| s.Logger.Info("No CSR found for node %q, assuming it was garbage-collected", node.Hostname) |
Signed-off-by: Artiom Diomin <kron82@gmail.com>
kron4eg
force-pushed
the
1893-csr-approve
branch
from
bfbe667
to
527c6c0
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kron4eg, xmudrii The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
LGTM label has been added. Git tree hash: 4579b78ee4c872329cbc8bdd89cb17cad0974962
|
|
/unhold |
kubermatic-bot
removed
the
do-not-merge/hold
|
@kron4eg: new pull request created: #1897 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
What type of PR is this?
/kind bug
What this PR does / why we need it:
Successfully approved CSR is GC-ed after 1 hour, effectively leading to the situation where perfectly good Kubelet cert doesn't need any new CSRs will make kubeone to throw out with misleading error.
Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when PR gets merged):Fixes #1893
Does this PR introduce a user-facing change?: