Don't pass true for bool type flag --discovery-token-unsafe-skip-ca-verification #488

xiangpengzhao · 2017-11-23T06:53:57Z

Passing the flag means true, right? Seems like --discovery-token-unsafe-skip-ca-verification true is invalid.

xref: kubernetes/kubernetes#56091 [job failure] kubeadm-gce

Nov 23 05:13:24 ubuntu startupscript: kubeadm join --token "$KUBEADM_TOKEN" "$KUBEADM_MASTER_IP:443" --skip-preflight-checks --discovery-token-unsafe-skip-ca-verification true
Nov 23 05:13:24 ubuntu startupscript: + kubeadm join --token 043479.1a6ec0adafb593d0 10.128.0.2:443 --skip-preflight-checks --discovery-token-unsafe-skip-ca-verification true
Nov 23 05:13:25 ubuntu startupscript: Flag --skip-preflight-checks has been deprecated, it is now equivalent to --ignore-checks-errors=all
Nov 23 05:13:25 ubuntu startupscript: [kubeadm] WARNING: kubeadm is currently in beta
Nov 23 05:13:25 ubuntu startupscript: [preflight] Running pre-flight checks.
Nov 23 05:13:25 ubuntu startupscript: #011[WARNING FileExisting-crictl]: crictl not found in system path
Nov 23 05:13:25 ubuntu startupscript: [validation] WARNING: kubeadm doesn't fully support multiple API Servers yet
Nov 23 05:13:25 ubuntu startupscript: discovery: Invalid value: "true": address true: missing port in address
Nov 23 05:13:25 ubuntu startupscript: Finished running startup script /var/run/google.startup.script

@pipejakob @luxas @dims @spiffxp

…erification

dims · 2017-11-23T17:42:30Z

/lgtm

xiangpengzhao · 2017-11-25T11:24:09Z

/priority critical-urgent
/priority failing-test

ping @pipejakob for merging.

luxas · 2017-11-26T18:54:39Z

phase2/kubeadm/configure-vm-kubeadm-node.sh

@@ -1,4 +1,4 @@

 # This is not meant to run on its own, but extends phase2/kubeadm/configure-vm-kubeadm.sh

-kubeadm join --token "$KUBEADM_TOKEN" "$KUBEADM_MASTER_IP:443" --skip-preflight-checks --discovery-token-unsafe-skip-ca-verification true


👍
also, we should pass this flag ONLY if the kubeadm version is v1.8 or higher.
The versions below that didn't have this feature.

Agreed. 👍

@shashidharatd I'm not familiar with kubeadm version management/check in kubernetes-anywhere. Could you please help fix this? Thanks!

Maybe can ues KUBEADM_VERSION, already have this variable in this file.
But KUBEADM_VERSION is a link like :gs://kubernetes-release-dev/bazel/v1.10.0-alpha.0.631+e7ad6e60081887/bin/linux/amd64/.

yes but the variable is also used in openstack and seems like there it uses "stable" version from another link. It makes it complicated to check the version. And I can't test it out on an gce cloud :(

yep, its complicated. off hand what i could think of is to extract a semver from KUBEADM_VERSION and write a semver matching function and based on the condition use the right option for --discovery-token-unsafe-skip-ca-verification flag.

AFAIK, the KUBEADM_VERSION can be either one of 2 values.

stable

an URL pointing to GCS like the one prefixed with gs://

@shashidharatd sounds great! Thanks! BTW, do you have cycle to help implement this?

@xiangpengzhao, i am giving it a try. will raise a PR once my GCE local testing pass.

@shashidharatd cool, thanks!

xiangpengzhao · 2017-11-27T13:22:12Z

/close
in favor of #491. Thanks @shashidharatd!

Don't pass true for bool type flag --discovery-token-unsafe-skip-ca-v…

22959ed

…erification

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Nov 23, 2017

xiangpengzhao mentioned this pull request Nov 23, 2017

[job failure] kubeadm-gce kubernetes/kubernetes#56091

Closed

k8s-ci-robot assigned dims Nov 23, 2017

k8s-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Nov 23, 2017

dims mentioned this pull request Nov 23, 2017

fix kubeadm join bug #490

Closed

luxas reviewed Nov 26, 2017

View reviewed changes

k8s-ci-robot closed this Nov 27, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Don't pass true for bool type flag --discovery-token-unsafe-skip-ca-verification #488

Don't pass true for bool type flag --discovery-token-unsafe-skip-ca-verification #488

xiangpengzhao commented Nov 23, 2017

dims commented Nov 23, 2017

xiangpengzhao commented Nov 25, 2017

luxas Nov 26, 2017

xiangpengzhao Nov 27, 2017

Lion-Wei Nov 27, 2017

xiangpengzhao Nov 27, 2017

shashidharatd Nov 27, 2017

xiangpengzhao Nov 27, 2017

shashidharatd Nov 27, 2017

xiangpengzhao Nov 27, 2017

xiangpengzhao commented Nov 27, 2017

		@@ -1,4 +1,4 @@

		# This is not meant to run on its own, but extends phase2/kubeadm/configure-vm-kubeadm.sh

		kubeadm join --token "$KUBEADM_TOKEN" "$KUBEADM_MASTER_IP:443" --skip-preflight-checks --discovery-token-unsafe-skip-ca-verification true

Don't pass true for bool type flag --discovery-token-unsafe-skip-ca-verification #488

Don't pass true for bool type flag --discovery-token-unsafe-skip-ca-verification #488

Conversation

xiangpengzhao commented Nov 23, 2017

dims commented Nov 23, 2017

xiangpengzhao commented Nov 25, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xiangpengzhao commented Nov 27, 2017