Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't use join tokens to bootstrap embedded kubelet #5487

Open
wants to merge 6 commits into
base: main
Choose a base branch
from

Conversation

twz123
Copy link
Member

@twz123 twz123 commented Jan 30, 2025

Description

When a controller bootstraps its embedded kubelet, it doesn't have to use a join token at all. Instead, it can just bootstrap the kubelet configuration using its own admin kubeconfig.

Add a new KubeconfigGetter argument to the worker start method. If running from a controller, this will simply point to the admin kubeconfig. When running as a standalone worker, this will actually be backed by the join token, if any.

Extract kubelet's CA from its kubeconfig, instead of doing it once during the bootstrapping process. This eliminates the need for another persistent flle in k0s's data directory, allows the use of arbitrary kubelet bootstrap kubeconfigs (as long as they're valid), and removes a potential panic for bootstrap kubeconfigs that don't have a cluster called "k0s".

Improve logging during kubelet config bootstrapping: Use a structured logger, remove "kubelet" from log and error messages, as that's now obvious from the context.

Remove the explicit initialization of the kubelet cert directory. This will be handled by the upstream client config loading code just fine.

Remove the join client's token type. It has to be always of type controller-bootstrap. Integrate that check into the join client creation function instead.

Introduce constants for join token auth names.

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update

How Has This Been Tested?

  • Manual test
  • Auto test added

Checklist:

  • My code follows the style guidelines of this project
  • My commit messages are signed-off
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules
  • I have checked my code and corrected any misspellings

@twz123 twz123 added area/worker chore enhancement New feature or request and removed chore labels Jan 30, 2025
It has to be always of type controller-bootstrap. Integrate that check
into the join client creation function instead.

Signed-off-by: Tom Wieczorek <[email protected]>
This will be handled by the upstream client config loading code just
fine.

Signed-off-by: Tom Wieczorek <[email protected]>
Instead of doing it once during the bootstrapping process. This
eliminates the need for another persistent flle in k0s's data directory,
allows the use of arbitrary kubelet bootstrap kubeconfigs (as long as
they're valid), and removes a potential panic for bootstrap kubeconfigs
that don't have a cluster called "k0s".

Signed-off-by: Tom Wieczorek <[email protected]>
Use a structured logger, remove "kubelet" from log and error messages,
as that's now obvious from the context.

Signed-off-by: Tom Wieczorek <[email protected]>
When a controller bootstraps its embedded kubelet, it doesn't have to
use a join token at all. Instead, it can just bootstrap the kubelet
configuration using its own admin kubeconfig.

Add a new KubeconfigGetter argument to the worker start method.
If running from a controller, this will simply point to the admin
kubeconfig. When running as a standalone worker, this will actually be
backed by the join token, if any.

Signed-off-by: Tom Wieczorek <[email protected]>
@twz123 twz123 force-pushed the controllerworker-without-join-token branch from bc75178 to 8809af1 Compare January 30, 2025 19:26
@twz123 twz123 marked this pull request as ready for review January 30, 2025 20:57
@twz123 twz123 requested review from a team as code owners January 30, 2025 20:57
@twz123 twz123 requested review from kke and makhov January 30, 2025 20:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/worker enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant