Skip to content
Snippets Groups Projects
Unverified Commit c9c0c01d authored by Etienne Champetier's avatar Etienne Champetier Committed by GitHub
Browse files

Stop using kubeadm to update server in kubeconfigs (#7338)


Using `kubeadm init phase kubeconfig all` breaks kubelet client certificate rotation
as we are missing `kubeadm init phase kubelet-finalize all` to point to `kubelet-client-current.pem`

kubeconfig format is stable so let's just use lineinfile,
this will avoid other future breakage

This revert to the logic before 6fe22483

Signed-off-by: default avatarEtienne Champetier <e.champetier@ateme.com>
parent e442b1d2
No related branches found
No related tags found
No related merge requests found
---
- name: Test if correct apiserver is set in all kubeconfigs
shell: >-
grep -Fq "{{ kube_apiserver_endpoint }}" {{ kube_config_dir }}/admin.conf &&
grep -Fq "{{ kube_apiserver_endpoint }}" {{ kube_config_dir }}/controller-manager.conf &&
grep -Fq "{{ kube_apiserver_endpoint }}" {{ kube_config_dir }}/kubelet.conf &&
grep -Fq "{{ kube_apiserver_endpoint }}" {{ kube_config_dir }}/scheduler.conf
register: kubeconfig_correct_apiserver
changed_when: False
failed_when: False
- name: Create temporary directory
tempfile:
state: directory
register: kubeconfig_temp_dir
when: kubeconfig_correct_apiserver.rc != 0
- name: Generate new kubeconfigs with correct apiserver
command: >-
{{ bin_dir }}/kubeadm init phase kubeconfig all
--config {{ kube_config_dir }}/kubeadm-config.yaml
--kubeconfig-dir {{ kubeconfig_temp_dir.path }}
when: kubeconfig_correct_apiserver.rc != 0
- name: Copy new kubeconfigs to kube config dir
copy:
src: "{{ kubeconfig_temp_dir.path }}/{{ item }}"
- name: Update server field in component kubeconfigs
lineinfile:
dest: "{{ kube_config_dir }}/{{ item }}"
mode: 0640
remote_src: yes
when: kubeconfig_correct_apiserver.rc != 0
regexp: '^ server: https'
line: ' server: {{ kube_apiserver_endpoint }}'
backup: yes
with_items:
- admin.conf
- controller-manager.conf
......@@ -38,9 +15,3 @@
- "Master | Restart kube-controller-manager"
- "Master | Restart kube-scheduler"
- "Master | reload kubelet"
- name: Cleanup temporary directory
file:
path: "{{ kubeconfig_temp_dir.path }}"
state: absent
when: kubeconfig_correct_apiserver.rc != 0
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment