USHIFT-278: Remove KAS kubeconfig #909
Conversation
717b44e
to
cece914
Compare
|
The "likely unused" part of the description, along with a lack of confidence in our CI coverage, combined make me concerned about merging this patch without understanding how to test it. Is there something I can do to poke at a running instance to see if the change is working properly? |
|
I don't see anything that reads the kubeconfig path during initialization. We would expect the controllers inside kube-apiserver to break if they were using this instead of the loopback client config. |
|
What Ben says - I found it odd that the kube-apiserver would need a kubeconfig but I did not want to rule anything out. Turns out it's only ever used for the /readyz checking, and so this PR is safe to merge |
| if err != nil { | ||
| return false, err | ||
| } | ||
| if err := rest.SetKubernetesDefaults(restConfig); err != nil { | ||
| return false, err | ||
| } | ||
| restConfig.NegotiatedSerializer = serializer.NewCodecFactory(runtime.NewScheme()) | ||
| restConfig.CAFile = s.servingCertPath |
There was a problem hiding this comment.
Should we use the CA from https://github.com/openshift/microshift/blob/main/pkg/controllers/kube-apiserver.go#L96?
There was a problem hiding this comment.
Since this is just a startup test and we are specifically interested in checking this very server, I believe a simple trust such as we've got here is adequate
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: pacevedom, stlaz The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@stlaz: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
The kube-apiserver kubeconfig is likely unused. This PR removes this file with privileged credentials.
The kubeconfig appears to have only been used to generate a REST client for KAS "/readyz" check. Let's see if we can easily replace that by just supplying an anonymous client instead for this check.