Aws-iam-authenticator: Race Condition in K8S Start

[RaphaelHerd]

Hi,

I successfully tested the auth plugin follwing your instructions. Now I would like to automate the deployment. What I found out is, that currently I have a race condition between the DaemonSet and KubeApiServer.

While KubeApiServer is starting (after a new master instance is launched by the AWS Autoscaling Group), the KubeAPIServer is not able to find the kubeconfig.yaml. This is because it's not present on the machine. It's not because the DS is nor started before and therefore heptio auth was not able to generate the config file on the local disc of this machine.

Do you have any ideas how to solve this issue? Using K8s 1.7.10 and current version of Kops for installing.

Thx
Raphael

[bbck]

I just ran into this and got around it using fileAssets in kops to place a dummy file. You also need to edit the example deployment to drop the webhook configuration into /srv/kubernetes since it's mounted in the apiserver pod.

fileAssets:
  - content: |
      clusters:
        - name: heptio-authenticator-aws
          cluster:
            certificate-authority: /srv/kubernetes/ca.crt
            server: https://127.0.0.1:21362/authenticate
      users:
        - name: apiserver
      current-context: webhook
      contexts:
      - name: webhook
        context:
          cluster: heptio-authenticator-aws
          user: apiserver
    name: heptio-authenticator-aws
    path: /srv/kubernetes/webhook-authentication.yaml
    roles:
    - Master

[RaphaelHerd]

Funny to hear that. I did exactly the same :-). But instead of file Assets I'm using a hook with an execContainer and mounted the path in it. One question: which kops version you are using? I currently need to use kops 1.7. Is the assets feature available in 1.7?

``

• execContainer:
  command:
  
  
  
  • sh
  
  
  • -c
  
  
  • "apk -Uuv add groff less python py-pip && pip install awscli && mkdir -p /rootfs/srv/kubernetes/heptio-authenticator-aws/ && aws s3 cp 's3://..../kubeconfig.yaml' '/rootfs/srv/kubernetes/heptio-authenticator-aws/kubeconfig.yaml' --region eu-central-1"
    
    image: alpine
  
  

``

[bbck]

@RaphaelHerd This was using kops 1.8.

[mirthy]

@bbck Did you have any issues with certificates? I'm running into an issue where the apiserver doesn't like the self-signed cert that the authenticator is using.

[mattmoyer]

@RaphaelHerd @bbck sorry for the slow response here. I'd love to include an example Kops configuration if one of you would be willing to share how you got it working.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.