search

GoogleCloudPlatform / deploymentmanager-samples

Deployment Manager samples and templates.
Apache License 2.0
946 stars 716 forks source link

Basic auth deprecated on latest GKE (Cloud Foundation templates) #463

Open claudiobizzotto opened 5 years ago

claudiobizzotto commented 5 years ago

Using the GKE Cloud Foundation templates to upgrade GKE to version 1.12+ will throw an error like the following:

ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-xxx]: errors:
- code: REFERENCE_VALUE_NOT_FOUND
location: /deployments/xxx/resources/xxx->$.properties
message: |-
The reference 'masterAuth.clientCertificate' is not found, reason:
The resource 'xxx' exists, but the reference value does not.

It looks like masterAuth has been deprecated as of June 3rd 2019: "Basic authentication and client certificate issuance are disabled by default for clusters created with GKE 1.12 and higher. We recommend switching your clusters to use OpenID instead."

bohdanyurov-gl commented 5 years ago

Related issue: https://github.com/GoogleCloudPlatform/deploymentmanager-samples/issues/436

bohdanyurov-gl commented 5 years ago

This was previously fixed, but error is still reproducible if we don't specify cluster version

gbhojak commented 5 years ago

Hi,

Is there a workaround for this issue? I have specified 'initialClusterVersion' in the template and I still get this error.

Regards, Giriraj

nick4fake commented 5 years ago

@gbhojak Are you sure you are using latest version? I am also not sure if all the changes are present in master now.

@ocsig ^

dtapia-rdc commented 5 years ago

I've just tested with InitialClusterVersion: '1.12.8-gke.10' and InitialClusterVersion: '1.13.7-gke.8'

Still fails the deployment with 

- code: REFERENCE_VALUE_NOT_FOUND
  location: /deployments/dev-gke-deployment/resources/eng-dev-kubernetes->$.properties
  message: |-
    The reference 'masterAuth.clientCertificate' is not found, reason:
    The resource 'eng-dev-kubernetes' exists, but the reference value does not.

Using cft apply

claudiobizzotto commented 5 years ago

I'm tellin ya dawg, this shis broken.

ocsig commented 5 years ago

@dtapia-rdc @claudiobizzotto Can you please confirm which template are you using? At the other repo, cft-dm-dev branch there is the latest version.

gbhojak commented 5 years ago

HI @nick4fake and @ocsig ,

I have used the template available in master at gke

Regards, Giriraj

claudiobizzotto commented 5 years ago

I'm using the gke.py that I've submitted here (without masterAuth).