search

digitalocean / clusterlint

A best practices checker for Kubernetes clusters. 🤠
Apache License 2.0
542 stars 45 forks source link

false positive for webhooks with TimeoutSeconds value greater than 29s #122

Closed sundowndev closed 2 years ago

sundowndev commented 3 years ago

Hi, each time digitalocean tries to upgrade my cluster automatically, they send me an alert about upgrade check failure :

Mutating webhook with a TimeoutSeconds value greater than 29 seconds will block upgrades

The issue is I find no such webhook with TimeoutSeconds value greater than 29 seconds.

My cluster is running version 1.20.7-do.0 and DO is trying to upgrade to 1.20.8-do.0.

Let me know if you need more details

gottwald commented 3 years ago

Hi there,

Looks like you're hitting this case: https://github.com/digitalocean/clusterlint/blob/9ffee1bec71c02cccb9544fa43a72b8dda6157e6/checks/doks/admission_controller_webhook_timeout.go#L60

You can check for all webhooks by doing:

kubectl get validatingwebhookconfiguration,mutatingwebhookconfiguration

In your specific case this should be sufficient:

kubectl get mutatingwebhookconfiguration

If you look closely at the code I've linked, the check also verifies whether the timeout is less than one and raises the warning. It looks like the error message should be made clearer and mention both possible error cases.

Please check again if your webhooks fit any of the mentioned cases.

sundowndev commented 2 years ago

I don't have this issue anymore so I'll guess it's fixed, thanks