search

heptio / aws-quickstart

AWS Kubernetes cluster via CloudFormation and kubeadm
Apache License 2.0
223 stars 134 forks source link

Kubeconfig endpoint uses ip address instead of cname #235

Closed stevesloka closed 5 years ago

stevesloka commented 5 years ago

What steps did you take and what happened:

After a cluster is built, the downloaded config uses the IP address of the ELB instead of the DNS name. This causes a problem if the IP address changes breaking the connection to the cluster.

stevesloka commented 5 years ago

//cc @chuckha

timothysc commented 5 years ago

/assign @vincepri

vincepri commented 5 years ago

During the last refresh the IP address was chosen instead of the cname because of https://github.com/heptio/aws-quickstart/blob/master/scripts/setup-k8s-master.sh.in#L127-L130 which fails validation if the address isn't a valid IP.

We need to investigate if this is still the case and if the address can now be a cname instead.

johnSchnake commented 5 years ago

According to https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/app/util/config/initconfiguration.go#L116 it still needs to be an ipv4 or ipv6 address and not a cname.

johnSchnake commented 5 years ago

I found https://github.com/kubernetes/kubeadm/issues/1057 where this had been raised before for kubeadm. Going to think try and grock this a bit more as @liztio already spent some time considering this apparently.

johnSchnake commented 5 years ago

So looking through the kubeadm code there does seem to be a discrepency between the validations that occur. I've confirmed that the kubeadm init --config flow does allow the cname but doesn't seem to hit the same validation logic that kubeadm alpha kubeconfig hits w.r.t. this value. Will look into it a bit more but in the meantime should have an easier fix for this where we can just swap out the IP for DNS name manually.