mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-12-07 18:06:21 +00:00
67870dac16
Automatic merge from submit-queue (batch tested with PRs 62655, 61711, 59122, 62853, 62390). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Modify the kubeadm upgrade DAG for the TLS Upgrade **What this PR does / why we need it**: This adds the necessary utilities to detect Etcd TLS on static pods from the file system and query Etcd. It modifies the upgrade logic to make it support the APIServer downtime. Tests are included and should be passing. ```bash bazel test //cmd/kubeadm/... \ && bazel build //cmd/kubeadm --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 \ && issue=TLSUpgrade ~/Repos/vagrant-kubeadm-testing/copy_kubeadm_bin.sh ``` These cases are working consistently for me ```bash kubeadm-1.9.6 reset \ && kubeadm-1.9.6 init --kubernetes-version 1.9.1 \ && kubectl apply -f https://git.io/weave-kube-1.6 /vagrant/bin/TLSUpgrade_kubeadm upgrade apply 1.9.6 # non-TLS to TLS /vagrant/bin/TLSUpgrade_kubeadm upgrade apply 1.10.0 # TLS to TLS /vagrant/bin/TLSUpgrade_kubeadm upgrade apply 1.10.1 # TLS to TLS /vagrant/bin/TLSUpgrade_kubeadm upgrade apply 1.9.1 # TLS to TLS /w major version downgrade ``` This branch is based on top of #61942, as resolving the hash race condition is necessary for consistent behavior. It looks to fit in pretty well with @craigtracey's PR: #62141 The interfaces are pretty similar /assign @detiber @timothysc **Which issue(s) this PR fixes** Helps with https://github.com/kubernetes/kubeadm/issues/740 **Special notes for your reviewer**: 278b322a1c [kubeadm] Implement ReadStaticPodFromDisk c74b56372d Implement etcdutils with Cluster.HasTLS() - Test HasTLS() - Instrument throughout upgrade plan and apply - Update plan_test and apply_test to use new fake Cluster interfaces - Add descriptions to upgrade range test - Support KubernetesDir and EtcdDataDir in upgrade tests - Cover etcdUpgrade in upgrade tests - Cover upcoming TLSUpgrade in upgrade tests 8d8e5fe33b Update test-case, fix nil-pointer bug, and improve error message 97117fa873 Modify the kubeadm upgrade DAG for the TLS Upgrade - Calculate `beforePodHashMap` before the etcd upgrade in anticipation of KubeAPIServer downtime - Detect if pre-upgrade etcd static pod cluster `HasTLS()==false` to switch on the Etcd TLS Upgrade if TLS Upgrade: - Skip L7 Etcd check (could implement a waiter for this) - Skip data rollback on etcd upgrade failure due to lack of L7 check (APIServer is already down unable to serve new requests) - On APIServer upgrade failure, also rollback the etcd manifest to maintain protocol compatibility - Add logging **Release note**: ```release-note kubeadm upgrade no longer races leading to unexpected upgrade behavior on pod restarts kubeadm upgrade now successfully upgrades etcd and the controlplane to use TLS kubeadm upgrade now supports external etcd setups kubeadm upgrade can now rollback and restore etcd after an upgrade failure ```