Bug 1820255 - kube-apiserver can be deployed without cert-syncer having a valid token
Summary: kube-apiserver can be deployed without cert-syncer having a valid token
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: kube-apiserver
Version: 4.4
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.5.0
Assignee: Tomáš Nožička
QA Contact: Xingxing Xia
Depends On:
Blocks: 1820258
TreeView+ depends on / blocked
Reported: 2020-04-02 15:38 UTC by Tomáš Nožička
Modified: 2020-07-13 17:25 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
: 1820258 (view as bug list)
Last Closed: 2020-07-13 17:25:20 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift cluster-kube-apiserver-operator pull 815 0 None closed Bug 1820255: Fix race for localhost-recovery-client-token snapshotting 2020-07-22 12:41:16 UTC
Red Hat Product Errata RHBA-2020:2409 0 None None None 2020-07-13 17:25:41 UTC

Description Tomáš Nožička 2020-04-02 15:38:36 UTC
kube-apiserver can be deployed without cert-syncer having a valid token. This ca be caused by a race when making revisions from token Secret as in https://bugzilla.redhat.com/show_bug.cgi?id=1819256

Comment 3 Xingxing Xia 2020-04-14 15:43:06 UTC
Due to pushed by PM/Dev for backport but daylight has no time, working at night:
Checked the commit https://github.com/openshift/cluster-kube-apiserver-operator/pull/815/commits/e83b8303911b286fa6eea4dde5ded2fc0bf555ec#diff-dd9e4bf75a3b418978ce9d66ec26cfadR351 , and PR https://github.com/openshift/library-go/pull/764/files change. Saw bug 1819256#c3 which needs to rollout the static pods, but each rollout will take 5 mins, all verification time will spend 5 * loop_count mins, not viable.
So just verify via the test code in 4.5.0-0.nightly-2020-04-13-213244:
=== RUN   TestSyncSecret
=== RUN   TestSyncSecret/syncing_existing_secret_succeeds_when_the_target_is_missing                                                   
=== RUN   TestSyncSecret/syncing_existing_secret_succeeds_when_the_target_is_present_and_up_to_date                                    
=== RUN   TestSyncSecret/syncing_existing_secret_succeeds_when_the_target_is_present_and_needs_update                                  
=== RUN   TestSyncSecret/syncing_missing_source_secret_doesn't_fail
=== RUN   TestSyncSecret/syncing_service_account_token_doesn't_sync_without_the_token_being_present                                    
=== RUN   TestSyncSecret/syncing_service_account_token_strips_"managed"_annotations                                                    
--- PASS: TestSyncSecret (0.00s)
    --- PASS: TestSyncSecret/syncing_existing_secret_succeeds_when_the_target_is_missing (0.00s)                                       
    --- PASS: TestSyncSecret/syncing_existing_secret_succeeds_when_the_target_is_present_and_up_to_date (0.00s)                        
    --- PASS: TestSyncSecret/syncing_existing_secret_succeeds_when_the_target_is_present_and_needs_update (0.00s)                      
    --- PASS: TestSyncSecret/syncing_missing_source_secret_doesn't_fail (0.00s)                                                        
    --- PASS: TestSyncSecret/syncing_service_account_token_doesn't_sync_without_the_token_being_present (0.00s)                        
    --- PASS: TestSyncSecret/syncing_service_account_token_strips_"managed"_annotations (0.00s)                                        
ok      github.com/openshift/library-go/pkg/operator/resource/resourceapply     0.013s

Comment 5 errata-xmlrpc 2020-07-13 17:25:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.