Bug 1820258 - kube-apiserver can be deployed without cert-syncer having valid token
Summary: kube-apiserver can be deployed without cert-syncer having valid token
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: kube-apiserver
Version: 4.4
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
: 4.4.0
Assignee: Tomáš Nožička
QA Contact: Ke Wang
URL:
Whiteboard:
: 1807881 (view as bug list)
Depends On: 1820255
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-04-02 15:39 UTC by Tomáš Nožička
Modified: 2020-05-12 13:47 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of: 1820255
Environment:
Last Closed: 2020-05-04 11:48:02 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-kube-apiserver-operator pull 821 0 None closed [release-4.4] Bug 1820258: Fix race for localhost-recovery-client-token snapshotting 2020-07-22 15:38:36 UTC
Red Hat Product Errata RHBA-2020:0581 0 None None None 2020-05-04 11:48:21 UTC

Description Tomáš Nožička 2020-04-02 15:39:54 UTC
+++ This bug was initially created as a clone of Bug #1820255 +++

kube-apiserver can be deployed without cert-syncer having a valid token. This ca be caused by a race when making revisions from token Secret as in https://bugzilla.redhat.com/show_bug.cgi?id=1819256

Comment 3 Ke Wang 2020-04-20 08:00:42 UTC
Verified with OCP build 4.4.0-0.nightly-2020-04-18-095545,
Verification steps:
1. In first terminal, Run this command in a loop to make sure that data.token is deleted from openshift-kube-controller-manager/localhost-recovery-client-token
# for i in {1..100} ; do oc patch secret -n openshift-kube-controller-manager localhost-recovery-client-token --type='json' -p='[{"op": "replace", "path": "/data/token", "value": ""}]'; done

2. In another terminal,  Force operator to retry rolling out by:
$ oc patch kubeapiserver/cluster --type=json -p '[ {"op": "replace", "path": "/spec/forceRedeploymentReason", "value": "forced test 1" } ]' 

$ oc get pods -n openshift-kube-apiserver
 ...
kube-apiserver-osp41-7g9pl-master-1      0/4     Init:0/1    0          2s
 ...
 
kube-apiserver can be deployed even though data.token is deleted from openshift-kube-controller-manager/localhost-recovery-client-token.

Comment 5 errata-xmlrpc 2020-05-04 11:48:02 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0581

Comment 6 Luis Sanchez 2020-05-12 13:47:45 UTC
*** Bug 1807881 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.