Description of problem: The Multus CNI entrypoint script does not account for the possibility of the kube ca rotating, since the entrypoint generates a kubeconfig only once -- the kube ca could be rotated and if you wait long enough, could cause a serious cluster failure upon rotation. How reproducible: (when kube ca rotates) Additional info: * The regenerated (and generated) kubeconfig should be an atomic swap of the file. * A must-gather improvement could be nice to look at the contents of the multus.d directory (note: this should omit the actual secret)
Have a work-around in place. Will work in an ideal fashion when upgrade to a thick plugin methodology.