Bug 1959658 - showing a lot "constructing many client instances from the same exec auth config"
Summary: showing a lot "constructing many client instances from the same exec auth con...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: oc
Version: 4.8
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 4.8.0
Assignee: Maciej Szulik
QA Contact: zhou ying
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-05-12 03:48 UTC by Wu Siu Wa
Modified: 2021-07-27 23:08 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-07-27 23:08:01 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 23:08:18 UTC

Description Wu Siu Wa 2021-05-12 03:48:22 UTC
Description of problem:
Seeing a lot warning message when executing "oc describe nodes".
~~~
W0511 08:48:15.590063     212 exec.go:282] constructing many client instances from the same exec auth config can cause performance problems during cert rotation and can exhaust available network connections; 1004 clients constructed calling "bash"
~~~

Using exec auth in .kube/config like
~~~
users:
- name: xxxxx
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - /home/xxxx/.kube/ocm-token
      command: bash
      env:
      - name: OCM_CONFIG
        value: /home/xxxxx/.ocm.json.stg
~~~

Version-Release number of selected component (if applicable):


How reproducible:
- 100%

Steps to Reproduce:
1. Configure oc to use exec auth like the above.
2. Run "oc describe nodes"
3.

Actual results:
Flooding with warning messages.

Expected results:
No warning messages.

Additional info:
The issue has been fixed upstream.
https://github.com/kubernetes/kubernetes/pull/97857/

I built the latest oc from source, the issue has been fixed.
~~~
./oc describe nodes //<--- no issue.
./oc version
Client Version: v4.2.0-alpha.0-1081-g4c2094c
Server Version: 4.7.8
Kubernetes Version: v1.20.0+7d0a2b2
~~~

The latest version provided in https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/openshift-client-linux-4.7.9.tar.gz still having the issue.

Comment 1 Maciej Szulik 2021-05-12 10:48:34 UTC
That fix (https://github.com/kubernetes/kubernetes/pull/97857/) was brought in with k8s 1.21 bump in https://github.com/openshift/oc/pull/773

Comment 5 zhou ying 2021-05-17 06:42:22 UTC
Could reproduce with old oc for the OSD cluster , and can't reproduce with latest oc for the OSD cluster , will move to verified status. 


[root@localhost ~]# ./oc version --client
Client Version: 4.5.0-0.nightly-2021-04-22-153347

[root@localhost ~]# ./oc describe node >/tmp/oldoc
W0517 14:39:51.730899 1143706 exec.go:203] constructing many client instances from the same exec auth config can cause performance problems during cert rotation and can exhaust available network connections; 1001 clients constructed calling "bash"
W0517 14:39:51.730954 1143706 exec.go:203] constructing many client instances from the same exec auth config can cause performance problems during cert rotation and can exhaust available network connections; 1002 clients constructed calling "bash"


[root@localhost ~]# oc version 
Client Version: 4.8.0-202104292348.p0.git.a765590-a765590
Server Version: 4.7.9
Kubernetes Version: v1.20.0+7d0a2b2
[root@localhost ~]# oc describe node >/tmp/newoc
[root@localhost ~]#

Comment 8 errata-xmlrpc 2021-07-27 23:08:01 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438


Note You need to log in before you can comment on or make changes to this bug.