Setting System parameter kube_apiserver admission_plugins to include PodSecurityPolicy deletes the kube-api pod
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
StarlingX |
Fix Released
|
Low
|
Carmen Rata |
Bug Description
Brief Description
-----------------
Setting System parameter kube_apiserver admission_plugins to include PodSecurityPolicy deletes the kube-api pod on active controller
Severity
--------
Major
Steps to Reproduce
------------------
1)Set the kubernetes kube_apiserver admission_plugins system parameter to include PodSecurityPolicy
system service-
2)Apply the Kubernetes system parameters
system service-
3)Kube-api pod gets deleted on the system
[sysadmin@
Expected Behavior
------------------
kube-apiserver pod should not gets deleted after adding psp
Actual Behavior
----------------
kube-apiserver pod gets deleted after adding psp to system admission_plugins
Reproducibility
---------------
100%
System Configuration
-------
tested on all the following systems
simplex system,wcp_112 ipv6
duplex system, ip_18_19,ipv4
Branch/Pull Time/Commit
-------
2020-05-31 20:01:53 -0400
Last Pass
---------
This is a new test scenario
Timestamp/Logs
--------------
2020-06-01 11:47:13.956
Test Activity
-------------
Feature Testing
Workaround
----------
Delete the system service parameter and apply the kube service brings back the pod
tags: | added: stx.4.0 stx.containers stx.security |
Changed in starlingx: | |
status: | New → Triaged |
importance: | Undecided → High |
assignee: | nobody → Jerry Sun (jerry-sun-u) |
Changed in starlingx: | |
assignee: | Jerry Sun (jerry-sun-u) → Carmen Rata (crata) |
Changed in starlingx: | |
status: | Triaged → In Progress |
tags: | removed: stx.retestneeded |
I tried this on a system I had up, it seems the pod is down but the apiserver process is still running somehow
[sysadmin@ controller- 0 ~(keystone_admin)]$ kubectl get pods --all-namespaces | grep apiserver controller- 1 1/1 Running 0 134m controller- 0 ~(keystone_admin)]$ ps -ef | grep apiserver address= 10.10.10. 4 --allow- privileged= true --authorization -mode=Node, RBAC --client- ca-file= /etc/kubernetes /pki/ca. crt --default- not-ready- toleration- seconds= 30 --default- unreachable- toleration- seconds= 30 --enable- admission- plugins= PodSecurityPoli cy,NodeRestrict ion --enable- bootstrap- token-auth= true --encryption- provider- config= /etc/kubernetes /encryption- provider. yaml --etcd-servers=http:// 192.168. 206.1:2379 --event-ttl=24h --feature- gates=SCTPSuppo rt=true, TTLAfterFinishe d=true, HugePageStorage MediumSize= true --insecure-port=0 --kubelet- client- certificate= /etc/kubernetes /pki/apiserver- kubelet- client. crt --kubelet- client- key=/etc/ kubernetes/ pki/apiserver- kubelet- client. key --kubelet- preferred- address- types=InternalI P,ExternalIP, Hostname --proxy- client- cert-file= /etc/kubernetes /pki/front- proxy-client. crt --proxy- client- key-file= /etc/kubernetes /pki/front- proxy-client. key --requestheader -allowed- names=front- proxy-client --requestheader -client- ca-file= /etc/kubernetes /pki/front- proxy-ca. crt --requestheader -extra- headers- prefix= X-Remote- Extra- --requestheader -group- headers= X-Remote- Group --requestheader -username- headers= X-Remote- User --secure-port=6443 --service- account- key-file= /etc/kubernetes /pki/sa. pub --service- cluster- ip-range= 10.96.0. 0/12 --tls-cert- file=/etc/ kubernetes/ pki/apiserver. crt --tls-private- key-file= /etc/kubernetes /pki/apiserver. key controller- 0 ~(keystone_admin)]$
kube-system kube-apiserver-
[sysadmin@
root 3720596 3720575 5 14:04 ? 00:07:13 kube-apiserver --advertise-
sysadmin 4179067 4177470 0 16:19 pts/0 00:00:00 grep --color=auto apiserver
[sysadmin@