kubeadm command can use wrong config file

[Bart Wensley]

Brief Description
-----------------
Our software uses the kubeadm command to install, manage and upgrade kubernetes. However, it is not passing the --kubeconfig parameter to this command, so the command will search for the kubeconfig file. Normally it finds this file in /etc/kubernetes/admin.conf, but if a user accidentally (or intentionally) creates a config file at /root/.kube/config, this file can take precedence and cause the kubeadm command to fail.

Changes will be required in the ansible, config and stx-puppet repos - anywhere
the kubeadm command is used. Note that some kubeadm commands (e.g. kubeadm init
and kubeadm join do not use the --kubeconfig parameter) because they actually
create this file.

Severity
--------
Major: the user should not be creating these extra files, but if they do, basic system functionality (e.g. locking/unlocking hosts) is broken.

Steps to Reproduce
------------------
Create an invalid kubeconfig file at /root/.kube/config. This can be done as the sysadmin user by running "sudo kubectl config set-context ..." and "sudo kubectl config use-context ..." commands.

Expected Behavior
------------------
The system should always use the /etc/kubernetes/admin.conf file for kubeadm commands.

Actual Behavior
----------------
See above

Reproducibility
---------------
Reproducible

System Configuration
--------------------
All

Branch/Pull Time/Commit
-----------------------
StarlingX Master - this is a day one issue.

Last Pass
---------
Never

Timestamp/Logs
--------------
N/A

Test Activity
-------------
Evaluation

Workaround
----------
Delete the extra kubeconfig file.

[Ghada Khalil (gkhalil)]

stx.4.0 / high priority - this can leave the system non-operational

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/735214

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/735215

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/735216

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/735216
Committed: https://git.openstack.org/cgit/starlingx/ansible-playbooks/commit/?id=01819d5090bc8da039533dd0ac915b35cc489db1
Submitter: Zuul
Branch: master

commit 01819d5090bc8da039533dd0ac915b35cc489db1
Author: Andy Ning <email address hidden>
Date: Thu Jun 11 09:19:41 2020 -0400

    Run kubeadm command with specific configuration file

    Playbook uses the kubeadm command to deploy kubernetes. However,
    it is not passing the --kubeconfig parameter to this command, so
    the command will search for the kubeconfig file. Normally it finds
    this file in /etc/kubernetes/admin.conf, but if a user accidentally
    (or intentionally) creates a config file at /root/.kube/config,
    this file can take precedence and cause the kubeadm command to fail.

    This commit updated the command with /etc/kubernetes/admin.conf as its
    configuration file explicitly.

    Change-Id: Id97a7c25cd6f0a0b3cc31276dd77c193fcbdefc6
    Closes-Bug: 1882678
    Signed-off-by: Andy Ning <email address hidden>

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/735214
Committed: https://git.openstack.org/cgit/starlingx/stx-puppet/commit/?id=6f23a813a3f5447a88e2058f12f022f044f82c08
Submitter: Zuul
Branch: master

commit 6f23a813a3f5447a88e2058f12f022f044f82c08
Author: Andy Ning <email address hidden>
Date: Thu Jun 11 09:44:21 2020 -0400

    Run kubeadm command with specific configuration file

    Puppet manifests use the kubeadm command during initializing
    kubernetes nodes. However, it is not passing the --kubeconfig
    parameter to this command, so the command will search for the
    kubeconfig file. Normally it finds this file in
    /etc/kubernetes/admin.conf, but if a user accidentally (or
    intentionally) creates a config file at /root/.kube/config, this
    file can take precedence and cause the kubeadm command to fail.

    This commit updated the command with /etc/kubernetes/admin.conf as
    its configuration file explicitly.

    Change-Id: I2942fa4a275145cc3a1b6c6fdb0f3827a244f1bb
    Closes-Bug: 1882678
    Signed-off-by: Andy Ning <email address hidden>

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/735215
Committed: https://git.openstack.org/cgit/starlingx/config/commit/?id=78974f643ab6bd65046385a774a3ee6f7313da15
Submitter: Zuul
Branch: master

commit 78974f643ab6bd65046385a774a3ee6f7313da15
Author: Andy Ning <email address hidden>
Date: Thu Jun 11 09:35:46 2020 -0400

    Run kubeadm command with specific configuration file

    sysinv uses the kubeadm command to generate kubeadm join command.
    However, it is not passing the --kubeconfig parameter to this command,
    so the command will search for the kubeconfig file. Normally it finds
    this file in /etc/kubernetes/admin.conf, but if a user accidentally
    (or intentionally) creates a config file at /root/.kube/config,
    this file can take precedence and cause the kubeadm command to fail.

    This commit updated the command with /etc/kubernetes/admin.conf as its
    configuration file explicitly.

    Change-Id: I4fb6d6325ca2cd8c7ab28c0acb0efdf6b1fea45b
    Closes-Bug: 1882678
    Signed-off-by: Andy Ning <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: f/centos8
Review: https://review.opendev.org/762919