Skip to content

Excessive logging in cert-manager-webhook pod? #1526

@bbzg

Description

@bbzg

Describe the bug:
cert-manager-webhook pod logs 10 lines every 5 seconds, and I don't understand why or what action I can take to fix it.

Expected behaviour:
Logs that are actionable, and that do not spam every 5 seconds

Steps to reproduce the bug:
Uninstalled cert-manager 0.2.5 and installed cert-manager 0.7, kept the old cert secret.

Anything else we need to know?:

Logs

[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.282389       1 request.go:942] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:generic-garbage-collector","group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.282532       1 round_trippers.go:419] curl -k -v -XPOST  -H "User-Agent: image.app_linux-amd64.binary/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Accept: application/json, */*" -H "Authorization: Bearer <redacted>" -H "Content-Type: application/json" 'https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews'
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288776       1 round_trippers.go:438] POST https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews 201 Created in 6 milliseconds
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288815       1 round_trippers.go:444] Response Headers:
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288832       1 round_trippers.go:447]     Audit-Id: 344d6760-7d49-4f76-a672-e5f928a816c5
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288840       1 round_trippers.go:447]     Content-Type: application/json
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288857       1 round_trippers.go:447]     Content-Length: 541
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288933       1 round_trippers.go:447]     Date: Thu, 04 Apr 2019 17:41:14 GMT
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.289009       1 request.go:942] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:generic-garbage-collector","group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"]},"status":{"allowed":true,"reason":"RBAC: allowed by ClusterRoleBinding \"system:discovery\" of ClusterRole \"system:discovery\" to Group \"system:authenticated\""}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.289187       1 handler.go:143] admission-server: GET "/apis/admission.certmanager.k8s.io/v1beta1" satisfied by gorestful with webservice /apis/admission.certmanager.k8s.io/v1beta1
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.289346       1 wrap.go:47] GET /apis/admission.certmanager.k8s.io/v1beta1?timeout=32s: (7.45329ms) 200 [kube-controller-manager/v1.11.7 (linux/amd64) kubernetes/06f08e6/system:serviceaccount:kube-system:generic-garbage-collector 10.40.11.1:53162]
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.506531       1 request.go:942] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/","verb":"get"},"user":"system:anonymous","group":["system:unauthenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.506673       1 round_trippers.go:419] curl -k -v -XPOST  -H "Accept: application/json, */*" -H "Content-Type: application/json" -H "User-Agent: image.app_linux-amd64.binary/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Authorization: Bearer <redacted>" 'https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews'
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509166       1 round_trippers.go:438] POST https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews 201 Created in 2 milliseconds
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509201       1 round_trippers.go:444] Response Headers:
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509215       1 round_trippers.go:447]     Audit-Id: 322feb6b-6045-406e-83ab-3088db76c107
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509222       1 round_trippers.go:447]     Content-Type: application/json
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509227       1 round_trippers.go:447]     Content-Length: 260
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509233       1 round_trippers.go:447]     Date: Thu, 04 Apr 2019 17:41:14 GMT
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509270       1 request.go:942] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/","verb":"get"},"user":"system:anonymous","group":["system:unauthenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509379       1 authorization.go:73] Forbidden: "/", Reason: ""
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509517       1 wrap.go:47] GET /: (3.233726ms) 403 [Go-http-client/2.0 10.40.11.1:53144]
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.953456       1 request.go:942] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:kube-controller-manager","group":["system:authenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.953574       1 round_trippers.go:419] curl -k -v -XPOST  -H "User-Agent: image.app_linux-amd64.binary/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Authorization: Bearer <redacted>" -H "Accept: application/json, */*" -H "Content-Type: application/json" 'https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews'
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955205       1 round_trippers.go:438] POST https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews 201 Created in 1 milliseconds
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955271       1 round_trippers.go:444] Response Headers:
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955296       1 round_trippers.go:447]     Content-Length: 450
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955305       1 round_trippers.go:447]     Date: Thu, 04 Apr 2019 17:41:14 GMT
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955308       1 round_trippers.go:447]     Audit-Id: 6a2970a7-6c70-47c4-af28-52bb732cbc75
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955314       1 round_trippers.go:447]     Content-Type: application/json
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955344       1 request.go:942] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:kube-controller-manager","group":["system:authenticated"]},"status":{"allowed":true,"reason":"RBAC: allowed by ClusterRoleBinding \"system:discovery\" of ClusterRole \"system:discovery\" to Group \"system:authenticated\""}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955438       1 handler.go:143] admission-server: GET "/apis/admission.certmanager.k8s.io/v1beta1" satisfied by gorestful with webservice /apis/admission.certmanager.k8s.io/v1beta1
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955592       1 wrap.go:47] GET /apis/admission.certmanager.k8s.io/v1beta1?timeout=32s: (2.490715ms) 200 [kube-controller-manager/v1.11.7 (linux/amd64) kubernetes/06f08e6/controller-discovery 10.40.11.1:53162]
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.555587       1 request.go:942] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:resourcequota-controller","group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.555733       1 round_trippers.go:419] curl -k -v -XPOST  -H "Accept: application/json, */*" -H "Content-Type: application/json" -H "User-Agent: image.app_linux-amd64.binary/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Authorization: Bearer <redacted>" 'https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews'
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563469       1 round_trippers.go:438] POST https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews 201 Created in 7 milliseconds
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563509       1 round_trippers.go:444] Response Headers:
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563520       1 round_trippers.go:447]     Content-Type: application/json
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563528       1 round_trippers.go:447]     Content-Length: 540
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563540       1 round_trippers.go:447]     Date: Thu, 04 Apr 2019 17:41:29 GMT
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563548       1 round_trippers.go:447]     Audit-Id: a3643fed-fa56-4fc4-ba94-35b4fa515daf
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563603       1 request.go:942] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:resourcequota-controller","group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"]},"status":{"allowed":true,"reason":"RBAC: allowed by ClusterRoleBinding \"system:discovery\" of ClusterRole \"system:discovery\" to Group \"system:authenticated\""}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563739       1 handler.go:143] admission-server: GET "/apis/admission.certmanager.k8s.io/v1beta1" satisfied by gorestful with webservice /apis/admission.certmanager.k8s.io/v1beta1
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563876       1 wrap.go:47] GET /apis/admission.certmanager.k8s.io/v1beta1?timeout=32s: (8.725156ms) 200 [kube-controller-manager/v1.11.7 (linux/amd64) kubernetes/06f08e6/system:serviceaccount:kube-system:resourcequota-controller 10.40.11.1:53162]

I would like to know if this is normal, or if there is something wrong with my deployment.

Thanks.

Environment details::

  • Kubernetes version: 1.11.7
  • Cloud-provider/provisioner: GKE
  • cert-manager version: 0.7
  • Install method: helm

/kind bug

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes issue or PR as related to a bug.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions