-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Excessive logging in cert-manager-webhook pod? #1526
Copy link
Copy link
Closed
Labels
kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.
Description
Describe the bug:
cert-manager-webhook pod logs 10 lines every 5 seconds, and I don't understand why or what action I can take to fix it.
Expected behaviour:
Logs that are actionable, and that do not spam every 5 seconds
Steps to reproduce the bug:
Uninstalled cert-manager 0.2.5 and installed cert-manager 0.7, kept the old cert secret.
Anything else we need to know?:
Logs
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.282389 1 request.go:942] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:generic-garbage-collector","group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.282532 1 round_trippers.go:419] curl -k -v -XPOST -H "User-Agent: image.app_linux-amd64.binary/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Accept: application/json, */*" -H "Authorization: Bearer <redacted>" -H "Content-Type: application/json" 'https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews'
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288776 1 round_trippers.go:438] POST https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews 201 Created in 6 milliseconds
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288815 1 round_trippers.go:444] Response Headers:
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288832 1 round_trippers.go:447] Audit-Id: 344d6760-7d49-4f76-a672-e5f928a816c5
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288840 1 round_trippers.go:447] Content-Type: application/json
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288857 1 round_trippers.go:447] Content-Length: 541
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.288933 1 round_trippers.go:447] Date: Thu, 04 Apr 2019 17:41:14 GMT
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.289009 1 request.go:942] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:generic-garbage-collector","group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"]},"status":{"allowed":true,"reason":"RBAC: allowed by ClusterRoleBinding \"system:discovery\" of ClusterRole \"system:discovery\" to Group \"system:authenticated\""}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.289187 1 handler.go:143] admission-server: GET "/apis/admission.certmanager.k8s.io/v1beta1" satisfied by gorestful with webservice /apis/admission.certmanager.k8s.io/v1beta1
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.289346 1 wrap.go:47] GET /apis/admission.certmanager.k8s.io/v1beta1?timeout=32s: (7.45329ms) 200 [kube-controller-manager/v1.11.7 (linux/amd64) kubernetes/06f08e6/system:serviceaccount:kube-system:generic-garbage-collector 10.40.11.1:53162]
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.506531 1 request.go:942] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/","verb":"get"},"user":"system:anonymous","group":["system:unauthenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.506673 1 round_trippers.go:419] curl -k -v -XPOST -H "Accept: application/json, */*" -H "Content-Type: application/json" -H "User-Agent: image.app_linux-amd64.binary/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Authorization: Bearer <redacted>" 'https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews'
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509166 1 round_trippers.go:438] POST https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews 201 Created in 2 milliseconds
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509201 1 round_trippers.go:444] Response Headers:
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509215 1 round_trippers.go:447] Audit-Id: 322feb6b-6045-406e-83ab-3088db76c107
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509222 1 round_trippers.go:447] Content-Type: application/json
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509227 1 round_trippers.go:447] Content-Length: 260
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509233 1 round_trippers.go:447] Date: Thu, 04 Apr 2019 17:41:14 GMT
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509270 1 request.go:942] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/","verb":"get"},"user":"system:anonymous","group":["system:unauthenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509379 1 authorization.go:73] Forbidden: "/", Reason: ""
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.509517 1 wrap.go:47] GET /: (3.233726ms) 403 [Go-http-client/2.0 10.40.11.1:53144]
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.953456 1 request.go:942] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:kube-controller-manager","group":["system:authenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.953574 1 round_trippers.go:419] curl -k -v -XPOST -H "User-Agent: image.app_linux-amd64.binary/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Authorization: Bearer <redacted>" -H "Accept: application/json, */*" -H "Content-Type: application/json" 'https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews'
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955205 1 round_trippers.go:438] POST https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews 201 Created in 1 milliseconds
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955271 1 round_trippers.go:444] Response Headers:
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955296 1 round_trippers.go:447] Content-Length: 450
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955305 1 round_trippers.go:447] Date: Thu, 04 Apr 2019 17:41:14 GMT
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955308 1 round_trippers.go:447] Audit-Id: 6a2970a7-6c70-47c4-af28-52bb732cbc75
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955314 1 round_trippers.go:447] Content-Type: application/json
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955344 1 request.go:942] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:kube-controller-manager","group":["system:authenticated"]},"status":{"allowed":true,"reason":"RBAC: allowed by ClusterRoleBinding \"system:discovery\" of ClusterRole \"system:discovery\" to Group \"system:authenticated\""}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955438 1 handler.go:143] admission-server: GET "/apis/admission.certmanager.k8s.io/v1beta1" satisfied by gorestful with webservice /apis/admission.certmanager.k8s.io/v1beta1
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:14.955592 1 wrap.go:47] GET /apis/admission.certmanager.k8s.io/v1beta1?timeout=32s: (2.490715ms) 200 [kube-controller-manager/v1.11.7 (linux/amd64) kubernetes/06f08e6/controller-discovery 10.40.11.1:53162]
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.555587 1 request.go:942] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:resourcequota-controller","group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"]},"status":{"allowed":false}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.555733 1 round_trippers.go:419] curl -k -v -XPOST -H "Accept: application/json, */*" -H "Content-Type: application/json" -H "User-Agent: image.app_linux-amd64.binary/v0.0.0 (linux/amd64) kubernetes/$Format" -H "Authorization: Bearer <redacted>" 'https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews'
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563469 1 round_trippers.go:438] POST https://10.43.240.1:443/apis/authorization.k8s.io/v1beta1/subjectaccessreviews 201 Created in 7 milliseconds
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563509 1 round_trippers.go:444] Response Headers:
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563520 1 round_trippers.go:447] Content-Type: application/json
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563528 1 round_trippers.go:447] Content-Length: 540
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563540 1 round_trippers.go:447] Date: Thu, 04 Apr 2019 17:41:29 GMT
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563548 1 round_trippers.go:447] Audit-Id: a3643fed-fa56-4fc4-ba94-35b4fa515daf
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563603 1 request.go:942] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/apis/admission.certmanager.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:resourcequota-controller","group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"]},"status":{"allowed":true,"reason":"RBAC: allowed by ClusterRoleBinding \"system:discovery\" of ClusterRole \"system:discovery\" to Group \"system:authenticated\""}}
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563739 1 handler.go:143] admission-server: GET "/apis/admission.certmanager.k8s.io/v1beta1" satisfied by gorestful with webservice /apis/admission.certmanager.k8s.io/v1beta1
[cert-manager-webhook-86bc6ff498-rgmqx] I0404 17:41:29.563876 1 wrap.go:47] GET /apis/admission.certmanager.k8s.io/v1beta1?timeout=32s: (8.725156ms) 200 [kube-controller-manager/v1.11.7 (linux/amd64) kubernetes/06f08e6/system:serviceaccount:kube-system:resourcequota-controller 10.40.11.1:53162]
I would like to know if this is normal, or if there is something wrong with my deployment.
Thanks.
Environment details::
- Kubernetes version: 1.11.7
- Cloud-provider/provisioner: GKE
- cert-manager version: 0.7
- Install method: helm
/kind bug
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.