kubeadm: HA documentation by Klaven · Pull Request #12923 · kubernetes/website

Klaven · 2019-03-01T15:38:13Z

this PR will update the kubeadm reference documentation regarding HA for 1.14.

xref: kubernetes/kubeadm#1422

/sig cluster-lifecycle

k8sio-netlify-preview-bot · 2019-03-01T15:38:18Z

Deploy preview for kubernetes-io-vnext-staging processing.

Building with commit 0da3d32

https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/5c87d2e3d18c47000808dfa5

k8s-ci-robot · 2019-03-01T15:38:30Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: bradtopol

If they are not already assigned, you can assign the PR to them by writing /assign @bradtopol in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

content/en/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

neolit123 · 2019-03-01T18:16:53Z

/sig cluster-lifecycle
/assign

neolit123 · 2019-03-08T21:02:59Z

in this PR we are going to have to document that there is no config field for the copy-certs functionality and we have to either pass everything as flags for HA join or to only use the --config .... --certificate-key ... mixture.
/cc @ereslibre

neolit123 · 2019-03-12T12:34:35Z

@kubernetes/sig-cluster-lifecycle-pr-reviews

neolit123 · 2019-03-13T18:45:36Z

/assign @fabriziopandini

yagonobre

Thanks @Klaven

yagonobre · 2019-03-14T02:27:05Z

content/en/docs/setup/independent/high-availability.md

-    cluster.
+    - Copy this output to a text file. You will need it later to join control plane and worker nodes to the cluster.
+    - When `--experimental-upload-certs` is used with `kubeadm init`, the certificates of the primary control plane
+    are uploaded to the cluster in a Secret and encrypted.


Maybe are encrypted and uploaded to the kubeadm-certs secret

yagonobre · 2019-03-14T02:29:21Z

content/en/docs/setup/independent/high-availability.md

+    - It's recommended that you join new control plane nodes in a sequence, only after the first node has finished initializing.

-1.  Copy the certificate files from the first control plane node to the rest:
+1.  Optionally copy the `admin.conf` file from the first control plane node to the rest:


Why we should copy this config? [1]

to use kubectl on the other CP nodes.
i'm OK with removing this but waiting on review by @fabriziopandini

The join don't generate a config?

that's actually a good point...
possibly best to remove this anyway.

@Klaven please remove these lines/steps

Optionally copy the admin.conf...

and

Optionally move the admin.conf file created...

It is not necessary to copy the admin.conf file
However, I think we should still provide user instruction for manually copy certs if they want to opt out from the --experimental-upload-certs feature, so my suggestion is to move everyting related to "configure SSH" and scp certs (without the admin.conf file) in a dedicated paragraph "manual certs distribution"

yagonobre · 2019-03-14T02:29:55Z

content/en/docs/setup/independent/high-availability.md

 ### Steps for the rest of the control plane nodes

-1.  Move the files created by the previous step where `scp` was used:
+1.  Optionally move the `admin.conf` file created by the previous step where `scp` was used:


neolit123 · 2019-03-14T02:33:47Z

/priority important-soon

fabriziopandini

@Klaven great to see this work!

I think we can simplify the doc by moving "Configure SSH", and all the manual copy instruction under a separated paragraph "manual certs distribution".
In other words, the main workflow described should focus on using automatic copy, but there should be a note "if instead you want to copy certs manually/using automation tools, please refer to "manual copy certs" paragraph.

Additionally, if you don't mind, there are also following possible improvements to this doc:

L22 (before your change) Change "Your clusters must run Kubernetes version 1.12 or later." into "This document refers to kubeadm version 1.14; similar documents are available for preview version as well"
L60 (before your change) Remove "{{< note >}} The following examples run Calico ..." Not true anymore
L71 (before your change) Remove "{{< note >}} {{< note >}} All commands ...". It seems out of context here and from a quick check there is already sudo before all command
L163 (before your change) Remove apiServer field and nested CertsSANs list (not necessary)
L295 (before your change) Same (remove apiServer/CertsSANs)
L343 (before your change) Remove Install a pod network, it is already part of the instructions above (eventually the content of the paragraph con be moved above)

fabriziopandini · 2019-03-14T08:24:31Z

content/en/docs/setup/independent/high-availability.md

+    sudo kubeadm init --config=kubeadm-config.yaml --experimental-upload-certs
    ```
-
+    - The `--experimental-upload-certs` flags is used to upload the control plane


What about:
"The --experimental-upload-certs flags is used to upload the certificates that should be shared across all the control-plane instances to the cluster; If instead, you prefer to copy certs across control-plane nodes manually or using automation tools, please remove this flag and refer to "manual certs distribution" paragraph"

fabriziopandini · 2019-03-14T08:28:24Z

content/en/docs/setup/independent/high-availability.md

+    - Copy this output to a text file. You will need it later to join control plane and worker nodes to the cluster.
+    - When `--experimental-upload-certs` is used with `kubeadm init`, the certificates of the primary control plane
+    are uploaded to the cluster in a Secret and encrypted.
+    -  When joining new control plane nodes using `kubeadm join ... --experimental-control-plane`,


Please move this point after the kubeadm join --experimental-control-plane command (L256 before your changes)

fabriziopandini · 2019-03-14T08:29:23Z

content/en/docs/setup/independent/high-availability.md

    ```

-    - It's recommended that you join new control plane nodes only after the first node has finished initializing.
+    - It's recommended that you join new control plane nodes in a sequence, only after the first node has finished initializing.


Please move this point before/after the kubeadm join --experimental-control-plane command (L256 before your changes)

fabriziopandini · 2019-03-14T08:34:15Z

content/en/docs/setup/independent/high-availability.md

+    - It's recommended that you join new control plane nodes in a sequence, only after the first node has finished initializing.

-1.  Copy the certificate files from the first control plane node to the rest:
+1.  Optionally copy the `admin.conf` file from the first control plane node to the rest:


It is not necessary to copy the admin.conf file
However, I think we should still provide user instruction for manually copy certs if they want to opt out from the --experimental-upload-certs feature, so my suggestion is to move everyting related to "configure SSH" and scp certs (without the admin.conf file) in a dedicated paragraph "manual certs distribution"

fabriziopandini · 2019-03-14T08:38:46Z

content/en/docs/setup/independent/high-availability.md

        - `ETCD_2_IP`

-1.  Run `kubeadm init --config kubeadm-config.yaml` on this node.
+1.  Run `kubeadm init --config kubeadm-config.yaml --experimental-upload-certs` on this node.


@yagonobre I don't remember if certificates for the external etcd are copied automatically or not...
If not, we should add a note that the user must take care of distributing those certs on all control-plane nodes

it's upload, we only skip certs upload in case of external ca.

detiber · 2019-03-14T17:17:17Z

content/en/docs/setup/independent/high-availability.md

    ...
-    You can now join any number of machines by running the following on each node
-    as root:
+    You can now join any number of control-plane node running the following command on each as a root:


Suggested change

You can now join any number of control-plane node running the following command on each as a root:

You can now join any number of control-plane nodes by running the following command on each as a root:

this is a CLI typo, can't fix here.
edit: well we can, but we need to fix in kubeadm too.

detiber · 2019-03-14T17:18:49Z

content/en/docs/setup/independent/high-availability.md

+      kubeadm join 192.168.0.200:6443 --token 9vr73a.a8uxyaju799qwdjv --discovery-token-ca-cert-hash sha256:7c2e69131a36ae2a042a339b33381c6d0d43887e2de83720eff5359e26aec866 --experimental-control-plane --certificate-key f8902e114ef118304e561c3ecd4d0b543adc226b7a07f675f56564185ffe0c07

-    kubeadm join 192.168.0.200:6443 --token j04n3m.octy8zely83cy2ts --discovery-token-ca-cert-hash    sha256:84938d2a22203a8e56a787ec0c6ddad7bc7dbd52ebabc62fd5f4dbea72b14d1f
+    Please note that the certificate-key gives access to cluster sensitive data, keep it secret!


Maybe highlight this a bit more by wrapping it in note tags

detiber · 2019-03-14T17:21:20Z

content/en/docs/setup/independent/high-availability.md

    ```

-    - It's recommended that you join new control plane nodes only after the first node has finished initializing.
+    - It's recommended that you join new control plane nodes in a sequence, only after the first node has finished initializing.


Suggested change

- It's recommended that you join new control plane nodes in a sequence, only after the first node has finished initializing.

- It's recommended that you join new control plane nodes sequentially, only after the first node has finished initializing.

neolit123 · 2019-03-14T21:22:06Z

/close
in favor of #13191

k8s-ci-robot · 2019-03-14T21:22:09Z

@neolit123: Closed this PR.

Details

In response to this:

/close
in favor of #13191

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 1, 2019

k8s-ci-robot added language/en Issues or PRs related to English language size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 1, 2019

k8s-ci-robot requested review from jbeda and luxas March 1, 2019 15:38

Klaven mentioned this pull request Mar 1, 2019

1.14: docs updates kubernetes/kubeadm#1422

Closed

3 tasks

k8s-ci-robot assigned neolit123 Mar 1, 2019

zacharysarah added this to the 1.14 milestone Mar 7, 2019

k8s-ci-robot requested a review from ereslibre March 8, 2019 21:03

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 12, 2019

Updated high-availability documentation

0da3d32

Klaven force-pushed the dev-1.14 branch from df69cee to 0da3d32 Compare March 12, 2019 15:39

Klaven changed the title ~~[WIP] kubeadm: HA documentation placeholder~~ kubeadm: HA documentation Mar 13, 2019

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 13, 2019

k8s-ci-robot assigned fabriziopandini Mar 13, 2019

yagonobre reviewed Mar 14, 2019

View reviewed changes

k8s-ci-robot added the priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. label Mar 14, 2019

jimangel force-pushed the dev-1.14 branch 2 times, most recently from 2534806 to ead0a28 Compare March 14, 2019 03:47

fabriziopandini suggested changes Mar 14, 2019

View reviewed changes

detiber reviewed Mar 14, 2019

View reviewed changes

neolit123 mentioned this pull request Mar 14, 2019

kubeadm: update the 1.14 HA guide #13191

Merged

k8s-ci-robot closed this Mar 14, 2019

	You can now join any number of control-plane node running the following command on each as a root:
	You can now join any number of control-plane nodes by running the following command on each as a root:

	- It's recommended that you join new control plane nodes in a sequence, only after the first node has finished initializing.
	- It's recommended that you join new control plane nodes sequentially, only after the first node has finished initializing.

Conversation

Klaven commented Mar 1, 2019

Uh oh!

k8sio-netlify-preview-bot commented Mar 1, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Mar 1, 2019

Uh oh!

neolit123 commented Mar 1, 2019

Uh oh!

neolit123 commented Mar 8, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

neolit123 commented Mar 12, 2019

Uh oh!

neolit123 commented Mar 13, 2019

Uh oh!

yagonobre left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

neolit123 Mar 14, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

neolit123 commented Mar 14, 2019

Uh oh!

fabriziopandini left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

neolit123 Mar 14, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

neolit123 commented Mar 14, 2019

Uh oh!

k8s-ci-robot commented Mar 14, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

k8sio-netlify-preview-bot commented Mar 1, 2019 •

edited

Loading

neolit123 commented Mar 8, 2019 •

edited

Loading

neolit123 Mar 14, 2019 •

edited

Loading

neolit123 Mar 14, 2019 •

edited

Loading