-
Notifications
You must be signed in to change notification settings - Fork 693
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add the --cert-dir flag to change the directory for Webhook certificate. #2463
Comments
It sounds like a legitimate request 👍 I have a few remarks and questions, to make sure I understand completely your use case:
|
@sebgl
Yes, I think so.
I don't know when ECK writes under /tmp, but I found that the elastic-operator terminated with the following log.
|
Maybe the culprit is |
Could be yeah, it looks like there is some history around klog/glog initialization (example fix in CoreDNS). @ymmt2005 @dulltz are you able to easily reproduce the |
@sebgl |
#2476 adds the flag |
I've spent some time investigating around the klog potential error. Even with a read-only filesystem and while logging with klog manually I cannot reproduce the error. Calling I double-checked in our dependencies, I don't think We did some changes in the way we handle logging a while ago. Did you observe the error message on ECK v1.0.0 (stable)? |
Ah, right. The default was changed to set appropriately in |
Proposal
Add the
--cert-dir
flag to pass to the controller-runtime.In PodSecurityPolicy enabled K8s cluster, read-only root filesystem is common.
I want to to use
/tmp
path as writable empty-dir because sometimes ECK writes its logs to under the /tmp/.However, ECK v1.0.0 uses
/tmp/k8s-webhook-server/serving-certs
for the elastic-webhook-server-cert secret.It is not good to overwrap mount paths, so I hope to add
--cert-dir
flag to ECK for changing the cert-dir.It seems to be changeable by passing to controller-runtime.
https://github.com/kubernetes-sigs/controller-runtime/blob/a7c8a93c1cf395974911ef0ece977a7d27b2bf4b/pkg/manager/manager.go#L175
Environment
The text was updated successfully, but these errors were encountered: