Skip to content
This repository has been archived by the owner on May 6, 2022. It is now read-only.

Tweaks to the walkthrough for local-up-cluster #1076

Merged
merged 1 commit into from
Jul 31, 2017

Conversation

pmorie
Copy link
Contributor

@pmorie pmorie commented Jul 28, 2017

A couple tweaks were necessary for me to make the walkthrough run on a cluster created with local-up-cluster.sh:

  • Needed to make the default service account for the kube-system namespace a cluster admin
  • Needed a knob to turn off TLS skip verify for the controller -> SC API server connection (you can't set insecure skip verify AND provide root cert data at the same time)

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 28, 2017
Copy link
Contributor

@arschles arschles left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am assuming you tested this @pmorie, and it looks good to me, so I'm LGTMing it.

@arschles arschles added the LGTM1 label Jul 31, 2017
KUBE_ENABLE_CLUSTER_DNS=true hack/local-up-cluster.sh -O
```
```console
KUBE_ENABLE_CLUSTER_DNS=true hack/local-up-cluster.sh -O
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

KUBE_ENABLE_CLUSTER_DNS=true is the default in kube now

- "--service-catalog-insecure-skip-verify=true"
{{- end }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall question:
Do we need an issue to make sure every single flag is helm exposed?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor

@MHBauer MHBauer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

some research makes it LGTM.

namespace has the `cluster-admin` role:

```console
kubectl create clusterrolebinding default-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:default
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kubeadm sets up this level of access, and while I have to include the disclaimer that kubeadm is not production ready, I have to somewhat assume that a decision was made that this is the correct level of access.

An additional data point is that Bluemix does include this serviceAccount bound to this level of access.

@MHBauer MHBauer merged commit e324287 into kubernetes-retired:master Jul 31, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. LGTM1
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants