The cluster name in generate-yaml.sh is now a random string. #370

spew · 2018-06-20T23:02:25Z

What this PR does / why we need it:
This change removes the static name from generate-yaml.sh and instead
generates a random string for the name. The reason for doing this is to
allow the script to be run over and over without failing due to accounts
already existing with the same name and to allow developers to verify
their changes with a more clean environment

Release note:

The cluster name in generate-yaml.sh is now a random string.

@kubernetes/kube-deploy-reviewers

k8s-ci-robot · 2018-06-20T23:02:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spew

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spew]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

spew · 2018-06-20T23:03:00Z

/assign @roberthbailey @mkjelland

mkjelland · 2018-06-20T23:44:53Z

What happens if the service account is still being used? For example, I have been running generate-yaml once and then using the same files to create multiple clusters. If I have a VM that is using the service account as it's default, I think that the deletion of the service account will fail, and then the script would still fail. An alternative would be to skip the part that creates the service account if it already exists, or to generate a random string to append to the account name so they'd be uniquely named every time you ran the script.

Also, thanks for doing this, it'll make the script easier to use :)

spew · 2018-06-21T14:39:04Z

I considered that case and came up with the following pros / cons for both, so what I have implemented is delete and I would consider what @mkjelland proposed as if exists, skip create. Upon further thought I think it's less disruptive & better to do what @mkjelland proposed. Injecting random strings is probably the best solution. I'll take a quick look and see if that is 'easy'. It's only easy if the script somehow makes sure that all locations that reference the account names are generated by the script.

delete
Pros:

Ensures accounts are always in the desired state. For example, if roles / permissions or flags / options are added to the account but at a later date we change generate-yaml.sh to no longer add those roles / permissions or flags / options then they would be removed as the account would be deleted and a fresh clean account would be created.

Cons:

Doesn't work if the service account is in use with attached VMs, all clusters must be deleted first

if exists, skip create
Pros:

Can handle attached VMs: isn't disrupted if there is an existing VM associated with the service account.

Cons:

Account state isn't guaranteed to be what the script says it is -- for example if extra flags & options are added to the account then they would not be added or if permissions are removed from the list that are added then the account would continue to retain them.

spew · 2018-06-21T22:09:34Z

Updated with the random string approach. Note that I renamed this PR. The random string is used for the entire cluster name.

mkjelland · 2018-06-21T22:15:33Z

clusterctl/examples/google/generate-yaml.sh

@@ -184,3 +186,5 @@ cat $ADDON_TEMPLATE_FILE \
  | sed -e "s/\$CLUSTER_NAME/$CLUSTER_NAME/" \
  | sed "s/\$LOADBALANCER_SA_KEY/$LOADBALANCER_SA_KEY/" \
  > $ADDON_GENERATED_FILE
+
+echo -e "\nYour generated cluster name is ''${CLUSTER_NAME}'"


I think there is an extra ' before ${CLUSTER_NAME}.

There is, fixing and retesting.

Fixed and re-ran, the last few lines looks like this now:

Your public key has been saved in out/machine-controller-key.pub. The key fingerprint is: SHA256:YwcmDSyt8VmNtNwVH0dJbT74qcUNNnwDjZ8wxz2tNTA clusterapi The key's randomart image is: +---[RSA 2048]----+ | o...o oEBoB| | o o+oo.. *.X*| | =.o* . .O=+| | . oo . .*=o| | S . .o+=| | . o =.| | o | | . | | | +----[SHA256]-----+ Your generated cluster name is 'kqkv6tulrgs'

mkjelland

lgtm

Looks great, thanks for doing this!

spew · 2018-06-21T22:19:50Z

Test failures will be fixed by this commit: #380

roberthbailey · 2018-06-21T22:23:56Z

clusterctl/examples/google/generate-yaml.sh

-CLUSTER_NAME=test1
+# Generate a somewhat unique cluster name, UUID is not an option as service-accounts are limited to 30 characters in length
+# and have a 19 character prefix (i.e. 'machine-controller-')
+CLUSTER_NAME=$(head -c11 < <(tr -dc 'a-zA-Z0-9' < /dev/urandom) | tr '[:upper:]' '[:lower:]')


Where did you test this command? Can you verify that it works on both mac and linux?

$ tr -dc 'a-zA-Z0-9' < /dev/urandom
tr: Illegal byte sequence

I tested on mac -- are you getting that on linux?

Just tried on a GCP VM, it's working for me there as well.

that was the output on my mac.

That is odd because i'm on mac too -- I just realized I installed gnutools on my mac (with brew) and I think I'm running a more linux-type flavor of tr. I'll try to find something that is cross platform.

function get-random-string() { for i in {0..31}; do string+=$(printf "%x" $(($RANDOM%16)) ); done; echo $string }

Turns out the default 'tr' on OSX is trying to interpret everything as UTF8 so it doesn't like the non-UTF8 characters coming out of urandom. Prefixing 'tr' with LC_ALL=C will tell tr that the locale is the C standard and therefore the input is treated as simply bytes. Updating with this change.

Tested on both a GCP VM, my mac with gnutools tr, and on my mac with the default OSX tr at /usr/bin/tr

Updated the PR with the change.

spew · 2018-06-21T23:58:54Z

/retest

roberthbailey · 2018-06-22T16:15:16Z

clusterctl/examples/google/generate-yaml.sh

-CLUSTER_NAME=test1
+# Generate a somewhat unique cluster name, UUID is not an option as service-accounts are limited to 30 characters in length
+# and have a 19 character prefix (i.e. 'machine-controller-')
+CLUSTER_NAME=$(head -c11 < <(LC_ALL=C tr -dc 'a-zA-Z0-9' < /dev/urandom) | tr '[:upper:]' '[:lower:]')


This version works on my mac! Yay!

roberthbailey · 2018-06-22T16:16:04Z

clusterctl/examples/google/generate-yaml.sh

-CLUSTER_NAME=test1
+# Generate a somewhat unique cluster name, UUID is not an option as service-accounts are limited to 30 characters in length
+# and have a 19 character prefix (i.e. 'machine-controller-')
+CLUSTER_NAME=$(head -c11 < <(LC_ALL=C tr -dc 'a-zA-Z0-9' < /dev/urandom) | tr '[:upper:]' '[:lower:]')


I think it'd be better to concatenate a human friendly name and a random string segment. Especially if you are trying to do things like manually clean up service accounts in the cloud console, it's much easier to think about looking for "test1" and just kill everything with that prefix.

Yeah I debated that and went with all random due to the limited number of characters that we can use.

I'll add back in the friendly name with a comment about the restrictions on length.

Note that we could possibly follow up with another PR where we make some of the names shorter, for example, the service account for machine controller currently named:

machine-controller-${CLUSTER_NAME}

Could be coming something like,

m-control-${CLUSTER_NAME}

I'd prefer to follow up with that in another PR as the limitation on cluster name length is not a new issue introduced by this PR (although I guess it is made a bit worse by the random string).

This change removes the static name from generate-yaml.sh and instead generates a random string for the name. The reason for doing this is to allow the script to be run over and over without failing due to accounts already existing with the same name and to allow developers to verify their changes with a more clean environment

roberthbailey · 2018-06-22T16:32:58Z

clusterctl/examples/google/generate-yaml.sh

@@ -21,7 +21,13 @@ set -o pipefail
 GCLOUD_PROJECT=$(gcloud config get-value project)
 ZONE=$(gcloud config get-value compute/zone)
 ZONE="${ZONE:-us-central1-f}"
-CLUSTER_NAME=test1
+# Generate a somewhat unique cluster name, UUID is not an option as service-accounts are limited to 30 characters in length
+# and one has a 19 character prefix (i.e. 'machine-controller-'). Of the 11 remaining characters 6 are reserved for the human


Since names must be so short we should consider making the fixed part of this one much shorter (e.g. mc-) at some point. For now I think making the human part be super short is ok.

I'll follow up with that change. I agree that 'mc' is fine... for us, but for new hires it will be difficult. Maybe that's just what we have to live with for now.

also "cc" for cluster-controller will be a bit cryptic.

spew · 2018-06-22T16:32:59Z

Updated with the friendly name reintroduced.

roberthbailey · 2018-06-22T16:33:06Z

/lgtm

…pport-maintenance-mode Add support for Machine maintenance window

k8s-ci-robot requested review from mkjelland and roberthbailey June 20, 2018 23:02

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. approved Indicates a PR has been approved by an approver from all required OWNERS files. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jun 20, 2018

k8s-ci-robot assigned mkjelland and roberthbailey Jun 20, 2018

spew force-pushed the reentrant-generate-yaml branch from b680ae9 to 4cba86e Compare June 21, 2018 22:08

k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jun 21, 2018

spew changed the title ~~Make generate-yaml.sh re-entrant for service accounts so the command can be run more than once.~~ The cluster name in generate-yaml.sh is now a random string. Jun 21, 2018

spew force-pushed the reentrant-generate-yaml branch from 4cba86e to e100bd5 Compare June 21, 2018 22:11

mkjelland reviewed Jun 21, 2018

View reviewed changes

spew force-pushed the reentrant-generate-yaml branch from e100bd5 to f94ed63 Compare June 21, 2018 22:17

mkjelland approved these changes Jun 21, 2018

View reviewed changes

roberthbailey reviewed Jun 21, 2018

View reviewed changes

spew force-pushed the reentrant-generate-yaml branch from f94ed63 to dec5ea7 Compare June 22, 2018 13:11

roberthbailey reviewed Jun 22, 2018

View reviewed changes

spew force-pushed the reentrant-generate-yaml branch from dec5ea7 to fb3009b Compare June 22, 2018 16:30

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jun 22, 2018

roberthbailey reviewed Jun 22, 2018

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 22, 2018

k8s-ci-robot merged commit a9881d5 into kubernetes-sigs:master Jun 22, 2018

jayunit100 pushed a commit to jayunit100/cluster-api that referenced this pull request Jan 31, 2020

Merge pull request kubernetes-sigs#370 from sidharthsurana/feature/su…

3ba76a0

…pport-maintenance-mode Add support for Machine maintenance window

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

The cluster name in generate-yaml.sh is now a random string. #370

The cluster name in generate-yaml.sh is now a random string. #370

spew commented Jun 20, 2018 •

edited

Loading

k8s-ci-robot commented Jun 20, 2018

spew commented Jun 20, 2018

mkjelland commented Jun 20, 2018 •

edited

Loading

spew commented Jun 21, 2018 •

edited

Loading

spew commented Jun 21, 2018

mkjelland Jun 21, 2018

spew Jun 21, 2018

spew Jun 21, 2018

mkjelland left a comment

spew commented Jun 21, 2018

roberthbailey Jun 21, 2018

roberthbailey Jun 21, 2018

spew Jun 21, 2018

spew Jun 21, 2018

roberthbailey Jun 22, 2018

spew Jun 22, 2018

dims Jun 22, 2018

spew Jun 22, 2018

spew Jun 22, 2018

spew commented Jun 21, 2018

roberthbailey Jun 22, 2018

roberthbailey Jun 22, 2018

spew Jun 22, 2018

spew Jun 22, 2018

roberthbailey Jun 22, 2018

spew Jun 22, 2018

spew Jun 22, 2018

spew commented Jun 22, 2018

roberthbailey commented Jun 22, 2018

The cluster name in generate-yaml.sh is now a random string. #370

The cluster name in generate-yaml.sh is now a random string. #370

Conversation

spew commented Jun 20, 2018 • edited Loading

k8s-ci-robot commented Jun 20, 2018

spew commented Jun 20, 2018

mkjelland commented Jun 20, 2018 • edited Loading

spew commented Jun 21, 2018 • edited Loading

spew commented Jun 21, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mkjelland left a comment

Choose a reason for hiding this comment

spew commented Jun 21, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spew commented Jun 21, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spew commented Jun 22, 2018

roberthbailey commented Jun 22, 2018

spew commented Jun 20, 2018 •

edited

Loading

mkjelland commented Jun 20, 2018 •

edited

Loading

spew commented Jun 21, 2018 •

edited

Loading