Updating kubeadm manifests

[mikedanese]

From @axsuul on October 7, 2016 7:57

I provisioned my kubernetes cluster using kubeadm but I would like to change the option to --secure-port=8081 for the API server. It seems like changing this manifest file

/etc/kubernetes/manifests/kube-apiserver.json

would give me what I want but how would I apply the changes? Running

# kubectl apply -f /etc/kubernetes/manifests/kube-apiserver.json

doesn't appear to update it properly.

Copied from original issue: kubernetes/kubernetes#34307

[mikedanese]

From @colemickens on October 7, 2016 8:5

@axsuul The kube-apiserver is a static pod manifest, so you will need to actually manually edit the /etc/kubernetes/manifests/kube-apiserver.json file on your master.

[mikedanese]

From @axsuul on October 7, 2016 8:10

@colemickens I have edited it but what do I do after editing it?

[mikedanese]

From @colemickens on October 7, 2016 8:14

I would've expected the kubelet sync loop to notice the difference and update/replace the Pod.

If it didn't, you could try deleting the kube-apiserver pod and letting it respawn from the manifest whenever kubelet notices it's missing (note, this obviously could lead to apiserver being unavailable for a period of time, presumably rather short period of time).

[mikedanese]

From @axsuul on October 7, 2016 19:21

When changing the --secure-port option in the manifest, it immediately places the kube-apiserver pod into a pending state. I've tried different ports and changing it back to 443 makes it active again.

Am I missing something here?

[mikedanese]

From @colemickens on October 7, 2016 19:30

cc: @luxas @errordeveloper

[mikedanese]

From @axsuul on October 7, 2016 19:36

Also want to point out that there's no events for kubectl describe pod kube-apiserver as well as nothing informative in kubectl get events

[mikedanese]

From @colemickens on October 7, 2016 19:53

I wouldn't expect this (kubectl describe pod kube-apiserver) to return anything anyway, you need to be looking at the kube-system namespace for the apiserver pod.

[mikedanese]

From @axsuul on October 7, 2016 20:6

Sorry, what I meant was kubectl describe pod kube-apiserver -n kube-system

[mikedanese]

From @errordeveloper on October 13, 2016 9:24

I'd like to fix kubernetes/kubernetes#33638 ASAP, also after kubernetes/kubernetes#34501 lands we will be able to allow users to pass any custom flags to any of the control plane components.

[mikedanese]

From @sandys on October 13, 2016 9:37

@errordeveloper does that mean that your official recommendation right now is to not touch kube-apiserver.json and instead use the flags from #33638 ?

[mikedanese]

From @errordeveloper on October 13, 2016 11:10

@sandys unless you really have to, it seems like patching the static pod manifest results in this weird pending situation, and it's probably a separate bug, but I'm not entierely sure we need to look into it, given we are looking to get rid of static pods all together soon with proper kubelet API.

[mikedanese]

From @sandys on October 13, 2016 12:23

@errordeveloper im not advocating for the manifest fix - im just asking what should we wait for ? Will this bug become WONTFIX and #33638 be the right way to do it ?

[mikedanese]

From @errordeveloper on October 13, 2016 13:10

@sandys I've just opened #34719, hope we might be able to merge it and cut a snapshot release later today ;)

[mikedanese]

From @errordeveloper on October 13, 2016 13:11

@sandys yes, this issues as it stands won't be fixed, as user's problem is only about setting the port.

[mikedanese]

From @axsuul on October 13, 2016 18:44

@errordeveloper how would we change an existing kubeadm cluster's API ports with the flags?

[luxas]

This was fixed in kubernetes/kubernetes#34719, and is in the latest version, closing...