CadolesKube/typhoon
7
0
Fork 0
mirror of https://github.com/puppetmaster/typhoon.git synced 2025-07-30 03:51:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix SELinux race condition on non-bootstrap controllers in multi-controller (#808)

Browse Source 
* Fix race condition for bootstrap-secrets SELinux context on non-bootstrap controllers in multi-controller FCOS clusters
* On first boot from disk on non-bootstrap controllers, adding bootstrap-secrets races with kubelet.service starting, which can cause the secrets assets to have the wrong label until kubelet.service restarts (service, reboot, auto-update)
* This can manifest as `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` pods crashlooping on spare controllers on first cluster creation
This commit is contained in:
Bo Huang
2020-08-19 21:18:10 -07:00
committed by GitHub
parent 9a07f1d30b
commit aafa38476a
6 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
google-cloud/fedora-coreos/kubernetes/fcc/controller.yaml
View File

@ -159,6 +159,7 @@ storage:
mv manifests /opt/bootstrap/assets/manifests
mv manifests-networking/* /opt/bootstrap/assets/manifests/
rm -rf assets auth static-manifests tls manifests-networking
chcon -R -u system_u -t container_file_t /etc/kubernetes/bootstrap-secrets
- path: /opt/bootstrap/apply
mode: 0544
contents: