Skip to content

Conversation

@wking
Copy link
Member

@wking wking commented Jul 22, 2020

We've declared the default ports for apiServerURL since afb690a (#646). Echo that for apiServerInternalURL. We don't have to call this out explicitly, since the IANA URI scheme registry links out to RFC 7230 for http and https, which have:

If the port subcomponent is empty or not given, TCP port 80 (the reserved port for WWW services) is the default.

and:

All of the requirements listed above for the "http" scheme are also requirements for the "https" scheme, except that TCP port 443 is the default if the port subcomponent is empty or not given...

respectively. But echoing those defaults locally doesn't hurt.

Autogenerated bumps via:

$ hack/update-swagger-docs.sh
$ make update-codegen-crds

…L too

We've declared the default ports for apiServerURL since afb690a
(modified port details for APIServerURL, 2020-05-13, openshift#646).  Echo that
for apiServerInternalURL.  We don't have to call this out explicitly,
since the IANA URI scheme registry [1] links out to [2] for http and
[3] for https, which have:

  If the port subcomponent is empty or not given, TCP port 80 (the
  reserved port for WWW services) is the default.

and:

  All of the requirements listed above for the "http" scheme are also
  requirements for the "https" scheme, except that TCP port 443 is the
  default if the port subcomponent is empty or not given...

respectively.  But echoing those defaults locally doesn't hurt.

Autogenerated bumps via:

  $ hack/update-swagger-docs.sh
  $ make update-codegen-crds

[1]: https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml
[2]: https://tools.ietf.org/html/rfc7230#section-2.7.1
[3]: https://tools.ietf.org/html/rfc7230#section-2.7.2
HTTP in apiServerInternalURL will cause kubelets to stop communicating
to the kube-apiserver.  The client won't send bearer tokens, so the
kubelets wouldn't start.

HTTP in apiServerURL... might work.  But seems unwise, and requiring
'http' here keeps us consistent.

Autogenerated bumps via:

  $ hack/update-swagger-docs.sh
  $ make update-codegen-crds
@wking
Copy link
Member Author

wking commented Jul 22, 2020

I've added an additional c2f7aea dropping http and requiring https for both apiServerURL and apiServerInternalURL. See here and the c2f7aea commit message.

@deads2k
Copy link
Contributor

deads2k commented Jul 22, 2020

This change matches the current reality.

  1. kube-apiserver cannot run in http mode
  2. internal LB is used by the kubelets to contact kube-apiserver. They use client certs to authenticate, so access requires it.

@deads2k deads2k closed this Jul 22, 2020
@deads2k deads2k reopened this Jul 22, 2020
@deads2k
Copy link
Contributor

deads2k commented Jul 22, 2020

/lgtm

@openshift-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jul 22, 2020
@openshift-merge-robot openshift-merge-robot merged commit c33fd0a into openshift:master Jul 22, 2020
@wking wking deleted the apiServerInternalURL-default-ports branch July 22, 2020 22:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants