Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove kube-apiserver --insecure-port usage #2156

Closed
neolit123 opened this issue May 28, 2020 · 4 comments · Fixed by kubernetes/kubernetes#102121
Closed

remove kube-apiserver --insecure-port usage #2156

neolit123 opened this issue May 28, 2020 · 4 comments · Fixed by kubernetes/kubernetes#102121
Assignees
Labels
kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete.

Comments

@neolit123
Copy link
Member

neolit123 commented May 28, 2020

the flag is being removed after a long deprecation period:
kubernetes/kubernetes#91506

in kubeadm we are passing:
--insecure-port=0 in the api server static pod.

the flag became a no-op in 1.20:
kubernetes/kubernetes#95856

it will be removed in 1.24:
https://github.com/kubernetes/kubernetes/pull/95856/files#diff-3149c6ede53e3a658bbcf11f1456f2ac955ae49db5ab66ee9e13f883488349d3R151

kubeadm can remove it earleir

related to:
#2207

NOTE

this PR might do the change in kubeadm as well:
kubernetes/kubernetes#95522

@neolit123 neolit123 added this to the v1.20 milestone May 28, 2020
@neolit123 neolit123 added kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. labels May 28, 2020
@neolit123 neolit123 changed the title remove kube-apiserver --port usage remove kube-apiserver --insecure-port usage May 28, 2020
@RA489
Copy link
Contributor

RA489 commented May 29, 2020

/assign

@liggitt
Copy link
Member

liggitt commented May 29, 2020

critically, kubeadm should not stop setting this flag until a kubernetes version that removes insecure serving ability... in all currently released versions, not specifying the flag accepts the default behavior of enabling the insecure port

@pacoxu
Copy link
Member

pacoxu commented May 19, 2021

/assign

Flag --insecure-port has been deprecated, **This flag has no effect now and will be removed in v1.24.**
Error: invalid port value 28080: only zero is allowed

As this flag has no effect, we can just remove it in kubeadm side in 1.22 now.

@neolit123
Copy link
Member Author

@pacoxu

i see that for the kube-apiserver the change was made in 1.20:
kubernetes/kubernetes@cfc2b33

kubeadm can deploy N and N-1 control-plane. so kubeadm 1.22 can deploy 1.22 and 1.21 kube-apiserver.
given the flag no longer has effect in 1.21, we can remove it for the kube-apiserver that kubeadm 1.22 manages.

for the KCM and KS i see the insecure flags are becoming no-op in 1.22:
kubernetes/kubernetes#96216
kubernetes/kubernetes#96345

thus we can delay the kubeadm change for KCM and KS to 1.23, to avoid branching:
#2207

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants