Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not collect c:/k/config in AKS Windows nodes #187

Closed
AbelHu opened this issue May 6, 2021 · 5 comments · Fixed by #190
Closed

Do not collect c:/k/config in AKS Windows nodes #187

AbelHu opened this issue May 6, 2021 · 5 comments · Fixed by #190
Assignees
Labels

Comments

@AbelHu
Copy link
Member

AbelHu commented May 6, 2021

c:/k/config contains credentials and it may not be helpful for troubleshooting. I do not have the background why we need to collect this file. @axelgMS, could you explain a bit more? Thanks.
fa3b6b6#diff-5479476b67bee0ed06b0852d806f953c23d87c96d34c7a38a1443dc53c854998

@axelgMS
Copy link
Member

axelgMS commented May 17, 2021

@AbelHu this is coming from that PR
adding kubelet config file to AKS manifest #149

Background = CRI 190534195 where we found some weird characters can cause issues with CLI:
Issue with special characters in SP credentials in latest version of Az CLI #13625

Having the c:\k\config file helped us to narrow down and confirm the cause. Otherwise we might have spent much more time investigating.

@AbelHu
Copy link
Member Author

AbelHu commented May 18, 2021

@axelgMS did you need this config to logon to AKS nodes for investigation? I think that we can use SAW to get the kubeconfig and then access the AKS nodes so we do not need to collect kubeconfig with disk inspector.

@axelgMS
Copy link
Member

axelgMS commented May 18, 2021

@AbelHu No, we are not allowed to logon to AKS nodes.

How do you get the kubelet config file from SAW? Do you mean you're getting it with Jarvis Actions? which one?
or with HcpDebug (I don't think we have permissions to run it).

@AbelHu
Copy link
Member Author

AbelHu commented May 19, 2021

@axelgMS AKS PG can use the tool in SAW to get kubeconfig to access the cluster after cx sends a request with an ICM for the help. kubeconfig is Highly Sensitive data and I think that we should not collect it with disk inspector.

@axelgMS
Copy link
Member

axelgMS commented May 19, 2021

@AbelHu sure, fine!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants