UPSTREAM: 62152: Keep node.kubeconfig correct during rotation

[smarterclayton]

The node.kubeconfig created by bootstrap will not work after the first
rotation - write bootstrap credentials into the cert store in order to
guarantee that rotation preserves that config.

Without this, SDN, the sync pod, and a few other node level actions will stop working when the pod gets rotated.

@liggitt

[liggitt]

Do we test actual rotation in any of our CI tests?

[smarterclayton]

All the GCP tests run with rotation on at 15 minutes, which means they rotate 2 times on average per run. If rotation is broken GCP e2e should break ~10-30% of the time. We don't have a rotation e2e but we need something that forces and verifies upstream.

[smarterclayton]

/retest

[smarterclayton]

I think this also fixes a "kubelet bypasses bootstrapping when the last bootstrap cert expires" bug, because we only ever read the bootstrap cert from the store (it will be nil if the cert has expired) and if it's nil we ask for a new cert. I hit this on api.ci tonight when i accidentally killed the autoapprover for > 15m which caused a node's bootstrap cert to expire. I had to clear the certs in order to proceed. With this fix we should have cleared it ourselves.

[smarterclayton]

/retest

…

On Sun, May 27, 2018 at 2:28 PM, OpenShift CI Robot < ***@***.***> wrote: @smarterclayton <https://github.com/smarterclayton>: The following test *failed*, say /retest to rerun them all: Test name Commit Details Rerun command ci/openshift-jenkins/extended_clusterup 8c3170d <8c3170d> link <https://openshift-gce-devel.appspot.com/build/origin-ci-test/pr-logs/pull/19857/test_pull_request_origin_extended_clusterup/1725/> /test extended_clusterup Full PR test history <https://openshift-gce-devel.appspot.com/pr/19857>. Your PR dashboard <https://openshift-gce-devel.appspot.com/pr/smarterclayton>. Please help us cut down on flakes by linking to <https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests> an open issue <https://github.com/openshift/origin/issues?q=is:issue+is:open> when you hit one in your PR. Instructions for interacting with me using PR comments are available here <https://git.k8s.io/community/contributors/devel/pull-requests.md>. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra <https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:> repository. I understand the commands that are listed here <https://go.k8s.io/bot-commands>. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#19857 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_p-jaRy8_9w7MWhUyO2xZW5XrVN5cks5t2vA1gaJpZM4UPXjE> .

[smarterclayton]

@liggitt without this we can’t have rotation

[liggitt]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, smarterclayton

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• vendor/k8s.io/kubernetes/pkg/kubelet/certificate/OWNERS [liggitt,smarterclayton]
• vendor/k8s.io/kubernetes/staging/src/k8s.io/client-go/OWNERS [liggitt,smarterclayton]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment