Change:
Dear All: I'm not sure if I'm right. When i use whith .I found controller-manager logs Someone can help me? Thanks a lot.
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list and label list
Reiterating the mentions to trigger a notification: <detailsIn response to : Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Please give more information about your set up cc
Sorry for report later. My openstack didn't support metadata service,but support config-drive service. More info:
Thanks Based on this, I think it's an openstack cloudprovider problem more than a kubeadm problem...
Thank you for help me. I will change the label.
/area cloudprovider
/remove-kind support
Should be fixed with you can specify a search order for metadata and config drive /close
Specifying a search order doesn't really solve the problem, especially if the metadata api isn't available which is what ZhenyangZhao said . I'm getting the same issue and since the config drive is my only option at the moment.
Like for this to be /open
can you please provide logs/versions for your problem in your environment? Thanks, Dims
Let me know if you need anything else Kubernetes version: 1.8.4 Docker version: 17.09.0-ce Linux: CentOS 7.4 Looking at the docker container log for the api-server (I don't have problems with the controller-manager):
and share the following:
Hi! Thank you for filing this issue. We appreciate your interest in Kubernetes and kubeadm. In order to make the kubernetes/kubernetes issue tracker more usable, we're routing issues to different repositories with different focuses. I think this issue belongs in the kubeadm repository. Please move this issue to the in order for the kubeadm team to be able to track this efficiently. If you disagree with my assessment of moving this issue, please speak up and/or reopen the issue. Finally, please try to reproduce the bug with the latest Kubernetes version, it might as well already have been fixed :) Thank you and have a good day!

Discussion:
NodeName             string AuthorizationModes   []string <ins> // Mark the controller and api server pods as privileged as some cloud // controllers like openstack need escalated privileges under some conditions // example - loading a config drive to fetch node information PrivilegedPods bool </ins> Token    string TokenTTL *metav1.Duration

NodeName             string               `json:"nodeName"` AuthorizationModes   []string             `json:"authorizationModes,omitempty"` <ins> // Mark the controller and api server pods as privileged as some cloud // controllers like openstack need escalated privileges under some conditions // example - loading a config drive to fetch node information PrivilegedPods bool `json:"privilegedPods"` </ins> Token    string           `json:"token"` TokenTTL *metav1.Duration `json:"tokenTTL,omitempty"`

out.CloudProvider = in.CloudProvider out.NodeName = in.NodeName out.AuthorizationModes = *(*[]string)(unsafe.Pointer(&in.AuthorizationModes)) <ins> out.PrivilegedPods = in.PrivilegedPods </ins> out.Token = in.Token out.TokenTTL = (*v1.Duration)(unsafe.Pointer(in.TokenTTL)) out.APIServerExtraArgs = *(*map[string]string)(unsafe.Pointer(&in.APIServerExtraArgs))

podSubnet: "" serviceSubnet: 10.96.0.1/12 nodeName: "" <ins> privilegedPods: false </ins> token: "" unifiedControlPlaneImage: "" `),

podSubnet: "" serviceSubnet: "" nodeName: "" <ins> privilegedPods: false </ins> token: "" unifiedControlPlaneImage: "" `),

"//cmd/kubeadm/app/util/staticpod:go_default_library", "//pkg/kubeapiserver/authorizer/modes:go_default_library", "//pkg/master/reconcilers:go_default_library", <ins> "//pkg/util/pointer:go_default_library", </ins> "//pkg/util/version:go_default_library", "//vendor/k8s.io/api/core/v1:go_default_library", "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",

staticpodutil "k8s.io/kubernetes/cmd/kubeadm/app/util/staticpod" authzmodes "k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes" "k8s.io/kubernetes/pkg/master/reconcilers" <ins> utilpointer "k8s.io/kubernetes/pkg/util/pointer" </ins> "k8s.io/kubernetes/pkg/util/version" )

}, mounts.GetVolumes(kubeadmconstants.KubeScheduler)), } <ins> // Some cloud providers need extra privileges for example to load node information from a config drive // TODO: when we fully to external cloud providers and the api server and controller manager do not need // to call out to cloud provider code, we can remove the support for the PrivilegedPods if cfg.PrivilegedPods { staticPodSpecs[kubeadmconstants.KubeAPIServer].Spec.Containers[0].SecurityContext = &v1.SecurityContext{ Privileged: utilpointer.BoolPtr(true), } staticPodSpecs[kubeadmconstants.KubeControllerManager].Spec.Containers[0].SecurityContext = &v1.SecurityContext{ Privileged: utilpointer.BoolPtr(true), } } </ins> return staticPodSpecs }

} } <ins> func TestCreatePrivilegedContainerForOpenStack(t *testing.T) { // Creates a Master Configuration with OpenStack cloud provider var staticPodNames = []string{ kubeadmconstants.KubeAPIServer, kubeadmconstants.KubeControllerManager, } var assertions = []struct { cloudProvider     string privilegedPods    bool expectedPrivilege bool }{ { cloudProvider:     "", expectedPrivilege: false, }, { cloudProvider:     "aws", expectedPrivilege: false, }, { cloudProvider:     "openstack", privilegedPods:    true, expectedPrivilege: true, }, } for _, assertion := range assertions { cfg := &kubeadmapi.MasterConfiguration{ KubernetesVersion: "v1.9.0", CloudProvider:     assertion.cloudProvider, PrivilegedPods:    assertion.privilegedPods, } k8sVersion, _ := version.ParseSemantic(cfg.KubernetesVersion) specs := GetStaticPodSpecs(cfg, k8sVersion) for _, podname := range staticPodNames { spec, _ := specs[podname] sc := spec.Spec.Containers[0].SecurityContext if assertion.expectedPrivilege == true { if sc == nil || sc.Privileged == nil || *sc.Privileged == false { t.Errorf("GetStaticPodSpecs did not enable privileged containers in %s pod for provider %s", podname, assertion.cloudProvider) } } else { if sc != nil && sc.Privileged != nil && *sc.Privileged == true { t.Errorf("GetStaticPodSpecs enabled privileged containers in %s pod for provider %s", podname, assertion.cloudProvider) } } } } } </ins> func TestGetAPIServerCommand(t *testing.T) { var tests = []struct { cfg      *kubeadmapi.MasterConfiguration