This repository has been archived by the owner on Jan 11, 2023. It is now read-only.
Delete role assignments when deleting a VM #2934
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
|
|
@dmitsh Can you take a quick look? I'll run upgrade/scale tests against it as well. Thanks! |
dmitsh
previously approved these changes
May 14, 2018
jackfrancis
suggested changes
May 15, 2018
pkg/operations/deletevm.go
Outdated
| // The role assignments should only be relevant if managed identities are used, | ||
| // but always cleaning them up is easier than adding rule based logic here and there. | ||
| scope := fmt.Sprintf(AADRoleResourceGroupScopeTemplate, subscriptionID, resourceGroup) | ||
| logger.Infof("fetching roleAssignments: %s with principal %s", scope, *vm.Identity.PrincipalID) |
There was a problem hiding this comment.
Ran an upgrade test against this branch and got the following nil pointer panic:
time="2018-05-15T19:03:56Z" level=info msg="deleting managed disk: kubernetes-koreasouth-74251/k8s-master-15172440-0_OsDisk_1_dc7dab13d2354a4f875595aa83b99d3c"
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x138a30f]
goroutine 1 [running]:
github.com/Azure/acs-engine/pkg/operations.CleanDeleteVirtualMachine(0x186eca0, 0xc4205f4900, 0xc42031c780, 0xc4208ade60, 0x24, 0x7fff98924da7, 0x1b, 0xc42034bc60, 0x15, 0x148c120, ...)
/go/src/github.com/Azure/acs-engine/pkg/operations/deletevm.go:98 +0xa2f
github.com/Azure/acs-engine/pkg/operations/kubernetesupgrade.(*UpgradeMasterNode).DeleteNode(0xc4201622a0, 0xc42086eb20, 0xc42034bc00, 0x15, 0x0)
/go/src/github.com/Azure/acs-engine/pkg/operations/kubernetesupgrade/upgrademasternode.go:39 +0x7f
github.com/Azure/acs-engine/pkg/operations/kubernetesupgrade.(*Upgrader).upgradeMasterNodes(0xc4208be210, 0x148c101, 0xc4208be210)
/go/src/github.com/Azure/acs-engine/pkg/operations/kubernetesupgrade/upgrader.go:137 +0xa98
github.com/Azure/acs-engine/pkg/operations/kubernetesupgrade.(*Upgrader).RunUpgrade(0xc4208be210, 0x0, 0x0)
/go/src/github.com/Azure/acs-engine/pkg/operations/kubernetesupgrade/upgrader.go:54 +0x2f
github.com/Azure/acs-engine/pkg/operations/kubernetesupgrade.(*UpgradeCluster).UpgradeCluster(0xc420a13c60, 0x804f1c7d6b541430, 0x6afe76994af22385, 0xc420b40800, 0x26be, 0x7fff98924da7, 0x1b, 0xc42073b6e0, 0xc420ac9940, 0x8, ...)
/go/src/github.com/Azure/acs-engine/pkg/operations/kubernetesupgrade/upgradecluster.go:115 +0x660
github.com/Azure/acs-engine/cmd.(*upgradeCmd).run(0xc4200914a0, 0xc42016a900, 0xc420487d00, 0x0, 0x10, 0x0, 0x0)
/go/src/github.com/Azure/acs-engine/cmd/upgrade.go:225 +0x455
github.com/Azure/acs-engine/cmd.newUpgradeCmd.func1(0xc42016a900, 0xc420487d00, 0x0, 0x10, 0x0, 0x0)
/go/src/github.com/Azure/acs-engine/cmd/upgrade.go:58 +0x52
github.com/Azure/acs-engine/vendor/github.com/spf13/cobra.(*Command).execute(0xc42016a900, 0xc420487c00, 0x10, 0x10, 0xc42016a900, 0xc420487c00)
/go/src/github.com/Azure/acs-engine/vendor/github.com/spf13/cobra/command.go:647 +0x3e4
github.com/Azure/acs-engine/vendor/github.com/spf13/cobra.(*Command).ExecuteC(0xc42021b8c0, 0xc42016ab40, 0xc42016a900, 0xc42016a480)
/go/src/github.com/Azure/acs-engine/vendor/github.com/spf13/cobra/command.go:726 +0x2d4
github.com/Azure/acs-engine/vendor/github.com/spf13/cobra.(*Command).Execute(0xc42021b8c0, 0xc42000e018, 0x13a4b83)
/go/src/github.com/Azure/acs-engine/vendor/github.com/spf13/cobra/command.go:685 +0x2b
main.main()
/go/src/github.com/Azure/acs-engine/main.go:12 +0x74
…le if no managed identity is returned by azure
Codecov Report
@@ Coverage Diff @@
## master #2934 +/- ##
==========================================
- Coverage 49.72% 49.66% -0.07%
==========================================
Files 91 91
Lines 13998 14027 +29
==========================================
+ Hits 6961 6967 +6
- Misses 6394 6415 +21
- Partials 643 645 +2
Continue to review full report at Codecov.
|
|
@jackfrancis I just added two test cases which should somewhat cover the issue you experienced. Can you please:
|
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jackfrancis The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Have a look at #2916 for the detailed error description.
In short: Role assignments do not get deleted when deleting a VM. If we use managed identities, this leads to an error during the rollout of a new node. With this PR we delete all role assignments that are associated with the VM to be deleted.
Implementation note:
I decided to pass the subscription ID to where I needed it for the scope calculation. If you should dislike this approach, I think we could also work without it. Then the listing of all role assignments would only be based on the principal ID of the VM
Which issue this PR fixes:
fixes #2916
Special notes for your reviewer:
Current tests were adjusted to work with these changes, but no new tests created.
If applicable: