[PodSecurityPolicy] Move the install of psp

[robinAwallace]

What type of PR is this?
/kind bug

What this PR does / why we need it:

I have found that there is an issue when installing HA etcd with kubeadm for kubernetes v1.22+ with 3 or more control planes when psp is enabled. Where kubelet on control plane 1 is up but non of the pods are mirrored because there is no psp to validate the request.

Apr 25 06:35:55 wallace-sc-k8s-master-nf-1 kubelet[11318]: E0425 06:35:55.993906   11318 kubelet.go:1701] "Failed creating a mirror pod for" err="pods \"etcd-wallace-sc-k8s-master-nf-1\" is forbidden: PodSecurityPolicy: no providers available to validate pod request" pod="kube-system/etcd-wallace-sc-k8s-master-nf-1"

Which is a problem when control plane 2 and 3 does kubeadm join which receives 0 etcd pods from control-plane 0 and fails.

This PR insures that the psp are installed before ´kubeadm join` is executed on the other control planes.

The issue have been traced down to this change:
kubernetes/kubernetes@8b9d0dc#diff-1671fef50296cdc263fe784ea570d008c1e123d15c2efb9aea27554a82080aaaR128

Which fails if the number of etcd pods is 0:
kubernetes/kubernetes@8b9d0dc#diff-1671fef50296cdc263fe784ea570d008c1e123d15c2efb9aea27554a82080aaaR143

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

This is a issue from v2.18.0+

Does this PR introduce a user-facing change?:

Fix issue when PodSecurityPolicy is enabled static pods are now mirrored earlier by kubelet. Problem when installing HA etcd via kubeadm.

[k8s-ci-robot]

Hi @robinAwallace. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[cristicalin]

Thanks @robinAwallace !

/approve
/ok-to-test

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cristicalin, robinAwallace

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [cristicalin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[oomichi]

Thanks for doing this, most part seems good for me.
just one comment.

/cc @oomichi

[oomichi]

Thanks for updating.

/lgtm

[oomichi]

/lgtm

[rptaylor]

@robinAwallace I have exactly the same problem, thank you so much for determing the cause and fixing this!!

Kubespray 2.18 remains broken for deployment of PSP-enabled clusters however.

[robinAwallace]

@robinAwallace I have exactly the same problem, thank you so much for determing the cause and fixing this!!

Kubespray 2.18 remains broken for deployment of PSP-enabled clusters however.

If i remember correctly it should just be a problem when using kubernetes v1.22+. So if you are specifying the kubernetes v1.22+ and still running kubespray-2.18 i guess you need to cherry pick this fix or use kubespray v2.19.

Hope this helps you a bit 🙂

[rptaylor]

Yes, k8s 1.22 is the default version in Kubespray 2.18.2 , so it is affected. I cherry picked the fix it into my branch.