kubeAPIServer authorizationMode still requires adding Node,RBAC on k8s 1.19.x

[gamer22026]

1. What kops version are you running? The command kops version, will display
this information.
1.19.1
2. What Kubernetes version are you running? kubectl version will print the
version if a cluster is running or provide the Kubernetes version specified as
a kops flag.
1.19.8
3. What cloud provider are you using?
AWS
4. What commands did you run? What is the simplest way to reproduce this issue?
rolling update from k8s 1.18.13 to 1.19.8
5. What happened after the commands executed?
First master node didn't come up
6. What did you expect to happen?
First master node comes up
7. Anything else do we need to know?
Issue was

  kubeAPIServer:
     authorizationMode: RBAC

had to be changed to

  kubeAPIServer:
     authorizationMode: Node,RBAC

The rolling update then worked. This slack thread ( https://kubernetes.slack.com/archives/C3QUFP0QM/p1614880910266900?thread_ts=1614872952.265000&cid=C3QUFP0QM ) indicates that for k8s >= 1.19 Node should be auto-included per https://github.com/kubernetes/kops/blob/master/pkg/model/components/apiserver.go#L89 but that's clearly not happening.

[rifelpet]

@gamer22026 can you post your full cluster spec? I'm curious what the spec.authorization field contains.

[microwaves]

Facing the same problem with our cluster here. But Node is already in place in the authorizationMode config. 2 of the 3 masters come up, the last complains about:

NetworkReady=false reason:NetworkPluginNotReady message:docker: network plugin is not ready: cni config uninitialized

Any thoughts?

[tuapuikia]

Facing the same problem with our cluster here. But Node is already in place in the authorizationMode config. 2 of the 3 masters come up, the last complains about:

NetworkReady=false reason:NetworkPluginNotReady message:docker: network plugin is not ready: cni config uninitialized

Any thoughts?

I have the same problem when bootstrap new cluster using kops 1.21.0

[olemarkus]

Can you open a new issue and post the cluster spec there?

[thienchuong]

Facing the same problem with our cluster here. But Node is already in place in the authorizationMode config. 2 of the 3 masters come up, the last complains about:

NetworkReady=false reason:NetworkPluginNotReady message:docker: network plugin is not ready: cni config uninitialized

Any thoughts?

I have exactly the same issue, did you fix it, and how