-
Notifications
You must be signed in to change notification settings - Fork 4.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ignore cert-manager in LBC's webhooks #16179
Conversation
LBC depends on cert-manager but kops can get in a circular dependency loop when applying these manifests on a new cluster. The cert-manager pods wont be created because the LBC webhook on "CREATE pods" isn't working yet, but LBC pod cant be created because it depends on a secret volume mount created by cert-manager
Signed-off-by: Peter Rifel <[email protected]>
/test pull-kops-e2e-aws-load-balancer-controller |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hakman The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/test pull-kops-e2e-aws-load-balancer-controller |
/lgtm cancel |
/test pull-kops-e2e-aws-load-balancer-controller using amd64 nodes for this job because LBC's e2e test uses single-arch images (example) |
/test pull-kops-e2e-aws-load-balancer-controller |
/cc @hakman |
/lgtm |
Hi, i found same issue after enable ALB controller via addos kops. how can fix this issue?
|
LBC depends on cert-manager but kops can get in a circular dependency loop when applying these manifests on a new cluster.
The cert-manager pods wont be created because the LBC webhook on "CREATE services" isn't working yet, but LBC pod cant be created because it depends on a secret volume mount created by cert-manager
Observe the errors in these protokube logs:
W1218 22:01:20.531717 10658 results.go:63] error from apply on /v1, Kind=Service kube-system/cert-manager: error from apply: error patching object: Internal error occurred: failed calling webhook "mservice.elbv2.k8s.aws": failed to call webhook: Post "https://aws-load-balancer-webhook-service.kube-system.svc:443/mutate-v1-service?timeout=10s": dial tcp 100.69.153.238:443: connect: connection refused
W1218 22:01:22.130490 10658 results.go:63] error from apply on cert-manager.io/v1, Kind=Certificate kube-system/aws-load-balancer-serving-cert: error from apply: error patching object: Internal error occurred: failed calling webhook "webhook.cert-manager.io": failed to call webhook: Post "https://cert-manager-webhook.kube-system.svc:443/mutate?timeout=10s": service "cert-manager-webhook" not found
and kube-system event:
This should fix the flakiness in this prow job that started after we upgraded LBC (#16155) that added the "CREATE services" webhook configuration.