Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bugfix: use correct service-account-issuer in case of custom clusterDomain #2342

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

vardhaman-surana
Copy link

@vardhaman-surana vardhaman-surana commented Dec 18, 2024

What issue type does this pull request address? (keep at least one, remove the others)
/kind bugfix

What does this pull request do? Which issues does it resolve? (use resolves #<issue_number> if possible)
resolves #2315

The PR adds the correct service account issuer to the apiserver in case custom clusterdomain is set using networking.advanced.clusterDomain.
It also fixes _coredns.tpl in the chart to correctly use custom clusterdomain in coredns configuration.

Please provide a short message that should be published in the vcluster release notes
Fixed an issue where vcluster was setting wrong service-account-issuer in case of custom clusterDomain.

What else do we need to know?

in case of the custom cluster domain the service account token for the vcluster pods is created with audiences

"https://kubernetes.default.svc.<custom-domain>", "https://kubernetes.default.svc", "https://kubernetes.default"

and because of the issuer set to https://kubernetes.default.svc.cluster.local the apiserver rejects the authentication request for the token. with the error

invalid bearer token, token audiences ["https://kubernetes.default.svc.<custom-domain>", "https://kubernetes.default.svc", "https://kubernetes.default"] is invalid for the target audiences ["https://kubernetes.default.svc.cluster.local"]

for k0s setting just the clusterDomain in the config file works. and for k3s users needs to use correct settings as below

networking:
  advanced:
    clusterDomain: "k8s.my-cluster"
controlPlane:
  distro:
    k3s:
      enabled: true
      extraArgs: ["--cluster-domain=k8s.my-cluster"]

Copy link

netlify bot commented Dec 18, 2024

Deploy Preview for vcluster-docs canceled.

Built without sensitive environment variables

Name Link
🔨 Latest commit 2ed2297
🔍 Latest deploy log https://app.netlify.com/sites/vcluster-docs/deploys/67626f5fc44ea0000863a8d3

@vardhaman-surana vardhaman-surana changed the title fix service account issuer in case of custom cluster domain fix service-account-issuer in case of custom cluster domain Dec 18, 2024
@vardhaman-surana vardhaman-surana changed the title fix service-account-issuer in case of custom cluster domain fix service-account-issuer in case of custom clusterDomain Dec 18, 2024
@vardhaman-surana vardhaman-surana changed the title fix service-account-issuer in case of custom clusterDomain bugfix: use correct service-account-issuer in case of custom clusterDomain Dec 18, 2024
@FabianKramm
Copy link
Member

@vardhaman-surana thanks for the PR! Looks good to me!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

kubedns not starting when using custom clusterDomain
3 participants