Kube-vip template fails with HA clusters

[cprivitere]

trafficstars

What steps did you take and what happened: kube-vip template doesn't work with HA clusters. The second control plane node that comes up fails to detect that a node is already up and using the VIP address and registers it on its own local host address. This prevents kubeadm from working, which prevents access to the API server that kube-vip would need to be able to clean things up on its own.

What did you expect to happen: Should bring up 3 control plane nodes just fine.

Anything else you would like to add: The line we need to look at is this one in the cluster-templates. ping -c 3 -q {{ .controlPlaneEndpoint }} && echo OK || ip addr add {{ .controlPlaneEndpoint }} dev lo

Environment:

• cluster-api-provider-packet version: 0.6.0
• Kubernetes version: (use kubectl version): 1.25
• OS (e.g. from /etc/os-release): Ubuntu 22.04

[displague]

I'm wondering if the -c3 with the default delay may not be long enough.

[cprivitere]

Ok here's my understanding of what's going on.

• First node comes up.

• cloud-init plumbs the VIP address onto localhost interface.

• cloud-init sets up the kube-vip manifest.

• kubelet starts up the kube-vip pod as part of kubeadm init.

• kube-vip does the right thing and does a bgp announcement of owning the VIP ip.

• Second node comes up.

• cloud-init detects that the VIP address is reachable and does NOT plumb it onto the localhost interface.

• cloud-init sets up the kube-vip manifest.

• kubelet starts up the kube-vip pod as part of kubeadm join.

• kube-vip plumbs the IP address onto the localhost interface.

• kubelet can't reach a functioning API server as there isn't one running locally.

• kube-vip does the WRONG thing and does a bgp announcement, cause it doesn't have any communication with the first server.

• both nodes fight, doing bgp announcements and taking the VIP IP address back and forth.

So! I'm going to move the code that sets up the kube-vip static pod manifest into the post kubeadm join/init commands block. This will ensure the kube-vip on the joining control plane nodes only comes up after the api server and etcd stuff is all set up so it can coordinate with the first node about who should broadcast the VIP address.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[cprivitere]

/remove-lifecycle rotten

[cprivitere]

/reopen

[k8s-ci-robot]

@cprivitere: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[khatrig]

@cprivitere , Why do you have to manually plumb the VIP onto lo interface? Isn't kube-vip pod supposed to do that automatically on startup?

[cprivitere]

So two things:

1. I fixed this back in September it seems and never closed this. (Answer was to move the code that sets up the kubevip static pod manifest into pre-kubeadm commands on the initial node and post-kubeadm commands on the joining nodes).
2. The answer to your question is...I don't know. Worth testing to see if we can get rid of the manual plumb.

[khatrig]

@cprivitere , I've tested it plenty of times and can confirm that manual vip assignment to the interface is not required.