K
Q

Errors in configuring feature gate in gke

10/2/2018

I was trying to run kubelet parameters add --feature-gates=ReadOnlyAPIDataVolumes=false on my GKE node with node version 1.9.7.

Then I got the following error:

I1002 00:56:53.617596   13469 feature_gate.go:226] feature gates: &{{} map[ReadOnlyAPIDataVolumes:false]}
I1002 00:56:53.617724   13469 controller.go:114] kubelet config controller: starting controller
I1002 00:56:53.617729   13469 controller.go:118] kubelet config controller: validating combination of defaults and flags
error: error reading /var/lib/kubelet/pki/kubelet.key, certificate and key must be supplied as a pair

If I run sudo kubelet parameters add --feature-gates=ReadOnlyAPIDataVolumes=false, then I got

error: unrecognized key: ReadOnlyAPIDataVolumes

My questions:

  • In general, should kubelet command be executed from as root or not?
  • Specifically how to run "kubelet parameters add" command successfully?
-- twimo
google-kubernetes-engine
kubernetes

Similar Questions

Multiple replicas of kube-system/ingress controller pods?
Kubernetes calico networkpolicy
Deploying Spinnaker to Openshift fails at spin-redis-bootstrap stage
How are you connecting two Istio clusters?
How to pass k8s secret key value into Jenkins via Declarative pipeline
nginx docker connect() failed (110: Connection timed out) while connecting to upstream, same configuration works without docker, what could be wrong?
helm/kubernets sending mail from connection times out

1 Answer

10/2/2018

  1. Yes. Although it may be possible to run as non-root, the kubelet has control over so many different components on your system that would be difficult to make it talk to all the components as non-root.

  2. I'm really not sure where kubelet parameters add comes from, or how it's setup on GKE (I believe it's the good old kube-up.sh script) But generally, you can change your kubelet parameters at the systemd level. For example, I use kubeadm and change/add flags in /var/lib/kubelet/kubeadm-flags.env or just inline on the kubelet command line, according to this systemd service definition:

    $ systemctl cat kubelet
# /lib/systemd/system/kubelet.service
[Unit]
Description=kubelet: The Kubernetes Node Agent
Documentation=https://kubernetes.io/docs/home/

[Service]
ExecStart=/usr/bin/kubelet
Restart=always
StartLimitInterval=0
RestartSec=10

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
# Note: This dropin only works with kubeadm and kubelet v1.11+
[Service]
Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap- kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --hostname-override=ip-x-x-x-x.us-east-1.compute.internal"
Environment="KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml"
# This is a file that "kubeadm init" and "kubeadm join" generates at runtime, populating the KUBELET_KUBEADM_ARGS variable dynamically
EnvironmentFile=-/var/lib/kubelet/kubeadm-flags.env
# This is a file that the user can use for overrides of the kubelet args as a last resort. Preferably, the user should use
# the .NodeRegistration.KubeletExtraArgs object in the configuration files instead. KUBELET_EXTRA_ARGS should be sourced from this file.
EnvironmentFile=-/etc/default/kubelet
ExecStart=
ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS
-- Rico
Source: StackOverflow