cockroachdb / cockroachdb/cockroach
cockroach-k8s-request-cert not generating csr
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
**The problem**
When I deploy cockroachDB with secure mode on GKE with helm chart and try to add a pod with init-certs container, it is not sending a CSR request and pod is staying in `Init:CrashLoopBackOff `
**To Reproduce**
1. Set up CockroachDB cluster ...
`helm install cockroachdb --values values.yml cockroachdb/cockroachdb`
Note: the values file I took from [here](https://github.com/cockroachdb/helm-charts/blob/master/cockroachdb/values.yaml) and just updated the `tls` to `enabled: true`
2. Deploy cockroachdb-client-secure pod ...
`kubectl apply -f https://raw.githubusercontent.com/cockroachdb/cockroach/master/cloud/kubernetes/client-secure.yaml`
Ref: https://github.com/cockroachdb/cockroach/blob/master/cloud/kubernetes/client-secure.yaml
3. Check state of the pod ...
`kubectl get po`
The pod `cockroachdb-client-secure ` is staying in `Init:CrashLoopBackOff `
Also there are no CSR available when I do `kubectl get csr`
4. Check logs of init container
`kubectl logs cockroachdb-client-secure -c init-certs`
Below mention is the logs
`+ /request-cert '-namespace=default' '-certs-dir=/cockroach-certs' '-type=client' '-user=root' '-symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
2023/07/12 18:01:26 Looking up cert and key under secret default.client.root
W0712 18:01:26.191389 1 client_config.go:529] Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work.
2023/07/12 18:01:26 Secret default.client.root not found, sending CSR
Sending create request: default.client.root for
2023/07/12 18:01:26 failed to get certificate: CertificateSigningRequest.Create(default.client.root) failed: the server could not find the requested resource`
**Expected behavior**
The `cockroachdb-client-secure ` pod should create a certificate signing request (CSR) and we should approve the certificate and after that the pod should be in ready state
**Environment:**
- CockroachDB version: v23.1.5
- GKE kubernetes version: v1.26
EDITED:
I think this is due to the deprecation of `certificates.k8s.io/v1beta1 ` API version of CertificateSigningRequest to `certificates.k8s.io/v1 `
Jira issue: CRDB-29713
Contributor guide
Assessment
This issue has not been assessed yet.