cockroachdb / cockroachdb/cockroach

cockroach-k8s-request-cert not generating csr

Open
#106,781 5 comments 0 reactions 0 assignees View on GitHub
C-bug O-community
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

**The problem**

When I deploy cockroachDB with secure mode on GKE with helm chart and try to add a pod with init-certs container, it is not sending a CSR request and pod is staying in `Init:CrashLoopBackOff `

**To Reproduce**

1. Set up CockroachDB cluster ...

`helm install cockroachdb --values values.yml cockroachdb/cockroachdb`
Note: the values file I took from [here](https://github.com/cockroachdb/helm-charts/blob/master/cockroachdb/values.yaml) and just updated the `tls` to `enabled: true`

2. Deploy cockroachdb-client-secure pod ...

`kubectl apply -f https://raw.githubusercontent.com/cockroachdb/cockroach/master/cloud/kubernetes/client-secure.yaml`
Ref: https://github.com/cockroachdb/cockroach/blob/master/cloud/kubernetes/client-secure.yaml

3. Check state of the pod ...

`kubectl get po`
The pod `cockroachdb-client-secure ` is staying in `Init:CrashLoopBackOff `
Also there are no CSR available when I do `kubectl get csr`

4. Check logs of init container

`kubectl logs cockroachdb-client-secure -c init-certs`

Below mention is the logs

`+ /request-cert '-namespace=default' '-certs-dir=/cockroach-certs' '-type=client' '-user=root' '-symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
2023/07/12 18:01:26 Looking up cert and key under secret default.client.root
W0712 18:01:26.191389 1 client_config.go:529] Neither --kubeconfig nor --master was specified. Using the inClusterConfig. This might not work.
2023/07/12 18:01:26 Secret default.client.root not found, sending CSR
Sending create request: default.client.root for
2023/07/12 18:01:26 failed to get certificate: CertificateSigningRequest.Create(default.client.root) failed: the server could not find the requested resource`

**Expected behavior**

The `cockroachdb-client-secure ` pod should create a certificate signing request (CSR) and we should approve the certificate and after that the pod should be in ready state

**Environment:**
- CockroachDB version: v23.1.5
- GKE kubernetes version: v1.26

EDITED:
I think this is due to the deprecation of `certificates.k8s.io/v1beta1 ` API version of CertificateSigningRequest to `certificates.k8s.io/v1 `

Jira issue: CRDB-29713

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.