Fix commands for using experimental kubeadm control plane

[ariskou]

Fixes #5005

Adds a few extra checks to handle the new kubeadm version.

[ariskou]

/kind bug

[ariskou]

/assign @ant31

[holmsten]

ci check this

[ariskou]

/test packet_centos7-flannel-addons

[ariskou]

I think that the packet_centos7-flannel-addons test might have failed for unrelated reasons (not sure though). I can't re-trigger the test myself though.

[woopstar]

/assign

[woopstar]

Is --certificate-key not required in versions after 1.15 ?

[ariskou]

Let me check the documentation, but the error message said:
can not mix '--config' with arguments [certificate-key]
I'll get back to this.

[praseodym]

Is --certificate-key not required in versions after 1.15 ?

It is not, because the certificate key is already included in kubeadm-config.yaml.

Also, it's a bit nicer to nest the if statements (like in roles/kubernetes/master/tasks/kubeadm-setup.yml):

--- a/roles/kubernetes/kubeadm/tasks/kubeadm_etcd_node.yml
+++ b/roles/kubernetes/kubeadm/tasks/kubeadm_etcd_node.yml
@@ -1,12 +1,16 @@
 ---
 - name: Refresh certificates so they are fresh and not expired
   command: >-
-    {{ bin_dir }}/kubeadm init phase
+    {{ bin_dir }}/kubeadm init phase upload-certs
     --config {{ kube_config_dir }}/kubeadm-config.yaml
-    upload-certs --experimental-upload-certs
+    {% if kubeadm_version is version('v1.15.0', '<') %}
+    --experimental-upload-certs
     {% if kubeadm_certificate_key is defined %}
     --certificate-key={{ kubeadm_certificate_key }}
     {% endif %}
+    {% else %}
+    --upload-certs
+    {% endif %}
   register: kubeadm_upload_cert
   delegate_to: "{{ groups['kube-master'][0] }}"
   when: kubeadm_etcd_refresh_cert_key

[woopstar]

Same here

[praseodym]

This change is not needed, there is already {% if kubeadm_version is version('v1.15.0', '<') %} on line 114.

[praseodym]

This change is not needed, there is already {% if kubeadm_version is version('v1.15.0', '<') %} on line 114.

[praseodym]

Is --certificate-key not required in versions after 1.15 ?

It is not, because the certificate key is already included in kubeadm-config.yaml.

Also, it's a bit nicer to nest the if statements (like in roles/kubernetes/master/tasks/kubeadm-setup.yml):

--- a/roles/kubernetes/kubeadm/tasks/kubeadm_etcd_node.yml
+++ b/roles/kubernetes/kubeadm/tasks/kubeadm_etcd_node.yml
@@ -1,12 +1,16 @@
 ---
 - name: Refresh certificates so they are fresh and not expired
   command: >-
-    {{ bin_dir }}/kubeadm init phase
+    {{ bin_dir }}/kubeadm init phase upload-certs
     --config {{ kube_config_dir }}/kubeadm-config.yaml
-    upload-certs --experimental-upload-certs
+    {% if kubeadm_version is version('v1.15.0', '<') %}
+    --experimental-upload-certs
     {% if kubeadm_certificate_key is defined %}
     --certificate-key={{ kubeadm_certificate_key }}
     {% endif %}
+    {% else %}
+    --upload-certs
+    {% endif %}
   register: kubeadm_upload_cert
   delegate_to: "{{ groups['kube-master'][0] }}"
   when: kubeadm_etcd_refresh_cert_key

[woopstar]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ariskou, woopstar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [woopstar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment