{"action":"opened","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/71271","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/71271/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/71271/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/71271/events","html_url":"https://github.com/kubernetes/kubernetes/issues/71271","id":382697806,"node_id":"MDU6SXNzdWUzODI2OTc4MDY=","number":71271,"title":"Update 1.10 to 1.11  kubelet node is forbidden to patch status","user":{"login":"peradel","id":6169896,"node_id":"MDQ6VXNlcjYxNjk4OTY=","avatar_url":"https://avatars0.githubusercontent.com/u/6169896?v=4","gravatar_id":"","url":"https://api.github.com/users/peradel","html_url":"https://github.com/peradel","followers_url":"https://api.github.com/users/peradel/followers","following_url":"https://api.github.com/users/peradel/following{/other_user}","gists_url":"https://api.github.com/users/peradel/gists{/gist_id}","starred_url":"https://api.github.com/users/peradel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/peradel/subscriptions","organizations_url":"https://api.github.com/users/peradel/orgs","repos_url":"https://api.github.com/users/peradel/repos","events_url":"https://api.github.com/users/peradel/events{/privacy}","received_events_url":"https://api.github.com/users/peradel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-20T14:49:35Z","updated_at":"2018-11-20T14:49:35Z","closed_at":null,"author_association":"NONE","body":"<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!-->\r\nPod's are unable to communicate.\r\n\r\n```Nov 20 14:12:30 test-node-09 kubelet-wrapper[1556]: W1120 14:12:30.493541    1556 status_manager.go:498] Failed to update status for pod \"kube-apiserver-test-node-09_kube-system(944906ec-ecc6-11e8-ae4e-0cc47afc2098)\": failed to patch status \"[...omitted patch data ...]\": pods \"kube-apiserver-test-node-09\" is forbidden: User \"system:node:test-node-09\" cannot patch pods/status in the namespace \"kube-system\"```\r\n\r\n**What happened**: patch to pods/status is denied.\r\n\r\n**What you expected to happen**: patch operation succeeds\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**: start updating kubelet 1.10 to 1.11.3 without using kubeadm. \r\n\r\n* Change hyperkube image from `k8s.gcr.io/hyperkube:v1.10.5` to  `k8s.gcr.io/hyperkube:v1.11.3`\r\n* restart one node\r\n\r\n**Anything else we need to know?**: The symptoms seem the same as in bug #52711 but we already use `--authorization-mode=Node,RBAC` successfully in the running cluster.\r\n\r\nThe logs of node-problemdetector on that node contained the following\r\n ```Error from server: Get https://test-node-09:10250/containerLogs/kube-system/node-problem-detector-btfth/node-problem-detector: x509: certificate signed by unknown authority```\r\n\r\nConnecting on that node with `openssl s_client -connect test-node-09:10250` will present  a certificate chain rooted in a self signed certificate generated on that node\r\n ```Certificate chain\r\n 0 s:/CN=test-node-09@1542720938\r\n   i:/CN=test-node-09-ca@1542720937\r\n 1 s:/CN=test-node-09-ca@1542720937\r\n   i:/CN=test-node-09-ca@1542720937```\r\nThis is different from the ca certificate set throughout  the rest of our cluster.\r\n\r\n**Environment**:\r\n- Kubernetes version (use `kubectl version`):1.10.5 (running)\r\n- Cloud provider or hardware configuration: bare-metal\r\n- OS (e.g. from /etc/os-release): Container Linux by CoreOS 1855.5.0\r\n- Kernel (e.g. `uname -a`): 4.14.74-coreos\r\n- Install tools:\r\n- Others: no kubeadm!\r\n\r\n<!-- DO NOT EDIT BELOW THIS LINE -->\r\n/kind bug"}}
{"actor":{"display_login":"peradel"}}