{"action":"opened","issue":{"url":"https://api.github.com/repos/kubernetes/kubeadm/issues/695","repository_url":"https://api.github.com/repos/kubernetes/kubeadm","labels_url":"https://api.github.com/repos/kubernetes/kubeadm/issues/695/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubeadm/issues/695/comments","events_url":"https://api.github.com/repos/kubernetes/kubeadm/issues/695/events","html_url":"https://github.com/kubernetes/kubeadm/issues/695","id":295816630,"number":695,"title":"kubeadm init --service-cidr= validations are broken for IPv6 subnets","user":{"login":"SpComb","id":3950373,"avatar_url":"https://avatars2.githubusercontent.com/u/3950373?v=4","gravatar_id":"","url":"https://api.github.com/users/SpComb","html_url":"https://github.com/SpComb","followers_url":"https://api.github.com/users/SpComb/followers","following_url":"https://api.github.com/users/SpComb/following{/other_user}","gists_url":"https://api.github.com/users/SpComb/gists{/gist_id}","starred_url":"https://api.github.com/users/SpComb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SpComb/subscriptions","organizations_url":"https://api.github.com/users/SpComb/orgs","repos_url":"https://api.github.com/users/SpComb/repos","events_url":"https://api.github.com/users/SpComb/events{/privacy}","received_events_url":"https://api.github.com/users/SpComb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-09T10:07:06Z","updated_at":"2018-02-09T10:07:06Z","closed_at":null,"author_association":"NONE","body":"## Versions\r\n`kubeadm version: &version.Info{Major:\"1\", Minor:\"9\", GitVersion:\"v1.9.2\", GitCommit:\"5fa2db2bd46ac79e5e00a4e6ed24191080aa463b\", GitTreeState:\"clean\", BuildDate:\"2018-01-18T09:42:01Z\", GoVersion:\"go1.9.2\", Compiler:\"gc\", Platform:\"linux/amd64\"}`\r\n\r\n`kubectl version`\r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"9\", GitVersion:\"v1.9.2\", GitCommit:\"5fa2db2bd46ac79e5e00a4e6ed24191080aa463b\", GitTreeState:\"clean\", BuildDate:\"2018-01-18T10:09:24Z\", GoVersion:\"go1.9.2\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"9\", GitVersion:\"v1.9.2\", GitCommit:\"5fa2db2bd46ac79e5e00a4e6ed24191080aa463b\", GitTreeState:\"clean\", BuildDate:\"2018-01-18T09:42:01Z\", GoVersion:\"go1.9.2\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n\r\n## What happened?\r\n\r\nThe `kubeadm init` validations incorrectly reject a `--service-cidr=.../64` subnet as being too *small*:\r\n\r\n```\r\n$ sudo kubeadm init --service-cidr=fd00::/64\r\n[init] Using Kubernetes version: v1.9.2\r\n[init] Using Authorization modes: [Node RBAC]\r\n[preflight] Running pre-flight checks.\r\n\t[WARNING FileExisting-crictl]: crictl not found in system path\r\nservice-subnet: Invalid value: \"fd00::/64\": subnet is too small\r\n```\r\n\r\nThis presumablyhapens because the [`ipallocator.RangeSize(svcSubnet)` => `2^64`](https://github.com/kubernetes/kubernetes/blob/v1.9.2/cmd/kubeadm/app/apis/kubeadm/validation/validation.go#L258-L261) overflows an `int64`.\r\n\r\nOTOH the `kubeadm init` validations accept a `--service-cidr=.../96`:\r\n```\r\n$ sudo kubeadm init --apiserver-advertise-address=2604:1380:2000:900::13 --service-cidr=fd00::/96\r\n[init] Using Kubernetes version: v1.9.2\r\n[init] Using Authorization modes: [Node RBAC]\r\n[preflight] Running pre-flight checks.\r\n\t[WARNING FileExisting-crictl]: crictl not found in system path\r\n[certificates] Generated ca certificate and key.\r\n[certificates] Generated apiserver certificate and key.\r\n[certificates] apiserver serving cert is signed for DNS names [terom-kube-master kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [fd00::1 2604:1380:2000:900::13]\r\n[certificates] Generated apiserver-kubelet-client certificate and key.\r\n[certificates] Generated sa key and public key.\r\n[certificates] Generated front-proxy-ca certificate and key.\r\n[certificates] Generated front-proxy-client certificate and key.\r\n[certificates] Valid certificates and keys now exist in \"/etc/kubernetes/pki\"\r\n[kubeconfig] Wrote KubeConfig file to disk: \"admin.conf\"\r\n[kubeconfig] Wrote KubeConfig file to disk: \"kubelet.conf\"\r\n[kubeconfig] Wrote KubeConfig file to disk: \"controller-manager.conf\"\r\n[kubeconfig] Wrote KubeConfig file to disk: \"scheduler.conf\"\r\n[controlplane] Wrote Static Pod manifest for component kube-apiserver to \"/etc/kubernetes/manifests/kube-apiserver.yaml\"\r\n[controlplane] Wrote Static Pod manifest for component kube-controller-manager to \"/etc/kubernetes/manifests/kube-controller-manager.yaml\"\r\n[controlplane] Wrote Static Pod manifest for component kube-scheduler to \"/etc/kubernetes/manifests/kube-scheduler.yaml\"\r\n[etcd] Wrote Static Pod manifest for a local etcd instance to \"/etc/kubernetes/manifests/etcd.yaml\"\r\n[init] Waiting for the kubelet to boot up the control plane as Static Pods from directory \"/etc/kubernetes/manifests\".\r\n[init] This might take a minute or longer if the control plane images have to be pulled.\r\n```\r\n\r\nBut the controller startup fails with `--service-cluster-ip-range=fd00::/96`, causing the `kubeadm init` to hang:\r\n\r\n```\r\n$ docker logs k8s_kube-apiserver_...\r\nI0208 18:19:41.153675       1 server.go:121] Version: v1.9.2\r\nspecified --service-cluster-ip-range is too large\r\n```\r\n\r\nThe service cluster IP range is [validated by the kube-apiserver](https://github.com/kubernetes/kubernetes/blob/v1.9.2/cmd/kube-apiserver/app/options/validation.go#L29-L32) to have at most 20 host bits, because it gets used a a bit mask: https://github.com/kubernetes/kubernetes/issues/12820\r\n\r\n## What you expected to happen?\r\n\r\nThe `kubeadm init` command should reject an IPv6 `--service-subnet=...` as being \"too large\" if it is larger than a `/108`. I was able to successfuly initialize a cluster using a `--service-cidr=fd00:XXXX:XXX::/112` subnet.\r\n\r\nLikewise for IPv4, a `kubeadm init --service-subnet=10.0.0.0/8` should probably also fail validation before causing the `kube-apiserver` to fail?\r\n\r\n## How to reproduce it (as minimally and precisely as possible)?\r\n\r\nSee examples under \"What happened\"\r\n\r\n## Anything else we need to know?\r\n"}}
{"actor":{"display_login":"SpComb"}}