This supports workflows that modify the local kubeconfig for advanced configurations,
which were accidentally broken by trying to always generate the config.
Issue #17262
This all-in-one command is a replacement for having to run multiple commands,
while still respecting the version skew policy.
It does the same thing as `kops update cluster --reconcile`:
* Updates the control plane nodes
* Does a rolling update of the control plane nodes
* Updates "normal" nodes and bastion nodes
* Does a rolling update of these nodes
* Prunes old resources that are no longer used
Kubernetes 1.31 now stops nodes joining a cluster if the minor version
of the node is greater than the minor version of the control plane.
The addition of the instance-group-roles flag to update means that we
can now update / rolling-update the control plane first. However, we
must now issue four commands:
* Update control plane
* Rolling update control plane
* Update nodes
* Rolling update nodes
This adds a flag to automate this process. It is implemented by
executing those 4 steps in sequence.
Update is also smart enough to not update the nodes if this would
violate the skew policy, but we do this explicitly in the reconcile
command to be clearer and safer.
This lets us safely make changes to otherwise immutable fields, in
particular for adding security groups to NLBs created without them.
We detect the older versions, and create deletion tasks to remove
them. These tasks can be deferred, and we expect them to be
deferred to a "prune" phase that runs after cluster apply.
Co-authored-by: Ciprian Hacman <ciprian@hakman.dev>
Kops creates an "api.internal.$clustername" dns A record that points to the master IP(s)
This adds a flag that will use that name and force the CA cert to be included.
This is a workaround for client certificate authentication not working on API ELBs with ACM certificates.
The ELB has a TLS listener rather than TCP, so the client certificate is not passed through to the apiserver.
Using --internal will bypass the API ELB so that the client certificate will be passed directly to the apiserver.
This also requires that the masters' security groups allow 443 access from the client which this does not handle automatically.
We also have to stop passing the flag on ContainerOS, because it's set
in /etc/docker/default.json and it's now an error to pass the flag.
That in turn means we move those options to code, which are the last of
those legacy config options. (We still have a few tasks declaratively
defined though)