New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove dependency on control plane nodes #2729
Comments
@CmdrSharp can we schedule CSI controller on the control plane nodes, but make sure we don't run CSI Node Daemonsets on the control plane node. For security reason it is not good to schedule CSI controller on the worker nodes, as CSI controller requires vCenter credentials and we want to make sure they are only used within control plane nodes. Also we may not have network configuration which allow connection to vCenter server from all worker nodes. |
Hi! The issue would remain for all cases where the control plane does not run a kubelet at all. There is nothing that guarantees control planes can run user workloads - although it is of course common. From a security standpoint, whilst I understand the thinking - I'd rather just not have my control plane be a schedulable entity. Perhaps the solution here is to just document the kustomizations needed to manually override the node selectors and tolerations? If users want to keep the controller separated from the worker nodes, they can create dedicated worker nodes with custom taints to support this. The documentation could underline the recommendation to keep the controller on nodes isolated from normal workloads. I would've happily taken a stab at this but documentation is hosted elsewhere. |
The Kubernetes project currently lacks enough contributors to adequately respond to all issues. This bot triages un-triaged issues according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
/remove-lifecycle stale |
Is this a BUG REPORT or FEATURE REQUEST?: Feature Request
/kind feature
Suggestion: Deploying the CSI Driver currently requires the control plane nodes to be schedulable and run the kubelet. This is not always the case, such as with k0s where by default the control plane is completely isolated and does not run a kubelet.
The suggestion is to either re-design or add an option to remove the dependency on control plane nodes; instead scheduling the csi-controller onto worker nodes.
The text was updated successfully, but these errors were encountered: