Don't try to migrate to new roles and rolebinding within 1.7 upgrades

Fixes: kubernetes/kubeadm#475
kad · Oct 2, 2017 · c24087a · c24087a
1 parent 457ea0c
commit c24087a
Showing 1 changed file with 13 additions and 6 deletions.
diff --git a/cmd/kubeadm/app/phases/upgrade/postupgrade.go b/cmd/kubeadm/app/phases/upgrade/postupgrade.go
@@ -20,6 +20,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/errors"
 	clientset "k8s.io/client-go/kubernetes"
 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	"k8s.io/kubernetes/cmd/kubeadm/app/phases/addons/dns"
 	"k8s.io/kubernetes/cmd/kubeadm/app/phases/addons/proxy"
 	"k8s.io/kubernetes/cmd/kubeadm/app/phases/apiconfig"
@@ -62,19 +63,25 @@ func PerformPostUpgradeTasks(client clientset.Interface, cfg *kubeadmapi.MasterC
 		errs = append(errs, err)
 	}
 
-	// Create/update RBAC rules that makes the bootstrap tokens able to get their CSRs approved automatically
-	if err := nodebootstraptoken.AutoApproveNodeBootstrapTokens(client, k8sVersion); err != nil {
-		errs = append(errs, err)
+	// Not needed for 1.7 upgrades
+	if k8sVersion.AtLeast(constants.MinimumCSRAutoApprovalClusterRolesVersion) {
+		// Create/update RBAC rules that makes the bootstrap tokens able to get their CSRs approved automatically
+		if err := nodebootstraptoken.AutoApproveNodeBootstrapTokens(client, k8sVersion); err != nil {
+			errs = append(errs, err)
+		}
 	}
 
 	// TODO: Is this needed to do here? I think that updating cluster info should probably be separate from a normal upgrade
 	// Create the cluster-info ConfigMap with the associated RBAC rules
 	// if err := clusterinfo.CreateBootstrapConfigMapIfNotExists(client, kubeadmconstants.GetAdminKubeConfigPath()); err != nil {
 	// 	return err
 	//}
-	// Create/update RBAC rules that makes the cluster-info ConfigMap reachable
-	if err := clusterinfo.CreateClusterInfoRBACRules(client); err != nil {
-		errs = append(errs, err)
+	// Not needed for 1.7 upgrades
+	if k8sVersion.AtLeast(constants.UseEnableBootstrapTokenAuthFlagVersion) {
+		// Create/update RBAC rules that makes the cluster-info ConfigMap reachable
+		if err := clusterinfo.CreateClusterInfoRBACRules(client); err != nil {
+			errs = append(errs, err)
+		}
 	}
 
 	// TODO: This call is deprecated