failSwapOn in kubeadm-config file does not work

[bruceauyeung]

/bug

[root@host-10-10-10-33 ~]# cat /tmp/kubeadm-config.yml

apiVersion: kubeadm.k8s.io/v1alpha3
kind: ClusterConfiguration
kubernetesVersion: v1.12.2
apiServerCertSANs:
\- "10.10.10.33"
controlPlaneEndpoint: "10.10.10.33:6443"
etcd:
  local:
    extraArgs:
      listen-client-urls: "https://127.0.0.1:2379,https://10.10.10.33:2379"
      advertise-client-urls: "https://10.10.10.33:2379"
      listen-peer-urls: "https://10.10.10.33:2380"
      initial-advertise-peer-urls: "https://10.10.10.33:2380"
      initial-cluster: >-
        "
        host-10-10-10-33.openstacklocal=https://10.10.10.33:2380
        "
    serverCertSANs:
      - "host-10-10-10-33.openstacklocal"
      - "10.10.10.33"
    peerCertSANs:
      - "host-10-10-10-33.openstacklocal"
      - "10.10.10.33"

networking:
    \# This CIDR is a Calico default. Substitute or remove for your CNI provider.
    podSubnet: "192.168.0.0/16"
imageRepository: apphub.zte.com.cn/itp/kubernetes
unifiedControlPlaneImage: ""
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
failSwapOn: false

[root@host-10-10-10-33 ~]# kubeadm init --config=/tmp/kubeadm-config.yml

[init] using Kubernetes version: v1.12.2
[preflight] running pre-flight checks
[preflight] Some fatal errors occurred:
[ERROR Swap]: running with swap on is not supported. Please disable swap
[preflight] If you know what you are doing, you can make a check non-fatal with --ignore-preflight-errors=...

[neolit123]

hello @bruceauyeung

this is failing because we have a kubeadm preflight check unrelated to the kubelet failSwapOn flag.
you need to pass --ignore-preflight-errors=Swap to make the check pass.

what can be done here is after reading the passed config file, check if there is a kubelet configuration and if it has failSwapOn and if it is set to false skip the preflight check Swap.

[bart0sh]

As I'm currently looking at this area I'd take if if you don't mind
/assign

[neolit123]

thanks @bart0sh

[yagonobre]

/lifecycle active

[timothysc]

No, we should not be doing this!

You can not respect cgroup limits when you have swap on. It's fine if folks want to override for a local test, but it will catastrophically fail in production.

[bart0sh]

@timothysc In my opinion if user explicitly sets this option in the config we should allow to do that. Silently ignoring it as we currently do is not an option. We can warn user if needed though.