This log records the issues I encountered while building the runtimeclass-debugger tool. The tool diagnoses the RuntimeClass path on a KubeEdge edge node. It answers four questions in dependency order. They are transport, bridge, CRI, and events. This document is the history behind the tool.
Every entry names three things:
- What I expected.
- The exact error or symptom I observed.
- The line in the KubeEdge source where I found the root cause.
KubeEdge replaces every Kubernetes module with its fork
What I expected. Version pins from upstream Kubernetes match what kubeedge vendors.
What I observed. The kubeedge go.mod requires k8s.io/kubernetes v1.32.10 and then replaces it with github.com/kubeedge/kubernetes v1.32.10-kubeedge1. The replace block covers about 30 staging modules. A tool that imports kubeedge modules would inherit the whole fork.
Root cause. KubeEdge maintains a fork of Kubernetes. The fork keeps the edged kubelet aligned with KubeEdge changes. The tool imports neither kubeedge modules nor the fork. It pins upstream k8s.io/kubernetes v1.32.10. The upstream module became consumable in release 1.32. Source: /home/veele/kubeedge/go.mod lines 283 to 318.
MetaServer auth is a feature gate, not a config key
What I expected. A key named requireAuthorization in the metaServer section controls client certificate checks.
What I observed. The key does not exist. The metaServer section has enable, server, and TLS file keys only. The tool had to detect the auth mode by probing the endpoint instead of reading the config.
Root cause. requireAuthorization is a top-level feature gate. Source: pkg/features/features.go lines 28 and 46. When the gate is on, MetaServer listens HTTPS on both its addresses. It verifies a client certificate only if the client presents one. The TLS mode is VerifyClientCertIfGiven. Source: edge/pkg/metamanager/metaserver/server.go lines 184 to 195 for the mode switch and lines 321 to 346 for the TLS config. The tool probes the endpoint for TLS. When no certificates are given, it reports an auth warning with the flags to pass.
MetaServer serves any resource through the local store
What I expected. A served-resource list gates which API groups MetaServer exposes.
What I observed. No such list exists. A search for node.k8s.io under edge/pkg returns nothing. The path for runtimeclasses works without any registration.
Root cause. MetaServer is fully generic. A list request goes to the cloud first and falls back to the local SQLite store when the cloud is not reachable. Cluster-scoped keys use the marker null in the namespace field. Source: edge/pkg/metamanager/metaserver/kubernetes/storage/storage.go lines 176 to 212, and pkg/metaserver/key.go lines 57 to 96.
reportEvent defaults to false
What I expected. Pod events flow to the cloud by default.
What I observed. The events check warns on a stock node even when the config file omits the key. The config default ships with reportEvent false.
Root cause. The default value is false. Source: staging/src/github.com/kubeedge/api/apis/componentconfig/edgecore/v1alpha2/default.go line 53. When the value is false, edged sets the event client to nil, and events never leave the node. Source: edge/pkg/edged/edged.go lines 368 to 379.