<p dir="auto">The location of apiserver auth certs and keys and the kube-apiserver SSH keys are inconsistent between Debian and GCI.  This means that master upgrades from Debian to GCI are broken.</p>
<p dir="auto">In Debian, Salt puts these files in <code class="notranslate">master-pd/srv/kubernetes</code> (via <code class="notranslate">/srv/salt-overlay/salt/kube-apiserver/basic_auth.csv</code> and <code class="notranslate">/srv/kubernetes/basic_auth.csv</code>, see <a href="https://github.com/kubernetes/kubernetes/blob/1ef19062096c4fcf8ddeaf3a46731d9f262a0c04/cluster/gce/configure-vm.sh">configure-vm.sh</a> and <a href="https://github.com/kubernetes/kubernetes/blob/1ef19062096c4fcf8ddeaf3a46731d9f262a0c04/cluster/saltbase/salt/kube-apiserver/init.sls">init.sls</a>), whereas GCI expects it in <code class="notranslate">master-pd/etc/srv/kubernetes</code> (see <a href="https://github.com/kubernetes/kubernetes/blob/1ef19062096c4fcf8ddeaf3a46731d9f262a0c04/cluster/gce/gci/configure-helper.sh">configure-helper.sh</a>, originally introduced in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="130540525" data-permission-text="Title is private" data-url="https://github.com/kubernetes/kubernetes/issues/20463" data-hovercard-type="pull_request" data-hovercard-url="/kubernetes/kubernetes/pull/20463/hovercard" href="https://github.com/kubernetes/kubernetes/pull/20463">#20463</a>).</p>
<p dir="auto">cc <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mikedanese/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mikedanese">@mikedanese</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/adityakali/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/adityakali">@adityakali</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/andyzheng0831/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/andyzheng0831">@andyzheng0831</a></p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="$ kubectl run -it --image=busybox --restart=Never false /bin/false"><pre class="notranslate">$ kubectl run -it --image=busybox --restart=Never <span class="pl-c1">false</span> /bin/false</pre></div>
<p dir="auto">I expect this to run the /bin/false once. Instead a job is created which restarts <code class="notranslate">/bin/false</code> until it succeeds (which it never does).</p>
<p dir="auto">This way it is impossible to create real one-off tasks with <code class="notranslate">kubectl run</code>.</p>