kubernetes: kubelet fails when cloudprovider openstack is used and should manage loadbalancer security group

Is this a BUG REPORT or FEATURE REQUEST?:

/kind bug @kubernetes/sig-openstack

What happened: kubelet fails when Kubernetes master gets started using cloud-provider openstack und kubeadm init command. journalctl -u kubelet.service says:

kubelet[4653]: I0111 09:10:41.745501    4653 feature_gate.go:220] feature gates: &{{} map[]}
kubelet[4653]: I0111 09:10:41.746039    4653 controller.go:114] kubelet config controller: starting controller
kubelet[4653]: I0111 09:10:41.746343    4653 controller.go:118] kubelet config controller: validating combination of defaults and flags
kubelet[4653]: W0111 09:10:41.765718    4653 cni.go:171] Unable to update cni config: No networks found in /etc/cni/net.d
kubelet[4653]: I0111 09:10:41.771503    4653 server.go:182] Version: v1.9.1
kubelet[4653]: I0111 09:10:41.771577    4653 feature_gate.go:220] feature gates: &{{} map[]}
kubelet[4653]: error: failed to run Kubelet: could not init cloud provider "openstack": warning:
kubelet[4653]: can't store data at section "LoadBalancer", variable "node-security-group"
systemd[1]: kubelet.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: kubelet.service: Unit entered failed state.
systemd[1]: kubelet.service: Failed with result 'exit-code'.

What you expected to happen:

kubelet starts and manages the loadbalancer and its security group.

How to reproduce it (as minimally and precisely as possible):

Setup an instance on Openstack. Place the following cloud-config in /etc/kubernetes/pki/cloud-config

[Global]
username=***
password=***
auth-url=https://identity.***/v3
tenant-id=***
domain-id=default

[LoadBalancer]
subnet-id=38264923-c60c-48cb-a146-1c707b2b5b8d
create-monitor=true
monitor-delay=10s
monitor-timeout=2000s
monitor-max-retries=3
manage-security-groups=true
node-security-group=cf73c410-7b8c-4e84-95f1-5c42ee8b09f7

And /etc/kubernetes/kubeadm.yaml:

apiVersion: kubeadm.k8s.io/v1alpha1
kind: MasterConfiguration
kubernetesVersion: v1.9.0
cloudProvider: openstack

apiServerExtraArgs:
  cloud-config: /etc/kubernetes/pki/cloud-config
controllerManagerExtraArgs:
  cloud-config: /etc/kubernetes/pki/cloud-config

As well as /etc/systemd/system/kubelet.service.d/10-kubeadm.conf:

[Service]
Environment="KUBELET_EXTRA_ARGS=--cloud-provider=openstack --cloud-config=/etc/kubernetes/pki/cloud-config"
Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf"
Environment="KUBELET_SYSTEM_PODS_ARGS=--pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true"
Environment="KUBELET_NETWORK_ARGS=--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin"
Environment="KUBELET_DNS_ARGS=--cluster-dns=10.96.0.10 --cluster-domain=cluster.local"
Environment="KUBELET_AUTHZ_ARGS=--authorization-mode=Webhook --client-ca-file=/etc/kubernetes/pki/ca.crt"
Environment="KUBELET_CADVISOR_ARGS=--cadvisor-port=0"
Environment="KUBELET_CERTIFICATE_ARGS=--rotate-certificates=true --cert-dir=/var/lib/kubelet/pki"
ExecStart=
ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_SYSTEM_PODS_ARGS $KUBELET_NETWORK_ARGS $KUBELET_DNS_ARGS $KUBELET_AUTHZ_ARGS $KUBELET_CADVISOR_ARGS $KUBELET_CERTIFICATE_ARGS $KUBELET_EXTRA_ARGS

Run:

sudo systemctl daemon-reload
sudo sysctl net.bridge.bridge-nf-call-iptables=1
sudo kubeadm init --config /etc/kubernetes/kubeadm.yaml > kubeadm.log

For further information:

openstack subnet show 38264923-c60c-48cb-a146-1c707b2b5b8d

+-------------------+--------------------------------------+
| Field             | Value                                |
+-------------------+--------------------------------------+
| allocation_pools  | 192.168.0.2-192.168.0.254            |
| cidr              | 192.168.0.0/24                       |
| created_at        | 2018-01-11T08:58:13Z                 |
| description       |                                      |
| dns_nameservers   | 8.8.8.8                              |
| enable_dhcp       | True                                 |
| gateway_ip        | 192.168.0.1                          |
| host_routes       |                                      |
| id                | 38264923-c60c-48cb-a146-1c707b2b5b8d |
| ip_version        | 4                                    |
| ipv6_address_mode | None                                 |
| ipv6_ra_mode      | None                                 |
| name              | idcp-subnet                          |
| network_id        | ecec1d3c-cd2b-4be1-86cc-99ed50be4ca2 |
| project_id        | a53498e42330492b8d4e335abbac17cb     |
| revision_number   | 2                                    |
| segment_id        | None                                 |
| service_types     |                                      |
| subnetpool_id     | None                                 |
| tags              |                                      |
| updated_at        | 2018-01-11T08:58:13Z                 |
+-------------------+--------------------------------------+

openstack security group show cf73c410-7b8c-4e84-95f1-5c42ee8b09f7

+-----------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field           | Value                                                                                                                                                                                                                                                                 |
+-----------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| created_at      | 2018-01-11T08:58:07Z                                                                                                                                                                                                                                                  |
| description     | kubernetes loadbalancer security group                                                                                                                                                                                                                                |
| id              | cf73c410-7b8c-4e84-95f1-5c42ee8b09f7                                                                                                                                                                                                                                  |
| name            | idcp-k8s-loadbalancer                                                                                                                                                                                                                                                 |
| project_id      | a53498e42330492b8d4e335abbac17cb                                                                                                                                                                                                                                      |
| revision_number | 5                                                                                                                                                                                                                                                                     |
| rules           | created_at='2018-01-11T08:58:07Z', direction='egress', ethertype='IPv4', id='12208e2d-ed36-4815-8a07-688b66adbcd7', revision_number='1', updated_at='2018-01-11T08:58:07Z'                                                                                            |
|                 | created_at='2018-01-11T08:58:07Z', direction='egress', ethertype='IPv6', id='75ecfee2-1e95-4201-853d-c62cbb89e11d', revision_number='1', updated_at='2018-01-11T08:58:07Z'                                                                                            |
|                 | created_at='2018-01-11T09:08:36Z', direction='ingress', ethertype='IPv4', id='77cc3d8f-6cbc-4562-bf18-673f19003ca9', protocol='icmp', remote_ip_prefix='0.0.0.0/0', revision_number='1', updated_at='2018-01-11T09:08:36Z'                                            |
|                 | created_at='2018-01-11T09:08:37Z', direction='ingress', ethertype='IPv4', id='4676c190-51b5-4b2c-b35a-d5762ad0c65e', port_range_max='443', port_range_min='443', protocol='tcp', remote_ip_prefix='0.0.0.0/0', revision_number='1', updated_at='2018-01-11T09:08:37Z' |
|                 | created_at='2018-01-11T09:08:37Z', direction='ingress', ethertype='IPv4', id='7b126e96-5fa7-454b-a9eb-ae11b07a71b5', port_range_max='80', port_range_min='80', protocol='tcp', remote_ip_prefix='0.0.0.0/0', revision_number='1', updated_at='2018-01-11T09:08:37Z'   |
| updated_at      | 2018-01-11T09:08:37Z                                                                                                                                                                                                                                                  |
+-----------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

Environment:

• Kubernetes version (use kubectl version): 1.9.1
• Cloud provider or hardware configuration: Openstack
• OS (e.g. from /etc/os-release): Ubuntu 16.04.3 LTS
• Kernel (e.g. uname -a): x86_64
• Install tools: kubeadm