github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
k3s/cmd/kubeadm/app/discovery/token/BUILD

51 lines
1.5 KiB
Python
Raw Normal View History

kubeadm: refactor discovery behind an interface
2016-11-08 19:27:16 +00:00
package(default_visibility = ["//visibility:public"])
load(
"@io_bazel_rules_go//go:def.bzl",
"go_library",
Hook up kubeadm against the BootstrapSigner/BootstrapTokenAuthenticator
2017-03-04 09:17:52 +00:00
"go_test",
kubeadm: refactor discovery behind an interface
2016-11-08 19:27:16 +00:00
)
go_library(
name = "go_default_library",
srcs = ["token.go"],
update BUILD files
2017-10-12 20:52:10 +00:00
importpath = "k8s.io/kubernetes/cmd/kubeadm/app/discovery/token",
Hook up kubeadm against the BootstrapSigner/BootstrapTokenAuthenticator
2017-03-04 09:17:52 +00:00
deps = [
"//cmd/kubeadm/app/constants:go_default_library",
"//cmd/kubeadm/app/util/kubeconfig:go_default_library",
kubeadm: implement TLS discovery root CA pinning. This change adds the `--discovery-token-ca-cert-hash` and `--discovery-token-unsafe-skip-ca-verification` flags for `kubeadm join` and corresponding fields on the kubeadm NodeConfiguration struct. These flags configure enhanced TLS validation for token-based discovery. The enhanced TLS validation works by pinning the public key hashes of the cluster CA. This is done by connecting to the `cluster-info` endpoint initially using an unvalidated/unsafe TLS connection. After the cluster info has been loaded, parsed, and validated with the existing symmetric signature/MAC scheme, the root CA is validated against the pinned public key set. A second request is made using validated/safe TLS using the newly-known CA and the result is validated to make sure the same `cluster-info` was returned from both requests. This validation prevents a class of attacks where a leaked bootstrap token (such as from a compromised worker node) allows an attacker to impersonate the API server. This change also update `kubeadm init` to print the correct `--discovery-token-ca-cert-hash` flag in the example `kubeadm join` command it prints at the end of initialization.
2017-07-24 21:34:36 +00:00
"//cmd/kubeadm/app/util/pubkeypin:go_default_library",
Hook up kubeadm against the BootstrapSigner/BootstrapTokenAuthenticator
2017-03-04 09:17:52 +00:00
"//cmd/kubeadm/app/util/token:go_default_library",
"//pkg/bootstrap/api:go_default_library",
"//pkg/controller/bootstrap:go_default_library",
run hack/update-all
2017-06-22 18:24:23 +00:00
"//vendor/k8s.io/api/core/v1:go_default_library",
autogenerated
2017-04-12 16:05:10 +00:00
"//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
"//vendor/k8s.io/client-go/tools/clientcmd:go_default_library",
"//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
Hook up kubeadm against the BootstrapSigner/BootstrapTokenAuthenticator
2017-03-04 09:17:52 +00:00
],
kubeadm: refactor discovery behind an interface
2016-11-08 19:27:16 +00:00
)
Enable auto-generating sources rules
2017-01-03 22:40:41 +00:00
filegroup(
name = "package-srcs",
srcs = glob(["**"]),
tags = ["automanaged"],
visibility = ["//visibility:private"],
)
filegroup(
name = "all-srcs",
srcs = [":package-srcs"],
tags = ["automanaged"],
)
Hook up kubeadm against the BootstrapSigner/BootstrapTokenAuthenticator
2017-03-04 09:17:52 +00:00
go_test(
name = "go_default_test",
srcs = ["token_test.go"],
Autogenerate BUILD files
2017-12-23 21:06:26 +00:00
embed = [":go_default_library"],
update BUILD files
2017-10-12 20:52:10 +00:00
importpath = "k8s.io/kubernetes/cmd/kubeadm/app/discovery/token",
Hook up kubeadm against the BootstrapSigner/BootstrapTokenAuthenticator
2017-03-04 09:17:52 +00:00
deps = [
"//cmd/kubeadm/app/util/kubeconfig:go_default_library",
autogenerated
2017-04-12 16:05:10 +00:00
"//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
Hook up kubeadm against the BootstrapSigner/BootstrapTokenAuthenticator
2017-03-04 09:17:52 +00:00
],
)