github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #43404 from deads2k/server-11-force-dns 

Automatic merge from submit-queue

force callers to specify the cert dns names

When generic apiservers were self-signing, they signed for service names they didn't control.  This stops them from doing that.

@kubernetes/sig-api-machinery-misc @ncdc
pull/6/head
Kubernetes Submit Queue 2017-03-27 06:18:38 -07:00 committed by GitHub
parent e38c575ae6 f31eb0a77f
commit 39907f1a9f
5 changed files with 5 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/kube-apiserver/app/server.go
View File

@ -427,7 +427,7 @@ func defaultOptions(s *options.ServerRunOptions) error {
if err != nil { if err != nil {
return fmt.Errorf("error determining service IP ranges: %v", err) return fmt.Errorf("error determining service IP ranges: %v", err)
} }
if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts(s.GenericServerRunOptions.AdvertiseAddress.String(), apiServerServiceIP); err != nil { if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts(s.GenericServerRunOptions.AdvertiseAddress.String(), []string{"kubernetes.default.svc", "kubernetes.default", "kubernetes"}, []net.IP{apiServerServiceIP}); err != nil {
return fmt.Errorf("error creating self-signed certificates: %v", err) return fmt.Errorf("error creating self-signed certificates: %v", err)
} }
if err := s.CloudProvider.DefaultExternalHost(s.GenericServerRunOptions); err != nil { if err := s.CloudProvider.DefaultExternalHost(s.GenericServerRunOptions); err != nil {

2
federation/cmd/federation-apiserver/app/server.go
View File

@ -84,7 +84,7 @@ func NonBlockingRun(s *options.ServerRunOptions, stopCh <-chan struct{}) error {
if err := s.GenericServerRunOptions.DefaultAdvertiseAddress(s.SecureServing, s.InsecureServing); err != nil { if err := s.GenericServerRunOptions.DefaultAdvertiseAddress(s.SecureServing, s.InsecureServing); err != nil {
return err return err
} }
if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts(s.GenericServerRunOptions.AdvertiseAddress.String()); err != nil { if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts(s.GenericServerRunOptions.AdvertiseAddress.String(), nil, nil); err != nil {
return fmt.Errorf("error creating self-signed certificates: %v", err) return fmt.Errorf("error creating self-signed certificates: %v", err)
} }
if err := s.CloudProvider.DefaultExternalHost(s.GenericServerRunOptions); err != nil { if err := s.CloudProvider.DefaultExternalHost(s.GenericServerRunOptions); err != nil {

7
staging/src/k8s.io/apiserver/pkg/server/options/serving.go
View File

@ -296,7 +296,7 @@ func (s *ServingOptions) ApplyTo(c *server.Config) error {
return nil return nil
} }
func (s *SecureServingOptions) MaybeDefaultWithSelfSignedCerts(publicAddress string, alternateIPs ...net.IP) error { func (s *SecureServingOptions) MaybeDefaultWithSelfSignedCerts(publicAddress string, alternateDNS []string, alternateIPs []net.IP) error {
if s == nil { if s == nil {
return nil return nil
} }
@ -313,11 +313,6 @@ func (s *SecureServingOptions) MaybeDefaultWithSelfSignedCerts(publicAddress str
return err return err
} }
if !canReadCertAndKey { if !canReadCertAndKey {
// TODO: It would be nice to set a fqdn subject alt name, but only the kubelets know, the apiserver is clueless
// alternateDNS = append(alternateDNS, "kubernetes.default.svc.CLUSTER.DNS.NAME")
// TODO (cjcullen): Is ClusterIP the right address to sign a cert with?
alternateDNS := []string{"kubernetes.default.svc", "kubernetes.default", "kubernetes"}
// add either the bind address or localhost to the valid alternates // add either the bind address or localhost to the valid alternates
bindIP := s.ServingOptions.BindAddress.String() bindIP := s.ServingOptions.BindAddress.String()
if bindIP == "0.0.0.0" { if bindIP == "0.0.0.0" {

2
staging/src/k8s.io/kube-aggregator/pkg/cmd/server/start.go
View File

@ -110,7 +110,7 @@ func (o *AggregatorOptions) Complete() error {
func (o AggregatorOptions) RunAggregator(stopCh <-chan struct{}) error { func (o AggregatorOptions) RunAggregator(stopCh <-chan struct{}) error {
// TODO have a "real" external address // TODO have a "real" external address
if err := o.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost"); err != nil { if err := o.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", nil, nil); err != nil {
return fmt.Errorf("error creating self-signed certificates: %v", err) return fmt.Errorf("error creating self-signed certificates: %v", err)
} }

2
staging/src/k8s.io/sample-apiserver/pkg/cmd/server/start.go
View File

@ -86,7 +86,7 @@ func (o *WardleServerOptions) Complete() error {
func (o WardleServerOptions) Config() (*apiserver.Config, error) { func (o WardleServerOptions) Config() (*apiserver.Config, error) {
// TODO have a "real" external address // TODO have a "real" external address
if err := o.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", net.ParseIP("127.0.0.1")); err != nil { if err := o.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", nil, []net.IP{net.ParseIP("127.0.0.1")}); err != nil {
return nil, fmt.Errorf("error creating self-signed certificates: %v", err) return nil, fmt.Errorf("error creating self-signed certificates: %v", err)
} }