From 976d5c3438d520b00e32087a8807acc7cd4beb25 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lucas=20K=C3=A4ldstr=C3=B6m?= Date: Fri, 8 Sep 2017 15:19:18 +0300 Subject: [PATCH 1/2] Revert commit 9dc3a661d71c18e33ac93a6125bb187fa83b8853 --- cmd/kubeadm/app/cmd/BUILD | 1 + cmd/kubeadm/app/cmd/join.go | 16 +++++++++- cmd/kubeadm/app/node/BUILD | 10 +++++- cmd/kubeadm/app/node/csr.go | 61 +++++++++++++++++++++++++++++++++++++ hack/.golint_failures | 1 + 5 files changed, 87 insertions(+), 2 deletions(-) create mode 100644 cmd/kubeadm/app/node/csr.go diff --git a/cmd/kubeadm/app/cmd/BUILD b/cmd/kubeadm/app/cmd/BUILD index 3603c31e1b..fba65c8602 100644 --- a/cmd/kubeadm/app/cmd/BUILD +++ b/cmd/kubeadm/app/cmd/BUILD @@ -29,6 +29,7 @@ go_library( "//cmd/kubeadm/app/discovery:go_default_library", "//cmd/kubeadm/app/features:go_default_library", "//cmd/kubeadm/app/images:go_default_library", + "//cmd/kubeadm/app/node:go_default_library", "//cmd/kubeadm/app/phases/addons/dns:go_default_library", "//cmd/kubeadm/app/phases/addons/proxy:go_default_library", "//cmd/kubeadm/app/phases/apiconfig:go_default_library", diff --git a/cmd/kubeadm/app/cmd/join.go b/cmd/kubeadm/app/cmd/join.go index acc8a09407..3de2b6d45c 100644 --- a/cmd/kubeadm/app/cmd/join.go +++ b/cmd/kubeadm/app/cmd/join.go @@ -32,6 +32,7 @@ import ( "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation" kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants" "k8s.io/kubernetes/cmd/kubeadm/app/discovery" + kubeadmnode "k8s.io/kubernetes/cmd/kubeadm/app/node" "k8s.io/kubernetes/cmd/kubeadm/app/preflight" kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util" kubeconfigutil "k8s.io/kubernetes/cmd/kubeadm/app/util/kubeconfig" @@ -203,7 +204,20 @@ func (j *Join) Run(out io.Writer) error { return err } - kubeconfigFile := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletBootstrapKubeConfigFileName) + hostname := nodeutil.GetHostname(j.cfg.NodeName) + + client, err := kubeconfigutil.KubeConfigToClientSet(cfg) + if err != nil { + return err + } + if err := kubeadmnode.ValidateAPIServer(client); err != nil { + return err + } + if err := kubeadmnode.PerformTLSBootstrap(cfg, hostname); err != nil { + return err + } + + kubeconfigFile := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletKubeConfigFileName) if err := kubeconfigutil.WriteToDisk(kubeconfigFile, cfg); err != nil { return err } diff --git a/cmd/kubeadm/app/node/BUILD b/cmd/kubeadm/app/node/BUILD index b06613c6bd..001da272bc 100644 --- a/cmd/kubeadm/app/node/BUILD +++ b/cmd/kubeadm/app/node/BUILD @@ -8,10 +8,18 @@ load( go_library( name = "go_default_library", - srcs = ["validate.go"], + srcs = [ + "csr.go", + "validate.go", + ], deps = [ + "//cmd/kubeadm/app/util/kubeconfig:go_default_library", + "//pkg/kubelet/util/csr:go_default_library", "//vendor/k8s.io/api/certificates/v1beta1:go_default_library", + "//vendor/k8s.io/apimachinery/pkg/types:go_default_library", "//vendor/k8s.io/client-go/kubernetes:go_default_library", + "//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library", + "//vendor/k8s.io/client-go/util/cert:go_default_library", ], ) diff --git a/cmd/kubeadm/app/node/csr.go b/cmd/kubeadm/app/node/csr.go new file mode 100644 index 0000000000..2f4f2b44d6 --- /dev/null +++ b/cmd/kubeadm/app/node/csr.go @@ -0,0 +1,61 @@ +/* +Copyright 2016 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package node + +import ( + "fmt" + + "k8s.io/apimachinery/pkg/types" + clientcmdapi "k8s.io/client-go/tools/clientcmd/api" + certutil "k8s.io/client-go/util/cert" + kubeconfigutil "k8s.io/kubernetes/cmd/kubeadm/app/util/kubeconfig" + "k8s.io/kubernetes/pkg/kubelet/util/csr" +) + +const CSRContextAndUser = "kubelet-csr" + +// PerformTLSBootstrap executes a node certificate signing request. +func PerformTLSBootstrap(cfg *clientcmdapi.Config, hostName string) error { + client, err := kubeconfigutil.KubeConfigToClientSet(cfg) + if err != nil { + return err + } + + fmt.Println("[csr] Created API client to obtain unique certificate for this node, generating keys and certificate signing request") + + key, err := certutil.MakeEllipticPrivateKeyPEM() + if err != nil { + return fmt.Errorf("failed to generate private key [%v]", err) + } + + cert, err := csr.RequestNodeCertificate(client.CertificatesV1beta1().CertificateSigningRequests(), key, types.NodeName(hostName)) + if err != nil { + return fmt.Errorf("failed to request signed certificate from the API server [%v]", err) + } + fmt.Println("[csr] Received signed certificate from the API server, generating KubeConfig...") + + cfg.AuthInfos[CSRContextAndUser] = &clientcmdapi.AuthInfo{ + ClientKeyData: key, + ClientCertificateData: cert, + } + cfg.Contexts[CSRContextAndUser] = &clientcmdapi.Context{ + AuthInfo: CSRContextAndUser, + Cluster: cfg.Contexts[cfg.CurrentContext].Cluster, + } + cfg.CurrentContext = CSRContextAndUser + return nil +} diff --git a/hack/.golint_failures b/hack/.golint_failures index 0b1c10647a..47a375eac2 100644 --- a/hack/.golint_failures +++ b/hack/.golint_failures @@ -17,6 +17,7 @@ cmd/kubeadm/app/discovery cmd/kubeadm/app/discovery/file cmd/kubeadm/app/discovery/token cmd/kubeadm/app/images +cmd/kubeadm/app/node cmd/kubeadm/app/phases/certs/pkiutil cmd/kubeadm/app/preflight cmd/kubeadm/app/util From 136d68b4d5c52472691ed893cfd5bf801a21461e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lucas=20K=C3=A4ldstr=C3=B6m?= Date: Fri, 8 Sep 2017 22:29:11 +0300 Subject: [PATCH 2/2] kubeadm: Perform TLS Bootstrapping in kubeadm join for v1.7 kubelets but not v1.8 ones --- cmd/kubeadm/app/cmd/join.go | 23 ++++++++++++++++++----- cmd/kubeadm/app/node/csr.go | 1 + hack/.golint_failures | 1 - 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/cmd/kubeadm/app/cmd/join.go b/cmd/kubeadm/app/cmd/join.go index 3de2b6d45c..1bc2a2dee3 100644 --- a/cmd/kubeadm/app/cmd/join.go +++ b/cmd/kubeadm/app/cmd/join.go @@ -20,7 +20,9 @@ import ( "fmt" "io" "io/ioutil" + "os/exec" "path/filepath" + "strings" "github.com/renstrom/dedent" "github.com/spf13/cobra" @@ -204,8 +206,6 @@ func (j *Join) Run(out io.Writer) error { return err } - hostname := nodeutil.GetHostname(j.cfg.NodeName) - client, err := kubeconfigutil.KubeConfigToClientSet(cfg) if err != nil { return err @@ -213,11 +213,24 @@ func (j *Join) Run(out io.Writer) error { if err := kubeadmnode.ValidateAPIServer(client); err != nil { return err } - if err := kubeadmnode.PerformTLSBootstrap(cfg, hostname); err != nil { - return err + + kubeconfigFile := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletBootstrapKubeConfigFileName) + + // Depending on the kubelet version, we might perform the TLS bootstrap or not + kubeletVersionBytes, err := exec.Command("sh", "-c", "kubelet --version").Output() + // In case the command executed successfully and returned v1.7-something, we'll perform TLS Bootstrapping + // Otherwise, just assume v1.8 + // TODO: In the beginning of the v1.9 cycle, we can remove the logic as we then don't support v1.7 anymore + if err == nil && strings.HasPrefix(string(kubeletVersionBytes), "Kubernetes v1.7") { + hostname := nodeutil.GetHostname(j.cfg.NodeName) + if err := kubeadmnode.PerformTLSBootstrap(cfg, hostname); err != nil { + return err + } + // As we now performed the TLS Bootstrap, change the filepath to be kubelet.conf instead of bootstrap-kubelet.conf + kubeconfigFile = filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletKubeConfigFileName) } - kubeconfigFile := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletKubeConfigFileName) + // Write the bootstrap kubelet config file or the TLS-Boostrapped kubelet config file down to disk if err := kubeconfigutil.WriteToDisk(kubeconfigFile, cfg); err != nil { return err } diff --git a/cmd/kubeadm/app/node/csr.go b/cmd/kubeadm/app/node/csr.go index 2f4f2b44d6..c488a0734c 100644 --- a/cmd/kubeadm/app/node/csr.go +++ b/cmd/kubeadm/app/node/csr.go @@ -26,6 +26,7 @@ import ( "k8s.io/kubernetes/pkg/kubelet/util/csr" ) +// CSRContextAndUser defines the context to use for the client certs in the kubelet kubeconfig file const CSRContextAndUser = "kubelet-csr" // PerformTLSBootstrap executes a node certificate signing request. diff --git a/hack/.golint_failures b/hack/.golint_failures index 47a375eac2..0b1c10647a 100644 --- a/hack/.golint_failures +++ b/hack/.golint_failures @@ -17,7 +17,6 @@ cmd/kubeadm/app/discovery cmd/kubeadm/app/discovery/file cmd/kubeadm/app/discovery/token cmd/kubeadm/app/images -cmd/kubeadm/app/node cmd/kubeadm/app/phases/certs/pkiutil cmd/kubeadm/app/preflight cmd/kubeadm/app/util