kubeadm: Implement certificate download for join

This implements the certificate download for the join process. If certificates
have been uploaded during init (or explicitly on any master node) and the secret
is still present in the cluster, the join process will try to download the secret
data, decrypting it with the provided key in the new `--certificate-key` flag.

cmd/kubeadm/app/BUILD

@@ -41,6 +41,7 @@ filegroup(
         "//cmd/kubeadm/app/phases/bootstraptoken/node:all-srcs",
         "//cmd/kubeadm/app/phases/certs:all-srcs",
         "//cmd/kubeadm/app/phases/controlplane:all-srcs",
+        "//cmd/kubeadm/app/phases/copycerts:all-srcs",
         "//cmd/kubeadm/app/phases/etcd:all-srcs",
         "//cmd/kubeadm/app/phases/kubeconfig:all-srcs",
         "//cmd/kubeadm/app/phases/kubelet:all-srcs",
@@ -48,7 +49,6 @@ filegroup(
         "//cmd/kubeadm/app/phases/patchnode:all-srcs",
         "//cmd/kubeadm/app/phases/selfhosting:all-srcs",
         "//cmd/kubeadm/app/phases/upgrade:all-srcs",
-        "//cmd/kubeadm/app/phases/uploadcerts:all-srcs",
         "//cmd/kubeadm/app/phases/uploadconfig:all-srcs",
         "//cmd/kubeadm/app/preflight:all-srcs",
         "//cmd/kubeadm/app/util:all-srcs",

cmd/kubeadm/app/apis/kubeadm/validation/validation.go

@@ -428,6 +428,7 @@ func isAllowedFlag(flagName string) bool {
 		kubeadmcmdoptions.NodeCRISocket,
 		kubeadmcmdoptions.KubeconfigDir,
 		kubeadmcmdoptions.UploadCerts,
+		kubeadmcmdoptions.CertificateKey,
 		"print-join-command", "rootfs", "v")
 	if knownFlags.Has(flagName) {
 		return true

cmd/kubeadm/app/cmd/join.go

@@ -127,6 +127,7 @@ type joinOptions struct {
 	controlPlane          bool
 	ignorePreflightErrors []string
 	externalcfg           *kubeadmapiv1beta1.JoinConfiguration
+	certificateKey        string
 }
 
 // compile-time assert that the local data object satisfies the phases data interface.
@@ -142,6 +143,7 @@ type joinData struct {
 	clientSets            map[string]*clientset.Clientset
 	ignorePreflightErrors sets.String
 	outputWriter          io.Writer
+	certificateKey        string
 }
 
 // NewCmdJoin returns "kubeadm join" command.
@@ -192,7 +194,7 @@ func NewCmdJoin(out io.Writer, joinOptions *joinOptions) *cobra.Command {
 	}
 
 	addJoinConfigFlags(cmd.Flags(), joinOptions.externalcfg)
-	addJoinOtherFlags(cmd.Flags(), &joinOptions.cfgPath, &joinOptions.ignorePreflightErrors, &joinOptions.controlPlane, &joinOptions.token)
+	addJoinOtherFlags(cmd.Flags(), &joinOptions.cfgPath, &joinOptions.ignorePreflightErrors, &joinOptions.controlPlane, &joinOptions.token, &joinOptions.certificateKey)
 
 	joinRunner.AppendPhase(phases.NewPreflightPhase())
 	joinRunner.AppendPhase(phases.NewControlPlanePreparePhase())
@@ -254,7 +256,14 @@ func addJoinConfigFlags(flagSet *flag.FlagSet, cfg *kubeadmapiv1beta1.JoinConfig
 }
 
 // addJoinOtherFlags adds join flags that are not bound to a configuration file to the given flagset
-func addJoinOtherFlags(flagSet *flag.FlagSet, cfgPath *string, ignorePreflightErrors *[]string, controlPlane *bool, token *string) {
+func addJoinOtherFlags(
+	flagSet *flag.FlagSet,
+	cfgPath *string,
+	ignorePreflightErrors *[]string,
+	controlPlane *bool,
+	token *string,
+	certificateKey *string,
+) {
 	flagSet.StringVar(
 		cfgPath, options.CfgPath, *cfgPath,
 		"Path to kubeadm config file.",
@@ -271,6 +280,10 @@ func addJoinOtherFlags(flagSet *flag.FlagSet, cfgPath *string, ignorePreflightEr
 		controlPlane, options.ControlPlane, *controlPlane,
 		"Create a new control plane instance on this node",
 	)
+	flagSet.StringVar(
+		certificateKey, options.CertificateKey, "",
+		"Use this key to decrypt the certificate secrets uploaded by init.",
+	)
 }
 
 // newJoinOptions returns a struct ready for being used for creating cmd join flags.
@@ -375,9 +388,15 @@ func newJoinData(cmd *cobra.Command, args []string, options *joinOptions, out io
 		clientSets:            map[string]*clientset.Clientset{},
 		ignorePreflightErrors: ignorePreflightErrorsSet,
 		outputWriter:          out,
+		certificateKey:        options.certificateKey,
 	}, nil
 }
 
+// CertificateKey returns the key used to encrypt the certs.
+func (j *joinData) CertificateKey() string {
+	return j.certificateKey
+}
+
 // Cfg returns the JoinConfiguration.
 func (j *joinData) Cfg() *kubeadmapi.JoinConfiguration {
 	return j.cfg

cmd/kubeadm/app/cmd/options/constant.go

@@ -121,4 +121,7 @@ const (
 
 	// UploadCerts flag instruct kubeadm to upload certificates
 	UploadCerts = "experimental-upload-certs"
+
+	// CertificateKey flag sets the key used to encrypt and decrypt certificate secrets
+	CertificateKey = "certificate-key"
 )

cmd/kubeadm/app/cmd/phases/init/BUILD

@@ -33,12 +33,12 @@ go_library(
         "//cmd/kubeadm/app/phases/bootstraptoken/node:go_default_library",
         "//cmd/kubeadm/app/phases/certs:go_default_library",
         "//cmd/kubeadm/app/phases/controlplane:go_default_library",
+        "//cmd/kubeadm/app/phases/copycerts:go_default_library",
         "//cmd/kubeadm/app/phases/etcd:go_default_library",
         "//cmd/kubeadm/app/phases/kubeconfig:go_default_library",
         "//cmd/kubeadm/app/phases/kubelet:go_default_library",
         "//cmd/kubeadm/app/phases/markcontrolplane:go_default_library",
         "//cmd/kubeadm/app/phases/patchnode:go_default_library",
-        "//cmd/kubeadm/app/phases/uploadcerts:go_default_library",
         "//cmd/kubeadm/app/phases/uploadconfig:go_default_library",
         "//cmd/kubeadm/app/preflight:go_default_library",
         "//cmd/kubeadm/app/util:go_default_library",

cmd/kubeadm/app/cmd/phases/init/uploadcerts.go

@@ -26,7 +26,7 @@ import (
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow"
 	cmdutil "k8s.io/kubernetes/cmd/kubeadm/app/cmd/util"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
-	"k8s.io/kubernetes/cmd/kubeadm/app/phases/uploadcerts"
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/copycerts"
 )
 
 // NewUploadCertsPhase returns the uploadCerts phase
@@ -59,14 +59,14 @@ func runUploadCerts(c workflow.RunData) error {
 	}
 
 	if len(data.CertificateKey()) == 0 {
-		certificateKey, err := uploadcerts.CreateCertificateKey()
+		certificateKey, err := copycerts.CreateCertificateKey()
 		if err != nil {
 			return err
 		}
 		data.SetCertificateKey(certificateKey)
 	}
 
-	if err := uploadcerts.UploadCerts(client, data.Cfg(), data.CertificateKey()); err != nil {
+	if err := copycerts.UploadCerts(client, data.Cfg(), data.CertificateKey()); err != nil {
 		return errors.Wrap(err, "error uploading certs")
 	}
 	return nil

cmd/kubeadm/app/cmd/phases/join/BUILD

@@ -20,6 +20,7 @@ go_library(
         "//cmd/kubeadm/app/constants:go_default_library",
         "//cmd/kubeadm/app/phases/certs:go_default_library",
         "//cmd/kubeadm/app/phases/controlplane:go_default_library",
+        "//cmd/kubeadm/app/phases/copycerts:go_default_library",
         "//cmd/kubeadm/app/phases/etcd:go_default_library",
         "//cmd/kubeadm/app/phases/kubeconfig:go_default_library",
         "//cmd/kubeadm/app/phases/kubelet:go_default_library",

cmd/kubeadm/app/cmd/phases/join/controlplaneprepare.go

@@ -21,13 +21,17 @@ import (
 
 	"github.com/pkg/errors"
 
+	clientset "k8s.io/client-go/kubernetes"
+	"k8s.io/klog"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow"
 	cmdutil "k8s.io/kubernetes/cmd/kubeadm/app/cmd/util"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	certsphase "k8s.io/kubernetes/cmd/kubeadm/app/phases/certs"
 	"k8s.io/kubernetes/cmd/kubeadm/app/phases/controlplane"
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/copycerts"
 	kubeconfigphase "k8s.io/kubernetes/cmd/kubeadm/app/phases/kubeconfig"
+	kubeconfigutil "k8s.io/kubernetes/cmd/kubeadm/app/util/kubeconfig"
 )
 
 // NewControlPlanePreparePhase creates a kubeadm workflow phase that implements the preparation of the node to serve a control plane
@@ -35,7 +39,6 @@ func NewControlPlanePreparePhase() workflow.Phase {
 	return workflow.Phase{
 		Name:  "control-plane-prepare",
 		Short: "Prepares the machine for serving a control plane.",
-		Long:  cmdutil.MacroCommandLongDescription,
 		Phases: []workflow.Phase{
 			{
 				Name:           "all",
@@ -43,6 +46,7 @@ func NewControlPlanePreparePhase() workflow.Phase {
 				InheritFlags:   getControlPlanePreparePhaseFlags(),
 				RunAllSiblings: true,
 			},
+			newControlPlanePrepareDownloadCertsSubphase(),
 			newControlPlanePrepareCertsSubphase(),
 			newControlPlanePrepareKubeconfigSubphase(),
 			newControlPlanePrepareManifestsSubphases(),
@@ -60,6 +64,20 @@ func getControlPlanePreparePhaseFlags() []string {
 		options.TokenDiscovery,
 		options.TokenDiscoveryCAHash,
 		options.TokenDiscoverySkipCAHash,
+		options.CertificateKey,
+	}
+}
+
+func newControlPlanePrepareDownloadCertsSubphase() workflow.Phase {
+	return workflow.Phase{
+		Name:  "download-certs",
+		Short: fmt.Sprintf("Download certificates from %s", kubeadmconstants.KubeadmCertsSecret),
+		Long:  cmdutil.MacroCommandLongDescription,
+		Run:   runControlPlanePrepareDownloadCertsPhaseLocal,
+		InheritFlags: []string{
+			options.CfgPath,
+			options.CertificateKey,
+		},
 	}
 }
 
@@ -110,6 +128,33 @@ func runControlPlanePrepareManifestsSubphase(c workflow.RunData) error {
 	return controlplane.CreateInitStaticPodManifestFiles(kubeadmconstants.GetStaticPodDirectory(), cfg)
 }
 
+func runControlPlanePrepareDownloadCertsPhaseLocal(c workflow.RunData) error {
+	data, ok := c.(JoinData)
+	if !ok {
+		return errors.New("download-certs phase invoked with an invalid data struct")
+	}
+
+	if data.Cfg().ControlPlane == nil || len(data.CertificateKey()) == 0 {
+		klog.V(1).Infoln("[download-certs] Skipping certs download")
+		return nil
+	}
+
+	cfg, err := data.InitCfg()
+	if err != nil {
+		return err
+	}
+
+	client, err := bootstrapClient(data)
+	if err != nil {
+		return err
+	}
+
+	if err := copycerts.DownloadCerts(client, cfg, data.CertificateKey()); err != nil {
+		return errors.Wrap(err, "error downloading certs")
+	}
+	return nil
+}
+
 func runControlPlanePrepareCertsPhaseLocal(c workflow.RunData) error {
 	data, ok := c.(JoinData)
 	if !ok {
@@ -157,3 +202,15 @@ func runControlPlanePrepareKubeconfigPhaseLocal(c workflow.RunData) error {
 
 	return nil
 }
+
+func bootstrapClient(data JoinData) (clientset.Interface, error) {
+	tlsBootstrapCfg, err := data.TLSBootstrapCfg()
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to access the cluster")
+	}
+	client, err := kubeconfigutil.ToClientSet(tlsBootstrapCfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to access the cluster")
+	}
+	return client, nil
+}

cmd/kubeadm/app/cmd/phases/join/data.go

@@ -28,6 +28,7 @@ import (
 // JoinData is the interface to use for join phases.
 // The "joinData" type from "cmd/join.go" must satisfy this interface.
 type JoinData interface {
+	CertificateKey() string
 	Cfg() *kubeadmapi.JoinConfiguration
 	KubeConfigPath() string
 	TLSBootstrapCfg() (*clientcmdapi.Config, error)

cmd/kubeadm/app/cmd/phases/join/data_test.go

@@ -31,6 +31,7 @@ type testJoinData struct{}
 // testJoinData must satisfy JoinData.
 var _ JoinData = &testJoinData{}
 
+func (j *testJoinData) CertificateKey() string                                      { return "" }
 func (j *testJoinData) Cfg() *kubeadmapi.JoinConfiguration                          { return nil }
 func (j *testJoinData) KubeConfigPath() string                                      { return "" }
 func (j *testJoinData) TLSBootstrapCfg() (*clientcmdapi.Config, error)              { return nil, nil }

cmd/kubeadm/app/cmd/phases/join/preflight.go

@@ -39,7 +39,7 @@ var (
 		kubeadm join phase preflight --config kubeadm-config.yml
 		`)
 
-	notReadyToJoinControPlaneTemp = template.Must(template.New("join").Parse(dedent.Dedent(`
+	notReadyToJoinControlPlaneTemp = template.Must(template.New("join").Parse(dedent.Dedent(`
 		One or more conditions for hosting a new control plane instance is not satisfied.
 
 		{{.Error}}
@@ -105,14 +105,15 @@ func runPreflight(c workflow.RunData) error {
 	if j.Cfg().ControlPlane != nil {
 		// Checks if the cluster configuration supports
 		// joining a new control plane instance and if all the necessary certificates are provided
-		if err := checkIfReadyForAdditionalControlPlane(&initCfg.ClusterConfiguration); err != nil {
+		hasCertificateKey := len(j.CertificateKey()) > 0
+		if err := checkIfReadyForAdditionalControlPlane(&initCfg.ClusterConfiguration, hasCertificateKey); err != nil {
 			// outputs the not ready for hosting a new control plane instance message
 			ctx := map[string]string{
 				"Error": err.Error(),
 			}
 
 			var msg bytes.Buffer
-			notReadyToJoinControPlaneTemp.Execute(&msg, ctx)
+			notReadyToJoinControlPlaneTemp.Execute(&msg, ctx)
 			return errors.New(msg.String())
 		}
 
@@ -134,15 +135,17 @@ func runPreflight(c workflow.RunData) error {
 
 // checkIfReadyForAdditionalControlPlane ensures that the cluster is in a state that supports
 // joining an additional control plane instance and if the node is ready to preflight
-func checkIfReadyForAdditionalControlPlane(initConfiguration *kubeadmapi.ClusterConfiguration) error {
+func checkIfReadyForAdditionalControlPlane(initConfiguration *kubeadmapi.ClusterConfiguration, hasCertificateKey bool) error {
 	// blocks if the cluster was created without a stable control plane endpoint
 	if initConfiguration.ControlPlaneEndpoint == "" {
 		return errors.New("unable to add a new control plane instance a cluster that doesn't have a stable controlPlaneEndpoint address")
 	}
 
-	// checks if the certificates that must be equal across contolplane instances are provided
+	if !hasCertificateKey {
-	if ret, err := certs.SharedCertificateExists(initConfiguration); !ret {
+		// checks if the certificates that must be equal across controlplane instances are provided
-		return err
+		if ret, err := certs.SharedCertificateExists(initConfiguration); !ret {
+			return err
+		}
 	}
 
 	return nil

cmd/kubeadm/app/phases/copycerts/BUILD

@@ -2,8 +2,8 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
     name = "go_default_library",
-    srcs = ["uploadcerts.go"],
+    srcs = ["copycerts.go"],
-    importpath = "k8s.io/kubernetes/cmd/kubeadm/app/phases/uploadcerts",
+    importpath = "k8s.io/kubernetes/cmd/kubeadm/app/phases/copycerts",
     visibility = ["//visibility:public"],
     deps = [
         "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
@@ -14,9 +14,12 @@ go_library(
         "//pkg/apis/rbac/v1:go_default_library",
         "//staging/src/k8s.io/api/core/v1:go_default_library",
         "//staging/src/k8s.io/api/rbac/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
         "//staging/src/k8s.io/client-go/kubernetes:go_default_library",
+        "//staging/src/k8s.io/client-go/util/cert:go_default_library",
+        "//staging/src/k8s.io/client-go/util/keyutil:go_default_library",
         "//staging/src/k8s.io/cluster-bootstrap/token/util:go_default_library",
         "//vendor/github.com/pkg/errors:go_default_library",
     ],
@@ -38,7 +41,7 @@ filegroup(
 
 go_test(
     name = "go_default_test",
-    srcs = ["uploadcerts_test.go"],
+    srcs = ["copycerts_test.go"],
     embed = [":go_default_library"],
     deps = [
         "//cmd/kubeadm/app/apis/kubeadm:go_default_library",

cmd/kubeadm/app/phases/copycerts/copycerts.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package uploadcerts
+package copycerts
 
 import (
 	"encoding/hex"
@@ -28,9 +28,12 @@ import (
 
 	v1 "k8s.io/api/core/v1"
 	rbac "k8s.io/api/rbac/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	clientset "k8s.io/client-go/kubernetes"
+	certutil "k8s.io/client-go/util/cert"
+	keyutil "k8s.io/client-go/util/keyutil"
 	bootstraputil "k8s.io/cluster-bootstrap/token/util"
 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
@@ -92,7 +95,7 @@ func UploadCerts(client clientset.Interface, cfg *kubeadmapi.InitConfiguration,
 		return err
 	}
 
-	secretData, err := getSecretData(cfg, decodedKey)
+	secretData, err := getDataFromDisk(cfg, decodedKey)
 	if err != nil {
 		return err
 	}
@@ -169,7 +172,7 @@ func loadAndEncryptCert(certPath string, key []byte) ([]byte, error) {
 	return cryptoutil.EncryptBytes(cert, key)
 }
 
-func certsToUpload(cfg *kubeadmapi.InitConfiguration) map[string]string {
+func certsToTransfer(cfg *kubeadmapi.InitConfiguration) map[string]string {
 	certsDir := cfg.CertificatesDir
 	certs := map[string]string{
 		kubeadmconstants.CACertName:                   path.Join(certsDir, kubeadmconstants.CACertName),
@@ -191,15 +194,85 @@ func certsToUpload(cfg *kubeadmapi.InitConfiguration) map[string]string {
 	return certs
 }
 
-func getSecretData(cfg *kubeadmapi.InitConfiguration, key []byte) (map[string][]byte, error) {
+func getDataFromDisk(cfg *kubeadmapi.InitConfiguration, key []byte) (map[string][]byte, error) {
 	secretData := map[string][]byte{}
-	for certName, certPath := range certsToUpload(cfg) {
+	for certName, certPath := range certsToTransfer(cfg) {
 		cert, err := loadAndEncryptCert(certPath, key)
 		if err == nil || (err != nil && os.IsNotExist(err)) {
-			secretData[strings.Replace(certName, "/", "-", -1)] = cert
+			secretData[certOrKeyNameToSecretName(certName)] = cert
 		} else {
 			return nil, err
 		}
 	}
 	return secretData, nil
 }
+
+// DownloadCerts downloads the certificates needed to join a new control plane.
+func DownloadCerts(client clientset.Interface, cfg *kubeadmapi.InitConfiguration, key string) error {
+	fmt.Printf("[download-certs] downloading the certificates in Secret %q in the %q Namespace\n", kubeadmconstants.KubeadmCertsSecret, metav1.NamespaceSystem)
+
+	decodedKey, err := hex.DecodeString(key)
+	if err != nil {
+		return errors.Wrap(err, "error decoding certificate key")
+	}
+
+	secret, err := getSecret(client)
+	if err != nil {
+		return errors.Wrap(err, "error downloading the secret")
+	}
+
+	secretData, err := getDataFromSecret(secret, decodedKey)
+	if err != nil {
+		return errors.Wrap(err, "error decoding secret data with provided key")
+	}
+
+	for certOrKeyName, certOrKeyPath := range certsToTransfer(cfg) {
+		certOrKeyData, found := secretData[certOrKeyNameToSecretName(certOrKeyName)]
+		if !found {
+			return errors.New("couldn't find required certificate or key in Secret")
+		}
+		if err := writeCertOrKey(certOrKeyPath, certOrKeyData); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func writeCertOrKey(certOrKeyPath string, certOrKeyData []byte) error {
+	if _, err := keyutil.ParsePublicKeysPEM(certOrKeyData); err == nil {
+		return keyutil.WriteKey(certOrKeyPath, certOrKeyData)
+	} else if _, err := certutil.ParseCertsPEM(certOrKeyData); err == nil {
+		return certutil.WriteCert(certOrKeyPath, certOrKeyData)
+	}
+	return errors.New("unknown data found in Secret entry")
+}
+
+func getSecret(client clientset.Interface) (*v1.Secret, error) {
+	secret, err := client.CoreV1().Secrets(metav1.NamespaceSystem).Get(kubeadmconstants.KubeadmCertsSecret, metav1.GetOptions{})
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil, errors.Errorf("Secret %q was not found in the %q Namespace. This Secret might have expired. Please, run `kubeadm init phase upload-certs` on a control plane to generate a new one", kubeadmconstants.KubeadmCertsSecret, metav1.NamespaceSystem)
+		}
+		return nil, err
+	}
+	return secret, nil
+}
+
+func getDataFromSecret(secret *v1.Secret, key []byte) (map[string][]byte, error) {
+	secretData := map[string][]byte{}
+	for certName, encryptedCert := range secret.Data {
+		cert, err := cryptoutil.DecryptBytes(encryptedCert, key)
+		if err != nil {
+			// If any of the decrypt operations fail do not return a partial result,
+			// return an empty result immediately
+			return map[string][]byte{}, err
+		}
+		secretData[certName] = cert
+	}
+	return secretData, nil
+}
+
+func certOrKeyNameToSecretName(certOrKeyName string) string {
+	return strings.Replace(certOrKeyName, "/", "-", -1)
+}

cmd/kubeadm/app/phases/copycerts/copycerts_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package uploadcerts
+package copycerts
 
 import (
 	"encoding/hex"
@@ -38,7 +38,7 @@ func TestUploadCerts(t *testing.T) {
 }
 
 //teste cert name, teste cert can be decrypted
-func TestGetSecretData(t *testing.T) {
+func TestGetDataFromInitConfig(t *testing.T) {
 	certData := []byte("cert-data")
 	tmpdir := testutil.SetupTempDir(t)
 	defer os.RemoveAll(tmpdir)
@@ -58,14 +58,14 @@ func TestGetSecretData(t *testing.T) {
 		t.Fatalf(dedent.Dedent("failed to create etcd cert dir.\nfatal error: %v"), err)
 	}
 
-	certs := certsToUpload(cfg)
+	certs := certsToTransfer(cfg)
 	for name, path := range certs {
 		if err := ioutil.WriteFile(path, certData, 0644); err != nil {
 			t.Fatalf(dedent.Dedent("failed to write cert: %s\nfatal error: %v"), name, err)
 		}
 	}
 
-	secretData, err := getSecretData(cfg, decodedKey)
+	secretData, err := getDataFromDisk(cfg, decodedKey)
 	if err != nil {
 		t.Fatalf("failed to get secret data. fatal error: %v", err)
 	}
@@ -83,29 +83,44 @@ func TestGetSecretData(t *testing.T) {
 	}
 }
 
-func TestCertsToUpload(t *testing.T) {
+func TestCertsToTransfer(t *testing.T) {
 	localEtcdCfg := &kubeadmapi.InitConfiguration{}
 	externalEtcdCfg := &kubeadmapi.InitConfiguration{}
 	externalEtcdCfg.Etcd = kubeadmapi.Etcd{}
 	externalEtcdCfg.Etcd.External = &kubeadmapi.ExternalEtcd{}
 
+	commonExpectedCerts := []string{
+		kubeadmconstants.CACertName,
+		kubeadmconstants.CAKeyName,
+		kubeadmconstants.FrontProxyCACertName,
+		kubeadmconstants.FrontProxyCAKeyName,
+		kubeadmconstants.ServiceAccountPublicKeyName,
+		kubeadmconstants.ServiceAccountPrivateKeyName,
+	}
+
 	tests := map[string]struct {
 		config        *kubeadmapi.InitConfiguration
 		expectedCerts []string
 	}{
 		"local etcd": {
-			config:        localEtcdCfg,
+			config: localEtcdCfg,
-			expectedCerts: []string{kubeadmconstants.EtcdCACertName, kubeadmconstants.EtcdCAKeyName},
+			expectedCerts: append(
+				[]string{kubeadmconstants.EtcdCACertName, kubeadmconstants.EtcdCAKeyName},
+				commonExpectedCerts...,
+			),
 		},
 		"external etcd": {
-			config:        externalEtcdCfg,
+			config: externalEtcdCfg,
-			expectedCerts: []string{externalEtcdCA, externalEtcdCert, externalEtcdKey},
+			expectedCerts: append(
+				[]string{externalEtcdCA, externalEtcdCert, externalEtcdKey},
+				commonExpectedCerts...,
+			),
 		},
 	}
 
 	for name, test := range tests {
 		t.Run(name, func(t2 *testing.T) {
-			certList := certsToUpload(test.config)
+			certList := certsToTransfer(test.config)
 			for _, cert := range test.expectedCerts {
 				if _, found := certList[cert]; !found {
 					t2.Fatalf(dedent.Dedent("failed to get list of certs to upload\ncert %s not found"), cert)
@@ -114,3 +129,30 @@ func TestCertsToUpload(t *testing.T) {
 		})
 	}
 }
+
+func TestCertOrKeyNameToSecretName(t *testing.T) {
+	tests := []struct {
+		keyName            string
+		expectedSecretName string
+	}{
+		{
+			keyName:            "apiserver-kubelet-client.crt",
+			expectedSecretName: "apiserver-kubelet-client.crt",
+		},
+		{
+			keyName:            "etcd/ca.crt",
+			expectedSecretName: "etcd-ca.crt",
+		},
+		{
+			keyName:            "etcd/healthcheck-client.crt",
+			expectedSecretName: "etcd-healthcheck-client.crt",
+		},
+	}
+
+	for _, tc := range tests {
+		secretName := certOrKeyNameToSecretName(tc.keyName)
+		if secretName != tc.expectedSecretName {
+			t.Fatalf("secret name %s didn't match expected name %s", secretName, tc.expectedSecretName)
+		}
+	}
+}