From f20437a8225539e1922b8961bec55728929f018c Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Wed, 8 Mar 2017 14:01:36 -0600 Subject: [PATCH] hack/cluster: download cfssl if not present hack/local-up-cluster.sh uses cfssl to generate certificates and will exit it cfssl is not already installed. But other cluster-up mechanisms (GCE) that generate certs just download cfssl if not present. Make local-up-cluster.sh do that too. --- cluster/common.sh | 55 +++------------ cluster/gce/upgrade.sh | 7 +- hack/lib/util.sh | 70 +++++++++++++++---- hack/local-up-cluster.sh | 2 +- .../hack/local-up-kube-aggregator.sh | 2 +- 5 files changed, 72 insertions(+), 64 deletions(-) diff --git a/cluster/common.sh b/cluster/common.sh index 3adaf1559f..a46cb1f27a 100755 --- a/cluster/common.sh +++ b/cluster/common.sh @@ -890,38 +890,6 @@ function sha1sum-file() { fi } -# Downloads cfssl into $1 directory -# -# Assumed vars: -# $1 (cfssl directory) -# -function download-cfssl { - mkdir -p "$1" - pushd "$1" - - kernel=$(uname -s) - case "${kernel}" in - Linux) - curl -s -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 - curl -s -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 - ;; - Darwin) - curl -s -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_darwin-amd64 - curl -s -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_darwin-amd64 - ;; - *) - echo "Unknown, unsupported platform: ${kernel}." >&2 - echo "Supported platforms: Linux, Darwin." >&2 - exit 2 - esac - - chmod +x cfssl - chmod +x cfssljson - - popd -} - - # Create certificate pairs for the cluster. # $1: The public IP for the master. # @@ -1012,12 +980,12 @@ function generate-certs { ./easyrsa --subject-alt-name="${SANS}" build-server-full "${MASTER_NAME}" nopass ./easyrsa build-client-full kube-apiserver nopass - download-cfssl "${KUBE_TEMP}/cfssl" + kube::util::ensure-cfssl "${KUBE_TEMP}/cfssl" # make the config for the signer echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","client auth"]}}}' > "ca-config.json" # create the kubelet client cert with the correct groups - echo '{"CN":"kubelet","names":[{"O":"system:nodes"}],"hosts":[""],"key":{"algo":"rsa","size":2048}}' | "${KUBE_TEMP}/cfssl/cfssl" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${KUBE_TEMP}/cfssl/cfssljson" -bare kubelet + echo '{"CN":"kubelet","names":[{"O":"system:nodes"}],"hosts":[""],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare kubelet mv "kubelet-key.pem" "pki/private/kubelet.key" mv "kubelet.pem" "pki/issued/kubelet.crt" rm -f "kubelet.csr" @@ -1061,10 +1029,7 @@ function generate-etcd-cert() { mkdir -p "${cert_dir}" pushd "${cert_dir}" - if [ ! -x cfssl ] || [ ! -x cfssljson ]; then - echo "Download cfssl & cfssljson ..." - download-cfssl . - fi + kube::util::ensure-cfssl . if [ ! -r "ca-config.json" ]; then cat >ca-config.json <&2 diff --git a/cluster/gce/upgrade.sh b/cluster/gce/upgrade.sh index 61e774eb1b..4425e99c53 100755 --- a/cluster/gce/upgrade.sh +++ b/cluster/gce/upgrade.sh @@ -28,6 +28,7 @@ if [[ "${KUBERNETES_PROVIDER:-gce}" != "gce" ]]; then fi KUBE_ROOT=$(dirname "${BASH_SOURCE}")/../.. +source "${KUBE_ROOT}/hack/lib/util.sh" source "${KUBE_ROOT}/cluster/kube-util.sh" function usage() { @@ -130,7 +131,7 @@ function backfile-kubeletauth-certs() { echo "${CA_KEY_BASE64}" | base64 -d > "${KUBE_TEMP}/pki/ca.key" echo "${CA_CERT_BASE64}" | base64 -d > "${KUBE_TEMP}/pki/ca.crt" (cd "${KUBE_TEMP}/pki" - download-cfssl "${KUBE_TEMP}/cfssl" + kube::util::ensure-cfssl "${KUBE_TEMP}/cfssl" cat < ca-config.json { "signing": { @@ -149,13 +150,13 @@ EOF # subpaths required for the apiserver to hit proxy # endpoints on the kubelet's handler. cat </dev/null || ! command -v cfssljson &>/dev/null; then - echo "Failed to successfully run 'cfssl', please verify that cfssl and cfssljson are in \$PATH." - echo "Hint: export PATH=\$PATH:\$GOPATH/bin; go get -u github.com/cloudflare/cfssl/cmd/..." - exit 1 - fi - CFSSL_BIN=$(command -v cfssl) - CFSSLJSON_BIN=$(command -v cfssljson) -} - # Test whether openssl is installed. # Sets: # OPENSSL_BIN: The path to the openssl binary to use @@ -716,6 +702,62 @@ function kube::util::join { echo "$*" } +# Downloads cfssl/cfssljson into $1 directory if they do not already exist in PATH +# +# Assumed vars: +# $1 (cfssl directory) (optional) +# +# Sets: +# CFSSL_BIN: The path of the installed cfssl binary +# CFSSLJSON_BIN: The path of the installed cfssljson binary +# +function kube::util::ensure-cfssl { + if command -v cfssl &>/dev/null && command -v cfssljson &>/dev/null; then + CFSSL_BIN=$(command -v cfssl) + CFSSLJSON_BIN=$(command -v cfssljson) + return 0 + fi + + # Create a temp dir for cfssl if no directory was given + local cfssldir=${1:-} + if [[ -z "${cfssldir}" ]]; then + kube::util::ensure-temp-dir + cfssldir="${KUBE_TEMP}/cfssl" + fi + + mkdir -p "${cfssldir}" + pushd "${cfssldir}" > /dev/null + + echo "Unable to successfully run 'cfssl' from $PATH; downloading instead..." + kernel=$(uname -s) + case "${kernel}" in + Linux) + curl -s -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 + curl -s -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 + ;; + Darwin) + curl -s -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_darwin-amd64 + curl -s -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_darwin-amd64 + ;; + *) + echo "Unknown, unsupported platform: ${kernel}." >&2 + echo "Supported platforms: Linux, Darwin." >&2 + exit 2 + esac + + chmod +x cfssl || true + chmod +x cfssljson || true + + CFSSL_BIN="${cfssldir}/cfssl" + CFSSLJSON_BIN="${cfssldir}/cfssljson" + if [[ ! -x ${CFSSL_BIN} || ! -x ${CFSSLJSON_BIN} ]]; then + echo "Failed to download 'cfssl'. Please install cfssl and cfssljson and verify they are in \$PATH." + echo "Hint: export PATH=\$PATH:\$GOPATH/bin; go get -u github.com/cloudflare/cfssl/cmd/..." + exit 1 + fi + popd > /dev/null +} + # Some useful colors. if [[ -z "${color_start-}" ]]; then declare -r color_start="\033[" diff --git a/hack/local-up-cluster.sh b/hack/local-up-cluster.sh index f80a02c2ef..2d84aa7e10 100755 --- a/hack/local-up-cluster.sh +++ b/hack/local-up-cluster.sh @@ -792,7 +792,7 @@ if [[ "${START_MODE}" != "kubeletonly" ]]; then fi kube::util::test_openssl_installed -kube::util::test_cfssl_installed +kube::util::ensure-cfssl ### IF the user didn't supply an output/ for the build... Then we detect. if [ "$GO_OUT" == "" ]; then diff --git a/staging/src/k8s.io/kube-aggregator/hack/local-up-kube-aggregator.sh b/staging/src/k8s.io/kube-aggregator/hack/local-up-kube-aggregator.sh index 3be9dfc0a1..f060e22d0a 100755 --- a/staging/src/k8s.io/kube-aggregator/hack/local-up-kube-aggregator.sh +++ b/staging/src/k8s.io/kube-aggregator/hack/local-up-kube-aggregator.sh @@ -86,7 +86,7 @@ function start_kube-aggregator { } kube::util::test_openssl_installed -kube::util::test_cfssl_installed +kube::util::ensure-cfssl start_kube-aggregator