kubernetes
/
apiserver
mirror of https://github.com/kubernetes/apiserver.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #119790 from seantywork/added-comment 

added comment for clarifying steps related to kubernetes mutual (2-wa…

Kubernetes-commit: 55c86d6ad930d437931079318d740bdf8dac34f0
This commit is contained in:
Kubernetes Publisher 2023-08-21 11:09:34 -07:00
parent d5379f908e bf05e35835
commit 08f8ff0d3f
4 changed files with 64 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
go.mod
View File

@ -43,7 +43,7 @@ require (
gopkg.in/square/go-jose.v2 v2.6.0
k8s.io/api v0.0.0-20230819043120-3dcdf4ede337
k8s.io/apimachinery v0.0.0-20230816163301-3e2600dc79fe
k8s.io/client-go v0.0.0-20230819035134-c1466acf62e0
k8s.io/client-go v0.0.0-20230821200706-3fe9aa44669d
k8s.io/component-base v0.0.0-20230816041302-b54afcf379c0
k8s.io/klog/v2 v2.100.1
k8s.io/kms v0.0.0-20230807211544-e54c40adc2b2
@ -128,7 +128,7 @@ require (
replace (
k8s.io/api => k8s.io/api v0.0.0-20230819043120-3dcdf4ede337
k8s.io/apimachinery => k8s.io/apimachinery v0.0.0-20230816163301-3e2600dc79fe
k8s.io/client-go => k8s.io/client-go v0.0.0-20230819035134-c1466acf62e0
k8s.io/client-go => k8s.io/client-go v0.0.0-20230821200706-3fe9aa44669d
k8s.io/component-base => k8s.io/component-base v0.0.0-20230816041302-b54afcf379c0
k8s.io/kms => k8s.io/kms v0.0.0-20230807211544-e54c40adc2b2
)

4
go.sum
View File

@ -674,8 +674,8 @@ k8s.io/api v0.0.0-20230819043120-3dcdf4ede337 h1:qcLQ7TKrB/qI/is+41gn8RLB1JchX77
k8s.io/api v0.0.0-20230819043120-3dcdf4ede337/go.mod h1:GT9MF3sI/KGC+k3nmiQ+++vvUhyZtGX3GHeDSaF2kT0=
k8s.io/apimachinery v0.0.0-20230816163301-3e2600dc79fe h1:UjWeb1lUhxUf0Ryph1r1hz+pENt060neKZ+P3gKWrDc=
k8s.io/apimachinery v0.0.0-20230816163301-3e2600dc79fe/go.mod h1:X0xh/chESs2hP9koe+SdIAcXWcQ+RM5hy0ZynB+yEvw=
k8s.io/client-go v0.0.0-20230819035134-c1466acf62e0 h1:4mJpKbDteQy8fsjj6mI1/sGfa2VElAnSsM6fM2W6c1Y=
k8s.io/client-go v0.0.0-20230819035134-c1466acf62e0/go.mod h1:46qDRE1bWZ6IIbXmAEjDEMmTiemgU0Pi60qAjMVgtm0=
k8s.io/client-go v0.0.0-20230821200706-3fe9aa44669d h1:Wcv63PNeJT9BPrA1SvMPuLrD1v6iNdyW/gs5zyzaNAc=
k8s.io/client-go v0.0.0-20230821200706-3fe9aa44669d/go.mod h1:ZVJFA6vjKq8QNuM75GId8thZXjQoLaojONFnrTB6olE=
k8s.io/component-base v0.0.0-20230816041302-b54afcf379c0 h1:uuljDMCaiT42hJDJgaxdoXrMEcej8ADI5y+kGjt4Dtw=
k8s.io/component-base v0.0.0-20230816041302-b54afcf379c0/go.mod h1:W5sXP3/QrFKETZVvaWLTjcl1LmhmxJhE8MFFRysUHPw=
k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=

27
pkg/authentication/request/x509/x509.go
View File

@ -148,6 +148,33 @@ func (a *Authenticator) AuthenticateRequest(req *http.Request) (*authenticator.R
}
}
/*
kubernetes mutual (2-way) x509 between client and apiserver:
1. apiserver sending its apiserver certificate along with its publickey to client
2. client verifies the apiserver certificate sent against its cluster certificate authority data
3. client sending its client certificate along with its public key to the apiserver
>4. apiserver verifies the client certificate sent against its cluster certificate authority data
description:
here, with this function,
client certificate and pub key sent during the handshake process
are verified by apiserver against its cluster certificate authority data
normal args related to this stage:
--client-ca-file string If set, any request presenting a client certificate signed by
one of the authorities in the client-ca-file is authenticated with an identity
corresponding to the CommonName of the client certificate.
(retrievable from "kube-apiserver --help" command)
(suggested by @deads2k)
see also:
- for the step 1, see: staging/src/k8s.io/apiserver/pkg/server/options/serving.go
- for the step 2, see: staging/src/k8s.io/client-go/transport/transport.go
- for the step 3, see: staging/src/k8s.io/client-go/transport/transport.go
*/
remaining := req.TLS.PeerCertificates[0].NotAfter.Sub(time.Now())
clientCertificateExpirationHistogram.WithContext(req.Context()).Observe(remaining.Seconds())
chains, err := req.TLS.PeerCertificates[0].Verify(optsCopy)

34
pkg/server/options/serving.go
View File

@ -260,7 +260,39 @@ func (s *SecureServingOptions) ApplyTo(config **server.SecureServingInfo) error
c := *config
serverCertFile, serverKeyFile := s.ServerCert.CertKey.CertFile, s.ServerCert.CertKey.KeyFile
// load main cert
// load main cert *original description until 2023-08-18*
/*
kubernetes mutual (2-way) x509 between client and apiserver:
>1. apiserver sending its apiserver certificate along with its publickey to client
2. client verifies the apiserver certificate sent against its cluster certificate authority data
3. client sending its client certificate along with its public key to the apiserver
4. apiserver verifies the client certificate sent against its cluster certificate authority data
description:
here, with this block,
apiserver certificate and pub key data (along with priv key)get loaded into server.SecureServingInfo
for client to later in the step 2 verify the apiserver certificate during the handshake
when making a request
normal args related to this stage:
--tls-cert-file string File containing the default x509 Certificate for HTTPS.
(CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and
--tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate
and key are generated for the public address and saved to the directory specified by
--cert-dir
--tls-private-key-file string File containing the default x509 private key matching --tls-cert-file.
(retrievable from "kube-apiserver --help" command)
(suggested by @deads2k)
see also:
- for the step 2, see: staging/src/k8s.io/client-go/transport/transport.go
- for the step 3, see: staging/src/k8s.io/client-go/transport/transport.go
- for the step 4, see: staging/src/k8s.io/apiserver/pkg/authentication/request/x509/x509.go
*/
if len(serverCertFile) != 0 || len(serverKeyFile) != 0 {
var err error
c.Cert, err = dynamiccertificates.NewDynamicServingContentFromFiles("serving-cert", serverCertFile, serverKeyFile)