kubernetes
/
apiserver
mirror of https://github.com/kubernetes/apiserver.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Resolve uncompatibility from update: etcd CAFile -> TrustedCAFIle 

Kubernetes-commit: 9ead9373f350c7ad438257a9e8b8977a67b900eb
This commit is contained in:
Wenjia Zhang 2019-10-23 11:15:43 -07:00 committed by Kubernetes Publisher
parent 41da2ced4c
commit e518fe04f6
9 changed files with 46 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/server/options/etcd.go
View File

@ -161,7 +161,7 @@ func (s *EtcdOptions) AddFlags(fs *pflag.FlagSet) {
fs.StringVar(&s.StorageConfig.Transport.CertFile, "etcd-certfile", s.StorageConfig.Transport.CertFile,
"SSL certification file used to secure etcd communication.")
fs.StringVar(&s.StorageConfig.Transport.CAFile, "etcd-cafile", s.StorageConfig.Transport.CAFile,
fs.StringVar(&s.StorageConfig.Transport.TrustedCAFile, "etcd-cafile", s.StorageConfig.Transport.TrustedCAFile,
"SSL Certificate Authority file used to secure etcd communication.")
fs.StringVar(&s.EncryptionProviderConfigFilepath, "experimental-encryption-provider-config", s.EncryptionProviderConfigFilepath,

32
pkg/server/options/etcd_test.go
View File

@ -40,10 +40,10 @@ func TestEtcdOptionsValidate(t *testing.T) {
Type: "etcd3",
Prefix: "/registry",
Transport: storagebackend.TransportConfig{
ServerList: nil,
KeyFile: "/var/run/kubernetes/etcd.key",
CAFile: "/var/run/kubernetes/etcdca.crt",
CertFile: "/var/run/kubernetes/etcdce.crt",
ServerList: nil,
KeyFile: "/var/run/kubernetes/etcd.key",
TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
CertFile: "/var/run/kubernetes/etcdce.crt",
},
CompactionInterval: storagebackend.DefaultCompactInterval,
CountMetricPollPeriod: time.Minute,
@ -64,10 +64,10 @@ func TestEtcdOptionsValidate(t *testing.T) {
Type: "etcd4",
Prefix: "/registry",
Transport: storagebackend.TransportConfig{
ServerList: []string{"http://127.0.0.1"},
KeyFile: "/var/run/kubernetes/etcd.key",
CAFile: "/var/run/kubernetes/etcdca.crt",
CertFile: "/var/run/kubernetes/etcdce.crt",
ServerList: []string{"http://127.0.0.1"},
KeyFile: "/var/run/kubernetes/etcd.key",
TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
CertFile: "/var/run/kubernetes/etcdce.crt",
},
CompactionInterval: storagebackend.DefaultCompactInterval,
CountMetricPollPeriod: time.Minute,
@ -87,10 +87,10 @@ func TestEtcdOptionsValidate(t *testing.T) {
StorageConfig: storagebackend.Config{
Type: "etcd3",
Transport: storagebackend.TransportConfig{
ServerList: []string{"http://127.0.0.1"},
KeyFile: "/var/run/kubernetes/etcd.key",
CAFile: "/var/run/kubernetes/etcdca.crt",
CertFile: "/var/run/kubernetes/etcdce.crt",
ServerList: []string{"http://127.0.0.1"},
KeyFile: "/var/run/kubernetes/etcd.key",
TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
CertFile: "/var/run/kubernetes/etcdce.crt",
},
Prefix: "/registry",
CompactionInterval: storagebackend.DefaultCompactInterval,
@ -112,10 +112,10 @@ func TestEtcdOptionsValidate(t *testing.T) {
Type: "etcd3",
Prefix: "/registry",
Transport: storagebackend.TransportConfig{
ServerList: []string{"http://127.0.0.1"},
KeyFile: "/var/run/kubernetes/etcd.key",
CAFile: "/var/run/kubernetes/etcdca.crt",
CertFile: "/var/run/kubernetes/etcdce.crt",
ServerList: []string{"http://127.0.0.1"},
KeyFile: "/var/run/kubernetes/etcd.key",
TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
CertFile: "/var/run/kubernetes/etcdce.crt",
},
CompactionInterval: storagebackend.DefaultCompactInterval,
CountMetricPollPeriod: time.Minute,

4
pkg/server/storage/storage_factory.go
View File

@ -307,8 +307,8 @@ func (s *DefaultStorageFactory) Backends() []Backend {
tlsConfig.Certificates = []tls.Certificate{cert}
}
}
if len(s.StorageConfig.Transport.CAFile) > 0 {
if caCert, err := ioutil.ReadFile(s.StorageConfig.Transport.CAFile); err != nil {
if len(s.StorageConfig.Transport.TrustedCAFile) > 0 {
if caCert, err := ioutil.ReadFile(s.StorageConfig.Transport.TrustedCAFile); err != nil {
klog.Errorf("failed to read ca file while getting backends: %s", err)
} else {
caPool := x509.NewCertPool()

4
pkg/storage/etcd3/event_test.go
View File

@ -17,10 +17,10 @@ limitations under the License.
package etcd3
import (
"go.etcd.io/etcd/clientv3"
"go.etcd.io/etcd/mvcc/mvccpb"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.etcd.io/etcd/clientv3"
"go.etcd.io/etcd/mvcc/mvccpb"
"testing"
)

2
pkg/storage/etcd3/store_test.go
View File

@ -29,9 +29,9 @@ import (
"sync"
"testing"
"github.com/coreos/pkg/capnslog"
"go.etcd.io/etcd/clientv3"
"go.etcd.io/etcd/integration"
"github.com/coreos/pkg/capnslog"
apitesting "k8s.io/apimachinery/pkg/api/apitesting"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

17
pkg/storage/etcd3/testing/test_server.go
View File

@ -42,6 +42,7 @@ import (
"go.etcd.io/etcd/pkg/testutil"
"go.etcd.io/etcd/pkg/transport"
"go.etcd.io/etcd/pkg/types"
"go.uber.org/zap"
"k8s.io/klog"
)
@ -85,9 +86,9 @@ func newSecuredLocalListener(t *testing.T, certFile, keyFile, caFile string) net
t.Fatal(err)
}
tlsInfo := transport.TLSInfo{
CertFile: certFile,
KeyFile: keyFile,
CAFile: caFile,
CertFile: certFile,
KeyFile: keyFile,
TrustedCAFile: caFile,
}
tlscfg, err := tlsInfo.ServerConfig()
if err != nil {
@ -103,9 +104,9 @@ func newSecuredLocalListener(t *testing.T, certFile, keyFile, caFile string) net
// newHTTPTransport create a new tls-based transport.
func newHTTPTransport(t *testing.T, certFile, keyFile, caFile string) etcd.CancelableTransport {
tlsInfo := transport.TLSInfo{
CertFile: certFile,
KeyFile: keyFile,
CAFile: caFile,
CertFile: certFile,
KeyFile: keyFile,
TrustedCAFile: caFile,
}
tr, err := transport.NewTransport(tlsInfo, time.Second)
if err != nil {
@ -194,7 +195,7 @@ func (m *EtcdTestServer) launch(t *testing.T) error {
}
m.s.SyncTicker = time.NewTicker(500 * time.Millisecond)
m.s.Start()
m.raftHandler = &testutil.PauseableHandler{Next: etcdhttp.NewPeerHandler(m.s)}
m.raftHandler = &testutil.PauseableHandler{Next: etcdhttp.NewPeerHandler(zap.NewExample(), m.s)}
for _, ln := range m.PeerListeners {
hs := &httptest.Server{
Listener: ln,
@ -206,7 +207,7 @@ func (m *EtcdTestServer) launch(t *testing.T) error {
for _, ln := range m.ClientListeners {
hs := &httptest.Server{
Listener: ln,
Config: &http.Server{Handler: v2http.NewClientHandler(m.s, m.ServerConfig.ReqTimeout())},
Config: &http.Server{Handler: v2http.NewClientHandler(zap.NewExample(), m.s, m.ServerConfig.ReqTimeout())},
}
hs.Start()
m.hss = append(m.hss, hs)

6
pkg/storage/storagebackend/config.go
View File

@ -36,9 +36,9 @@ type TransportConfig struct {
// ServerList is the list of storage servers to connect with.
ServerList []string
// TLS credentials
KeyFile string
CertFile string
CAFile string
KeyFile string
CertFile string
TrustedCAFile string
// function to determine the egress dialer. (i.e. konnectivity server dialer)
EgressLookup egressselector.Lookup
}

10
pkg/storage/storagebackend/factory/etcd3.go
View File

@ -26,9 +26,9 @@ import (
"sync/atomic"
"time"
grpcprom "github.com/grpc-ecosystem/go-grpc-prometheus"
"go.etcd.io/etcd/clientv3"
"go.etcd.io/etcd/pkg/transport"
grpcprom "github.com/grpc-ecosystem/go-grpc-prometheus"
"google.golang.org/grpc"
utilnet "k8s.io/apimachinery/pkg/util/net"
@ -97,9 +97,9 @@ func newETCD3HealthCheck(c storagebackend.Config) (func() error, error) {
func newETCD3Client(c storagebackend.TransportConfig) (*clientv3.Client, error) {
tlsInfo := transport.TLSInfo{
CertFile: c.CertFile,
KeyFile: c.KeyFile,
CAFile: c.CAFile,
CertFile: c.CertFile,
KeyFile: c.KeyFile,
TrustedCAFile: c.TrustedCAFile,
}
tlsConfig, err := tlsInfo.ClientConfig()
if err != nil {
@ -107,7 +107,7 @@ func newETCD3Client(c storagebackend.TransportConfig) (*clientv3.Client, error)
}
// NOTE: Client relies on nil tlsConfig
// for non-secure connections, update the implicit variable
if len(c.CertFile) == 0 && len(c.KeyFile) == 0 && len(c.CAFile) == 0 {
if len(c.CertFile) == 0 && len(c.KeyFile) == 0 && len(c.TrustedCAFile) == 0 {
tlsConfig = nil
}
networkContext := egressselector.Etcd.AsNetworkContext()

14
pkg/storage/storagebackend/factory/tls_test.go
View File

@ -54,9 +54,9 @@ func TestTLSConnection(t *testing.T) {
defer os.RemoveAll(filepath.Dir(certFile))
tlsInfo := &transport.TLSInfo{
CertFile: certFile,
KeyFile: keyFile,
CAFile: caFile,
CertFile: certFile,
KeyFile: keyFile,
TrustedCAFile: caFile,
}
cluster := integration.NewClusterV3(t, &integration.ClusterConfig{
@ -68,10 +68,10 @@ func TestTLSConnection(t *testing.T) {
cfg := storagebackend.Config{
Type: storagebackend.StorageTypeETCD3,
Transport: storagebackend.TransportConfig{
ServerList: []string{cluster.Members[0].GRPCAddr()},
CertFile: certFile,
KeyFile: keyFile,
CAFile: caFile,
ServerList: []string{cluster.Members[0].GRPCAddr()},
CertFile: certFile,
KeyFile: keyFile,
TrustedCAFile: caFile,
},
Codec: codec,
}