kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14054 from olemarkus/etcd-managet-cabundle 

Use cabundle for etcd CA files to fix key rotation in HA clusters
This commit is contained in:
Kubernetes Prow Robot 2022-07-29 00:07:11 -07:00 committed by GitHub
parent 47f7a63d07 e7a77e808b
commit 051aeea733
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
nodeup/pkg/model/etcd_manager_tls.go
View File

@ -17,7 +17,10 @@ limitations under the License.
package model package model
import ( import (
"path/filepath"
"k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi"
"k8s.io/kops/upup/pkg/fi/nodeup/nodetasks"
) )
// EtcdManagerTLSBuilder configures TLS support for etcd-manager // EtcdManagerTLSBuilder configures TLS support for etcd-manager
@ -50,9 +53,16 @@ func (b *EtcdManagerTLSBuilder) Build(ctx *fi.ModelBuilderContext) error {
} }
for fileName, keystoreName := range keys { for fileName, keystoreName := range keys {
if err := b.buildCertificatePairTask(ctx, keystoreName, d, fileName, nil, nil, true); err != nil { if err := b.buildCertificatePairTask(ctx, keystoreName, d, fileName, nil, nil, false); err != nil {
return err return err
} }
ctx.AddTask(&nodetasks.File{
Path: filepath.Join(d, fileName+".crt"),
Contents: fi.NewStringResource(b.NodeupConfig.CAs[keystoreName]),
Type: nodetasks.FileType_File,
Mode: fi.String("0644"),
})
} }
} }