kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6470 from rochacon/custom-tls-cipher-suites 

Add flags for TLS Cipher suites customization for API Server, Kubelet and Controller-Manager
This commit is contained in:
Kubernetes Prow Robot 2019-03-25 11:24:19 -07:00 committed by GitHub
parent 5f0b40de99 6532ecf377
commit 24b36668f8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 105 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/apis/kops/componentconfig.go
View File

@ -34,6 +34,10 @@ type KubeletConfigSpec struct {
TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"`
// TODO: Remove unused TLSPrivateKeyFile
TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"`
// TLSCipherSuites indicates the allowed TLS cipher suite
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"`
// TLSMinVersion indicates the minimum TLS version allowed
TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"`
// KubeconfigPath is the path of kubeconfig for the kubelet
KubeconfigPath string `json:"kubeconfigPath,omitempty" flag:"kubeconfig"`
// RequireKubeconfig indicates a kubeconfig is required
@ -281,6 +285,10 @@ type KubeAPIServerConfig struct {
TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"`
// TODO: Remove unused TLSPrivateKeyFile
TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"`
// TLSCipherSuites indicates the allowed TLS cipher suite
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"`
// TLSMinVersion indicates the minimum TLS version allowed
TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"`
// TODO: Remove unused TokenAuthFile
TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"`
// AllowPrivileged indicates if we can run privileged containers
@ -475,6 +483,10 @@ type KubeControllerManagerConfig struct {
ExperimentalClusterSigningDuration *metav1.Duration `json:"experimentalClusterSigningDuration,omitempty" flag:"experimental-cluster-signing-duration"`
// FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features.
FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"`
// TLSCipherSuites indicates the allowed TLS cipher suite
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"`
// TLSMinVersion indicates the minimum TLS version allowed
TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"`
}
// CloudControllerManagerConfig is the configuration of the cloud controller

12
pkg/apis/kops/v1alpha1/componentconfig.go
View File

@ -34,6 +34,10 @@ type KubeletConfigSpec struct {
TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"`
// TODO: Remove unused TLSPrivateKeyFile
TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"`
// TLSCipherSuites indicates the allowed TLS cipher suite
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"`
// TLSMinVersion indicates the minimum TLS version allowed
TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"`
// KubeconfigPath is the path of kubeconfig for the kubelet
KubeconfigPath string `json:"kubeconfigPath,omitempty" flag:"kubeconfig"`
// RequireKubeconfig indicates a kubeconfig is required
@ -281,6 +285,10 @@ type KubeAPIServerConfig struct {
TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"`
// TODO: Remove unused TLSPrivateKeyFile
TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"`
// TLSCipherSuites indicates the allowed TLS cipher suite
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"`
// TLSMinVersion indicates the minimum TLS version allowed
TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"`
// TODO: Remove unused TokenAuthFile
TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"`
// AllowPrivileged indicates if we can run privileged containers
@ -475,6 +483,10 @@ type KubeControllerManagerConfig struct {
ExperimentalClusterSigningDuration *metav1.Duration `json:"experimentalClusterSigningDuration,omitempty" flag:"experimental-cluster-signing-duration"`
// FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features.
FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"`
// TLSCipherSuites indicates the allowed TLS cipher suite
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"`
// TLSMinVersion indicates the minimum TLS version allowed
TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"`
}
// CloudControllerManagerConfig is the configuration of the cloud controller

12
pkg/apis/kops/v1alpha1/zz_generated.conversion.go
View File

@ -2932,6 +2932,8 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
out.TokenAuthFile = in.TokenAuthFile
out.AllowPrivileged = in.AllowPrivileged
out.APIServerCount = in.APIServerCount
@ -3017,6 +3019,8 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
out.TokenAuthFile = in.TokenAuthFile
out.AllowPrivileged = in.AllowPrivileged
out.APIServerCount = in.APIServerCount
@ -3112,6 +3116,8 @@ func autoConvert_v1alpha1_KubeControllerManagerConfig_To_kops_KubeControllerMana
out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients
out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration
out.FeatureGates = in.FeatureGates
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
return nil
}
@ -3156,6 +3162,8 @@ func autoConvert_kops_KubeControllerManagerConfig_To_v1alpha1_KubeControllerMana
out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients
out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration
out.FeatureGates = in.FeatureGates
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
return nil
}
@ -3312,6 +3320,8 @@ func autoConvert_v1alpha1_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
out.KubeconfigPath = in.KubeconfigPath
out.RequireKubeconfig = in.RequireKubeconfig
out.LogLevel = in.LogLevel
@ -3391,6 +3401,8 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha1_KubeletConfigSpec(in *kops.K
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
out.KubeconfigPath = in.KubeconfigPath
out.RequireKubeconfig = in.RequireKubeconfig
out.LogLevel = in.LogLevel

15
pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go
View File

@ -1607,6 +1607,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.TLSCipherSuites != nil {
in, out := &in.TLSCipherSuites, &out.TLSCipherSuites
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.AllowPrivileged != nil {
in, out := &in.AllowPrivileged, &out.AllowPrivileged
*out = new(bool)
@ -1929,6 +1934,11 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo
(*out)[key] = val
}
}
if in.TLSCipherSuites != nil {
in, out := &in.TLSCipherSuites, &out.TLSCipherSuites
*out = make([]string, len(*in))
copy(*out, *in)
}
return
}
@ -2082,6 +2092,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) {
*out = new(bool)
**out = **in
}
if in.TLSCipherSuites != nil {
in, out := &in.TLSCipherSuites, &out.TLSCipherSuites
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.RequireKubeconfig != nil {
in, out := &in.RequireKubeconfig, &out.RequireKubeconfig
*out = new(bool)

12
pkg/apis/kops/v1alpha2/componentconfig.go
View File

@ -34,6 +34,10 @@ type KubeletConfigSpec struct {
TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"`
// TODO: Remove unused TLSPrivateKeyFile
TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"`
// TLSCipherSuites indicates the allowed TLS cipher suite
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"`
// TLSMinVersion indicates the minimum TLS version allowed
TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"`
// KubeconfigPath is the path of kubeconfig for the kubelet
KubeconfigPath string `json:"kubeconfigPath,omitempty" flag:"kubeconfig"`
// RequireKubeconfig indicates a kubeconfig is required
@ -281,6 +285,10 @@ type KubeAPIServerConfig struct {
TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"`
// TODO: Remove unused TLSPrivateKeyFile
TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"`
// TLSCipherSuites indicates the allowed TLS cipher suite
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"`
// TLSMinVersion indicates the minimum TLS version allowed
TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"`
// TODO: Remove unused TokenAuthFile
TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"`
// AllowPrivileged indicates if we can run privileged containers
@ -475,6 +483,10 @@ type KubeControllerManagerConfig struct {
ExperimentalClusterSigningDuration *metav1.Duration `json:"experimentalClusterSigningDuration,omitempty" flag:"experimental-cluster-signing-duration"`
// FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features.
FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"`
// TLSCipherSuites indicates the allowed TLS cipher suite
TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"`
// TLSMinVersion indicates the minimum TLS version allowed
TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"`
}
// CloudControllerManagerConfig is the configuration of the cloud controller

12
pkg/apis/kops/v1alpha2/zz_generated.conversion.go
View File

@ -3202,6 +3202,8 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
out.TokenAuthFile = in.TokenAuthFile
out.AllowPrivileged = in.AllowPrivileged
out.APIServerCount = in.APIServerCount
@ -3287,6 +3289,8 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
out.TokenAuthFile = in.TokenAuthFile
out.AllowPrivileged = in.AllowPrivileged
out.APIServerCount = in.APIServerCount
@ -3382,6 +3386,8 @@ func autoConvert_v1alpha2_KubeControllerManagerConfig_To_kops_KubeControllerMana
out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients
out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration
out.FeatureGates = in.FeatureGates
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
return nil
}
@ -3426,6 +3432,8 @@ func autoConvert_kops_KubeControllerManagerConfig_To_v1alpha2_KubeControllerMana
out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients
out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration
out.FeatureGates = in.FeatureGates
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
return nil
}
@ -3582,6 +3590,8 @@ func autoConvert_v1alpha2_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
out.KubeconfigPath = in.KubeconfigPath
out.RequireKubeconfig = in.RequireKubeconfig
out.LogLevel = in.LogLevel
@ -3661,6 +3671,8 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha2_KubeletConfigSpec(in *kops.K
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.TLSCipherSuites = in.TLSCipherSuites
out.TLSMinVersion = in.TLSMinVersion
out.KubeconfigPath = in.KubeconfigPath
out.RequireKubeconfig = in.RequireKubeconfig
out.LogLevel = in.LogLevel

15
pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
View File

@ -1678,6 +1678,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.TLSCipherSuites != nil {
in, out := &in.TLSCipherSuites, &out.TLSCipherSuites
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.AllowPrivileged != nil {
in, out := &in.AllowPrivileged, &out.AllowPrivileged
*out = new(bool)
@ -2000,6 +2005,11 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo
(*out)[key] = val
}
}
if in.TLSCipherSuites != nil {
in, out := &in.TLSCipherSuites, &out.TLSCipherSuites
*out = make([]string, len(*in))
copy(*out, *in)
}
return
}
@ -2153,6 +2163,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) {
*out = new(bool)
**out = **in
}
if in.TLSCipherSuites != nil {
in, out := &in.TLSCipherSuites, &out.TLSCipherSuites
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.RequireKubeconfig != nil {
in, out := &in.RequireKubeconfig, &out.RequireKubeconfig
*out = new(bool)

15
pkg/apis/kops/zz_generated.deepcopy.go
View File

@ -1860,6 +1860,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.TLSCipherSuites != nil {
in, out := &in.TLSCipherSuites, &out.TLSCipherSuites
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.AllowPrivileged != nil {
in, out := &in.AllowPrivileged, &out.AllowPrivileged
*out = new(bool)
@ -2182,6 +2187,11 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo
(*out)[key] = val
}
}
if in.TLSCipherSuites != nil {
in, out := &in.TLSCipherSuites, &out.TLSCipherSuites
*out = make([]string, len(*in))
copy(*out, *in)
}
return
}
@ -2335,6 +2345,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) {
*out = new(bool)
**out = **in
}
if in.TLSCipherSuites != nil {
in, out := &in.TLSCipherSuites, &out.TLSCipherSuites
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.RequireKubeconfig != nil {
in, out := &in.RequireKubeconfig, &out.RequireKubeconfig
*out = new(bool)