From 6532ecf3779c25ae7e77216154f83e60c8d64d86 Mon Sep 17 00:00:00 2001 From: Rodrigo Chacon Date: Thu, 14 Feb 2019 18:05:16 -0200 Subject: [PATCH] Add TLS Cipher suite configuration flags for apiserver, controller-manager and kubelet Signed-off-by: Rodrigo Chacon --- pkg/apis/kops/componentconfig.go | 12 ++++++++++++ pkg/apis/kops/v1alpha1/componentconfig.go | 12 ++++++++++++ pkg/apis/kops/v1alpha1/zz_generated.conversion.go | 12 ++++++++++++ pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go | 15 +++++++++++++++ pkg/apis/kops/v1alpha2/componentconfig.go | 12 ++++++++++++ pkg/apis/kops/v1alpha2/zz_generated.conversion.go | 12 ++++++++++++ pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go | 15 +++++++++++++++ pkg/apis/kops/zz_generated.deepcopy.go | 15 +++++++++++++++ 8 files changed, 105 insertions(+) diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index 350579f5b5..9e4cc82d80 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -34,6 +34,10 @@ type KubeletConfigSpec struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // KubeconfigPath is the path of kubeconfig for the kubelet KubeconfigPath string `json:"kubeconfigPath,omitempty" flag:"kubeconfig"` // RequireKubeconfig indicates a kubeconfig is required @@ -281,6 +285,10 @@ type KubeAPIServerConfig struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // TODO: Remove unused TokenAuthFile TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"` // AllowPrivileged indicates if we can run privileged containers @@ -475,6 +483,10 @@ type KubeControllerManagerConfig struct { ExperimentalClusterSigningDuration *metav1.Duration `json:"experimentalClusterSigningDuration,omitempty" flag:"experimental-cluster-signing-duration"` // FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features. FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` } // CloudControllerManagerConfig is the configuration of the cloud controller diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index 6f86c9ced8..ce1de1875b 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -34,6 +34,10 @@ type KubeletConfigSpec struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // KubeconfigPath is the path of kubeconfig for the kubelet KubeconfigPath string `json:"kubeconfigPath,omitempty" flag:"kubeconfig"` // RequireKubeconfig indicates a kubeconfig is required @@ -281,6 +285,10 @@ type KubeAPIServerConfig struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // TODO: Remove unused TokenAuthFile TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"` // AllowPrivileged indicates if we can run privileged containers @@ -475,6 +483,10 @@ type KubeControllerManagerConfig struct { ExperimentalClusterSigningDuration *metav1.Duration `json:"experimentalClusterSigningDuration,omitempty" flag:"experimental-cluster-signing-duration"` // FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features. FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` } // CloudControllerManagerConfig is the configuration of the cloud controller diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index c95bf479be..058d4c2089 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -2930,6 +2930,8 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -3015,6 +3017,8 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -3110,6 +3114,8 @@ func autoConvert_v1alpha1_KubeControllerManagerConfig_To_kops_KubeControllerMana out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration out.FeatureGates = in.FeatureGates + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion return nil } @@ -3154,6 +3160,8 @@ func autoConvert_kops_KubeControllerManagerConfig_To_v1alpha1_KubeControllerMana out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration out.FeatureGates = in.FeatureGates + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion return nil } @@ -3310,6 +3318,8 @@ func autoConvert_v1alpha1_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.KubeconfigPath = in.KubeconfigPath out.RequireKubeconfig = in.RequireKubeconfig out.LogLevel = in.LogLevel @@ -3389,6 +3399,8 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha1_KubeletConfigSpec(in *kops.K out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.KubeconfigPath = in.KubeconfigPath out.RequireKubeconfig = in.RequireKubeconfig out.LogLevel = in.LogLevel diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index f955b0c539..1f91b1c80d 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -1602,6 +1602,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.AllowPrivileged != nil { in, out := &in.AllowPrivileged, &out.AllowPrivileged *out = new(bool) @@ -1924,6 +1929,11 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo (*out)[key] = val } } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } return } @@ -2077,6 +2087,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = new(bool) **out = **in } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.RequireKubeconfig != nil { in, out := &in.RequireKubeconfig, &out.RequireKubeconfig *out = new(bool) diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 2b38cfc738..832ad37734 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -34,6 +34,10 @@ type KubeletConfigSpec struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // KubeconfigPath is the path of kubeconfig for the kubelet KubeconfigPath string `json:"kubeconfigPath,omitempty" flag:"kubeconfig"` // RequireKubeconfig indicates a kubeconfig is required @@ -281,6 +285,10 @@ type KubeAPIServerConfig struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // TODO: Remove unused TokenAuthFile TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"` // AllowPrivileged indicates if we can run privileged containers @@ -475,6 +483,10 @@ type KubeControllerManagerConfig struct { ExperimentalClusterSigningDuration *metav1.Duration `json:"experimentalClusterSigningDuration,omitempty" flag:"experimental-cluster-signing-duration"` // FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features. FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` } // CloudControllerManagerConfig is the configuration of the cloud controller diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index f73fd006d1..4f7e565cc5 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -3200,6 +3200,8 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -3285,6 +3287,8 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -3380,6 +3384,8 @@ func autoConvert_v1alpha2_KubeControllerManagerConfig_To_kops_KubeControllerMana out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration out.FeatureGates = in.FeatureGates + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion return nil } @@ -3424,6 +3430,8 @@ func autoConvert_kops_KubeControllerManagerConfig_To_v1alpha2_KubeControllerMana out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration out.FeatureGates = in.FeatureGates + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion return nil } @@ -3580,6 +3588,8 @@ func autoConvert_v1alpha2_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.KubeconfigPath = in.KubeconfigPath out.RequireKubeconfig = in.RequireKubeconfig out.LogLevel = in.LogLevel @@ -3659,6 +3669,8 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha2_KubeletConfigSpec(in *kops.K out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.KubeconfigPath = in.KubeconfigPath out.RequireKubeconfig = in.RequireKubeconfig out.LogLevel = in.LogLevel diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index 4def0f107d..c283f1be4a 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -1673,6 +1673,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.AllowPrivileged != nil { in, out := &in.AllowPrivileged, &out.AllowPrivileged *out = new(bool) @@ -1995,6 +2000,11 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo (*out)[key] = val } } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } return } @@ -2148,6 +2158,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = new(bool) **out = **in } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.RequireKubeconfig != nil { in, out := &in.RequireKubeconfig, &out.RequireKubeconfig *out = new(bool) diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index 43b0581de4..9daa465e71 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -1855,6 +1855,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.AllowPrivileged != nil { in, out := &in.AllowPrivileged, &out.AllowPrivileged *out = new(bool) @@ -2177,6 +2182,11 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo (*out)[key] = val } } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } return } @@ -2330,6 +2340,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = new(bool) **out = **in } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.RequireKubeconfig != nil { in, out := &in.RequireKubeconfig, &out.RequireKubeconfig *out = new(bool)