kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Create separate certificate for etcd peer authentication 

This works around the (very unusual) etcd changes for validation of
peer certificates by DNS lookup, which were introduced in etcd 3.2.

Issue #6024
This commit is contained in:
Justin Santa Barbara 2018-11-24 22:21:21 -05:00
parent 4eeba152cd
commit 3405ee1382
2 changed files with 36 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nodeup/pkg/model/protokube.go
View File

@ -69,12 +69,12 @@ func (t *ProtokubeBuilder) Build(c *fi.ModelBuilderContext) error {
// retrieve the etcd peer certificates and private keys from the keystore
if t.UseEtcdTLS() {
for _, x := range []string{"etcd", "etcd-client"} {
for _, x := range []string{"etcd", "etcd-peer", "etcd-client"} {
if err := t.BuildCertificateTask(c, x, fmt.Sprintf("%s.pem", x)); err != nil {
return err
}
}
for _, x := range []string{"etcd", "etcd-client"} {
for _, x := range []string{"etcd", "etcd-peer", "etcd-client"} {
if err := t.BuildPrivateKeyTask(c, x, fmt.Sprintf("%s-key.pem", x)); err != nil {
return err
}
@ -290,8 +290,8 @@ func (t *ProtokubeBuilder) ProtokubeFlags(k8sVersion semver.Version) (*Protokube
// check if we are using tls and add the options to protokube
if t.UseEtcdTLS() {
f.PeerTLSCaFile = s(filepath.Join(t.PathSrvKubernetes(), "ca.crt"))
f.PeerTLSCertFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd.pem"))
f.PeerTLSKeyFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-key.pem"))
f.PeerTLSCertFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-peer.pem"))
f.PeerTLSKeyFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-peer-key.pem"))
f.TLSCAFile = s(filepath.Join(t.PathSrvKubernetes(), "ca.crt"))
f.TLSCertFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd.pem"))
f.TLSKeyFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-key.pem"))

34
pkg/model/pki.go
View File

@ -121,18 +121,48 @@ func (b *PKIModelBuilder) Build(c *fi.ModelBuilderContext) error {
// that mutual tls used to verify between the peers we don't want certificates for kubernetes able to act as a peer.
// For clients assuming we are using etcdv3 is can switch on user authentication and map the common names for auth.
if b.UseEtcdTLS() {
alternativeNames := []string{fmt.Sprintf("*.internal.%s", b.ClusterName()), "localhost", "127.0.0.1"}
servingNames := []string{fmt.Sprintf("*.internal.%s", b.ClusterName()), "localhost", "127.0.0.1"}
// @question should wildcard's be here instead of generating per node. If we ever provide the
// ability to resize the master, this will become a blocker
c.AddTask(&fitasks.Keypair{
AlternateNames: alternativeNames,
AlternateNames: servingNames,
Lifecycle: b.Lifecycle,
Name: fi.String("etcd"),
Subject: "cn=etcd",
// TODO: Can this be "server" now that we're not using it for peer connectivity?
Type: "clientServer",
Signer: defaultCA,
Format: format,
})
// For peer authentication, the same cert is used both as a client
// cert and as a server cert (which is unusual). Moreover, etcd
// 3.2 introduces some breaking changes to certificate validation
// where it tries to match any IP or DNS names to the client IP
// (including reverse DNS lookups!) We _could_ include a wildcard
// reverse DNS name e.g. *.ec2.internal for EC2, but it seems
// better just to list the names that we expect peer connectivity
// to happen on.
var peerNames []string
for _, etcdCluster := range b.Cluster.Spec.EtcdClusters {
prefix := "etcd-" + etcdCluster.Name + "-"
if prefix == "etcd-main-" {
prefix = "etcd-"
}
for _, m := range etcdCluster.Members {
peerNames = append(peerNames, prefix+m.Name+".internal."+b.ClusterName())
}
}
c.AddTask(&fitasks.Keypair{
AlternateNames: peerNames,
Lifecycle: b.Lifecycle,
Name: fi.String("etcd-peer"),
Subject: "cn=etcd-peer",
Type: "clientServer",
Signer: defaultCA,
Format: format,
})
c.AddTask(&fitasks.Keypair{
Name: fi.String("etcd-client"),
Lifecycle: b.Lifecycle,