From 046a64cb1928a5daec473680b4babac53131f1ac Mon Sep 17 00:00:00 2001 From: John Gardiner Myers Date: Sat, 14 Nov 2020 11:19:55 -0800 Subject: [PATCH] Use separate domain for kops-controller bootstrap --- nodeup/pkg/model/kops_controller.go | 2 +- upup/models/bindata.go | 4 ++++ .../kops-controller.addons.k8s.io/k8s-1.16.yaml.template | 4 ++++ .../bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml | 2 +- .../simple/kops-controller.addons.k8s.io-k8s-1.16.yaml | 2 ++ .../tests/bootstrapchannelbuilder/simple/manifest.yaml | 2 +- upup/pkg/fi/nodeup/nodetasks/bootstrap_client.go | 2 +- 7 files changed, 14 insertions(+), 4 deletions(-) diff --git a/nodeup/pkg/model/kops_controller.go b/nodeup/pkg/model/kops_controller.go index a07987af95..8779047203 100644 --- a/nodeup/pkg/model/kops_controller.go +++ b/nodeup/pkg/model/kops_controller.go @@ -62,7 +62,7 @@ func (b *KopsControllerBuilder) Build(c *fi.ModelBuilderContext) error { Signer: fi.CertificateIDCA, Type: "server", Subject: nodetasks.PKIXName{CommonName: "kops-controller"}, - AlternateNames: []string{b.Cluster.Spec.MasterInternalName}, + AlternateNames: []string{"kops-controller.internal." + b.Cluster.ObjectMeta.Name}, } c.AddTask(issueCert) diff --git a/upup/models/bindata.go b/upup/models/bindata.go index 54b6a79832..f5a20374a7 100644 --- a/upup/models/bindata.go +++ b/upup/models/bindata.go @@ -1836,6 +1836,10 @@ spec: k8s-addon: kops-controller.addons.k8s.io k8s-app: kops-controller version: v1.19.0-beta.1 +{{ if UseKopsControllerForNodeBootstrap }} + annotations: + dns.alpha.kubernetes.io/internal: kops-controller.internal.{{ ClusterName }} +{{ end }} spec: priorityClassName: system-node-critical tolerations: diff --git a/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template b/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template index 50b166f074..b38b8bfa6f 100644 --- a/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template +++ b/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template @@ -34,6 +34,10 @@ spec: k8s-addon: kops-controller.addons.k8s.io k8s-app: kops-controller version: v1.19.0-beta.1 +{{ if UseKopsControllerForNodeBootstrap }} + annotations: + dns.alpha.kubernetes.io/internal: kops-controller.internal.{{ ClusterName }} +{{ end }} spec: priorityClassName: system-node-critical tolerations: diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml index 109858c5bd..22e68ced61 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml @@ -7,7 +7,7 @@ spec: - id: k8s-1.16 kubernetesVersion: '>=1.16.0-alpha.0' manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml - manifestHash: a7d47f4a668812e334b505231855a82cef2f670c + manifestHash: 5a0a74b65c83649d0a494311a55e7c39a98475a6 name: kops-controller.addons.k8s.io selector: k8s-addon: kops-controller.addons.k8s.io diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml index a8c86208ff..76d52bab77 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml @@ -26,6 +26,8 @@ spec: k8s-app: kops-controller template: metadata: + annotations: + dns.alpha.kubernetes.io/internal: kops-controller.internal.minimal.example.com labels: k8s-addon: kops-controller.addons.k8s.io k8s-app: kops-controller diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml index 5547674e43..57de7ae810 100644 --- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml +++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml @@ -7,7 +7,7 @@ spec: - id: k8s-1.16 kubernetesVersion: '>=1.16.0-alpha.0' manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml - manifestHash: a7d47f4a668812e334b505231855a82cef2f670c + manifestHash: 5a0a74b65c83649d0a494311a55e7c39a98475a6 name: kops-controller.addons.k8s.io selector: k8s-addon: kops-controller.addons.k8s.io diff --git a/upup/pkg/fi/nodeup/nodetasks/bootstrap_client.go b/upup/pkg/fi/nodeup/nodetasks/bootstrap_client.go index 5ccb7370f8..56c52b39f9 100644 --- a/upup/pkg/fi/nodeup/nodetasks/bootstrap_client.go +++ b/upup/pkg/fi/nodeup/nodetasks/bootstrap_client.go @@ -151,7 +151,7 @@ func (b *BootstrapClient) queryBootstrap(c *fi.Context, req *nodeup.BootstrapReq bootstrapUrl := url.URL{ Scheme: "https", - Host: net.JoinHostPort(c.Cluster.Spec.MasterInternalName, strconv.Itoa(wellknownports.KopsControllerPort)), + Host: net.JoinHostPort("kops-controller.internal."+c.Cluster.ObjectMeta.Name, strconv.Itoa(wellknownports.KopsControllerPort)), Path: "/bootstrap", } httpReq, err := http.NewRequest("POST", bootstrapUrl.String(), bytes.NewReader(reqBytes))