kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use secure kubelet auth 

Without secure node auth enabled, commands like `kubectl logs` may fail
with certain configurations.

Previously, we checked if anonymousAuth was enabled on the kubelet
before securing node communication, but this isn't really relevant. We
can still authenticate even if anonymous access is allowed.
This commit is contained in:
Ole Markus With 2021-04-07 08:45:05 +02:00
parent 2050280b20
commit bd731ce989
4 changed files with 15 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
nodeup/pkg/model/context.go
View File

@ -397,11 +397,6 @@ func (c *NodeupModelContext) UseBootstrapTokens() bool {
return c.Cluster.Spec.Kubelet != nil && c.Cluster.Spec.Kubelet.BootstrapKubeconfig != ""
}
// UseSecureKubelet checks if the kubelet api should be protected by a client certificate.
func (c *NodeupModelContext) UseSecureKubelet() bool {
return c.NodeupConfig.KubeletConfig.AnonymousAuth != nil && !*c.NodeupConfig.KubeletConfig.AnonymousAuth
}
// KubectlPath returns distro based path for kubectl
func (c *NodeupModelContext) KubectlPath() string {
kubeletCommand := "/usr/local/bin"

32
nodeup/pkg/model/kube_apiserver.go
View File

@ -107,19 +107,16 @@ func (b *KubeAPIServerBuilder) Build(c *fi.ModelBuilderContext) error {
}
}
// @check if we are using secure client certificates for kubelet and grab the certificates
if b.UseSecureKubelet() {
issueCert := &nodetasks.IssueCert{
Name: "kubelet-api",
Signer: fi.CertificateIDCA,
Type: "client",
Subject: nodetasks.PKIXName{CommonName: "kubelet-api"},
}
c.AddTask(issueCert)
err := issueCert.AddFileTasks(c, b.PathSrvKubernetes(), "kubelet-api", "", nil)
if err != nil {
return err
}
issueCert := &nodetasks.IssueCert{
Name: "kubelet-api",
Signer: fi.CertificateIDCA,
Type: "client",
Subject: nodetasks.PKIXName{CommonName: "kubelet-api"},
}
c.AddTask(issueCert)
err := issueCert.AddFileTasks(c, b.PathSrvKubernetes(), "kubelet-api", "", nil)
if err != nil {
return err
}
c.AddTask(&nodetasks.File{
@ -341,12 +338,9 @@ func (b *KubeAPIServerBuilder) buildPod() (*v1.Pod, error) {
kubeAPIServer.EtcdServersOverrides = []string{"/events#" + eventsEtcdCluster}
}
// @check if we are using secure kubelet client certificates
if b.UseSecureKubelet() {
// @note we are making assumption were using the ones created by the pki model, not custom defined ones
kubeAPIServer.KubeletClientCertificate = filepath.Join(b.PathSrvKubernetes(), "kubelet-api.crt")
kubeAPIServer.KubeletClientKey = filepath.Join(b.PathSrvKubernetes(), "kubelet-api.key")
}
// @note we are making assumption were using the ones created by the pki model, not custom defined ones
kubeAPIServer.KubeletClientCertificate = filepath.Join(b.PathSrvKubernetes(), "kubelet-api.crt")
kubeAPIServer.KubeletClientKey = filepath.Join(b.PathSrvKubernetes(), "kubelet-api.key")
{
certPath := filepath.Join(b.PathSrvKubernetes(), "apiserver-aggregator.crt")

5
nodeup/pkg/model/kubelet.go
View File

@ -426,10 +426,7 @@ func (b *KubeletBuilder) buildKubeletConfigSpec() (*kops.KubeletConfigSpec, erro
// Merge KubeletConfig for NodeLabels
c := b.NodeupConfig.KubeletConfig
// check if we are using secure kubelet <-> api settings
if b.UseSecureKubelet() {
c.ClientCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt")
}
c.ClientCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt")
if isMaster {
c.BootstrapKubeconfig = ""

2
nodeup/pkg/model/tests/kubelet/featuregates/tasks.yaml
View File

@ -3,7 +3,7 @@ path: /etc/kubernetes/manifests
type: directory
---
contents: |
DAEMON_ARGS="--feature-gates=AllowExtTrafficLocalEndpoints=false,ExperimentalCriticalPodAnnotation=true --node-labels=kubernetes.io/role=node,node-role.kubernetes.io/node= --pod-manifest-path=/etc/kubernetes/manifests --register-schedulable=true --volume-plugin-dir=/usr/libexec/kubernetes/kubelet-plugins/volume/exec/ --cni-bin-dir=/opt/cni/bin/ --cni-conf-dir=/etc/cni/net.d/"
DAEMON_ARGS="--client-ca-file=/srv/kubernetes/ca.crt --feature-gates=AllowExtTrafficLocalEndpoints=false,ExperimentalCriticalPodAnnotation=true --node-labels=kubernetes.io/role=node,node-role.kubernetes.io/node= --pod-manifest-path=/etc/kubernetes/manifests --register-schedulable=true --volume-plugin-dir=/usr/libexec/kubernetes/kubelet-plugins/volume/exec/ --cni-bin-dir=/opt/cni/bin/ --cni-conf-dir=/etc/cni/net.d/"
HOME="/root"
path: /etc/sysconfig/kubelet
type: file