mirror of https://github.com/kubernetes/kops.git
Issue aws-iam-authenticator cert in nodeup
This commit is contained in:
parent
b453209957
commit
c8b523e8b6
|
@ -245,46 +245,31 @@ func (b *KubeAPIServerBuilder) writeAuthenticationConfig(c *fi.ModelBuilderConte
|
||||||
}
|
}
|
||||||
|
|
||||||
{
|
{
|
||||||
certificate, err := b.NodeupModelContext.KeyStore.FindCert(id)
|
issueCert := &nodetasks.IssueCert{
|
||||||
if err != nil {
|
Name: id,
|
||||||
return fmt.Errorf("error fetching %q certificate from keystore: %v", id, err)
|
Signer: fi.CertificateIDCA,
|
||||||
}
|
Type: "server",
|
||||||
if certificate == nil {
|
Subject: nodetasks.PKIXName{CommonName: id},
|
||||||
return fmt.Errorf("certificate %q not found", id)
|
AlternateNames: []string{
|
||||||
}
|
"localhost",
|
||||||
|
"127.0.0.1",
|
||||||
certificateData, err := certificate.AsBytes()
|
},
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("error encoding %q certificate: %v", id, err)
|
|
||||||
}
|
}
|
||||||
|
c.AddTask(issueCert)
|
||||||
|
certificate, privateKey, _ := issueCert.GetResources()
|
||||||
|
|
||||||
c.AddTask(&nodetasks.File{
|
c.AddTask(&nodetasks.File{
|
||||||
Path: "/srv/kubernetes/aws-iam-authenticator/cert.pem",
|
Path: "/srv/kubernetes/aws-iam-authenticator/cert.pem",
|
||||||
Contents: fi.NewBytesResource(certificateData),
|
Contents: certificate,
|
||||||
Type: nodetasks.FileType_File,
|
Type: nodetasks.FileType_File,
|
||||||
Mode: fi.String("600"),
|
Mode: fi.String("600"),
|
||||||
Owner: fi.String("aws-iam-authenticator"),
|
Owner: fi.String("aws-iam-authenticator"),
|
||||||
Group: fi.String("aws-iam-authenticator"),
|
Group: fi.String("aws-iam-authenticator"),
|
||||||
})
|
})
|
||||||
}
|
|
||||||
|
|
||||||
{
|
|
||||||
privateKey, err := b.NodeupModelContext.KeyStore.FindPrivateKey(id)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("error fetching %q private key from keystore: %v", id, err)
|
|
||||||
}
|
|
||||||
if privateKey == nil {
|
|
||||||
return fmt.Errorf("private key %q not found", id)
|
|
||||||
}
|
|
||||||
|
|
||||||
keyData, err := privateKey.AsBytes()
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("error encoding %q private key: %v", id, err)
|
|
||||||
}
|
|
||||||
|
|
||||||
c.AddTask(&nodetasks.File{
|
c.AddTask(&nodetasks.File{
|
||||||
Path: "/srv/kubernetes/aws-iam-authenticator/key.pem",
|
Path: "/srv/kubernetes/aws-iam-authenticator/key.pem",
|
||||||
Contents: fi.NewBytesResource(keyData),
|
Contents: privateKey,
|
||||||
Type: nodetasks.FileType_File,
|
Type: nodetasks.FileType_File,
|
||||||
Mode: fi.String("600"),
|
Mode: fi.String("600"),
|
||||||
Owner: fi.String("aws-iam-authenticator"),
|
Owner: fi.String("aws-iam-authenticator"),
|
||||||
|
|
|
@ -190,3 +190,10 @@ func TestKubeAPIServerBuilder(t *testing.T) {
|
||||||
return builder.Build(target)
|
return builder.Build(target)
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func TestAwsIamAuthenticator(t *testing.T) {
|
||||||
|
RunGoldenTest(t, "tests/golden/awsiam", "kube-apiserver", func(nodeupModelContext *NodeupModelContext, target *fi.ModelBuilderContext) error {
|
||||||
|
builder := KubeAPIServerBuilder{NodeupModelContext: nodeupModelContext}
|
||||||
|
return builder.Build(target)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
|
@ -0,0 +1,68 @@
|
||||||
|
apiVersion: kops.k8s.io/v1alpha2
|
||||||
|
kind: Cluster
|
||||||
|
metadata:
|
||||||
|
name: minimal.example.com
|
||||||
|
spec:
|
||||||
|
kubernetesApiAccess:
|
||||||
|
- 0.0.0.0/0
|
||||||
|
authentication:
|
||||||
|
aws: {}
|
||||||
|
channel: stable
|
||||||
|
cloudProvider: aws
|
||||||
|
configBase: memfs://clusters.example.com/minimal.example.com
|
||||||
|
etcdClusters:
|
||||||
|
- cpuRequest: 200m
|
||||||
|
etcdMembers:
|
||||||
|
- instanceGroup: master-us-test-1a
|
||||||
|
name: us-test-1a
|
||||||
|
memoryRequest: 100Mi
|
||||||
|
name: main
|
||||||
|
provider: Manager
|
||||||
|
backups:
|
||||||
|
backupStore: memfs://clusters.example.com/minimal.example.com/backups/etcd-main
|
||||||
|
- cpuRequest: 100m
|
||||||
|
etcdMembers:
|
||||||
|
- instanceGroup: master-us-test-1a
|
||||||
|
name: us-test-1a
|
||||||
|
memoryRequest: 100Mi
|
||||||
|
name: events
|
||||||
|
provider: Manager
|
||||||
|
backups:
|
||||||
|
backupStore: memfs://clusters.example.com/minimal.example.com/backups/etcd-events
|
||||||
|
kubelet:
|
||||||
|
anonymousAuth: false
|
||||||
|
kubernetesVersion: v1.18.0
|
||||||
|
masterInternalName: api.internal.minimal.example.com
|
||||||
|
masterPublicName: api.minimal.example.com
|
||||||
|
networkCIDR: 172.20.0.0/16
|
||||||
|
networking:
|
||||||
|
kubenet: {}
|
||||||
|
nonMasqueradeCIDR: 100.64.0.0/10
|
||||||
|
sshAccess:
|
||||||
|
- 0.0.0.0/0
|
||||||
|
topology:
|
||||||
|
masters: public
|
||||||
|
nodes: public
|
||||||
|
subnets:
|
||||||
|
- cidr: 172.20.32.0/19
|
||||||
|
name: us-test-1a
|
||||||
|
type: Public
|
||||||
|
zone: us-test-1a
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: kops.k8s.io/v1alpha2
|
||||||
|
kind: InstanceGroup
|
||||||
|
metadata:
|
||||||
|
name: master-us-test-1a
|
||||||
|
labels:
|
||||||
|
kops.k8s.io/cluster: minimal.example.com
|
||||||
|
spec:
|
||||||
|
associatePublicIp: true
|
||||||
|
image: ami-1234
|
||||||
|
machineType: m3.medium
|
||||||
|
maxSize: 1
|
||||||
|
minSize: 1
|
||||||
|
role: Master
|
||||||
|
subnets:
|
||||||
|
- us-test-1a
|
|
@ -0,0 +1,268 @@
|
||||||
|
contents: |
|
||||||
|
apiVersion: ""
|
||||||
|
clusters:
|
||||||
|
- cluster:
|
||||||
|
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMyRENDQWNDZ0F3SUJBZ0lSQUxKWEFrVmo5NjR0cTY3d01TSThvSlF3RFFZSktvWklodmNOQVFFTEJRQXcKRlRFVE1CRUdBMVVFQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB4TnpFeU1qY3lNelV5TkRCYUZ3MHlOekV5TWpjeQpNelV5TkRCYU1CVXhFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBCkE0SUJEd0F3Z2dFS0FvSUJBUURnbkNrU210bm1meEVnUzNxTlBhVUNINVFPQkdESC9pbkhiV0NPRExCQ0s5Z2QKWEVjQmw3RlZ2OFQya0ZyMURZYjBIVkR0TUk3dGl4UlZGRExna3dObFczNHh3V2RaWEI3R2VvRmdVMXhXT1FTWQpPQUNDOEpnWVRRLzEzOUhCRXZncTRzZWo2N3ArL3MvU05jdzM0S2s3SEl1RmhsazFyUms1a01leEtJbEpCS1AxCllZVVlldHNKL1FwVU9rcUo1SFc0R29ldEU3Nll0SG5PUmZZdm55YnZpU01yaDJ3R0dhTjZyL3M0Q2hPYUliWkMKQW44L1lpUEtHSURhWkdwajZHWG5tWEFSUlgvVElkZ1NRa0x3dDBhVERCblBaNFh2dHBJOGFhTDhEWUpJcUF6QQpOUEgyYjQvdU55bGF0NWpEbzBiMEc1NGFnTWk5NysyQVVyQzlVVVhwQWdNQkFBR2pJekFoTUE0R0ExVWREd0VCCi93UUVBd0lCQmpBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCVkdSMnIKaHpYelJNVTV3cmlQUUFKU2Nzek5PUnZvQnBYZlpvWjA5Rkl1cHVkRnhCVlUzZDRoVjlTdEtuUWdQU0dBNVhRTwpIRTk3K0J4SkR1QS9yQjVvQlVzTUJqYzd5MWNkZS9UNmhtaTNyTG9FWUJTblN1ZENPWEpFNEc5LzBmOGJ5QUplCnJOOCtObzFyMlZnWnZaaDZwNzRURWtYdi9sM0hCUFdNN0lkVVYwSE85SkRoU2dPVkYxZnlRS0p4UnVMSlI4anQKTzZtUEgyVVgwdk13VmE0anZ3dGtkZHFrMk9BZFlRdkg5cmJEampiemFpVzBLbm1kdWVSbzkyS0hBTjdCc0RaeQpWcFhIcHFvMUt6ZzdEM2ZwYVhDZjVzaTdscXFyZEpWWEg0SkM3Mnp4c1BlaHFnaThlSXVxT0JraURXbVJ4QXhoCjh5R2VSeDlBYmtuSGg0SWEKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||||
|
server: https://127.0.0.1:21362/authenticate
|
||||||
|
name: aws-iam-authenticator
|
||||||
|
contexts:
|
||||||
|
- context:
|
||||||
|
cluster: aws-iam-authenticator
|
||||||
|
user: kube-apiserver
|
||||||
|
name: webhook
|
||||||
|
current-context: webhook
|
||||||
|
kind: ""
|
||||||
|
users:
|
||||||
|
- name: kube-apiserver
|
||||||
|
user: {}
|
||||||
|
mode: "600"
|
||||||
|
path: /etc/kubernetes/authn.config
|
||||||
|
type: file
|
||||||
|
---
|
||||||
|
contents: |
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
dns.alpha.kubernetes.io/external: api.minimal.example.com
|
||||||
|
dns.alpha.kubernetes.io/internal: api.internal.minimal.example.com
|
||||||
|
scheduler.alpha.kubernetes.io/critical-pod: ""
|
||||||
|
creationTimestamp: null
|
||||||
|
labels:
|
||||||
|
k8s-app: kube-apiserver
|
||||||
|
name: kube-apiserver
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- --allow-privileged=true
|
||||||
|
- --anonymous-auth=false
|
||||||
|
- --apiserver-count=1
|
||||||
|
- --authentication-token-webhook-config-file=/etc/kubernetes/authn.config
|
||||||
|
- --authorization-mode=AlwaysAllow
|
||||||
|
- --bind-address=0.0.0.0
|
||||||
|
- --client-ca-file=/srv/kubernetes/ca.crt
|
||||||
|
- --cloud-provider=aws
|
||||||
|
- --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,NodeRestriction,ResourceQuota
|
||||||
|
- --etcd-cafile=/etc/kubernetes/pki/kube-apiserver/etcd-ca.crt
|
||||||
|
- --etcd-certfile=/etc/kubernetes/pki/kube-apiserver/etcd-client.crt
|
||||||
|
- --etcd-keyfile=/etc/kubernetes/pki/kube-apiserver/etcd-client.key
|
||||||
|
- --etcd-servers-overrides=/events#https://127.0.0.1:4002
|
||||||
|
- --etcd-servers=https://127.0.0.1:4001
|
||||||
|
- --insecure-bind-address=127.0.0.1
|
||||||
|
- --insecure-port=0
|
||||||
|
- --kubelet-client-certificate=/srv/kubernetes/kubelet-api.crt
|
||||||
|
- --kubelet-client-key=/srv/kubernetes/kubelet-api.key
|
||||||
|
- --kubelet-preferred-address-types=InternalIP,Hostname,ExternalIP
|
||||||
|
- --proxy-client-cert-file=/srv/kubernetes/apiserver-aggregator.cert
|
||||||
|
- --proxy-client-key-file=/srv/kubernetes/apiserver-aggregator.key
|
||||||
|
- --requestheader-allowed-names=aggregator
|
||||||
|
- --requestheader-client-ca-file=/srv/kubernetes/apiserver-aggregator-ca.cert
|
||||||
|
- --requestheader-extra-headers-prefix=X-Remote-Extra-
|
||||||
|
- --requestheader-group-headers=X-Remote-Group
|
||||||
|
- --requestheader-username-headers=X-Remote-User
|
||||||
|
- --secure-port=443
|
||||||
|
- --service-cluster-ip-range=100.64.0.0/13
|
||||||
|
- --storage-backend=etcd3
|
||||||
|
- --tls-cert-file=/srv/kubernetes/server.cert
|
||||||
|
- --tls-private-key-file=/srv/kubernetes/server.key
|
||||||
|
- --v=2
|
||||||
|
- --logtostderr=false
|
||||||
|
- --alsologtostderr
|
||||||
|
- --log-file=/var/log/kube-apiserver.log
|
||||||
|
command:
|
||||||
|
- /usr/local/bin/kube-apiserver
|
||||||
|
image: k8s.gcr.io/kube-apiserver:v1.18.0
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
host: 127.0.0.1
|
||||||
|
path: /healthz
|
||||||
|
port: 443
|
||||||
|
scheme: HTTPS
|
||||||
|
initialDelaySeconds: 45
|
||||||
|
timeoutSeconds: 15
|
||||||
|
name: kube-apiserver
|
||||||
|
ports:
|
||||||
|
- containerPort: 443
|
||||||
|
hostPort: 443
|
||||||
|
name: https
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 150m
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /var/log/kube-apiserver.log
|
||||||
|
name: logfile
|
||||||
|
- mountPath: /etc/ssl
|
||||||
|
name: etcssl
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /etc/pki/tls
|
||||||
|
name: etcpkitls
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /etc/pki/ca-trust
|
||||||
|
name: etcpkica-trust
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /usr/share/ssl
|
||||||
|
name: usrsharessl
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /usr/ssl
|
||||||
|
name: usrssl
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /usr/lib/ssl
|
||||||
|
name: usrlibssl
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /usr/local/openssl
|
||||||
|
name: usrlocalopenssl
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /var/ssl
|
||||||
|
name: varssl
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /etc/openssl
|
||||||
|
name: etcopenssl
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /etc/kubernetes/pki/kube-apiserver
|
||||||
|
name: pki
|
||||||
|
- mountPath: /srv/kubernetes
|
||||||
|
name: srvkube
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /srv/sshproxy
|
||||||
|
name: srvsshproxy
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /etc/kubernetes/authn.config
|
||||||
|
name: authn-config
|
||||||
|
readOnly: true
|
||||||
|
hostNetwork: true
|
||||||
|
priorityClassName: system-cluster-critical
|
||||||
|
tolerations:
|
||||||
|
- key: CriticalAddonsOnly
|
||||||
|
operator: Exists
|
||||||
|
volumes:
|
||||||
|
- hostPath:
|
||||||
|
path: /var/log/kube-apiserver.log
|
||||||
|
name: logfile
|
||||||
|
- hostPath:
|
||||||
|
path: /etc/ssl
|
||||||
|
name: etcssl
|
||||||
|
- hostPath:
|
||||||
|
path: /etc/pki/tls
|
||||||
|
name: etcpkitls
|
||||||
|
- hostPath:
|
||||||
|
path: /etc/pki/ca-trust
|
||||||
|
name: etcpkica-trust
|
||||||
|
- hostPath:
|
||||||
|
path: /usr/share/ssl
|
||||||
|
name: usrsharessl
|
||||||
|
- hostPath:
|
||||||
|
path: /usr/ssl
|
||||||
|
name: usrssl
|
||||||
|
- hostPath:
|
||||||
|
path: /usr/lib/ssl
|
||||||
|
name: usrlibssl
|
||||||
|
- hostPath:
|
||||||
|
path: /usr/local/openssl
|
||||||
|
name: usrlocalopenssl
|
||||||
|
- hostPath:
|
||||||
|
path: /var/ssl
|
||||||
|
name: varssl
|
||||||
|
- hostPath:
|
||||||
|
path: /etc/openssl
|
||||||
|
name: etcopenssl
|
||||||
|
- hostPath:
|
||||||
|
path: /etc/kubernetes/pki/kube-apiserver
|
||||||
|
type: DirectoryOrCreate
|
||||||
|
name: pki
|
||||||
|
- hostPath:
|
||||||
|
path: /srv/kubernetes
|
||||||
|
name: srvkube
|
||||||
|
- hostPath:
|
||||||
|
path: /srv/sshproxy
|
||||||
|
name: srvsshproxy
|
||||||
|
- hostPath:
|
||||||
|
path: /etc/kubernetes/authn.config
|
||||||
|
name: authn-config
|
||||||
|
status: {}
|
||||||
|
path: /etc/kubernetes/manifests/kube-apiserver.manifest
|
||||||
|
type: file
|
||||||
|
---
|
||||||
|
mode: "0755"
|
||||||
|
path: /srv/kubernetes
|
||||||
|
type: directory
|
||||||
|
---
|
||||||
|
contents:
|
||||||
|
task:
|
||||||
|
Name: aws-iam-authenticator
|
||||||
|
alternateNames:
|
||||||
|
- localhost
|
||||||
|
- 127.0.0.1
|
||||||
|
signer: ca
|
||||||
|
subject:
|
||||||
|
CommonName: aws-iam-authenticator
|
||||||
|
type: server
|
||||||
|
group: aws-iam-authenticator
|
||||||
|
mode: "600"
|
||||||
|
owner: aws-iam-authenticator
|
||||||
|
path: /srv/kubernetes/aws-iam-authenticator/cert.pem
|
||||||
|
type: file
|
||||||
|
---
|
||||||
|
contents:
|
||||||
|
task:
|
||||||
|
Name: aws-iam-authenticator
|
||||||
|
alternateNames:
|
||||||
|
- localhost
|
||||||
|
- 127.0.0.1
|
||||||
|
signer: ca
|
||||||
|
subject:
|
||||||
|
CommonName: aws-iam-authenticator
|
||||||
|
type: server
|
||||||
|
group: aws-iam-authenticator
|
||||||
|
mode: "600"
|
||||||
|
owner: aws-iam-authenticator
|
||||||
|
path: /srv/kubernetes/aws-iam-authenticator/key.pem
|
||||||
|
type: file
|
||||||
|
---
|
||||||
|
contents:
|
||||||
|
task:
|
||||||
|
Name: kubelet-api
|
||||||
|
signer: ca
|
||||||
|
subject:
|
||||||
|
CommonName: kubelet-api
|
||||||
|
type: client
|
||||||
|
mode: "0644"
|
||||||
|
path: /srv/kubernetes/kubelet-api.crt
|
||||||
|
type: file
|
||||||
|
---
|
||||||
|
contents:
|
||||||
|
task:
|
||||||
|
Name: kubelet-api
|
||||||
|
signer: ca
|
||||||
|
subject:
|
||||||
|
CommonName: kubelet-api
|
||||||
|
type: client
|
||||||
|
mode: "0600"
|
||||||
|
path: /srv/kubernetes/kubelet-api.key
|
||||||
|
type: file
|
||||||
|
---
|
||||||
|
contents: ""
|
||||||
|
ifNotExists: true
|
||||||
|
mode: "0400"
|
||||||
|
path: /var/log/kube-apiserver.log
|
||||||
|
type: file
|
||||||
|
---
|
||||||
|
Name: aws-iam-authenticator
|
||||||
|
alternateNames:
|
||||||
|
- localhost
|
||||||
|
- 127.0.0.1
|
||||||
|
signer: ca
|
||||||
|
subject:
|
||||||
|
CommonName: aws-iam-authenticator
|
||||||
|
type: server
|
||||||
|
---
|
||||||
|
Name: kubelet-api
|
||||||
|
signer: ca
|
||||||
|
subject:
|
||||||
|
CommonName: kubelet-api
|
||||||
|
type: client
|
||||||
|
---
|
||||||
|
Name: aws-iam-authenticator
|
||||||
|
home: /srv/kubernetes/aws-iam-authenticator
|
||||||
|
shell: /sbin/nologin
|
||||||
|
uid: 10000
|
|
@ -218,24 +218,6 @@ func (b *PKIModelBuilder) Build(c *fi.ModelBuilderContext) error {
|
||||||
c.AddTask(t)
|
c.AddTask(t)
|
||||||
}
|
}
|
||||||
|
|
||||||
if b.Cluster.Spec.Authentication != nil {
|
|
||||||
if b.KopsModelContext.Cluster.Spec.Authentication.Aws != nil {
|
|
||||||
alternateNames := []string{
|
|
||||||
"localhost",
|
|
||||||
"127.0.0.1",
|
|
||||||
}
|
|
||||||
|
|
||||||
t := &fitasks.Keypair{
|
|
||||||
Name: fi.String("aws-iam-authenticator"),
|
|
||||||
Subject: "cn=aws-iam-authenticator",
|
|
||||||
Type: "server",
|
|
||||||
AlternateNames: alternateNames,
|
|
||||||
Signer: defaultCA,
|
|
||||||
}
|
|
||||||
c.AddTask(t)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// @TODO this is VERY presumptuous, i'm going on the basis we can make it configurable in the future.
|
// @TODO this is VERY presumptuous, i'm going on the basis we can make it configurable in the future.
|
||||||
// But I'm conscious not to do too much work on bootstrap tokens as it might overlay further down the
|
// But I'm conscious not to do too much work on bootstrap tokens as it might overlay further down the
|
||||||
// line with the machines api
|
// line with the machines api
|
||||||
|
|
Loading…
Reference in New Issue