kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6112 from justinsb/issue_6024 

Create separate certificate for etcd peer authentication
This commit is contained in:
k8s-ci-robot 2018-11-26 11:42:21 -08:00 committed by GitHub
parent c83ebe8915 3405ee1382
commit e5a3e495e2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 36 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nodeup/pkg/model/protokube.go
View File

@ -69,12 +69,12 @@ func (t *ProtokubeBuilder) Build(c *fi.ModelBuilderContext) error {
// retrieve the etcd peer certificates and private keys from the keystore
if t.UseEtcdTLS() {
for _, x := range []string{"etcd", "etcd-client"} {
for _, x := range []string{"etcd", "etcd-peer", "etcd-client"} {
if err := t.BuildCertificateTask(c, x, fmt.Sprintf("%s.pem", x)); err != nil {
return err
}
}
for _, x := range []string{"etcd", "etcd-client"} {
for _, x := range []string{"etcd", "etcd-peer", "etcd-client"} {
if err := t.BuildPrivateKeyTask(c, x, fmt.Sprintf("%s-key.pem", x)); err != nil {
return err
}
@ -290,8 +290,8 @@ func (t *ProtokubeBuilder) ProtokubeFlags(k8sVersion semver.Version) (*Protokube
// check if we are using tls and add the options to protokube
if t.UseEtcdTLS() {
f.PeerTLSCaFile = s(filepath.Join(t.PathSrvKubernetes(), "ca.crt"))
f.PeerTLSCertFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd.pem"))
f.PeerTLSKeyFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-key.pem"))
f.PeerTLSCertFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-peer.pem"))
f.PeerTLSKeyFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-peer-key.pem"))
f.TLSCAFile = s(filepath.Join(t.PathSrvKubernetes(), "ca.crt"))
f.TLSCertFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd.pem"))
f.TLSKeyFile = s(filepath.Join(t.PathSrvKubernetes(), "etcd-key.pem"))

34
pkg/model/pki.go
View File

@ -121,18 +121,48 @@ func (b *PKIModelBuilder) Build(c *fi.ModelBuilderContext) error {
// that mutual tls used to verify between the peers we don't want certificates for kubernetes able to act as a peer.
// For clients assuming we are using etcdv3 is can switch on user authentication and map the common names for auth.
if b.UseEtcdTLS() {
alternativeNames := []string{fmt.Sprintf("*.internal.%s", b.ClusterName()), "localhost", "127.0.0.1"}
servingNames := []string{fmt.Sprintf("*.internal.%s", b.ClusterName()), "localhost", "127.0.0.1"}
// @question should wildcard's be here instead of generating per node. If we ever provide the
// ability to resize the master, this will become a blocker
c.AddTask(&fitasks.Keypair{
AlternateNames: alternativeNames,
AlternateNames: servingNames,
Lifecycle: b.Lifecycle,
Name: fi.String("etcd"),
Subject: "cn=etcd",
// TODO: Can this be "server" now that we're not using it for peer connectivity?
Type: "clientServer",
Signer: defaultCA,
Format: format,
})
// For peer authentication, the same cert is used both as a client
// cert and as a server cert (which is unusual). Moreover, etcd
// 3.2 introduces some breaking changes to certificate validation
// where it tries to match any IP or DNS names to the client IP
// (including reverse DNS lookups!) We _could_ include a wildcard
// reverse DNS name e.g. *.ec2.internal for EC2, but it seems
// better just to list the names that we expect peer connectivity
// to happen on.
var peerNames []string
for _, etcdCluster := range b.Cluster.Spec.EtcdClusters {
prefix := "etcd-" + etcdCluster.Name + "-"
if prefix == "etcd-main-" {
prefix = "etcd-"
}
for _, m := range etcdCluster.Members {
peerNames = append(peerNames, prefix+m.Name+".internal."+b.ClusterName())
}
}
c.AddTask(&fitasks.Keypair{
AlternateNames: peerNames,
Lifecycle: b.Lifecycle,
Name: fi.String("etcd-peer"),
Subject: "cn=etcd-peer",
Type: "clientServer",
Signer: defaultCA,
Format: format,
})
c.AddTask(&fitasks.Keypair{
Name: fi.String("etcd-client"),
Lifecycle: b.Lifecycle,