6 Commits

Author	SHA1	Message	Date
John Gardiner Myers	9d7a93e124	Issue kubelet-api cert in nodeup	2020-06-13 16:35:44 -07:00
Justin SB	bf11a65bd3	Try wrapping pkix.Name	2020-06-09 20:24:09 -07:00
ZouYu	2fc52ec6be	fix some go-lint warning ... Signed-off-by: ZouYu <zouy.fnst@cn.fujitsu.com>	2020-06-09 08:52:50 +08:00
John Gardiner Myers	8b9145f6c4	Create nodetasks.IssueCert()	2020-06-05 08:00:38 -07:00
John Gardiner Myers	d64e760d5b	Use pki.IssueCert() for nodeup client certs	2020-06-04 10:26:45 -07:00
Justin SB	75fd939a62	kube-apiserver: healthcheck via sidecar container ... kube-apiserver doesn't expose the healthcheck via a dedicated endpoint, instead relying on anonyomous-access being enabled. That has previously forced us to enable the unauthenticated endpoint on 127.0.0.1:8080. Instead we now run a small sidecar container, which proxies /healthz and /readyz requests (only) adding appropriate authentication using a client certificate. This will also enable better load balancer checks in future, as these have previously been hampered by the custom CA certificate. Co-authored-by: John Gardiner Myers <jgmyers@proofpoint.com>	2020-05-07 08:06:52 -04:00