Merge pull request #39020 from deads2k/rbac-26-tweak-cert-gen

cluster/common.sh

@@ -932,9 +932,20 @@ function generate-certs {
     tar xzf easy-rsa.tar.gz
     cd easy-rsa-master/easyrsa3
     ./easyrsa init-pki
+    # this puts the cert into pki/ca.crt and the key into pki/private/ca.key
     ./easyrsa --batch "--req-cn=${PRIMARY_CN}@$(date +%s)" build-ca nopass
     ./easyrsa --subject-alt-name="${SANS}" build-server-full "${MASTER_NAME}" nopass
-    ./easyrsa build-client-full kubelet nopass
+
+    download-cfssl
+
+    # make the config for the signer
+    echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","client auth"]}}}' > "ca-config.json"
+    # create the kubelet client cert with the correct groups
+    echo '{"CN":"kubelet","names":[{"O":"system:nodes"}],"hosts":[""],"key":{"algo":"rsa","size":2048}}' | "${KUBE_TEMP}/cfssl/cfssl" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${KUBE_TEMP}/cfssl/cfssljson" -bare kubelet
+    mv "kubelet-key.pem" "pki/private/kubelet.key"
+    mv "kubelet.pem" "pki/issued/kubelet.crt"
+    rm -f "kubelet.csr"
+
     ./easyrsa build-client-full kubecfg nopass) &>${cert_create_debug_output} || {
     # If there was an error in the subshell, just die.
     # TODO(roberthbailey): add better error handling here

cluster/gce/util.sh

@@ -726,29 +726,12 @@ function get-master-disk-size() {
   fi
 }
 
-# Generates SSL certificates for etcd cluster. Uses cfssl program.
+# Downloads cfssl into ${KUBE_TEMP}/cfssl directory
 #
 # Assumed vars:
 #   KUBE_TEMP: temporary directory
 #
-# Args:
-#  $1: host name
-#  $2: CA certificate
-#  $3: CA key
-#
-# If CA cert/key is empty, the function will also generate certs for CA.
-#
-# Vars set:
-#   ETCD_CA_KEY_BASE64
-#   ETCD_CA_CERT_BASE64
-#   ETCD_PEER_KEY_BASE64
-#   ETCD_PEER_CERT_BASE64
-#
-function create-etcd-certs {
-  local host=${1}
-  local ca_cert=${2:-}
-  local ca_key=${3:-}
-
+function download-cfssl {
   mkdir -p "${KUBE_TEMP}/cfssl"
   pushd "${KUBE_TEMP}/cfssl"
 
@@ -771,6 +754,37 @@ function create-etcd-certs {
   chmod +x cfssl
   chmod +x cfssljson
 
+  popd
+}
+
+
+# Generates SSL certificates for etcd cluster. Uses cfssl program.
+#
+# Assumed vars:
+#   KUBE_TEMP: temporary directory
+#
+# Args:
+#  $1: host name
+#  $2: CA certificate
+#  $3: CA key
+#
+# If CA cert/key is empty, the function will also generate certs for CA.
+#
+# Vars set:
+#   ETCD_CA_KEY_BASE64
+#   ETCD_CA_CERT_BASE64
+#   ETCD_PEER_KEY_BASE64
+#   ETCD_PEER_CERT_BASE64
+#
+function create-etcd-certs {
+  local host=${1}
+  local ca_cert=${2:-}
+  local ca_key=${3:-}
+
+  download-cfssl
+
+  pushd "${KUBE_TEMP}/cfssl"
+
   cat >ca-config.json <<EOF
 {
     "signing": {