Skip to content

K
k3s
Unverified Commit 2860bd59 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #63806 from detiber/externalEtcdCerts

Automatic merge from submit-queue (batch tested with PRs 63588, 63806). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. kubeadm - do not generate etcd ca/certs for external etcd **What this PR does / why we need it**: Currently we generate an etcd CA and certificates even if we are specifying an external etcd cluster when running `kubeadm init`, this PR changes this behavior to skip generating the etcd CA and certificates if configured for an external etcd cluster. **Which issue(s) this PR fixes** Fixes https://github.com/kubernetes/kubeadm/issues/807 **Release note**: ```release-note kubeadm will no longer generate an unused etcd CA and certificates when configured to use an external etcd cluster. ```
parents 13f846f7 187ef17e
Show whitespace changes
Inline Side-by-side
Showing with 27 additions and 3 deletions
cmd/kubeadm/app/phases/certs/certs.go
View file @ 2860bd59
...@@ -39,14 +39,21 @@ func CreatePKIAssets(cfg *kubeadmapi.MasterConfiguration) error { ...@@ -39,14 +39,21 @@ func CreatePKIAssets(cfg *kubeadmapi.MasterConfiguration) error {
CreateCACertAndKeyFiles, CreateCACertAndKeyFiles,
CreateAPIServerCertAndKeyFiles, CreateAPIServerCertAndKeyFiles,
CreateAPIServerKubeletClientCertAndKeyFiles, CreateAPIServerKubeletClientCertAndKeyFiles,
CreateServiceAccountKeyAndPublicKeyFiles,
CreateFrontProxyCACertAndKeyFiles,
CreateFrontProxyClientCertAndKeyFiles,
}
etcdCertActions := []func(cfg *kubeadmapi.MasterConfiguration) error{
CreateEtcdCACertAndKeyFiles, CreateEtcdCACertAndKeyFiles,
CreateEtcdServerCertAndKeyFiles, CreateEtcdServerCertAndKeyFiles,
CreateEtcdPeerCertAndKeyFiles, CreateEtcdPeerCertAndKeyFiles,
CreateEtcdHealthcheckClientCertAndKeyFiles, CreateEtcdHealthcheckClientCertAndKeyFiles,
CreateAPIServerEtcdClientCertAndKeyFiles, CreateAPIServerEtcdClientCertAndKeyFiles,
CreateServiceAccountKeyAndPublicKeyFiles, }
CreateFrontProxyCACertAndKeyFiles,
CreateFrontProxyClientCertAndKeyFiles, // Currently this is the only way we have to identify static pod etcd vs external etcd
if len(cfg.Etcd.Endpoints) == 0 {
certActions = append(certActions, etcdCertActions...)
} }
for _, action := range certActions { for _, action := range certActions {
......
cmd/kubeadm/app/phases/certs/certs_test.go
View file @ 2860bd59
...@@ -603,6 +603,7 @@ func TestCreateCertificateFilesMethods(t *testing.T) { ...@@ -603,6 +603,7 @@ func TestCreateCertificateFilesMethods(t *testing.T) {
setupFunc func(cfg *kubeadmapi.MasterConfiguration) error setupFunc func(cfg *kubeadmapi.MasterConfiguration) error
createFunc func(cfg *kubeadmapi.MasterConfiguration) error createFunc func(cfg *kubeadmapi.MasterConfiguration) error
expectedFiles []string expectedFiles []string
externalEtcd bool
}{ }{
{ {
createFunc: CreatePKIAssets, createFunc: CreatePKIAssets,
...@@ -621,6 +622,18 @@ func TestCreateCertificateFilesMethods(t *testing.T) { ...@@ -621,6 +622,18 @@ func TestCreateCertificateFilesMethods(t *testing.T) {
}, },
}, },
{ {
createFunc: CreatePKIAssets,
externalEtcd: true,
expectedFiles: []string{
kubeadmconstants.CACertName, kubeadmconstants.CAKeyName,
kubeadmconstants.APIServerCertName, kubeadmconstants.APIServerKeyName,
kubeadmconstants.APIServerKubeletClientCertName, kubeadmconstants.APIServerKubeletClientKeyName,
kubeadmconstants.ServiceAccountPrivateKeyName, kubeadmconstants.ServiceAccountPublicKeyName,
kubeadmconstants.FrontProxyCACertName, kubeadmconstants.FrontProxyCAKeyName,
kubeadmconstants.FrontProxyClientCertName, kubeadmconstants.FrontProxyClientKeyName,
},
},
{
createFunc: CreateCACertAndKeyFiles, createFunc: CreateCACertAndKeyFiles,
expectedFiles: []string{kubeadmconstants.CACertName, kubeadmconstants.CAKeyName}, expectedFiles: []string{kubeadmconstants.CACertName, kubeadmconstants.CAKeyName},
}, },
...@@ -685,6 +698,10 @@ func TestCreateCertificateFilesMethods(t *testing.T) { ...@@ -685,6 +698,10 @@ func TestCreateCertificateFilesMethods(t *testing.T) {
CertificatesDir: tmpdir, CertificatesDir: tmpdir,
} }
if test.externalEtcd {
cfg.Etcd.Endpoints = []string{"192.168.1.1:2379"}
}
// executes setup func (if necessary) // executes setup func (if necessary)
if test.setupFunc != nil { if test.setupFunc != nil {
if err := test.setupFunc(cfg); err != nil { if err := test.setupFunc(cfg); err != nil {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment