Skip to content

K
k3s
Commit 49a13109 authored by Brad Davidson's avatar Brad Davidson Committed by Brad Davidson
Browse files
Options

Create new kubeconfig for supervisor use

Only actual admin actions should use the admin kubeconfig; everything done by the supervisor/deploy/helm controllers will now use a distinct account for audit purposes. Signed-off-by: 's avatarBrad Davidson <brad.davidson@rancher.com> (cherry picked from commit 64a5f58f)
parent d11adfd3
Hide whitespace changes
Inline Side-by-side
Showing with 33 additions and 17 deletions
pkg/cli/cmds/server.go
View file @ 49a13109
...@@ -15,10 +15,10 @@ const ( ...@@ -15,10 +15,10 @@ const (
) )
type StartupHookArgs struct { type StartupHookArgs struct {
APIServerReady <-chan struct{} APIServerReady <-chan struct{}
KubeConfigAdmin string KubeConfigSupervisor string
Skips map[string]bool Skips map[string]bool
Disables map[string]bool Disables map[string]bool
} }
type StartupHook func(context.Context, *sync.WaitGroup, StartupHookArgs) error type StartupHook func(context.Context, *sync.WaitGroup, StartupHookArgs) error
......
pkg/cli/etcdsnapshot/etcd_snapshot.go
View file @ 49a13109
...@@ -64,7 +64,7 @@ func commandSetup(app *cli.Context, cfg *cmds.Server, sc *server.Config) error { ...@@ -64,7 +64,7 @@ func commandSetup(app *cli.Context, cfg *cmds.Server, sc *server.Config) error {
sc.ControlConfig.Runtime.ETCDServerCA = filepath.Join(dataDir, "tls", "etcd", "server-ca.crt") sc.ControlConfig.Runtime.ETCDServerCA = filepath.Join(dataDir, "tls", "etcd", "server-ca.crt")
sc.ControlConfig.Runtime.ClientETCDCert = filepath.Join(dataDir, "tls", "etcd", "client.crt") sc.ControlConfig.Runtime.ClientETCDCert = filepath.Join(dataDir, "tls", "etcd", "client.crt")
sc.ControlConfig.Runtime.ClientETCDKey = filepath.Join(dataDir, "tls", "etcd", "client.key") sc.ControlConfig.Runtime.ClientETCDKey = filepath.Join(dataDir, "tls", "etcd", "client.key")
sc.ControlConfig.Runtime.KubeConfigAdmin = filepath.Join(dataDir, "cred", "admin.kubeconfig") sc.ControlConfig.Runtime.KubeConfigSupervisor = filepath.Join(dataDir, "cred", "supervisor.kubeconfig")
return nil return nil
} }
...@@ -115,7 +115,7 @@ func save(app *cli.Context, cfg *cmds.Server) error { ...@@ -115,7 +115,7 @@ func save(app *cli.Context, cfg *cmds.Server) error {
return err return err
} }
sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigAdmin) sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigSupervisor)
if err != nil { if err != nil {
return err return err
} }
...@@ -149,7 +149,7 @@ func delete(app *cli.Context, cfg *cmds.Server) error { ...@@ -149,7 +149,7 @@ func delete(app *cli.Context, cfg *cmds.Server) error {
return err return err
} }
sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigAdmin) sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigSupervisor)
if err != nil { if err != nil {
return err return err
} }
...@@ -255,7 +255,7 @@ func prune(app *cli.Context, cfg *cmds.Server) error { ...@@ -255,7 +255,7 @@ func prune(app *cli.Context, cfg *cmds.Server) error {
return err return err
} }
sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigAdmin) sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigSupervisor)
if err != nil { if err != nil {
return err return err
} }
......
pkg/daemons/config/types.go
View file @ 49a13109
...@@ -293,6 +293,7 @@ type ControlRuntime struct { ...@@ -293,6 +293,7 @@ type ControlRuntime struct {
ServiceCurrentKey string ServiceCurrentKey string
KubeConfigAdmin string KubeConfigAdmin string
KubeConfigSupervisor string
KubeConfigController string KubeConfigController string
KubeConfigScheduler string KubeConfigScheduler string
KubeConfigAPIServer string KubeConfigAPIServer string
...@@ -316,6 +317,8 @@ type ControlRuntime struct { ...@@ -316,6 +317,8 @@ type ControlRuntime struct {
ClientAdminCert string ClientAdminCert string
ClientAdminKey string ClientAdminKey string
ClientSupervisorCert string
ClientSupervisorKey string
ClientControllerCert string ClientControllerCert string
ClientControllerKey string ClientControllerKey string
ClientSchedulerCert string ClientSchedulerCert string
......
pkg/daemons/control/deps/deps.go
View file @ 49a13109
...@@ -119,6 +119,7 @@ func CreateRuntimeCertFiles(config *config.Control) { ...@@ -119,6 +119,7 @@ func CreateRuntimeCertFiles(config *config.Control) {
runtime.ServiceCurrentKey = filepath.Join(config.DataDir, "tls", "service.current.key") runtime.ServiceCurrentKey = filepath.Join(config.DataDir, "tls", "service.current.key")
runtime.KubeConfigAdmin = filepath.Join(config.DataDir, "cred", "admin.kubeconfig") runtime.KubeConfigAdmin = filepath.Join(config.DataDir, "cred", "admin.kubeconfig")
runtime.KubeConfigSupervisor = filepath.Join(config.DataDir, "cred", "supervisor.kubeconfig")
runtime.KubeConfigController = filepath.Join(config.DataDir, "cred", "controller.kubeconfig") runtime.KubeConfigController = filepath.Join(config.DataDir, "cred", "controller.kubeconfig")
runtime.KubeConfigScheduler = filepath.Join(config.DataDir, "cred", "scheduler.kubeconfig") runtime.KubeConfigScheduler = filepath.Join(config.DataDir, "cred", "scheduler.kubeconfig")
runtime.KubeConfigAPIServer = filepath.Join(config.DataDir, "cred", "api-server.kubeconfig") runtime.KubeConfigAPIServer = filepath.Join(config.DataDir, "cred", "api-server.kubeconfig")
...@@ -126,6 +127,8 @@ func CreateRuntimeCertFiles(config *config.Control) { ...@@ -126,6 +127,8 @@ func CreateRuntimeCertFiles(config *config.Control) {
runtime.ClientAdminCert = filepath.Join(config.DataDir, "tls", "client-admin.crt") runtime.ClientAdminCert = filepath.Join(config.DataDir, "tls", "client-admin.crt")
runtime.ClientAdminKey = filepath.Join(config.DataDir, "tls", "client-admin.key") runtime.ClientAdminKey = filepath.Join(config.DataDir, "tls", "client-admin.key")
runtime.ClientSupervisorCert = filepath.Join(config.DataDir, "tls", "client-supervisor.crt")
runtime.ClientSupervisorKey = filepath.Join(config.DataDir, "tls", "client-supervisor.key")
runtime.ClientControllerCert = filepath.Join(config.DataDir, "tls", "client-controller.crt") runtime.ClientControllerCert = filepath.Join(config.DataDir, "tls", "client-controller.crt")
runtime.ClientControllerKey = filepath.Join(config.DataDir, "tls", "client-controller.key") runtime.ClientControllerKey = filepath.Join(config.DataDir, "tls", "client-controller.key")
runtime.ClientCloudControllerCert = filepath.Join(config.DataDir, "tls", "client-"+version.Program+"-cloud-controller.crt") runtime.ClientCloudControllerCert = filepath.Join(config.DataDir, "tls", "client-"+version.Program+"-cloud-controller.crt")
...@@ -351,6 +354,16 @@ func genClientCerts(config *config.Control) error { ...@@ -351,6 +354,16 @@ func genClientCerts(config *config.Control) error {
} }
} }
certGen, err = factory("system:"+version.Program+"-supervisor", []string{user.SystemPrivilegedGroup}, runtime.ClientSupervisorCert, runtime.ClientSupervisorKey)
if err != nil {
return err
}
if certGen {
if err := KubeConfig(runtime.KubeConfigSupervisor, apiEndpoint, runtime.ServerCA, runtime.ClientSupervisorCert, runtime.ClientSupervisorKey); err != nil {
return err
}
}
certGen, err = factory(user.KubeControllerManager, nil, runtime.ClientControllerCert, runtime.ClientControllerKey) certGen, err = factory(user.KubeControllerManager, nil, runtime.ClientControllerCert, runtime.ClientControllerKey)
if err != nil { if err != nil {
return err return err
......
pkg/daemons/control/server.go
View file @ 49a13109
...@@ -371,7 +371,7 @@ func cloudControllerManager(ctx context.Context, cfg *config.Control) error { ...@@ -371,7 +371,7 @@ func cloudControllerManager(ctx context.Context, cfg *config.Control) error {
// If the CCM RBAC changes, the ResourceAttributes checked for by this function should // If the CCM RBAC changes, the ResourceAttributes checked for by this function should
// be modified to check for the most recently added privilege. // be modified to check for the most recently added privilege.
func checkForCloudControllerPrivileges(ctx context.Context, runtime *config.ControlRuntime, timeout time.Duration) error { func checkForCloudControllerPrivileges(ctx context.Context, runtime *config.ControlRuntime, timeout time.Duration) error {
return util.WaitForRBACReady(ctx, runtime.KubeConfigAdmin, timeout, authorizationv1.ResourceAttributes{ return util.WaitForRBACReady(ctx, runtime.KubeConfigSupervisor, timeout, authorizationv1.ResourceAttributes{
Namespace: metav1.NamespaceSystem, Namespace: metav1.NamespaceSystem,
Verb: "watch", Verb: "watch",
Resource: "endpointslices", Resource: "endpointslices",
...@@ -412,7 +412,7 @@ func waitForAPIServerInBackground(ctx context.Context, runtime *config.ControlRu ...@@ -412,7 +412,7 @@ func waitForAPIServerInBackground(ctx context.Context, runtime *config.ControlRu
select { select {
case <-ctx.Done(): case <-ctx.Done():
return return
case err := <-promise(func() error { return util.WaitForAPIServerReady(ctx, runtime.KubeConfigAdmin, 30*time.Second) }): case err := <-promise(func() error { return util.WaitForAPIServerReady(ctx, runtime.KubeConfigSupervisor, 30*time.Second) }):
if err != nil { if err != nil {
logrus.Infof("Waiting for API server to become available") logrus.Infof("Waiting for API server to become available")
continue continue
......
pkg/server/server.go
View file @ 49a13109
...@@ -70,10 +70,10 @@ func StartServer(ctx context.Context, config *Config, cfg *cmds.Server) error { ...@@ -70,10 +70,10 @@ func StartServer(ctx context.Context, config *Config, cfg *cmds.Server) error {
config.ControlConfig.Runtime.StartupHooksWg = wg config.ControlConfig.Runtime.StartupHooksWg = wg
shArgs := cmds.StartupHookArgs{ shArgs := cmds.StartupHookArgs{
APIServerReady: config.ControlConfig.Runtime.APIServerReady, APIServerReady: config.ControlConfig.Runtime.APIServerReady,
KubeConfigAdmin: config.ControlConfig.Runtime.KubeConfigAdmin, KubeConfigSupervisor: config.ControlConfig.Runtime.KubeConfigSupervisor,
Skips: config.ControlConfig.Skips, Skips: config.ControlConfig.Skips,
Disables: config.ControlConfig.Disables, Disables: config.ControlConfig.Disables,
} }
for _, hook := range config.StartupHooks { for _, hook := range config.StartupHooks {
if err := hook(ctx, wg, shArgs); err != nil { if err := hook(ctx, wg, shArgs); err != nil {
...@@ -104,7 +104,7 @@ func startOnAPIServerReady(ctx context.Context, config *Config) { ...@@ -104,7 +104,7 @@ func startOnAPIServerReady(ctx context.Context, config *Config) {
func runControllers(ctx context.Context, config *Config) error { func runControllers(ctx context.Context, config *Config) error {
controlConfig := &config.ControlConfig controlConfig := &config.ControlConfig
sc, err := NewContext(ctx, controlConfig.Runtime.KubeConfigAdmin) sc, err := NewContext(ctx, controlConfig.Runtime.KubeConfigSupervisor)
if err != nil { if err != nil {
return errors.Wrap(err, "failed to create new server context") return errors.Wrap(err, "failed to create new server context")
} }
...@@ -212,7 +212,7 @@ func coreControllers(ctx context.Context, sc *Context, config *Config) error { ...@@ -212,7 +212,7 @@ func coreControllers(ctx context.Context, sc *Context, config *Config) error {
} }
if !config.ControlConfig.DisableHelmController { if !config.ControlConfig.DisableHelmController {
restConfig, err := clientcmd.BuildConfigFromFlags("", config.ControlConfig.Runtime.KubeConfigAdmin) restConfig, err := clientcmd.BuildConfigFromFlags("", config.ControlConfig.Runtime.KubeConfigSupervisor)
if err != nil { if err != nil {
return err return err
} }
...@@ -293,7 +293,7 @@ func stageFiles(ctx context.Context, sc *Context, controlConfig *config.Control) ...@@ -293,7 +293,7 @@ func stageFiles(ctx context.Context, sc *Context, controlConfig *config.Control)
return err return err
} }
restConfig, err := clientcmd.BuildConfigFromFlags("", controlConfig.Runtime.KubeConfigAdmin) restConfig, err := clientcmd.BuildConfigFromFlags("", controlConfig.Runtime.KubeConfigSupervisor)
if err != nil { if err != nil {
return err return err
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment