Skip to content

K
k3s
Commit 4a15d32b authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #50762 from jamiehannaford/kubeadm-gated-secrets

Automatic merge from submit-queue (batch tested with PRs 41901, 50762, 50756) Feature-gate self-hosted secrets **What this PR does / why we need it**: Feature gates now select whether secrets are used for TLS cert storage in self-hosted clusters. **Release note**: ```release-note TLS cert storage for self-hosted clusters is now configurable. You can store them as secrets (alpha) or as usual host mounts. ``` /cc @luxas
parents 4032896e abedc49b
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 220 additions and 172 deletions
cmd/kubeadm/app/cmd/features/features.go
View file @ 4a15d32b
...@@ -33,8 +33,7 @@ type FeatureList map[utilfeature.Feature]utilfeature.FeatureSpec ...@@ -33,8 +33,7 @@ type FeatureList map[utilfeature.Feature]utilfeature.FeatureSpec
// Enabled indicates whether a feature name has been enabled // Enabled indicates whether a feature name has been enabled
func Enabled(featureList map[string]bool, featureName utilfeature.Feature) bool { func Enabled(featureList map[string]bool, featureName utilfeature.Feature) bool {
_, ok := featureList[string(featureName)] return featureList[string(featureName)]
return ok
} }
// Supports indicates whether a feature name is supported on the given // Supports indicates whether a feature name is supported on the given
......
cmd/kubeadm/app/phases/selfhosting/BUILD
View file @ 4a15d32b
...@@ -16,6 +16,7 @@ go_test( ...@@ -16,6 +16,7 @@ go_test(
library = ":go_default_library", library = ":go_default_library",
deps = [ deps = [
"//cmd/kubeadm/app/apis/kubeadm:go_default_library", "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
"//cmd/kubeadm/app/cmd/features:go_default_library",
"//cmd/kubeadm/app/constants:go_default_library", "//cmd/kubeadm/app/constants:go_default_library",
"//vendor/github.com/ghodss/yaml:go_default_library", "//vendor/github.com/ghodss/yaml:go_default_library",
"//vendor/k8s.io/api/core/v1:go_default_library", "//vendor/k8s.io/api/core/v1:go_default_library",
...@@ -31,6 +32,7 @@ go_library( ...@@ -31,6 +32,7 @@ go_library(
], ],
deps = [ deps = [
"//cmd/kubeadm/app/apis/kubeadm:go_default_library", "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
"//cmd/kubeadm/app/cmd/features:go_default_library",
"//cmd/kubeadm/app/constants:go_default_library", "//cmd/kubeadm/app/constants:go_default_library",
"//cmd/kubeadm/app/util/apiclient:go_default_library", "//cmd/kubeadm/app/util/apiclient:go_default_library",
"//pkg/api:go_default_library", "//pkg/api:go_default_library",
......
cmd/kubeadm/app/phases/selfhosting/podspec_mutation.go
View file @ 4a15d32b
...@@ -79,7 +79,7 @@ func setRightDNSPolicyOnPodSpec(cfg *kubeadmapi.MasterConfiguration, podSpec *v1 ...@@ -79,7 +79,7 @@ func setRightDNSPolicyOnPodSpec(cfg *kubeadmapi.MasterConfiguration, podSpec *v1
// setVolumesOnKubeAPIServerPodSpec makes sure the self-hosted api server has the required files // setVolumesOnKubeAPIServerPodSpec makes sure the self-hosted api server has the required files
func setVolumesOnKubeAPIServerPodSpec(cfg *kubeadmapi.MasterConfiguration, podSpec *v1.PodSpec) { func setVolumesOnKubeAPIServerPodSpec(cfg *kubeadmapi.MasterConfiguration, podSpec *v1.PodSpec) {
setK8sVolume(apiServerProjectedVolume, cfg, podSpec) setK8sVolume(apiServerVolume, cfg, podSpec)
for _, c := range podSpec.Containers { for _, c := range podSpec.Containers {
c.VolumeMounts = append(c.VolumeMounts, k8sSelfHostedVolumeMount()) c.VolumeMounts = append(c.VolumeMounts, k8sSelfHostedVolumeMount())
} }
...@@ -87,7 +87,7 @@ func setVolumesOnKubeAPIServerPodSpec(cfg *kubeadmapi.MasterConfiguration, podSp ...@@ -87,7 +87,7 @@ func setVolumesOnKubeAPIServerPodSpec(cfg *kubeadmapi.MasterConfiguration, podSp
// setVolumesOnKubeControllerManagerPodSpec makes sure the self-hosted controller manager has the required files // setVolumesOnKubeControllerManagerPodSpec makes sure the self-hosted controller manager has the required files
func setVolumesOnKubeControllerManagerPodSpec(cfg *kubeadmapi.MasterConfiguration, podSpec *v1.PodSpec) { func setVolumesOnKubeControllerManagerPodSpec(cfg *kubeadmapi.MasterConfiguration, podSpec *v1.PodSpec) {
setK8sVolume(controllerManagerProjectedVolume, cfg, podSpec) setK8sVolume(controllerManagerVolume, cfg, podSpec)
for _, c := range podSpec.Containers { for _, c := range podSpec.Containers {
c.VolumeMounts = append(c.VolumeMounts, k8sSelfHostedVolumeMount()) c.VolumeMounts = append(c.VolumeMounts, k8sSelfHostedVolumeMount())
} }
...@@ -95,7 +95,7 @@ func setVolumesOnKubeControllerManagerPodSpec(cfg *kubeadmapi.MasterConfiguratio ...@@ -95,7 +95,7 @@ func setVolumesOnKubeControllerManagerPodSpec(cfg *kubeadmapi.MasterConfiguratio
// setVolumesOnKubeSchedulerPodSpec makes sure the self-hosted scheduler has the required files // setVolumesOnKubeSchedulerPodSpec makes sure the self-hosted scheduler has the required files
func setVolumesOnKubeSchedulerPodSpec(cfg *kubeadmapi.MasterConfiguration, podSpec *v1.PodSpec) { func setVolumesOnKubeSchedulerPodSpec(cfg *kubeadmapi.MasterConfiguration, podSpec *v1.PodSpec) {
setK8sVolume(schedulerProjectedVolume, cfg, podSpec) setK8sVolume(schedulerVolume, cfg, podSpec)
for _, c := range podSpec.Containers { for _, c := range podSpec.Containers {
c.VolumeMounts = append(c.VolumeMounts, k8sSelfHostedVolumeMount()) c.VolumeMounts = append(c.VolumeMounts, k8sSelfHostedVolumeMount())
} }
......
cmd/kubeadm/app/phases/selfhosting/selfhosting.go
View file @ 4a15d32b
...@@ -28,6 +28,7 @@ import ( ...@@ -28,6 +28,7 @@ import (
kuberuntime "k8s.io/apimachinery/pkg/runtime" kuberuntime "k8s.io/apimachinery/pkg/runtime"
clientset "k8s.io/client-go/kubernetes" clientset "k8s.io/client-go/kubernetes"
kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm" kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
"k8s.io/kubernetes/cmd/kubeadm/app/cmd/features"
kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants" kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
"k8s.io/kubernetes/cmd/kubeadm/app/util/apiclient" "k8s.io/kubernetes/cmd/kubeadm/app/util/apiclient"
"k8s.io/kubernetes/pkg/api" "k8s.io/kubernetes/pkg/api"
...@@ -46,12 +47,13 @@ import ( ...@@ -46,12 +47,13 @@ import (
// 9. Do that for the kube-apiserver, kube-controller-manager and kube-scheduler in a loop // 9. Do that for the kube-apiserver, kube-controller-manager and kube-scheduler in a loop
func CreateSelfHostedControlPlane(cfg *kubeadmapi.MasterConfiguration, client clientset.Interface) error { func CreateSelfHostedControlPlane(cfg *kubeadmapi.MasterConfiguration, client clientset.Interface) error {
if err := createTLSSecrets(cfg, client); err != nil { if features.Enabled(cfg.FeatureFlags, features.StoreCertsInSecrets) {
return err if err := createTLSSecrets(cfg, client); err != nil {
} return err
}
if err := createOpaqueSecrets(cfg, client); err != nil { if err := createOpaqueSecrets(cfg, client); err != nil {
return err return err
}
} }
for _, componentName := range kubeadmconstants.MasterComponents { for _, componentName := range kubeadmconstants.MasterComponents {
......
cmd/kubeadm/app/phases/selfhosting/selfhosting_volumes.go
View file @ 4a15d32b
...@@ -25,9 +25,15 @@ import ( ...@@ -25,9 +25,15 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
clientset "k8s.io/client-go/kubernetes" clientset "k8s.io/client-go/kubernetes"
kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm" kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
"k8s.io/kubernetes/cmd/kubeadm/app/cmd/features"
kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants" kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
) )
const (
volumeName = "k8s"
volumeMountName = "k8s"
)
type tlsKeyPair struct { type tlsKeyPair struct {
name string name string
cert string cert string
...@@ -36,16 +42,16 @@ type tlsKeyPair struct { ...@@ -36,16 +42,16 @@ type tlsKeyPair struct {
func k8sSelfHostedVolumeMount() v1.VolumeMount { func k8sSelfHostedVolumeMount() v1.VolumeMount {
return v1.VolumeMount{ return v1.VolumeMount{
Name: "k8s", Name: volumeMountName,
MountPath: kubeadmconstants.KubernetesDir, MountPath: kubeadmconstants.KubernetesDir,
ReadOnly: true, ReadOnly: true,
} }
} }
func apiServerProjectedVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume { func apiServerVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume {
return v1.Volume{ var volumeSource v1.VolumeSource
Name: "k8s", if features.Enabled(cfg.FeatureFlags, features.StoreCertsInSecrets) {
VolumeSource: v1.VolumeSource{ volumeSource = v1.VolumeSource{
Projected: &v1.ProjectedVolumeSource{ Projected: &v1.ProjectedVolumeSource{
Sources: []v1.VolumeProjection{ Sources: []v1.VolumeProjection{
{ {
...@@ -148,14 +154,24 @@ func apiServerProjectedVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume { ...@@ -148,14 +154,24 @@ func apiServerProjectedVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume {
}, },
}, },
}, },
}, }
} else {
volumeSource = v1.VolumeSource{
HostPath: &v1.HostPathVolumeSource{
Path: kubeadmconstants.KubernetesDir,
},
}
}
return v1.Volume{
Name: volumeName,
VolumeSource: volumeSource,
} }
} }
func schedulerProjectedVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume { func schedulerVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume {
return v1.Volume{ var volumeSource v1.VolumeSource
Name: "k8s", if features.Enabled(cfg.FeatureFlags, features.StoreCertsInSecrets) {
VolumeSource: v1.VolumeSource{ volumeSource = v1.VolumeSource{
Projected: &v1.ProjectedVolumeSource{ Projected: &v1.ProjectedVolumeSource{
Sources: []v1.VolumeProjection{ Sources: []v1.VolumeProjection{
{ {
...@@ -167,14 +183,24 @@ func schedulerProjectedVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume { ...@@ -167,14 +183,24 @@ func schedulerProjectedVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume {
}, },
}, },
}, },
}, }
} else {
volumeSource = v1.VolumeSource{
HostPath: &v1.HostPathVolumeSource{
Path: kubeadmconstants.KubernetesDir,
},
}
}
return v1.Volume{
Name: volumeName,
VolumeSource: volumeSource,
} }
} }
func controllerManagerProjectedVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume { func controllerManagerVolume(cfg *kubeadmapi.MasterConfiguration) v1.Volume {
return v1.Volume{ var volumeSource v1.VolumeSource
Name: "k8s", if features.Enabled(cfg.FeatureFlags, features.StoreCertsInSecrets) {
VolumeSource: v1.VolumeSource{ volumeSource = v1.VolumeSource{
Projected: &v1.ProjectedVolumeSource{ Projected: &v1.ProjectedVolumeSource{
Sources: []v1.VolumeProjection{ Sources: []v1.VolumeProjection{
{ {
...@@ -216,7 +242,17 @@ func controllerManagerProjectedVolume(cfg *kubeadmapi.MasterConfiguration) v1.Vo ...@@ -216,7 +242,17 @@ func controllerManagerProjectedVolume(cfg *kubeadmapi.MasterConfiguration) v1.Vo
}, },
}, },
}, },
}, }
} else {
volumeSource = v1.VolumeSource{
HostPath: &v1.HostPathVolumeSource{
Path: kubeadmconstants.KubernetesDir,
},
}
}
return v1.Volume{
Name: volumeName,
VolumeSource: volumeSource,
} }
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment