Remove the old Kubelet TLS Bootstrapping mode

cmd/kubeadm/app/BUILD

@@ -32,7 +32,6 @@ filegroup(
         "//cmd/kubeadm/app/discovery:all-srcs",
         "//cmd/kubeadm/app/features:all-srcs",
         "//cmd/kubeadm/app/images:all-srcs",
-        "//cmd/kubeadm/app/node:all-srcs",
         "//cmd/kubeadm/app/phases/addons/dns:all-srcs",
         "//cmd/kubeadm/app/phases/addons/proxy:all-srcs",
         "//cmd/kubeadm/app/phases/bootstraptoken/clusterinfo:all-srcs",

cmd/kubeadm/app/cmd/BUILD

@@ -29,7 +29,6 @@ go_library(
         "//cmd/kubeadm/app/discovery:go_default_library",
         "//cmd/kubeadm/app/features:go_default_library",
         "//cmd/kubeadm/app/images:go_default_library",
-        "//cmd/kubeadm/app/node:go_default_library",
         "//cmd/kubeadm/app/phases/addons/dns:go_default_library",
         "//cmd/kubeadm/app/phases/addons/proxy:go_default_library",
         "//cmd/kubeadm/app/phases/bootstraptoken/clusterinfo:go_default_library",

cmd/kubeadm/app/cmd/join.go

@@ -33,7 +33,6 @@ import (
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	"k8s.io/kubernetes/cmd/kubeadm/app/discovery"
-	kubeadmnode "k8s.io/kubernetes/cmd/kubeadm/app/node"
 	"k8s.io/kubernetes/cmd/kubeadm/app/preflight"
 	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
 	kubeconfigutil "k8s.io/kubernetes/cmd/kubeadm/app/util/kubeconfig"
@@ -218,30 +217,8 @@ func (j *Join) Run(out io.Writer) error {
 		return err
 	}
 
-	client, err := kubeconfigutil.ToClientSet(cfg)
-	if err != nil {
-		return err
-	}
-	if err := kubeadmnode.ValidateAPIServer(client); err != nil {
-		return err
-	}
-
 	kubeconfigFile := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletBootstrapKubeConfigFileName)
 
-	// Depending on the kubelet version, we might perform the TLS bootstrap or not
-	kubeletVersion, err := preflight.GetKubeletVersion()
-	// In case the command executed successfully and returned v1.7-something, we'll perform TLS Bootstrapping
-	// Otherwise, just assume v1.8
-	// TODO: In the beginning of the v1.9 cycle, we can remove the logic as we then don't support v1.7 anymore
-	if err == nil && kubeletVersion.Major() == 1 && kubeletVersion.Minor() == 7 {
-		hostname := nodeutil.GetHostname(j.cfg.NodeName)
-		if err := kubeadmnode.PerformTLSBootstrap(cfg, hostname); err != nil {
-			return err
-		}
-		// As we now performed the TLS Bootstrap, change the filepath to be kubelet.conf instead of bootstrap-kubelet.conf
-		kubeconfigFile = filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletKubeConfigFileName)
-	}
-
 	// Write the bootstrap kubelet config file or the TLS-Boostrapped kubelet config file down to disk
 	if err := kubeconfigutil.WriteToDisk(kubeconfigFile, cfg); err != nil {
 		return err

cmd/kubeadm/app/node/BUILD

-package(default_visibility = ["//visibility:public"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-    "go_test",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "csr.go",
-        "validate.go",
-    ],
-    deps = [
-        "//cmd/kubeadm/app/util/kubeconfig:go_default_library",
-        "//pkg/kubelet/util/csr:go_default_library",
-        "//vendor/k8s.io/api/certificates/v1beta1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-        "//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
-        "//vendor/k8s.io/client-go/util/cert:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = ["validate_test.go"],
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/version:go_default_library",
-        "//vendor/k8s.io/client-go/discovery:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-        "//vendor/k8s.io/client-go/rest:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)

cmd/kubeadm/app/node/csr.go

-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package node
-
-import (
-	"fmt"
-
-	"k8s.io/apimachinery/pkg/types"
-	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
-	certutil "k8s.io/client-go/util/cert"
-	kubeconfigutil "k8s.io/kubernetes/cmd/kubeadm/app/util/kubeconfig"
-	"k8s.io/kubernetes/pkg/kubelet/util/csr"
-)
-
-// CSRContextAndUser defines the context to use for the client certs in the kubelet kubeconfig file
-const CSRContextAndUser = "kubelet-csr"
-
-// PerformTLSBootstrap executes a node certificate signing request.
-func PerformTLSBootstrap(cfg *clientcmdapi.Config, hostName string) error {
-	client, err := kubeconfigutil.ToClientSet(cfg)
-	if err != nil {
-		return err
-	}
-
-	fmt.Println("[csr] Created API client to obtain unique certificate for this node, generating keys and certificate signing request")
-
-	key, err := certutil.MakeEllipticPrivateKeyPEM()
-	if err != nil {
-		return fmt.Errorf("failed to generate private key [%v]", err)
-	}
-
-	cert, err := csr.RequestNodeCertificate(client.CertificatesV1beta1().CertificateSigningRequests(), key, types.NodeName(hostName))
-	if err != nil {
-		return fmt.Errorf("failed to request signed certificate from the API server [%v]", err)
-	}
-	fmt.Println("[csr] Received signed certificate from the API server, generating KubeConfig...")
-
-	cfg.AuthInfos[CSRContextAndUser] = &clientcmdapi.AuthInfo{
-		ClientKeyData:         key,
-		ClientCertificateData: cert,
-	}
-	cfg.Contexts[CSRContextAndUser] = &clientcmdapi.Context{
-		AuthInfo: CSRContextAndUser,
-		Cluster:  cfg.Contexts[cfg.CurrentContext].Cluster,
-	}
-	cfg.CurrentContext = CSRContextAndUser
-	return nil
-}

cmd/kubeadm/app/node/validate.go

-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package node
-
-import (
-	"fmt"
-
-	certsapi "k8s.io/api/certificates/v1beta1"
-	clientset "k8s.io/client-go/kubernetes"
-)
-
-// ValidateAPIServer makes sure the server we're connecting to supports the Beta Certificates API
-func ValidateAPIServer(client clientset.Interface) error {
-	version, err := client.Discovery().ServerVersion()
-	if err != nil {
-		return fmt.Errorf("failed to check server version: %v", err)
-	}
-	fmt.Printf("[bootstrap] Detected server version: %s\n", version.String())
-
-	// Check certificates API. If the server supports the version of the Certificates API we're using, we're good to go
-	serverGroups, err := client.Discovery().ServerGroups()
-	if err != nil {
-		return fmt.Errorf("certificate API check failed: failed to retrieve a list of supported API objects [%v]", err)
-	}
-	for _, group := range serverGroups.Groups {
-		if group.Name == certsapi.SchemeGroupVersion.Group {
-			for _, version := range group.Versions {
-				if version.Version == certsapi.SchemeGroupVersion.Version {
-					fmt.Printf("[bootstrap] The server supports the Certificates API (%s/%s)\n", certsapi.SchemeGroupVersion.Group, certsapi.SchemeGroupVersion.Version)
-					return nil
-				}
-			}
-		}
-	}
-	return fmt.Errorf("certificate API check failed: API server with version %s doesn't support Certificates API (%s/%s), use v1.6.0 or newer",
-		version.String(), certsapi.SchemeGroupVersion.Group, certsapi.SchemeGroupVersion.Version)
-}

cmd/kubeadm/app/node/validate_test.go

-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package node
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/version"
-	"k8s.io/client-go/discovery"
-	clientset "k8s.io/client-go/kubernetes"
-	restclient "k8s.io/client-go/rest"
-)
-
-func TestValidateAPIServer(t *testing.T) {
-	expect := version.Info{
-		Major:     "foo",
-		Minor:     "bar",
-		GitCommit: "baz",
-	}
-	tests := []struct {
-		s      *httptest.Server
-		expect bool
-	}{
-		{
-			s:      httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {})),
-			expect: false,
-		},
-		{
-			s: httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-				var obj interface{}
-				switch req.URL.Path {
-				case "/api":
-					obj = &metav1.APIVersions{
-						Versions: []string{
-							"v1.6.0",
-						},
-					}
-					output, err := json.Marshal(obj)
-					if err != nil {
-						t.Fatalf("unexpected encoding error: %v", err)
-						return
-					}
-					w.Header().Set("Content-Type", "application/json")
-					w.WriteHeader(http.StatusOK)
-					w.Write(output)
-				default:
-					output, err := json.Marshal(expect)
-					if err != nil {
-						t.Errorf("unexpected encoding error: %v", err)
-						return
-					}
-					w.Header().Set("Content-Type", "application/json")
-					w.WriteHeader(http.StatusOK)
-					w.Write(output)
-				}
-			})),
-			expect: false,
-		},
-		{
-			s: httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-				var obj interface{}
-				switch req.URL.Path {
-				case "/api":
-					obj = &metav1.APIVersions{
-						Versions: []string{
-							"v1.6.0",
-						},
-					}
-					output, err := json.Marshal(obj)
-					if err != nil {
-						t.Fatalf("unexpected encoding error: %v", err)
-						return
-					}
-					w.Header().Set("Content-Type", "application/json")
-					w.WriteHeader(http.StatusOK)
-					w.Write(output)
-				case "/apis":
-					obj = &metav1.APIGroupList{
-						Groups: []metav1.APIGroup{
-							{
-								Name: "certificates.k8s.io",
-								Versions: []metav1.GroupVersionForDiscovery{
-									{GroupVersion: "certificates.k8s.io/v1beta1", Version: "v1beta1"},
-								},
-							},
-						},
-					}
-					output, err := json.Marshal(obj)
-					if err != nil {
-						t.Fatalf("unexpected encoding error: %v", err)
-						return
-					}
-					w.Header().Set("Content-Type", "application/json")
-					w.WriteHeader(http.StatusOK)
-					w.Write(output)
-				default:
-					output, err := json.Marshal(expect)
-					if err != nil {
-						t.Errorf("unexpected encoding error: %v", err)
-						return
-					}
-					w.Header().Set("Content-Type", "application/json")
-					w.WriteHeader(http.StatusOK)
-					w.Write(output)
-				}
-			})),
-			expect: true,
-		},
-	}
-	for _, rt := range tests {
-		defer rt.s.Close()
-		rc := &restclient.Config{Host: rt.s.URL}
-		c, err := discovery.NewDiscoveryClientForConfig(rc)
-		if err != nil {
-			t.Fatalf("encountered an error while trying to get the new discovery client: %v", err)
-		}
-		cs := &clientset.Clientset{DiscoveryClient: c}
-		actual := ValidateAPIServer(cs)
-		if (actual == nil) != rt.expect {
-			t.Errorf(
-				"failed TestValidateAPIServer:\n\texpected: %t\n\t  actual: %t",
-				rt.expect,
-				(actual == nil),
-			)
-		}
-	}
-}