Generate and approve CSRs for conntrol-plane and static workers nodes #1750
Conversation
kubermatic-bot
added
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
kubermatic-bot
added
approved
kron4eg
force-pushed
the
cp-csrs
branch
4 times, most recently
from
2110551
to
2a0e7ca
Compare
kubermatic-bot
added
size/L
kubermatic-bot
removed
the
do-not-merge/work-in-progress
Signed-off-by: Artiom Diomin <kron82@gmail.com>
Signed-off-by: Artiom Diomin <kron82@gmail.com>
|
/assign @xmudrii |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ahmedwaleedmalik, kron4eg The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
LGTM label has been added. Git tree hash: f75eb598de77f6ea6107ce63d37516893d313453
|
| // Need to wait for the second CSR to appear | ||
| time.Sleep(20 * time.Second) |
There was a problem hiding this comment.
I think we should leave a log message that KubeOne is waiting 20 seconds for CSRs to appear. We already do that when we wait for other tasks (e.g. for the control plane instance to come up).
| if fmt.Sprintf("%s:%s", nodeUser, node.Hostname) != spec.Username { | ||
| return errors.New("") | ||
| } | ||
|
|
||
| if !sets.NewString(spec.Groups...).HasAll(groupNodes, groupAuthenticated) { | ||
| return errors.New("") | ||
| } | ||
|
|
||
| for _, usage := range spec.Usages { | ||
| if !isUsageInUsageList(usage, allowedUsages) { | ||
| return errors.New("") | ||
| } | ||
| } |
There was a problem hiding this comment.
Why is this returning empty errors?
| csrBlock, rest := pem.Decode(spec.Request) | ||
| if csrBlock == nil { | ||
| return fmt.Errorf("no certificate request found for the given CSR") | ||
| } | ||
|
|
||
| if len(rest) != 0 { | ||
| return fmt.Errorf("found more than one PEM encoded block in the result") | ||
| } |
There was a problem hiding this comment.
Why don't we use errors.New() here?
What this PR does / why we need it:
Fixes the issue that kubelets on control-plane and static workers nodes are service requests under self-signed certificates.
Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when PR gets merged):Fixes #1093
Special notes for your reviewer:
Does this PR introduce a user-facing change?: