When bootstrapping a client cert, store it with other client certs #62152
Conversation
k8s-ci-robot
added
size/L
smarterclayton
force-pushed
the
use_client_store
branch
from
422a136
to
2c3778e
Compare
|
/test pull-kubernetes-verify |
1 similar comment
|
/test pull-kubernetes-verify |
|
We've noticed weird corruptions of the kubeconfig after a bootstrap, e.g. "server.go:140] tls: failed to find any PEM data in certificate input". I wonder if the recovery in filestore will do better then the old LoadClientCert. |
|
The atomic swap should help. |
k8s-ci-robot
added
release-note
| } | ||
| } | ||
| }() | ||
| } | ||
| if keyData == nil { |
There was a problem hiding this comment.
len(keyData) == 0. Should we do any other integrity checks here?
There was a problem hiding this comment.
Probably. Let me noodle it.
There was a problem hiding this comment.
Updated with sanity checking that it's a valid private key at minimum.
|
One comment, otherwise LGTM. |
The kubelet uses two different locations to store certificates on initial bootstrap and then on subsequent rotation: * bootstrap: certDir/kubelet-client.(crt|key) * rotation: certDir/kubelet-client-(DATE|current).pem Bootstrap also creates an initial node.kubeconfig that points to the certs. Unfortunately, with short rotation the node.kubeconfig then becomes out of date because it points to the initial cert/key, not the rotated cert key. Alter the bootstrap code to store client certs exactly as if they would be rotated (using the same cert Store code), and reference the PEM file containing cert/key from node.kubeconfig, which is supported by kubectl and other Go tooling. This ensures that the node.kubeconfig continues to be valid past the first expiration.
smarterclayton
force-pushed
the
use_client_store
branch
from
2c3778e
to
3689593
Compare
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mikedanese, smarterclayton The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest |
1 similar comment
|
/retest |
|
Automatic merge from submit-queue (batch tested with PRs 63001, 62152, 61950). If you want to cherry-pick this change to another branch, please follow the instructions here. |
The kubelet uses two different locations to store certificates on
initial bootstrap and then on subsequent rotation:
Bootstrap also creates an initial node.kubeconfig that points to the
certs. Unfortunately, with short rotation the node.kubeconfig then
becomes out of date because it points to the initial cert/key, not the
rotated cert key.
Alter the bootstrap code to store client certs exactly as if they would
be rotated (using the same cert Store code), and reference the PEM file
containing cert/key from node.kubeconfig, which is supported by kubectl
and other Go tooling. This ensures that the node.kubeconfig continues to
be valid past the first expiration.
Example:
This will also allow us to remove the wierd "init store with bootstrap cert" stuff, although I'd prefer to do that in a follow up.
@mikedanese @liggitt as per discussion on Slack today