From 7294a3dad283b42a4f2b1dddb4f8372001ff17b6 Mon Sep 17 00:00:00 2001 From: Luis Sanchez Date: Fri, 26 Oct 2018 15:45:33 -0400 Subject: [PATCH] manifests: new secret etcd-client.kube-system Manifest to create this resources belongs in installer. The renderer in cluster-kube-apiserver-operator will need to be also changed to stop creating the same manifest file. Also, updated the dependency graph at docs/design/resource_dep.svg --- docs/design/resource_dep.svg | 906 ++++++++++-------- .../kube-system-configmap-etcd-serving-ca.go | 18 + pkg/asset/manifests/operators.go | 23 +- pkg/asset/manifests/template.go | 1 + 4 files changed, 561 insertions(+), 387 deletions(-) create mode 100644 pkg/asset/manifests/content/bootkube/kube-system-configmap-etcd-serving-ca.go diff --git a/docs/design/resource_dep.svg b/docs/design/resource_dep.svg index 83c9288a36b..c866ca52b04 100644 --- a/docs/design/resource_dep.svg +++ b/docs/design/resource_dep.svg @@ -1,613 +1,763 @@ - - + G - + -InstallConfig - -InstallConfig + +InstallConfig + +InstallConfig -Target Install Config - -Target Install Config + +Target Install Config + +Target Install Config -InstallConfig->Target Install Config - - + +InstallConfig->Target Install Config + + -Manifests - -Manifests + +Manifests + +Manifests -InstallConfig->Manifests - - + +InstallConfig->Manifests + + -networkOperator - -networkOperator + +networkOperator + +networkOperator -InstallConfig->networkOperator - - + +InstallConfig->networkOperator + + -IngressCertKey - -IngressCertKey + +IngressCertKey + +IngressCertKey -InstallConfig->IngressCertKey - - + +InstallConfig->IngressCertKey + + -MCSCertKey - -MCSCertKey + +MCSCertKey + +MCSCertKey -InstallConfig->MCSCertKey - - + +InstallConfig->MCSCertKey + + -Tectonic - -Tectonic + +Tectonic + +Tectonic -InstallConfig->Tectonic - - + +InstallConfig->Tectonic + + -ClusterK8sIO - -ClusterK8sIO + +ClusterK8sIO + +ClusterK8sIO -InstallConfig->ClusterK8sIO - - + +InstallConfig->ClusterK8sIO + + -Worker - -Worker + +Worker + +Worker -InstallConfig->Worker - - + +InstallConfig->Worker + + -Master - -Master + +Master + +Master -InstallConfig->Master - - + +InstallConfig->Master + + -kubeAddonOperator - -kubeAddonOperator + +kubeAddonOperator + +kubeAddonOperator -InstallConfig->kubeAddonOperator - - + +InstallConfig->kubeAddonOperator + + -Bootstrap - -Bootstrap + +Bootstrap + +Bootstrap -InstallConfig->Bootstrap - - + +InstallConfig->Bootstrap + + + + + +APIServerCertKey + +APIServerCertKey + + + +InstallConfig->APIServerCertKey + + -Admin - -Admin + +Admin + +Admin -InstallConfig->Admin - - + +InstallConfig->Admin + + -Kubelet - -Kubelet + +Kubelet + +Kubelet -InstallConfig->Kubelet - - + +InstallConfig->Kubelet + + -TerraformVariables - -TerraformVariables + +TerraformVariables + +TerraformVariables -InstallConfig->TerraformVariables - - + +InstallConfig->TerraformVariables + + -Cluster - -Cluster + +Cluster + +Cluster -InstallConfig->Cluster - - + +InstallConfig->Cluster + + -clusterID - -clusterID + +clusterID + +clusterID -clusterID->InstallConfig - - + +clusterID->InstallConfig + + -emailAddress - -emailAddress + +emailAddress + +emailAddress -emailAddress->InstallConfig - - + +emailAddress->InstallConfig + + -password - -password + +password + +password -password->InstallConfig - - + +password->InstallConfig + + -sshPublicKey - -sshPublicKey + +sshPublicKey + +sshPublicKey -sshPublicKey->InstallConfig - - + +sshPublicKey->InstallConfig + + -baseDomain - -baseDomain + +baseDomain + +baseDomain -baseDomain->InstallConfig - - + +baseDomain->InstallConfig + + -clusterName - -clusterName + +clusterName + +clusterName -clusterName->InstallConfig - - + +clusterName->InstallConfig + + -pullSecret - -pullSecret + +pullSecret + +pullSecret -pullSecret->InstallConfig - - + +pullSecret->InstallConfig + + -platform - -platform + +platform + +platform -platform->InstallConfig - - + +platform->InstallConfig + + -Target Manifests - -Target Manifests + +Target Manifests + +Target Manifests -Manifests->Target Manifests - - + +Manifests->Target Manifests + + -Manifests->Bootstrap - - + +Manifests->Bootstrap + + -networkOperator->Manifests - - + +networkOperator->Manifests + + -RootCA - -RootCA + +RootCA + +RootCA -RootCA->Manifests - - + +RootCA->Manifests + + + + + +EtcdCA + +EtcdCA + + + +RootCA->EtcdCA + + -KubeCA - -KubeCA + +KubeCA + +KubeCA -RootCA->KubeCA - - + +RootCA->KubeCA + + -ServiceServingCA - -ServiceServingCA + +ServiceServingCA + +ServiceServingCA -RootCA->ServiceServingCA - - + +RootCA->ServiceServingCA + + -RootCA->MCSCertKey - - + +RootCA->MCSCertKey + + -RootCA->Worker - - + +RootCA->Worker + + -RootCA->Master - - + +RootCA->Master + + -RootCA->Bootstrap - - - - -EtcdCA - -EtcdCA - - -RootCA->EtcdCA - - + +RootCA->Bootstrap + + -AggregatorCA - -AggregatorCA + +AggregatorCA + +AggregatorCA -RootCA->AggregatorCA - - + +RootCA->AggregatorCA + + -RootCA->Admin - - + +RootCA->Admin + + -RootCA->Kubelet - - + +RootCA->Kubelet + + + + + +EtcdCA->Manifests + + + + + +EtcdClientCertKey + +EtcdClientCertKey + + + +EtcdCA->EtcdClientCertKey + + + + + +EtcdCA->Bootstrap + + -IngressCertKey->Manifests - - + +IngressCertKey->Manifests + + -IngressCertKey->Tectonic - - + +IngressCertKey->Tectonic + + - -IngressCertKey->Bootstrap - - + + +KubeCA->Manifests + + -KubeCA->IngressCertKey - - - - -KubeCA->Manifests - - + +KubeCA->IngressCertKey + + -KubeletCertKey - -KubeletCertKey + +KubeletCertKey + +KubeletCertKey -KubeCA->KubeletCertKey - - + +KubeCA->KubeletCertKey + + -KubeCA->Tectonic - - + +KubeCA->Tectonic + + -KubeCA->Bootstrap - - + +KubeCA->Bootstrap + + + + + +KubeCA->APIServerCertKey + + -AdminCertKey - -AdminCertKey + +AdminCertKey + +AdminCertKey -KubeCA->AdminCertKey - - + +KubeCA->AdminCertKey + + -ServiceServingCA->Manifests - - + +ServiceServingCA->Manifests + + -ServiceServingCA->Bootstrap - - + +ServiceServingCA->Bootstrap + + + + + +EtcdClientCertKey->Manifests + + + + + +EtcdClientCertKey->Bootstrap + + -MCSCertKey->Manifests - - + +MCSCertKey->Manifests + + -MCSCertKey->Bootstrap - - + +MCSCertKey->Bootstrap + + -KubeletCertKey->Manifests - - + +KubeletCertKey->Manifests + + -KubeletCertKey->Bootstrap - - + +KubeletCertKey->Bootstrap + + -KubeletCertKey->Kubelet - - + +KubeletCertKey->Kubelet + + -Tectonic->Target Manifests - - + +Tectonic->Target Manifests + + -Tectonic->Bootstrap - - + +Tectonic->Bootstrap + + -ClusterK8sIO->Tectonic - - + +ClusterK8sIO->Tectonic + + -Worker->Tectonic - - + +Worker->Tectonic + + -Worker->Worker - - + +Worker->Worker + + -Target Ignition Configs - -Target Ignition Configs + +Target Ignition Configs + +Target Ignition Configs -Worker->Target Ignition Configs - - + +Worker->Target Ignition Configs + + -Worker->TerraformVariables - - + +Worker->TerraformVariables + + -Master->Tectonic - - + +Master->Tectonic + + -Master->Master - - + +Master->Master + + -Master->Target Ignition Configs - - + +Master->Target Ignition Configs + + -Master->TerraformVariables - - + +Master->TerraformVariables + + -kubeAddonOperator->Tectonic - - + +kubeAddonOperator->Tectonic + + -Bootstrap->Target Ignition Configs - - + +Bootstrap->Target Ignition Configs + + -Bootstrap->TerraformVariables - - - - -EtcdCA->Bootstrap - - - - -EtcdClientCertKey - -EtcdClientCertKey - - -EtcdCA->EtcdClientCertKey - - + +Bootstrap->TerraformVariables + + -AggregatorCA->Bootstrap - - + +AggregatorCA->Bootstrap + + -APIServerProxyCertKey - -APIServerProxyCertKey + +APIServerProxyCertKey + +APIServerProxyCertKey -AggregatorCA->APIServerProxyCertKey - - + +AggregatorCA->APIServerProxyCertKey + + - -EtcdClientCertKey->Bootstrap - - + + +APIServerCertKey->Bootstrap + + -APIServerProxyCertKey->Bootstrap - - + +APIServerProxyCertKey->Bootstrap + + -AdminCertKey->Bootstrap - - + +AdminCertKey->Bootstrap + + -AdminCertKey->Admin - - + +AdminCertKey->Admin + + -ServiceAccountKeyPair - -ServiceAccountKeyPair + +ServiceAccountKeyPair + +ServiceAccountKeyPair -ServiceAccountKeyPair->Bootstrap - - + +ServiceAccountKeyPair->Bootstrap + + -Admin->Bootstrap - - + +Admin->Bootstrap + + -Target Cluster - -Target Cluster + +Target Cluster + +Target Cluster -Admin->Target Cluster - - + +Admin->Target Cluster + + -Admin->Cluster - - + +Admin->Cluster + + -Kubelet->Bootstrap - - + +Kubelet->Bootstrap + + -TerraformVariables->Target Cluster - - + +TerraformVariables->Target Cluster + + -TerraformVariables->Cluster - - + +TerraformVariables->Cluster + + -Cluster->Target Cluster - - + +Cluster->Target Cluster + + diff --git a/pkg/asset/manifests/content/bootkube/kube-system-configmap-etcd-serving-ca.go b/pkg/asset/manifests/content/bootkube/kube-system-configmap-etcd-serving-ca.go new file mode 100644 index 00000000000..a0ed32718a0 --- /dev/null +++ b/pkg/asset/manifests/content/bootkube/kube-system-configmap-etcd-serving-ca.go @@ -0,0 +1,18 @@ +package bootkube + +import "text/template" + +var ( + // KubeSystemConfigmapEtcdServingCA is the constant to represent contents of kube-system-configmap-etcd-serving-ca.yaml file + KubeSystemConfigmapEtcdServingCA = template.Must(template.New("kube-system-configmap-etcd-serving-ca.yaml").Parse(` +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: etcd-serving-ca + namespace: kube-system +data: + ca-bundle.crt: | + {{.EtcdCaCert}} +`)) +) diff --git a/pkg/asset/manifests/operators.go b/pkg/asset/manifests/operators.go index d09ac7ba7ea..b6404d84547 100644 --- a/pkg/asset/manifests/operators.go +++ b/pkg/asset/manifests/operators.go @@ -47,6 +47,7 @@ func (m *Manifests) Dependencies() []asset.Asset { &installconfig.InstallConfig{}, &networkOperator{}, &tls.RootCA{}, + &tls.EtcdCA{}, &tls.IngressCertKey{}, &tls.KubeCA{}, &tls.ServiceServingCA{}, @@ -90,6 +91,7 @@ func (m *Manifests) Files() []*asset.File { func (m *Manifests) generateBootKubeManifests(dependencies asset.Parents) []*asset.File { installConfig := &installconfig.InstallConfig{} + etcdCA := &tls.EtcdCA{} kubeCA := &tls.KubeCA{} mcsCertKey := &tls.MCSCertKey{} etcdClientCertKey := &tls.EtcdClientCertKey{} @@ -97,6 +99,7 @@ func (m *Manifests) generateBootKubeManifests(dependencies asset.Parents) []*ass serviceServingCA := &tls.ServiceServingCA{} dependencies.Get( installConfig, + etcdCA, etcdClientCertKey, kubeCA, mcsCertKey, @@ -111,6 +114,7 @@ func (m *Manifests) generateBootKubeManifests(dependencies asset.Parents) []*ass templateData := &bootkubeTemplateData{ Base64encodeCloudProviderConfig: "", // FIXME + EtcdCaCert: base64.StdEncoding.EncodeToString(etcdCA.Cert()), EtcdClientCert: base64.StdEncoding.EncodeToString(etcdClientCertKey.Cert()), EtcdClientKey: base64.StdEncoding.EncodeToString(etcdClientCertKey.Key()), KubeCaCert: base64.StdEncoding.EncodeToString(kubeCA.Cert()), @@ -128,15 +132,16 @@ func (m *Manifests) generateBootKubeManifests(dependencies asset.Parents) []*ass } assetData := map[string][]byte{ - "kube-cloud-config.yaml": applyTemplateData(bootkube.KubeCloudConfig, templateData), - "machine-config-server-tls-secret.yaml": applyTemplateData(bootkube.MachineConfigServerTLSSecret, templateData), - "openshift-service-signer-secret.yaml": applyTemplateData(bootkube.OpenshiftServiceCertSignerSecret, templateData), - "pull.json": applyTemplateData(bootkube.Pull, templateData), - "tectonic-network-operator.yaml": applyTemplateData(bootkube.TectonicNetworkOperator, templateData), - "cvo-overrides.yaml": applyTemplateData(bootkube.CVOOverrides, templateData), - "legacy-cvo-overrides.yaml": applyTemplateData(bootkube.LegacyCVOOverrides, templateData), - "etcd-service-endpoints.yaml": applyTemplateData(bootkube.EtcdServiceEndpointsKubeSystem, templateData), - "kube-system-secret-etcd-client.yaml": applyTemplateData(bootkube.KubeSystemSecretEtcdClient, templateData), + "kube-cloud-config.yaml": applyTemplateData(bootkube.KubeCloudConfig, templateData), + "machine-config-server-tls-secret.yaml": applyTemplateData(bootkube.MachineConfigServerTLSSecret, templateData), + "openshift-service-signer-secret.yaml": applyTemplateData(bootkube.OpenshiftServiceCertSignerSecret, templateData), + "pull.json": applyTemplateData(bootkube.Pull, templateData), + "tectonic-network-operator.yaml": applyTemplateData(bootkube.TectonicNetworkOperator, templateData), + "cvo-overrides.yaml": applyTemplateData(bootkube.CVOOverrides, templateData), + "legacy-cvo-overrides.yaml": applyTemplateData(bootkube.LegacyCVOOverrides, templateData), + "etcd-service-endpoints.yaml": applyTemplateData(bootkube.EtcdServiceEndpointsKubeSystem, templateData), + "kube-system-configmap-etcd-serving-ca.yaml": applyTemplateData(bootkube.KubeSystemConfigmapEtcdServingCA, templateData), + "kube-system-secret-etcd-client.yaml": applyTemplateData(bootkube.KubeSystemSecretEtcdClient, templateData), "01-tectonic-namespace.yaml": []byte(bootkube.TectonicNamespace), "03-openshift-web-console-namespace.yaml": []byte(bootkube.OpenshiftWebConsoleNamespace), diff --git a/pkg/asset/manifests/template.go b/pkg/asset/manifests/template.go index b934547bfe1..fd47ccc08cf 100644 --- a/pkg/asset/manifests/template.go +++ b/pkg/asset/manifests/template.go @@ -18,6 +18,7 @@ type cloudCredsSecretData struct { type bootkubeTemplateData struct { Base64encodeCloudProviderConfig string + EtcdCaCert string EtcdClientCert string EtcdClientKey string KubeCaCert string