change yurthub's protocol from http to https #368

wangchenglong01 · 2021-06-23T16:08:41Z

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespace from that line:
/kind bug
/kind documentation
/kind enhancement
/kind good-first-issue
/kind feature
/kind question
/kind design
/sig ai
/sig iot
/sig network
/sig storage
/sig storage

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #361

Special notes for your reviewer:

Does this PR introduce a user-facing change?

other Note

openyurt-bot · 2021-06-23T16:08:48Z

@wangchenglong01: GitHub didn't allow me to assign the following users: your_reviewer.

Note that only openyurtio members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespace from that line:
/kind bug
/kind documentation
/kind enhancement
/kind good-first-issue
/kind feature
/kind question
/kind design
/sig ai
/sig iot
/sig network
/sig storage
/sig storage

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #361

Special notes for your reviewer:

Does this PR introduce a user-facing change?
other Note

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openyurt-bot · 2021-06-23T16:09:01Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: wangchenglong01
To complete the pull request process, please assign rambohe-ch
You can assign the PR to them by writing /assign @rambohe-ch in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openyurt-bot · 2021-06-23T16:09:12Z

Welcome @wangchenglong01! It looks like this is your first PR to openyurtio/openyurt 🎉

MIBc · 2021-06-24T01:57:20Z

If use https, the kubelet and other components config should be changed. We can point out how to change config of these components.

qclc · 2021-06-24T02:05:38Z

cmd/yurthub/app/config/config.go

@@ -94,6 +97,9 @@ func Complete(options *options.YurtHubOptions) (*YurtHubConfiguration, error) {
 		HubAgentDummyIfName:         options.HubAgentDummyIfName,
 		StorageWrapper:              storageWrapper,
 		SerializerManager:           serializerManager,
+		CAFile:                      options.CAFile,
+		CertFile:                    options.CertFile,
+		KeyFile:                     options.KeyFile,
 	}


I think the establishment and configuration of TLS may be better done by yurthub, users do not need to pay attention to the underlying certificate configuration by default.

It's a good idea. I will improve it later.

luckymrwang · 2021-06-24T02:16:51Z

If use https, the kubelet and other components config should be changed. We can point out how to change config of these components.

Yes, I'm collecting the changed config.

rambohe-ch · 2021-06-25T06:30:40Z

@wangchenglong01 we need to keep proxyPort for http unchanged, and add a new port(like secureProxyPort) for https.

…enyurt into yurthub-https # Conflicts: # cmd/yurthub/app/config/config.go # pkg/yurthub/server/server.go

…enyurt into yurthub-https

rambohe-ch · 2021-07-01T03:36:12Z

If use https, the kubelet and other components config should be changed. We can point out how to change config of these components.

The background of support https for yurthub is here: #372

rambohe-ch · 2021-07-01T03:38:00Z

cmd/yurthub/app/options/options.go

 }

 // NewYurtHubOptions creates a new YurtHubOptions with a default config.
 func NewYurtHubOptions() *YurtHubOptions {
 	o := &YurtHubOptions{
 		YurtHubHost:               "127.0.0.1",
+		YurtHubProxySecurePort:    "10260",


maybe 10260 is used by k8s, how about 10268?

rambohe-ch · 2021-07-01T03:40:40Z

cmd/yurthub/app/config/config.go

@@ -72,28 +76,33 @@ func Complete(options *options.YurtHubOptions) (*YurtHubConfiguration, error) {

 	hubServerAddr := net.JoinHostPort(options.YurtHubHost, options.YurtHubPort)
 	proxyServerAddr := net.JoinHostPort(options.YurtHubHost, options.YurtHubProxyPort)
+	proxySecureServerAddr := net.JoinHostPort(options.YurtHubHost, options.YurtHubProxySecurePort)


yurthub's https also need to listen on HubAgentDummyIfIP address

The latest code has been commited. Yurthub's https also listens on HubAgentDummyIfIP address

rambohe-ch · 2021-07-01T03:43:45Z

cmd/yurthub/app/options/options.go

@@ -130,6 +148,9 @@ func (o *YurtHubOptions) AddFlags(fs *pflag.FlagSet) {
 	fs.StringVar(&o.HubAgentDummyIfIP, "dummy-if-ip", o.HubAgentDummyIfIP, "the ip address of dummy interface that used for container connect hub agent(exclusive ips: 169.254.31.0/24, 169.254.1.1/32)")
 	fs.StringVar(&o.HubAgentDummyIfName, "dummy-if-name", o.HubAgentDummyIfName, "the name of dummy interface that is used for hub agent")
 	fs.StringVar(&o.DiskCachePath, "disk-cache-path", o.DiskCachePath, "the path for kubernetes to storage metadata")
+	fs.StringVar(&o.CAFile, "ca-file", "", "the CA for yurthub to verify client")
+	fs.StringVar(&o.CertFile, "tls-cert-file", "", "the tls cert of yurthub")
+	fs.StringVar(&o.KeyFile, "tls-private-key-file", "", "the tls key of yurthub")


It's not convenient for user to setup server certifcates. I think Yurthub shoud generate server certificates by itself.

The latest code has been commited. Yurthub generated server certificates by itself.

…enyurt into yurthub-https

…yurthub-https

…enyurt into yurthub-https

rambohe-ch · 2021-07-13T07:03:13Z

pkg/yurthub/server/server.go

+
+// create a certificate manager for the yurthub server and run the csr approver for both yurthub
+// and generate a TLS configuration
+func genUseCertMgrAndTLSConfig(certificateMgr interfaces.YurtCertificateManager, certDir string, stopCh <-chan struct{}) (*tls.Config, error) {


It's more readable to prepare tls.config after client certificate ready instead of preparing when start server.

and the client certificate preparation ready is here: https://github.com/openyurtio/openyurt/blob/master/cmd/yurthub/app/start.go#L95

rambohe-ch · 2021-07-13T07:04:33Z

cmd/yurthub/app/start.go

@@ -147,8 +147,8 @@ func Run(cfg *config.YurtHubConfiguration, stopCh <-chan struct{}) error {
 		klog.Infof("%d. new %s server and begin to serve, dummy proxy server: %s", trace, projectinfo.GetHubName(), cfg.YurtHubProxyServerDummyAddr)


please add YurtHubProxyServerSecureDummyAddr here

rambohe-ch · 2021-07-13T07:06:13Z

cmd/yurthub/app/config/config.go

+	Client                            *kubernetes.Clientset
+	CertDNSNames                      []string
+	CertIPs                           []net.IP
+	SharedInformerFactory             informers.SharedInformerFactory


The following fields should be deleted?

CertFile string KeyFile string KubeConfig string RootCert *x509.CertPool Client *kubernetes.Clientset CertDNSNames []string CertIPs []net.IP SharedInformerFactory informers.SharedInformerFactory

rambohe-ch · 2021-07-13T07:10:53Z

@luckymrwang Would you be able to upload the detail logs of creating yurthub server certificates successfully when yurthub startup?

…yurthub-https

change yurthub's protocol from http to https

2a9460f

openyurt-bot added the kind/feature kind/feature label Jun 23, 2021

openyurt-bot requested review from Fei-Guo and kadisi June 23, 2021 16:08

openyurt-bot added the size/M size/M: 30-99 label Jun 23, 2021

qclc reviewed Jun 24, 2021

View reviewed changes

wangchenglong01 and others added 2 commits June 29, 2021 14:32

change yurthub's protocol from http to https

0a0e313

Merge branch 'yurthub-https' of https://github.com/wangchenglong01/op…

4775c54

…enyurt into yurthub-https # Conflicts: # cmd/yurthub/app/config/config.go # pkg/yurthub/server/server.go

openyurt-bot added size/L size/L: 100-499 and removed size/M size/M: 30-99 labels Jun 29, 2021

luckymrwang added 2 commits June 29, 2021 14:44

Merge branch 'yurthub-https' of https://github.com/wangchenglong01/op…

a3dd98b

…enyurt into yurthub-https

Merge branch 'yurthub-https' of https://github.com/wangchenglong01/op…

2b53769

…enyurt into yurthub-https

rambohe-ch mentioned this pull request Jul 1, 2021

[feature request] Support InClusterConfig for pods to access kube-apiserver through yurt-hub on edge nodes #372

Closed

rambohe-ch reviewed Jul 1, 2021

View reviewed changes

luckymrwang added 5 commits July 10, 2021 09:41

Merge branch 'yurthub-https' of https://github.com/wangchenglong01/op…

f2a30e4

…enyurt into yurthub-https

Merge branch 'master' of https://github.com/openyurtio/openyurt into …

229bb3f

…yurthub-https

Merge branch 'yurthub-https' of https://github.com/wangchenglong01/op…

55b3ea2

…enyurt into yurthub-https

Merge branch 'yurthub-https' of https://github.com/wangchenglong01/op…

c516d4d

…enyurt into yurthub-https

Merge branch 'yurthub-https' of https://github.com/wangchenglong01/op…

d04af20

…enyurt into yurthub-https

rambohe-ch reviewed Jul 13, 2021

View reviewed changes

Merge branch 'master' of https://github.com/openyurtio/openyurt into …

8b8f874

…yurthub-https

openyurt-bot added size/XL size/XL: 500-999 and removed size/L size/L: 100-499 labels Jul 19, 2021

wangchenglong01 closed this Jul 20, 2021

wangchenglong01 deleted the yurthub-https branch November 23, 2021 13:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

change yurthub's protocol from http to https #368

change yurthub's protocol from http to https #368

wangchenglong01 commented Jun 23, 2021

openyurt-bot commented Jun 23, 2021

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

other Note

openyurt-bot commented Jun 23, 2021

openyurt-bot commented Jun 23, 2021

MIBc commented Jun 24, 2021 •

edited

Loading

qclc Jun 24, 2021

luckymrwang Jun 24, 2021

luckymrwang commented Jun 24, 2021

rambohe-ch commented Jun 25, 2021

rambohe-ch commented Jul 1, 2021

rambohe-ch Jul 1, 2021

rambohe-ch Jul 1, 2021

luckymrwang Jul 12, 2021

rambohe-ch Jul 1, 2021

luckymrwang Jul 12, 2021

rambohe-ch Jul 13, 2021

rambohe-ch Jul 13, 2021

rambohe-ch Jul 13, 2021

rambohe-ch commented Jul 13, 2021

		@@ -147,8 +147,8 @@ func Run(cfg *config.YurtHubConfiguration, stopCh <-chan struct{}) error {
		klog.Infof("%d. new %s server and begin to serve, dummy proxy server: %s", trace, projectinfo.GetHubName(), cfg.YurtHubProxyServerDummyAddr)

change yurthub's protocol from http to https #368

change yurthub's protocol from http to https #368

Conversation

wangchenglong01 commented Jun 23, 2021

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

other Note

openyurt-bot commented Jun 23, 2021

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

other Note

openyurt-bot commented Jun 23, 2021

openyurt-bot commented Jun 23, 2021

MIBc commented Jun 24, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

luckymrwang commented Jun 24, 2021

rambohe-ch commented Jun 25, 2021

rambohe-ch commented Jul 1, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rambohe-ch commented Jul 13, 2021

MIBc commented Jun 24, 2021 •

edited

Loading