github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-04 18:00:08 +00:00
Code Issues Projects Releases Wiki Activity

kubeadm: fix the generation of ECDSA keys in kubeconfig files

Browse Source 
When the PublicKeysECDSA feature gate is used or the new
v1beta4.ClusterConfiguration.EncryptionAlgorithm field is used
with "ECDSA-P256" as value, make sure that this is reflected
in the "cert spec" used to generate private keys and they end
up as "EC keys".
This commit is contained in:
Lubomir I. Ivanov 2024-06-07 19:31:04 +03:00
parent 51f89c3b2d
commit 02ed1aee71
2 changed files with 36 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
cmd/kubeadm/app/phases/kubeconfig/kubeconfig.go
View File

@ -66,12 +66,13 @@ type tokenAuth struct {
// kubeConfigSpec struct holds info required to build a KubeConfig object
type kubeConfigSpec struct {
CACert *x509.Certificate
APIServer string
ClientName string
ClientCertNotAfter time.Time
TokenAuth *tokenAuth `datapolicy:"token"`
ClientCertAuth *clientCertAuth `datapolicy:"security-key"`
CACert *x509.Certificate
APIServer string
ClientName string
ClientCertNotAfter time.Time
TokenAuth *tokenAuth `datapolicy:"token"`
ClientCertAuth *clientCertAuth `datapolicy:"security-key"`
EncryptionAlgorithm kubeadmapi.EncryptionAlgorithmType
}
// CreateJoinControlPlaneKubeConfigFiles will create and write to disk the kubeconfig files required by kubeadm
@ -212,7 +213,8 @@ func newClientCertConfigFromKubeConfigSpec(spec *kubeConfigSpec) pkiutil.CertCon
Organization: spec.ClientCertAuth.Organizations,
Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
},
NotAfter: spec.ClientCertNotAfter,
NotAfter: spec.ClientCertNotAfter,
EncryptionAlgorithm: spec.EncryptionAlgorithm,
}
}
@ -324,7 +326,8 @@ func WriteKubeConfigWithClientCert(out io.Writer, cfg *kubeadmapi.InitConfigurat
CAKey: caKey,
Organizations: organizations,
},
ClientCertNotAfter: notAfter,
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
}
return writeKubeConfigFromSpec(out, spec, cfg.ClusterName)
@ -353,7 +356,8 @@ func WriteKubeConfigWithToken(out io.Writer, cfg *kubeadmapi.InitConfiguration,
TokenAuth: &tokenAuth{
Token: token,
},
ClientCertNotAfter: notAfter,
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
}
return writeKubeConfigFromSpec(out, spec, cfg.ClusterName)
@ -452,7 +456,8 @@ func getKubeConfigSpecsBase(cfg *kubeadmapi.InitConfiguration) (map[string]*kube
ClientCertAuth: &clientCertAuth{
Organizations: []string{kubeadmconstants.ClusterAdminsGroupAndClusterRoleBinding},
},
ClientCertNotAfter: notAfter,
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
kubeadmconstants.SuperAdminKubeConfigFileName: {
APIServer: controlPlaneEndpoint,
@ -460,7 +465,8 @@ func getKubeConfigSpecsBase(cfg *kubeadmapi.InitConfiguration) (map[string]*kube
ClientCertAuth: &clientCertAuth{
Organizations: []string{kubeadmconstants.SystemPrivilegedGroup},
},
ClientCertNotAfter: notAfter,
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
kubeadmconstants.KubeletKubeConfigFileName: {
APIServer: controlPlaneEndpoint,
@ -468,19 +474,22 @@ func getKubeConfigSpecsBase(cfg *kubeadmapi.InitConfiguration) (map[string]*kube
ClientCertAuth: &clientCertAuth{
Organizations: []string{kubeadmconstants.NodesGroup},
},
ClientCertNotAfter: notAfter,
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
kubeadmconstants.ControllerManagerKubeConfigFileName: {
APIServer: localAPIEndpoint,
ClientName: kubeadmconstants.ControllerManagerUser,
ClientCertAuth: &clientCertAuth{},
ClientCertNotAfter: notAfter,
APIServer: localAPIEndpoint,
ClientName: kubeadmconstants.ControllerManagerUser,
ClientCertAuth: &clientCertAuth{},
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
kubeadmconstants.SchedulerKubeConfigFileName: {
APIServer: localAPIEndpoint,
ClientName: kubeadmconstants.SchedulerUser,
ClientCertAuth: &clientCertAuth{},
ClientCertNotAfter: notAfter,
APIServer: localAPIEndpoint,
ClientName: kubeadmconstants.SchedulerUser,
ClientCertAuth: &clientCertAuth{},
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
}, nil
}

8
cmd/kubeadm/app/phases/kubeconfig/kubeconfig_test.go
View File

@ -84,7 +84,8 @@ func TestGetKubeConfigSpecs(t *testing.T) {
{
LocalAPIEndpoint: kubeadmapi.APIEndpoint{AdvertiseAddress: "1.2.3.4", BindPort: 1234},
ClusterConfiguration: kubeadmapi.ClusterConfiguration{
CertificatesDir: pkidir,
CertificatesDir: pkidir,
EncryptionAlgorithm: kubeadmapi.EncryptionAlgorithmECDSAP256,
},
NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: "valid-node-name"},
},
@ -180,6 +181,11 @@ func TestGetKubeConfigSpecs(t *testing.T) {
t.Errorf("getKubeConfigSpecs for %s Organizations is %v, expected %v", assertion.kubeConfigFile, spec.ClientCertAuth.Organizations, assertion.organizations)
}
// Assert EncryptionAlgorithm
if spec.EncryptionAlgorithm != cfg.EncryptionAlgorithm {
t.Errorf("getKubeConfigSpecs for %s EncryptionAlgorithm is %s, expected %s", assertion.kubeConfigFile, spec.EncryptionAlgorithm, cfg.EncryptionAlgorithm)
}
// Asserts InitConfiguration values injected into spec
controlPlaneEndpoint, err := kubeadmutil.GetControlPlaneEndpoint(cfg.ControlPlaneEndpoint, &cfg.LocalAPIEndpoint)
if err != nil {