github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-05 10:19:50 +00:00
Code Issues Projects Releases Wiki Activity

kubeadm: fix the generation of ECDSA keys in kubeconfig files

Browse Source 
When the PublicKeysECDSA feature gate is used or the new
v1beta4.ClusterConfiguration.EncryptionAlgorithm field is used
with "ECDSA-P256" as value, make sure that this is reflected
in the "cert spec" used to generate private keys and they end
up as "EC keys".
This commit is contained in:
Lubomir I. Ivanov 2024-06-07 19:31:04 +03:00
parent 51f89c3b2d
commit 02ed1aee71
2 changed files with 36 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
cmd/kubeadm/app/phases/kubeconfig/kubeconfig.go
View File

@ -72,6 +72,7 @@ type kubeConfigSpec struct {
ClientCertNotAfter time.Time
TokenAuth *tokenAuth `datapolicy:"token"`
ClientCertAuth *clientCertAuth `datapolicy:"security-key"`
EncryptionAlgorithm kubeadmapi.EncryptionAlgorithmType
}
// CreateJoinControlPlaneKubeConfigFiles will create and write to disk the kubeconfig files required by kubeadm
@ -213,6 +214,7 @@ func newClientCertConfigFromKubeConfigSpec(spec *kubeConfigSpec) pkiutil.CertCon
Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
},
NotAfter: spec.ClientCertNotAfter,
EncryptionAlgorithm: spec.EncryptionAlgorithm,
}
}
@ -325,6 +327,7 @@ func WriteKubeConfigWithClientCert(out io.Writer, cfg *kubeadmapi.InitConfigurat
Organizations: organizations,
},
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
}
return writeKubeConfigFromSpec(out, spec, cfg.ClusterName)
@ -354,6 +357,7 @@ func WriteKubeConfigWithToken(out io.Writer, cfg *kubeadmapi.InitConfiguration,
Token: token,
},
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
}
return writeKubeConfigFromSpec(out, spec, cfg.ClusterName)
@ -453,6 +457,7 @@ func getKubeConfigSpecsBase(cfg *kubeadmapi.InitConfiguration) (map[string]*kube
Organizations: []string{kubeadmconstants.ClusterAdminsGroupAndClusterRoleBinding},
},
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
kubeadmconstants.SuperAdminKubeConfigFileName: {
APIServer: controlPlaneEndpoint,
@ -461,6 +466,7 @@ func getKubeConfigSpecsBase(cfg *kubeadmapi.InitConfiguration) (map[string]*kube
Organizations: []string{kubeadmconstants.SystemPrivilegedGroup},
},
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
kubeadmconstants.KubeletKubeConfigFileName: {
APIServer: controlPlaneEndpoint,
@ -469,18 +475,21 @@ func getKubeConfigSpecsBase(cfg *kubeadmapi.InitConfiguration) (map[string]*kube
Organizations: []string{kubeadmconstants.NodesGroup},
},
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
kubeadmconstants.ControllerManagerKubeConfigFileName: {
APIServer: localAPIEndpoint,
ClientName: kubeadmconstants.ControllerManagerUser,
ClientCertAuth: &clientCertAuth{},
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
kubeadmconstants.SchedulerKubeConfigFileName: {
APIServer: localAPIEndpoint,
ClientName: kubeadmconstants.SchedulerUser,
ClientCertAuth: &clientCertAuth{},
ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
},
}, nil
}

6
cmd/kubeadm/app/phases/kubeconfig/kubeconfig_test.go
View File

@ -85,6 +85,7 @@ func TestGetKubeConfigSpecs(t *testing.T) {
LocalAPIEndpoint: kubeadmapi.APIEndpoint{AdvertiseAddress: "1.2.3.4", BindPort: 1234},
ClusterConfiguration: kubeadmapi.ClusterConfiguration{
CertificatesDir: pkidir,
EncryptionAlgorithm: kubeadmapi.EncryptionAlgorithmECDSAP256,
},
NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: "valid-node-name"},
},
@ -180,6 +181,11 @@ func TestGetKubeConfigSpecs(t *testing.T) {
t.Errorf("getKubeConfigSpecs for %s Organizations is %v, expected %v", assertion.kubeConfigFile, spec.ClientCertAuth.Organizations, assertion.organizations)
}
// Assert EncryptionAlgorithm
if spec.EncryptionAlgorithm != cfg.EncryptionAlgorithm {
t.Errorf("getKubeConfigSpecs for %s EncryptionAlgorithm is %s, expected %s", assertion.kubeConfigFile, spec.EncryptionAlgorithm, cfg.EncryptionAlgorithm)
}
// Asserts InitConfiguration values injected into spec
controlPlaneEndpoint, err := kubeadmutil.GetControlPlaneEndpoint(cfg.ControlPlaneEndpoint, &cfg.LocalAPIEndpoint)
if err != nil {