From 136d68b4d5c52472691ed893cfd5bf801a21461e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lucas=20K=C3=A4ldstr=C3=B6m?= <lucas@weave.works>
Date: Fri, 8 Sep 2017 22:29:11 +0300
Subject: [PATCH] kubeadm: Perform TLS Bootstrapping in kubeadm join for v1.7
 kubelets but not v1.8 ones

---
 cmd/kubeadm/app/cmd/join.go | 23 ++++++++++++++++++-----
 cmd/kubeadm/app/node/csr.go |  1 +
 hack/.golint_failures       |  1 -
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/cmd/kubeadm/app/cmd/join.go b/cmd/kubeadm/app/cmd/join.go
index 3de2b6d45ce..1bc2a2dee3c 100644
--- a/cmd/kubeadm/app/cmd/join.go
+++ b/cmd/kubeadm/app/cmd/join.go
@@ -20,7 +20,9 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
+	"os/exec"
 	"path/filepath"
+	"strings"
 
 	"github.com/renstrom/dedent"
 	"github.com/spf13/cobra"
@@ -204,8 +206,6 @@ func (j *Join) Run(out io.Writer) error {
 		return err
 	}
 
-	hostname := nodeutil.GetHostname(j.cfg.NodeName)
-
 	client, err := kubeconfigutil.KubeConfigToClientSet(cfg)
 	if err != nil {
 		return err
@@ -213,11 +213,24 @@ func (j *Join) Run(out io.Writer) error {
 	if err := kubeadmnode.ValidateAPIServer(client); err != nil {
 		return err
 	}
-	if err := kubeadmnode.PerformTLSBootstrap(cfg, hostname); err != nil {
-		return err
+
+	kubeconfigFile := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletBootstrapKubeConfigFileName)
+
+	// Depending on the kubelet version, we might perform the TLS bootstrap or not
+	kubeletVersionBytes, err := exec.Command("sh", "-c", "kubelet --version").Output()
+	// In case the command executed successfully and returned v1.7-something, we'll perform TLS Bootstrapping
+	// Otherwise, just assume v1.8
+	// TODO: In the beginning of the v1.9 cycle, we can remove the logic as we then don't support v1.7 anymore
+	if err == nil && strings.HasPrefix(string(kubeletVersionBytes), "Kubernetes v1.7") {
+		hostname := nodeutil.GetHostname(j.cfg.NodeName)
+		if err := kubeadmnode.PerformTLSBootstrap(cfg, hostname); err != nil {
+			return err
+		}
+		// As we now performed the TLS Bootstrap, change the filepath to be kubelet.conf instead of bootstrap-kubelet.conf
+		kubeconfigFile = filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletKubeConfigFileName)
 	}
 
-	kubeconfigFile := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.KubeletKubeConfigFileName)
+	// Write the bootstrap kubelet config file or the TLS-Boostrapped kubelet config file down to disk
 	if err := kubeconfigutil.WriteToDisk(kubeconfigFile, cfg); err != nil {
 		return err
 	}
diff --git a/cmd/kubeadm/app/node/csr.go b/cmd/kubeadm/app/node/csr.go
index 2f4f2b44d61..c488a0734c9 100644
--- a/cmd/kubeadm/app/node/csr.go
+++ b/cmd/kubeadm/app/node/csr.go
@@ -26,6 +26,7 @@ import (
 	"k8s.io/kubernetes/pkg/kubelet/util/csr"
 )
 
+// CSRContextAndUser defines the context to use for the client certs in the kubelet kubeconfig file
 const CSRContextAndUser = "kubelet-csr"
 
 // PerformTLSBootstrap executes a node certificate signing request.
diff --git a/hack/.golint_failures b/hack/.golint_failures
index 47a375eac2e..0b1c10647ae 100644
--- a/hack/.golint_failures
+++ b/hack/.golint_failures
@@ -17,7 +17,6 @@ cmd/kubeadm/app/discovery
 cmd/kubeadm/app/discovery/file
 cmd/kubeadm/app/discovery/token
 cmd/kubeadm/app/images
-cmd/kubeadm/app/node
 cmd/kubeadm/app/phases/certs/pkiutil
 cmd/kubeadm/app/preflight
 cmd/kubeadm/app/util