github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-23 11:50:44 +00:00
Code Issues Projects Releases Wiki Activity

kubeadm: add required etcd certs to selfhosting api-server

Browse Source 
Selfhosting pivoting fails when using --store-certs-in-secrets
as api-server fails to start because of missing etcd/ca and
apiserver-etcd-client certificates:
   F1227 16:01:52.237352 1 storage_decorator.go:57] Unable to create storage backend:
   config (&{ /registry [https://127.0.0.1:2379]
              /etc/kubernetes/pki/apiserver-etcd-client.key
              /etc/kubernetes/pki/apiserver-etcd-client.crt
              /etc/kubernetes/pki/etcd/ca.crt true 0xc000884120 <nil> 5m0s 1m0s}),
   err (open /etc/kubernetes/pki/apiserver-etcd-client.crt: no such file or directory)

Added required certificates to fix this.

Secret name for etc/ca certifcate has been converted to conform RFC-1123 subdomain
naming conventions to prevent this TLS secret creation failure:
    unable to create secret: Secret "etcd/ca" is invalid: metadata.name:
    Invalid value: "etcd/ca": a DNS-1123 subdomain must consist of lower
    case alphanumeric characters, '-' or '.', and must start and end with an
    alphanumeric character (e.g. 'example.com', regex used for validation is
    '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')

Related issue: kubernetes/kubeadm#1281
This commit is contained in:
Ed Bartosh 2019-01-02 13:26:36 +02:00
parent 483d25785c
commit 7b058c4357
1 changed files with 46 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
cmd/kubeadm/app/phases/selfhosting/selfhosting_volumes.go
View File

@ -20,6 +20,7 @@ import (
"fmt" "fmt"
"io/ioutil" "io/ioutil"
"path/filepath" "path/filepath"
"strings"
"k8s.io/api/core/v1" "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@ -128,6 +129,40 @@ func apiServerCertificatesVolumeSource() v1.VolumeSource {
}, },
}, },
}, },
{
Secret: &v1.SecretProjection{
LocalObjectReference: v1.LocalObjectReference{
Name: strings.Replace(kubeadmconstants.EtcdCACertAndKeyBaseName, "/", "-", -1),
},
Items: []v1.KeyToPath{
{
Key: v1.TLSCertKey,
Path: kubeadmconstants.EtcdCACertName,
},
{
Key: v1.TLSPrivateKeyKey,
Path: kubeadmconstants.EtcdCAKeyName,
},
},
},
},
{
Secret: &v1.SecretProjection{
LocalObjectReference: v1.LocalObjectReference{
Name: kubeadmconstants.APIServerEtcdClientCertAndKeyBaseName,
},
Items: []v1.KeyToPath{
{
Key: v1.TLSCertKey,
Path: kubeadmconstants.APIServerEtcdClientCertName,
},
{
Key: v1.TLSPrivateKeyKey,
Path: kubeadmconstants.APIServerEtcdClientKeyName,
},
},
},
},
}, },
}, },
} }
@ -175,7 +210,7 @@ func controllerManagerCertificatesVolumeSource() v1.VolumeSource {
func kubeConfigVolumeSource(kubeconfigSecretName string) v1.VolumeSource { func kubeConfigVolumeSource(kubeconfigSecretName string) v1.VolumeSource {
return v1.VolumeSource{ return v1.VolumeSource{
Secret: &v1.SecretVolumeSource{ Secret: &v1.SecretVolumeSource{
SecretName: kubeconfigSecretName, SecretName: strings.Replace(kubeconfigSecretName, "/", "-", -1),
}, },
} }
} }
@ -294,5 +329,15 @@ func getTLSKeyPairs() []*tlsKeyPair {
cert: kubeadmconstants.FrontProxyClientCertName, cert: kubeadmconstants.FrontProxyClientCertName,
key: kubeadmconstants.FrontProxyClientKeyName, key: kubeadmconstants.FrontProxyClientKeyName,
}, },
{
name: strings.Replace(kubeadmconstants.EtcdCACertAndKeyBaseName, "/", "-", -1),
cert: kubeadmconstants.EtcdCACertName,
key: kubeadmconstants.EtcdCAKeyName,
},
{
name: kubeadmconstants.APIServerEtcdClientCertAndKeyBaseName,
cert: kubeadmconstants.APIServerEtcdClientCertName,
key: kubeadmconstants.APIServerEtcdClientKeyName,
},
} }
} }