github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-28 14:07:14 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #106854 from neolit123/1.24-fix-kubeadm-check-expiration-kubeconfig

Browse Source 
kubeadm: avoid requiring a CA key during kubeconfig expiration checks
This commit is contained in:
Kubernetes Prow Robot 2021-12-07 20:57:44 -08:00 committed by GitHub
commit 89f53538ff
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
cmd/kubeadm/app/phases/certs/renewal/readwriter.go
View File

@ -29,7 +29,6 @@ import (
certutil "k8s.io/client-go/util/cert" certutil "k8s.io/client-go/util/cert"
"k8s.io/client-go/util/keyutil" "k8s.io/client-go/util/keyutil"
certsphase "k8s.io/kubernetes/cmd/kubeadm/app/phases/certs"
pkiutil "k8s.io/kubernetes/cmd/kubeadm/app/util/pkiutil" pkiutil "k8s.io/kubernetes/cmd/kubeadm/app/util/pkiutil"
) )
@ -141,11 +140,15 @@ func (rw *kubeConfigReadWriter) Read() (*x509.Certificate, error) {
// For local CA renewal, the local CA on disk could have changed, thus a reload is needed. // For local CA renewal, the local CA on disk could have changed, thus a reload is needed.
// For CSR renewal we assume the same CA on disk is mounted for usage with KCM's // For CSR renewal we assume the same CA on disk is mounted for usage with KCM's
// '--cluster-signing-cert-file' flag. // '--cluster-signing-cert-file' flag.
caCert, _, err := certsphase.LoadCertificateAuthority(rw.certificateDir, rw.baseName) certificatePath, _ := pkiutil.PathsForCertAndKey(rw.certificateDir, rw.baseName)
caCerts, err := certutil.CertsFromFile(certificatePath)
if err != nil { if err != nil {
return nil, err return nil, errors.Wrapf(err, "failed to load existing certificate %s", rw.baseName)
} }
rw.caCert = caCert if len(caCerts) != 1 {
return nil, errors.Errorf("wanted exactly one certificate, got %d", len(caCerts))
}
rw.caCert = caCerts[0]
// get current context // get current context
if _, ok := kubeConfig.Contexts[kubeConfig.CurrentContext]; !ok { if _, ok := kubeConfig.Contexts[kubeConfig.CurrentContext]; !ok {

5
cmd/kubeadm/app/phases/certs/renewal/readwriter_test.go
View File

@ -127,6 +127,11 @@ func TestKubeconfigReadWriter(t *testing.T) {
t.Fatalf("couldn't write new embedded certificate: %v", err) t.Fatalf("couldn't write new embedded certificate: %v", err)
} }
// Make sure that CA key is not present during Read() as it is not needed.
// This covers testing when the CA is external and not present on the host.
_, caKeyPath := pkiutil.PathsForCertAndKey(dirPKI, caName)
os.Remove(caKeyPath)
// Reads back the new certificate embedded in a kubeconfig writer // Reads back the new certificate embedded in a kubeconfig writer
readCert, err = kubeconfigReadWriter.Read() readCert, err = kubeconfigReadWriter.Read()
if err != nil { if err != nil {