From f31eb0a77f0616a5c4c3477b6d87a5a6726845cc Mon Sep 17 00:00:00 2001 From: deads2k Date: Mon, 20 Mar 2017 16:02:42 -0400 Subject: [PATCH] force callers to specify the cert dns names --- cmd/kube-apiserver/app/server.go | 2 +- federation/cmd/federation-apiserver/app/server.go | 2 +- staging/src/k8s.io/apiserver/pkg/server/options/serving.go | 7 +------ staging/src/k8s.io/kube-aggregator/pkg/cmd/server/start.go | 2 +- .../src/k8s.io/sample-apiserver/pkg/cmd/server/start.go | 2 +- 5 files changed, 5 insertions(+), 10 deletions(-) diff --git a/cmd/kube-apiserver/app/server.go b/cmd/kube-apiserver/app/server.go index 2d0fc251291..f431eae9f79 100644 --- a/cmd/kube-apiserver/app/server.go +++ b/cmd/kube-apiserver/app/server.go @@ -427,7 +427,7 @@ func defaultOptions(s *options.ServerRunOptions) error { if err != nil { return fmt.Errorf("error determining service IP ranges: %v", err) } - if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts(s.GenericServerRunOptions.AdvertiseAddress.String(), apiServerServiceIP); err != nil { + if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts(s.GenericServerRunOptions.AdvertiseAddress.String(), []string{"kubernetes.default.svc", "kubernetes.default", "kubernetes"}, []net.IP{apiServerServiceIP}); err != nil { return fmt.Errorf("error creating self-signed certificates: %v", err) } if err := s.CloudProvider.DefaultExternalHost(s.GenericServerRunOptions); err != nil { diff --git a/federation/cmd/federation-apiserver/app/server.go b/federation/cmd/federation-apiserver/app/server.go index 212e0e4f1a8..76f62545553 100644 --- a/federation/cmd/federation-apiserver/app/server.go +++ b/federation/cmd/federation-apiserver/app/server.go @@ -84,7 +84,7 @@ func NonBlockingRun(s *options.ServerRunOptions, stopCh <-chan struct{}) error { if err := s.GenericServerRunOptions.DefaultAdvertiseAddress(s.SecureServing, s.InsecureServing); err != nil { return err } - if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts(s.GenericServerRunOptions.AdvertiseAddress.String()); err != nil { + if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts(s.GenericServerRunOptions.AdvertiseAddress.String(), nil, nil); err != nil { return fmt.Errorf("error creating self-signed certificates: %v", err) } if err := s.CloudProvider.DefaultExternalHost(s.GenericServerRunOptions); err != nil { diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/serving.go b/staging/src/k8s.io/apiserver/pkg/server/options/serving.go index 074cfbbe929..c122d1e10d2 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/options/serving.go +++ b/staging/src/k8s.io/apiserver/pkg/server/options/serving.go @@ -296,7 +296,7 @@ func (s *ServingOptions) ApplyTo(c *server.Config) error { return nil } -func (s *SecureServingOptions) MaybeDefaultWithSelfSignedCerts(publicAddress string, alternateIPs ...net.IP) error { +func (s *SecureServingOptions) MaybeDefaultWithSelfSignedCerts(publicAddress string, alternateDNS []string, alternateIPs []net.IP) error { if s == nil { return nil } @@ -313,11 +313,6 @@ func (s *SecureServingOptions) MaybeDefaultWithSelfSignedCerts(publicAddress str return err } if !canReadCertAndKey { - // TODO: It would be nice to set a fqdn subject alt name, but only the kubelets know, the apiserver is clueless - // alternateDNS = append(alternateDNS, "kubernetes.default.svc.CLUSTER.DNS.NAME") - // TODO (cjcullen): Is ClusterIP the right address to sign a cert with? - alternateDNS := []string{"kubernetes.default.svc", "kubernetes.default", "kubernetes"} - // add either the bind address or localhost to the valid alternates bindIP := s.ServingOptions.BindAddress.String() if bindIP == "0.0.0.0" { diff --git a/staging/src/k8s.io/kube-aggregator/pkg/cmd/server/start.go b/staging/src/k8s.io/kube-aggregator/pkg/cmd/server/start.go index d2bdf3f74a0..de0a31e82d0 100644 --- a/staging/src/k8s.io/kube-aggregator/pkg/cmd/server/start.go +++ b/staging/src/k8s.io/kube-aggregator/pkg/cmd/server/start.go @@ -110,7 +110,7 @@ func (o *AggregatorOptions) Complete() error { func (o AggregatorOptions) RunAggregator(stopCh <-chan struct{}) error { // TODO have a "real" external address - if err := o.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost"); err != nil { + if err := o.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", nil, nil); err != nil { return fmt.Errorf("error creating self-signed certificates: %v", err) } diff --git a/staging/src/k8s.io/sample-apiserver/pkg/cmd/server/start.go b/staging/src/k8s.io/sample-apiserver/pkg/cmd/server/start.go index 53bf023095c..c9c6eba7bcd 100644 --- a/staging/src/k8s.io/sample-apiserver/pkg/cmd/server/start.go +++ b/staging/src/k8s.io/sample-apiserver/pkg/cmd/server/start.go @@ -86,7 +86,7 @@ func (o *WardleServerOptions) Complete() error { func (o WardleServerOptions) Config() (*apiserver.Config, error) { // TODO have a "real" external address - if err := o.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", net.ParseIP("127.0.0.1")); err != nil { + if err := o.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", nil, []net.IP{net.ParseIP("127.0.0.1")}); err != nil { return nil, fmt.Errorf("error creating self-signed certificates: %v", err) }