Refactor PKI ENV

cluster/kubectl.go

@@ -23,12 +23,20 @@ type KubectlCommand struct {
 
 func (c *Cluster) buildClusterConfigEnv() []string {
 	// This needs to be updated when add more configuration
-	return []string{
+	environmentMap := map[string]string{
-		pki.ConvertConfigToENV(pki.KubeAdminConfigENVName, c.Certificates[pki.KubeAdminCommonName].Config),
+		ClusterCIDREnvName:        c.ClusterCIDR,
-		pki.ConvertConfigToENV(ClusterCIDREnvName, c.ClusterCIDR),
+		ClusterDNSServerIPEnvName: c.ClusterDNSServer,
-		pki.ConvertConfigToENV(ClusterDNSServerIPEnvName, c.ClusterDNSServer),
+		ClusterDomainEnvName:      c.ClusterDomain,
-		pki.ConvertConfigToENV(ClusterDomainEnvName, c.ClusterDomain),
 	}
+	adminConfig := c.Certificates[pki.KubeAdminCommonName]
+	//build ClusterConfigEnv
+	env := []string{
+		adminConfig.ConfigToEnv(),
+	}
+	for k, v := range environmentMap {
+		env = append(env, fmt.Sprintf("%s=%s", k, v))
+	}
+	return env
 }
 
 func (c *Cluster) RunKubectlCmd(kubectlCmd *KubectlCommand) error {

pki/deploy.go

@@ -2,8 +2,6 @@ package pki
 
 import (
 	"context"
-	"crypto/rsa"
-	"crypto/x509"
 	"fmt"
 	"io/ioutil"
 	"time"
@@ -13,42 +11,24 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/rancher/rke/docker"
 	"github.com/rancher/rke/hosts"
-	"k8s.io/client-go/util/cert"
 )
 
-func ConvertCrtToENV(name string, certificate *x509.Certificate) string {
-	encodedCrt := cert.EncodeCertPEM(certificate)
-	return fmt.Sprintf("%s=%s", name, string(encodedCrt))
-}
-
-func ConvertKeyToENV(name string, key *rsa.PrivateKey) string {
-	encodedKey := cert.EncodePrivateKeyPEM(key)
-	return fmt.Sprintf("%s=%s", name, string(encodedKey))
-}
-
-func ConvertConfigToENV(name string, config string) string {
-	return fmt.Sprintf("%s=%s", name, config)
-}
-
 func DeployCertificatesOnMasters(cpHosts []hosts.Host, crtMap map[string]CertificatePKI) error {
-	env := []string{
+	// list of certificates that should be deployed on the masters
-		ConvertCrtToENV(CACertENVName, crtMap[CACertName].Certificate),
+	crtList := []string{
-		ConvertKeyToENV(CAKeyENVName, crtMap[CACertName].Key),
+		CACertName,
-		ConvertCrtToENV(KubeAPICertENVName, crtMap[KubeAPICertName].Certificate),
+		KubeAPICertName,
-		ConvertKeyToENV(KubeAPIKeyENVName, crtMap[KubeAPICertName].Key),
+		KubeControllerName,
-		ConvertCrtToENV(KubeControllerCertENVName, crtMap[KubeControllerName].Certificate),
+		KubeSchedulerName,
-		ConvertKeyToENV(KubeControllerKeyENVName, crtMap[KubeControllerName].Key),
+		KubeProxyName,
-		ConvertConfigToENV(KubeControllerConfigENVName, crtMap[KubeControllerName].Config),
+		KubeNodeName,
-		ConvertCrtToENV(KubeSchedulerCertENVName, crtMap[KubeSchedulerName].Certificate),
-		ConvertKeyToENV(KubeSchedulerKeyENVName, crtMap[KubeSchedulerName].Key),
-		ConvertConfigToENV(KubeSchedulerConfigENVName, crtMap[KubeSchedulerName].Config),
-		ConvertCrtToENV(KubeProxyCertENVName, crtMap[KubeProxyName].Certificate),
-		ConvertKeyToENV(KubeProxyKeyENVName, crtMap[KubeProxyName].Key),
-		ConvertConfigToENV(KubeProxyConfigENVName, crtMap[KubeProxyName].Config),
-		ConvertCrtToENV(KubeNodeCertENVName, crtMap[KubeNodeName].Certificate),
-		ConvertKeyToENV(KubeNodeKeyENVName, crtMap[KubeNodeName].Key),
-		ConvertConfigToENV(KubeNodeConfigENVName, crtMap[KubeNodeName].Config),
 	}
+	env := []string{}
+	for _, crtName := range crtList {
+		c := crtMap[crtName]
+		env = append(env, c.ToEnv()...)
+	}
+
 	for i := range cpHosts {
 		err := doRunDeployer(&cpHosts[i], env)
 		if err != nil {
@@ -59,15 +39,18 @@ func DeployCertificatesOnMasters(cpHosts []hosts.Host, crtMap map[string]Certifi
 }
 
 func DeployCertificatesOnWorkers(workerHosts []hosts.Host, crtMap map[string]CertificatePKI) error {
-	env := []string{
+	// list of certificates that should be deployed on the workers
-		ConvertCrtToENV(CACertENVName, crtMap[CACertName].Certificate),
+	crtList := []string{
-		ConvertCrtToENV(KubeProxyCertENVName, crtMap[KubeProxyName].Certificate),
+		CACertName,
-		ConvertKeyToENV(KubeProxyKeyENVName, crtMap[KubeProxyName].Key),
+		KubeProxyName,
-		ConvertConfigToENV(KubeProxyConfigENVName, crtMap[KubeProxyName].Config),
+		KubeNodeName,
-		ConvertCrtToENV(KubeNodeCertENVName, crtMap[KubeNodeName].Certificate),
-		ConvertKeyToENV(KubeNodeKeyENVName, crtMap[KubeNodeName].Key),
-		ConvertConfigToENV(KubeNodeConfigENVName, crtMap[KubeNodeName].Config),
 	}
+	env := []string{}
+	for _, crtName := range crtList {
+		c := crtMap[crtName]
+		env = append(env, c.ToEnv()...)
+	}
+
 	for i := range workerHosts {
 		err := doRunDeployer(&workerHosts[i], env)
 		if err != nil {

pki/pki.go

@@ -12,9 +12,18 @@ import (
 )
 
 type CertificatePKI struct {
-	Certificate *x509.Certificate
+	Certificate   *x509.Certificate
-	Key         *rsa.PrivateKey
+	Key           *rsa.PrivateKey
-	Config      string
+	Config        string
+	Name          string
+	CommonName    string
+	OUName        string
+	EnvName       string
+	Path          string
+	KeyEnvName    string
+	KeyPath       string
+	ConfigEnvName string
+	ConfigPath    string
 }
 
 // StartCertificatesGeneration ...
@@ -39,6 +48,11 @@ func generateCerts(cpHosts []hosts.Host, clusterDomain string, KubernetesService
 	certs[CACertName] = CertificatePKI{
 		Certificate: caCrt,
 		Key:         caKey,
+		Name:        CACertName,
+		EnvName:     CACertENVName,
+		KeyEnvName:  CAKeyENVName,
+		Path:        CACertPath,
+		KeyPath:     CAKeyPath,
 	}
 
 	// generate API certificate and key
@@ -52,6 +66,11 @@ func generateCerts(cpHosts []hosts.Host, clusterDomain string, KubernetesService
 	certs[KubeAPICertName] = CertificatePKI{
 		Certificate: kubeAPICrt,
 		Key:         kubeAPIKey,
+		Name:        KubeAPICertName,
+		EnvName:     KubeAPICertENVName,
+		KeyEnvName:  KubeAPIKeyENVName,
+		Path:        KubeAPICertPath,
+		KeyPath:     KubeAPIKeyPath,
 	}
 
 	// generate Kube controller-manager certificate and key
@@ -62,9 +81,17 @@ func generateCerts(cpHosts []hosts.Host, clusterDomain string, KubernetesService
 	}
 	logrus.Debugf("[certificates] Kube Controller Certificate: %s", string(cert.EncodeCertPEM(kubeControllerCrt)))
 	certs[KubeControllerName] = CertificatePKI{
-		Certificate: kubeControllerCrt,
+		Certificate:   kubeControllerCrt,
-		Key:         kubeControllerKey,
+		Key:           kubeControllerKey,
-		Config:      getKubeConfigX509("https://"+cpHosts[0].AdvertiseAddress+":6443", KubeControllerName, CACertPath, KubeControllerCertPath, KubeControllerKeyPath),
+		Config:        getKubeConfigX509("https://"+cpHosts[0].AdvertiseAddress+":6443", KubeControllerName, CACertPath, KubeControllerCertPath, KubeControllerKeyPath),
+		Name:          KubeControllerName,
+		CommonName:    KubeControllerCommonName,
+		EnvName:       KubeControllerCertENVName,
+		KeyEnvName:    KubeControllerKeyENVName,
+		Path:          KubeControllerCertPath,
+		KeyPath:       KubeControllerKeyPath,
+		ConfigEnvName: KubeControllerConfigENVName,
+		ConfigPath:    KubeControllerConfigPath,
 	}
 
 	// generate Kube scheduler certificate and key
@@ -75,9 +102,17 @@ func generateCerts(cpHosts []hosts.Host, clusterDomain string, KubernetesService
 	}
 	logrus.Debugf("[certificates] Kube Scheduler Certificate: %s", string(cert.EncodeCertPEM(kubeSchedulerCrt)))
 	certs[KubeSchedulerName] = CertificatePKI{
-		Certificate: kubeSchedulerCrt,
+		Certificate:   kubeSchedulerCrt,
-		Key:         kubeSchedulerKey,
+		Key:           kubeSchedulerKey,
-		Config:      getKubeConfigX509("https://"+cpHosts[0].AdvertiseAddress+":6443", KubeSchedulerName, CACertPath, KubeSchedulerCertPath, KubeSchedulerKeyPath),
+		Config:        getKubeConfigX509("https://"+cpHosts[0].AdvertiseAddress+":6443", KubeSchedulerName, CACertPath, KubeSchedulerCertPath, KubeSchedulerKeyPath),
+		Name:          KubeSchedulerName,
+		CommonName:    KubeSchedulerCommonName,
+		EnvName:       KubeSchedulerCertENVName,
+		KeyEnvName:    KubeSchedulerKeyENVName,
+		Path:          KubeSchedulerCertPath,
+		KeyPath:       KubeSchedulerKeyPath,
+		ConfigEnvName: KubeSchedulerConfigENVName,
+		ConfigPath:    KubeSchedulerConfigPath,
 	}
 
 	// generate Kube Proxy certificate and key
@@ -88,9 +123,17 @@ func generateCerts(cpHosts []hosts.Host, clusterDomain string, KubernetesService
 	}
 	logrus.Debugf("[certificates] Kube Proxy Certificate: %s", string(cert.EncodeCertPEM(kubeProxyCrt)))
 	certs[KubeProxyName] = CertificatePKI{
-		Certificate: kubeProxyCrt,
+		Certificate:   kubeProxyCrt,
-		Key:         kubeProxyKey,
+		Key:           kubeProxyKey,
-		Config:      getKubeConfigX509("https://"+cpHosts[0].AdvertiseAddress+":6443", KubeProxyName, CACertPath, KubeProxyCertPath, KubeProxyKeyPath),
+		Config:        getKubeConfigX509("https://"+cpHosts[0].AdvertiseAddress+":6443", KubeProxyName, CACertPath, KubeProxyCertPath, KubeProxyKeyPath),
+		Name:          KubeProxyName,
+		CommonName:    KubeProxyCommonName,
+		EnvName:       KubeProxyCertENVName,
+		Path:          KubeProxyCertPath,
+		KeyEnvName:    KubeProxyKeyENVName,
+		KeyPath:       KubeProxyKeyPath,
+		ConfigEnvName: KubeProxyConfigENVName,
+		ConfigPath:    KubeProxyConfigPath,
 	}
 
 	// generate Kubelet certificate and key
@@ -101,9 +144,18 @@ func generateCerts(cpHosts []hosts.Host, clusterDomain string, KubernetesService
 	}
 	logrus.Debugf("[certificates] Node Certificate: %s", string(cert.EncodeCertPEM(kubeProxyCrt)))
 	certs[KubeNodeName] = CertificatePKI{
-		Certificate: nodeCrt,
+		Certificate:   nodeCrt,
-		Key:         nodeKey,
+		Key:           nodeKey,
-		Config:      getKubeConfigX509("https://"+cpHosts[0].AdvertiseAddress+":6443", KubeNodeName, CACertPath, KubeNodeCertPath, KubeNodeKeyPath),
+		Config:        getKubeConfigX509("https://"+cpHosts[0].AdvertiseAddress+":6443", KubeNodeName, CACertPath, KubeNodeCertPath, KubeNodeKeyPath),
+		Name:          KubeNodeName,
+		CommonName:    KubeNodeCommonName,
+		OUName:        KubeNodeOrganizationName,
+		EnvName:       KubeNodeCertENVName,
+		KeyEnvName:    KubeNodeKeyENVName,
+		Path:          KubeNodeCertPath,
+		KeyPath:       KubeNodeKeyPath,
+		ConfigEnvName: KubeNodeConfigENVName,
+		ConfigPath:    KubeNodeCommonName,
 	}
 	logrus.Infof("[certificates] Generating admin certificates and kubeconfig")
 	kubeAdminCrt, kubeAdminKey, err := generateClientCertAndKey(caCrt, caKey, KubeAdminCommonName, []string{KubeAdminOrganizationName})
@@ -120,6 +172,10 @@ func generateCerts(cpHosts []hosts.Host, clusterDomain string, KubernetesService
 			string(cert.EncodeCertPEM(caCrt)),
 			string(cert.EncodeCertPEM(kubeAdminCrt)),
 			string(cert.EncodePrivateKeyPEM(kubeAdminKey))),
+		CommonName:    KubeAdminCommonName,
+		OUName:        KubeAdminOrganizationName,
+		ConfigEnvName: KubeAdminConfigENVName,
+		ConfigPath:    KubeAdminConfigPath,
 	}
 	return certs, nil
 }
@@ -200,3 +256,28 @@ func getAltNames(cpHosts []hosts.Host, clusterDomain string, KubernetesServiceIP
 		DNSNames: dnsNames,
 	}
 }
+
+func (c *CertificatePKI) ToEnv() []string {
+	env := []string{
+		c.CertToEnv(),
+		c.KeyToEnv(),
+	}
+	if c.Config != "" {
+		env = append(env, c.ConfigToEnv())
+	}
+	return env
+}
+
+func (c *CertificatePKI) CertToEnv() string {
+	encodedCrt := cert.EncodeCertPEM(c.Certificate)
+	return fmt.Sprintf("%s=%s", c.EnvName, string(encodedCrt))
+}
+
+func (c *CertificatePKI) KeyToEnv() string {
+	encodedKey := cert.EncodePrivateKeyPEM(c.Key)
+	return fmt.Sprintf("%s=%s", c.KeyEnvName, string(encodedKey))
+}
+
+func (c *CertificatePKI) ConfigToEnv() string {
+	return fmt.Sprintf("%s=%s", c.ConfigEnvName, c.Config)
+}