Add default cluster config file and return service container pointer

Add more generic functions to go services Add x509 authentication
2025-09-16 23:20:56 +00:00 · 2017-10-31 15:55:35 +02:00
parent 405a709a69
commit ad34392a3c
21 changed files with 669 additions and 365 deletions
--- a/pki/deploy.go
+++ b/pki/deploy.go
@@ -0,0 +1,129 @@
+package pki
+
+import (
+	"context"
+	"crypto/rsa"
+	"crypto/x509"
+	"fmt"
+	"time"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/rancher/rke/docker"
+	"github.com/rancher/rke/hosts"
+	"k8s.io/client-go/util/cert"
+)
+
+func convertCrtToENV(name string, certificate *x509.Certificate) string {
+	encodedCrt := cert.EncodeCertPEM(certificate)
+	return name + "=" + string(encodedCrt)
+}
+
+func convertKeyToENV(name string, key *rsa.PrivateKey) string {
+	encodedKey := cert.EncodePrivateKeyPEM(key)
+	return name + "=" + string(encodedKey)
+}
+
+func convertConfigToENV(name string, config string) string {
+	return name + "=" + config
+}
+
+func deployCertificatesOnMasters(cpHosts []hosts.Host, crtMap map[string]CertificatePKI, forceDeploy bool) error {
+	forceDeployEnv := "FORCE_DEPLOY=false"
+	if forceDeploy {
+		forceDeployEnv = "FORCE_DEPLOY=true"
+	}
+	env := []string{
+		forceDeployEnv,
+		convertCrtToENV(CACertENVName, crtMap[CACertName].certificate),
+		convertKeyToENV(CAKeyENVName, crtMap[CACertName].key),
+		convertCrtToENV(KubeAPICertENVName, crtMap[KubeAPICertName].certificate),
+		convertKeyToENV(KubeAPIKeyENVName, crtMap[KubeAPICertName].key),
+		convertCrtToENV(KubeControllerCertENVName, crtMap[KubeControllerName].certificate),
+		convertKeyToENV(KubeControllerKeyENVName, crtMap[KubeControllerName].key),
+		convertConfigToENV(KubeControllerConfigENVName, crtMap[KubeControllerName].config),
+		convertCrtToENV(KubeSchedulerCertENVName, crtMap[KubeSchedulerName].certificate),
+		convertKeyToENV(KubeSchedulerKeyENVName, crtMap[KubeSchedulerName].key),
+		convertConfigToENV(KubeSchedulerConfigENVName, crtMap[KubeSchedulerName].config),
+		convertCrtToENV(KubeProxyCertENVName, crtMap[KubeProxyName].certificate),
+		convertKeyToENV(KubeProxyKeyENVName, crtMap[KubeProxyName].key),
+		convertConfigToENV(KubeProxyConfigENVName, crtMap[KubeProxyName].config),
+		convertCrtToENV(KubeNodeCertENVName, crtMap[KubeNodeName].certificate),
+		convertKeyToENV(KubeNodeKeyENVName, crtMap[KubeNodeName].key),
+		convertConfigToENV(KubeNodeConfigENVName, crtMap[KubeNodeName].config),
+	}
+	for _, host := range cpHosts {
+		err := doRunDeployer(&host, env)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func deployCertificatesOnWorkers(workerHosts []hosts.Host, crtMap map[string]CertificatePKI, forceDeploy bool) error {
+	forceDeployEnv := "FORCE_DEPLOY=false"
+	if forceDeploy {
+		forceDeployEnv = "FORCE_DEPLOY=true"
+	}
+	env := []string{
+		forceDeployEnv,
+		convertCrtToENV(CACertENVName, crtMap[CACertName].certificate),
+		convertCrtToENV(KubeProxyCertENVName, crtMap[KubeProxyName].certificate),
+		convertKeyToENV(KubeProxyKeyENVName, crtMap[KubeProxyName].key),
+		convertConfigToENV(KubeProxyConfigENVName, crtMap[KubeProxyName].config),
+		convertCrtToENV(KubeNodeCertENVName, crtMap[KubeNodeName].certificate),
+		convertKeyToENV(KubeNodeKeyENVName, crtMap[KubeNodeName].key),
+		convertConfigToENV(KubeNodeConfigENVName, crtMap[KubeNodeName].config),
+	}
+	for _, host := range workerHosts {
+		err := doRunDeployer(&host, env)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func doRunDeployer(host *hosts.Host, containerEnv []string) error {
+	logrus.Debugf("[certificates] Pulling Certificate downloader Image on host [%s]", host.Hostname)
+	err := docker.PullImage(host, CrtDownloaderImage)
+	if err != nil {
+		return err
+	}
+	imageCfg := &container.Config{
+		Image: CrtDownloaderImage,
+		Env:   containerEnv,
+	}
+	hostCfg := &container.HostConfig{
+		Binds: []string{
+			"/etc/kubernetes:/etc/kubernetes",
+		},
+		Privileged:    true,
+		RestartPolicy: container.RestartPolicy{Name: "never"},
+	}
+	resp, err := host.DClient.ContainerCreate(context.Background(), imageCfg, hostCfg, nil, CrtDownloaderContainer)
+	if err != nil {
+		return fmt.Errorf("Failed to create Certificates deployer container on host [%s]: %v", host.Hostname, err)
+	}
+
+	if err := host.DClient.ContainerStart(context.Background(), resp.ID, types.ContainerStartOptions{}); err != nil {
+		return fmt.Errorf("Failed to start Certificates deployer container on host [%s]: %v", host.Hostname, err)
+	}
+	logrus.Debugf("[certificates] Successfully started Certificate deployer container: %s", resp.ID)
+	for {
+		isDeployerRunning, err := docker.IsContainerRunning(host, CrtDownloaderContainer)
+		if err != nil {
+			return err
+		}
+		if isDeployerRunning {
+			time.Sleep(5 * time.Second)
+			continue
+		}
+		if err := host.DClient.ContainerRemove(context.Background(), resp.ID, types.ContainerRemoveOptions{}); err != nil {
+			return fmt.Errorf("Failed to delete Certificates deployer container on host[%s]: %v", host.Hostname, err)
+		}
+		return nil
+	}
+}