k3s-io
/
k3s
mirror of https://github.com/k3s-io/k3s.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Create new kubeconfig for supervisor use 

Only actual admin actions should use the admin kubeconfig; everything done by the supervisor/deploy/helm controllers will now use a distinct account for audit purposes.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 64a5f58f1e)
pull/7763/head
Brad Davidson 2023-05-26 20:35:17 +00:00 committed by Brad Davidson
parent ac6966145c
commit 29bc03305a
6 changed files with 33 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/cli/cmds/server.go
View File

@ -15,10 +15,10 @@ const (
)
type StartupHookArgs struct {
APIServerReady <-chan struct{}
KubeConfigAdmin string
Skips map[string]bool
Disables map[string]bool
APIServerReady <-chan struct{}
KubeConfigSupervisor string
Skips map[string]bool
Disables map[string]bool
}
type StartupHook func(context.Context, *sync.WaitGroup, StartupHookArgs) error

8
pkg/cli/etcdsnapshot/etcd_snapshot.go
View File

@ -64,7 +64,7 @@ func commandSetup(app *cli.Context, cfg *cmds.Server, sc *server.Config) error {
sc.ControlConfig.Runtime.ETCDServerCA = filepath.Join(dataDir, "tls", "etcd", "server-ca.crt")
sc.ControlConfig.Runtime.ClientETCDCert = filepath.Join(dataDir, "tls", "etcd", "client.crt")
sc.ControlConfig.Runtime.ClientETCDKey = filepath.Join(dataDir, "tls", "etcd", "client.key")
sc.ControlConfig.Runtime.KubeConfigAdmin = filepath.Join(dataDir, "cred", "admin.kubeconfig")
sc.ControlConfig.Runtime.KubeConfigSupervisor = filepath.Join(dataDir, "cred", "supervisor.kubeconfig")
return nil
}
@ -115,7 +115,7 @@ func save(app *cli.Context, cfg *cmds.Server) error {
return err
}
sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigAdmin)
sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigSupervisor)
if err != nil {
return err
}
@ -149,7 +149,7 @@ func delete(app *cli.Context, cfg *cmds.Server) error {
return err
}
sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigAdmin)
sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigSupervisor)
if err != nil {
return err
}
@ -255,7 +255,7 @@ func prune(app *cli.Context, cfg *cmds.Server) error {
return err
}
sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigAdmin)
sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigSupervisor)
if err != nil {
return err
}

3
pkg/daemons/config/types.go
View File

@ -294,6 +294,7 @@ type ControlRuntime struct {
ServiceCurrentKey string
KubeConfigAdmin string
KubeConfigSupervisor string
KubeConfigController string
KubeConfigScheduler string
KubeConfigAPIServer string
@ -317,6 +318,8 @@ type ControlRuntime struct {
ClientAdminCert string
ClientAdminKey string
ClientSupervisorCert string
ClientSupervisorKey string
ClientControllerCert string
ClientControllerKey string
ClientSchedulerCert string

13
pkg/daemons/control/deps/deps.go
View File

@ -118,6 +118,7 @@ func CreateRuntimeCertFiles(config *config.Control) {
runtime.ServiceCurrentKey = filepath.Join(config.DataDir, "tls", "service.current.key")
runtime.KubeConfigAdmin = filepath.Join(config.DataDir, "cred", "admin.kubeconfig")
runtime.KubeConfigSupervisor = filepath.Join(config.DataDir, "cred", "supervisor.kubeconfig")
runtime.KubeConfigController = filepath.Join(config.DataDir, "cred", "controller.kubeconfig")
runtime.KubeConfigScheduler = filepath.Join(config.DataDir, "cred", "scheduler.kubeconfig")
runtime.KubeConfigAPIServer = filepath.Join(config.DataDir, "cred", "api-server.kubeconfig")
@ -125,6 +126,8 @@ func CreateRuntimeCertFiles(config *config.Control) {
runtime.ClientAdminCert = filepath.Join(config.DataDir, "tls", "client-admin.crt")
runtime.ClientAdminKey = filepath.Join(config.DataDir, "tls", "client-admin.key")
runtime.ClientSupervisorCert = filepath.Join(config.DataDir, "tls", "client-supervisor.crt")
runtime.ClientSupervisorKey = filepath.Join(config.DataDir, "tls", "client-supervisor.key")
runtime.ClientControllerCert = filepath.Join(config.DataDir, "tls", "client-controller.crt")
runtime.ClientControllerKey = filepath.Join(config.DataDir, "tls", "client-controller.key")
runtime.ClientCloudControllerCert = filepath.Join(config.DataDir, "tls", "client-"+version.Program+"-cloud-controller.crt")
@ -350,6 +353,16 @@ func genClientCerts(config *config.Control) error {
}
}
certGen, err = factory("system:"+version.Program+"-supervisor", []string{user.SystemPrivilegedGroup}, runtime.ClientSupervisorCert, runtime.ClientSupervisorKey)
if err != nil {
return err
}
if certGen {
if err := KubeConfig(runtime.KubeConfigSupervisor, apiEndpoint, runtime.ServerCA, runtime.ClientSupervisorCert, runtime.ClientSupervisorKey); err != nil {
return err
}
}
certGen, err = factory(user.KubeControllerManager, nil, runtime.ClientControllerCert, runtime.ClientControllerKey)
if err != nil {
return err

4
pkg/daemons/control/server.go
View File

@ -371,7 +371,7 @@ func cloudControllerManager(ctx context.Context, cfg *config.Control) error {
// If the CCM RBAC changes, the ResourceAttributes checked for by this function should
// be modified to check for the most recently added privilege.
func checkForCloudControllerPrivileges(ctx context.Context, runtime *config.ControlRuntime, timeout time.Duration) error {
return util.WaitForRBACReady(ctx, runtime.KubeConfigAdmin, timeout, authorizationv1.ResourceAttributes{
return util.WaitForRBACReady(ctx, runtime.KubeConfigSupervisor, timeout, authorizationv1.ResourceAttributes{
Namespace: metav1.NamespaceSystem,
Verb: "watch",
Resource: "endpointslices",
@ -412,7 +412,7 @@ func waitForAPIServerInBackground(ctx context.Context, runtime *config.ControlRu
select {
case <-ctx.Done():
return
case err := <-promise(func() error { return util.WaitForAPIServerReady(ctx, runtime.KubeConfigAdmin, 30*time.Second) }):
case err := <-promise(func() error { return util.WaitForAPIServerReady(ctx, runtime.KubeConfigSupervisor, 30*time.Second) }):
if err != nil {
logrus.Infof("Waiting for API server to become available")
continue

14
pkg/server/server.go
View File

@ -70,10 +70,10 @@ func StartServer(ctx context.Context, config *Config, cfg *cmds.Server) error {
config.ControlConfig.Runtime.StartupHooksWg = wg
shArgs := cmds.StartupHookArgs{
APIServerReady: config.ControlConfig.Runtime.APIServerReady,
KubeConfigAdmin: config.ControlConfig.Runtime.KubeConfigAdmin,
Skips: config.ControlConfig.Skips,
Disables: config.ControlConfig.Disables,
APIServerReady: config.ControlConfig.Runtime.APIServerReady,
KubeConfigSupervisor: config.ControlConfig.Runtime.KubeConfigSupervisor,
Skips: config.ControlConfig.Skips,
Disables: config.ControlConfig.Disables,
}
for _, hook := range config.StartupHooks {
if err := hook(ctx, wg, shArgs); err != nil {
@ -104,7 +104,7 @@ func startOnAPIServerReady(ctx context.Context, config *Config) {
func runControllers(ctx context.Context, config *Config) error {
controlConfig := &config.ControlConfig
sc, err := NewContext(ctx, controlConfig.Runtime.KubeConfigAdmin)
sc, err := NewContext(ctx, controlConfig.Runtime.KubeConfigSupervisor)
if err != nil {
return errors.Wrap(err, "failed to create new server context")
}
@ -212,7 +212,7 @@ func coreControllers(ctx context.Context, sc *Context, config *Config) error {
}
if !config.ControlConfig.DisableHelmController {
restConfig, err := clientcmd.BuildConfigFromFlags("", config.ControlConfig.Runtime.KubeConfigAdmin)
restConfig, err := clientcmd.BuildConfigFromFlags("", config.ControlConfig.Runtime.KubeConfigSupervisor)
if err != nil {
return err
}
@ -293,7 +293,7 @@ func stageFiles(ctx context.Context, sc *Context, controlConfig *config.Control)
return err
}
restConfig, err := clientcmd.BuildConfigFromFlags("", controlConfig.Runtime.KubeConfigAdmin)
restConfig, err := clientcmd.BuildConfigFromFlags("", controlConfig.Runtime.KubeConfigSupervisor)
if err != nil {
return err
}