diff --git a/pkg/cli/cmds/server.go b/pkg/cli/cmds/server.go index 33f255a40b..3d5941faf7 100644 --- a/pkg/cli/cmds/server.go +++ b/pkg/cli/cmds/server.go @@ -15,10 +15,10 @@ const ( ) type StartupHookArgs struct { - APIServerReady <-chan struct{} - KubeConfigAdmin string - Skips map[string]bool - Disables map[string]bool + APIServerReady <-chan struct{} + KubeConfigSupervisor string + Skips map[string]bool + Disables map[string]bool } type StartupHook func(context.Context, *sync.WaitGroup, StartupHookArgs) error diff --git a/pkg/cli/etcdsnapshot/etcd_snapshot.go b/pkg/cli/etcdsnapshot/etcd_snapshot.go index a60832d7f9..01bddcf126 100644 --- a/pkg/cli/etcdsnapshot/etcd_snapshot.go +++ b/pkg/cli/etcdsnapshot/etcd_snapshot.go @@ -64,7 +64,7 @@ func commandSetup(app *cli.Context, cfg *cmds.Server, sc *server.Config) error { sc.ControlConfig.Runtime.ETCDServerCA = filepath.Join(dataDir, "tls", "etcd", "server-ca.crt") sc.ControlConfig.Runtime.ClientETCDCert = filepath.Join(dataDir, "tls", "etcd", "client.crt") sc.ControlConfig.Runtime.ClientETCDKey = filepath.Join(dataDir, "tls", "etcd", "client.key") - sc.ControlConfig.Runtime.KubeConfigAdmin = filepath.Join(dataDir, "cred", "admin.kubeconfig") + sc.ControlConfig.Runtime.KubeConfigSupervisor = filepath.Join(dataDir, "cred", "supervisor.kubeconfig") return nil } @@ -115,7 +115,7 @@ func save(app *cli.Context, cfg *cmds.Server) error { return err } - sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigAdmin) + sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigSupervisor) if err != nil { return err } @@ -149,7 +149,7 @@ func delete(app *cli.Context, cfg *cmds.Server) error { return err } - sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigAdmin) + sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigSupervisor) if err != nil { return err } @@ -255,7 +255,7 @@ func prune(app *cli.Context, cfg *cmds.Server) error { return err } - sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigAdmin) + sc, err := server.NewContext(ctx, serverConfig.ControlConfig.Runtime.KubeConfigSupervisor) if err != nil { return err } diff --git a/pkg/daemons/config/types.go b/pkg/daemons/config/types.go index 34d68378bb..2c1c8c53c7 100644 --- a/pkg/daemons/config/types.go +++ b/pkg/daemons/config/types.go @@ -294,6 +294,7 @@ type ControlRuntime struct { ServiceCurrentKey string KubeConfigAdmin string + KubeConfigSupervisor string KubeConfigController string KubeConfigScheduler string KubeConfigAPIServer string @@ -317,6 +318,8 @@ type ControlRuntime struct { ClientAdminCert string ClientAdminKey string + ClientSupervisorCert string + ClientSupervisorKey string ClientControllerCert string ClientControllerKey string ClientSchedulerCert string diff --git a/pkg/daemons/control/deps/deps.go b/pkg/daemons/control/deps/deps.go index 6afae23358..f08708b485 100644 --- a/pkg/daemons/control/deps/deps.go +++ b/pkg/daemons/control/deps/deps.go @@ -118,6 +118,7 @@ func CreateRuntimeCertFiles(config *config.Control) { runtime.ServiceCurrentKey = filepath.Join(config.DataDir, "tls", "service.current.key") runtime.KubeConfigAdmin = filepath.Join(config.DataDir, "cred", "admin.kubeconfig") + runtime.KubeConfigSupervisor = filepath.Join(config.DataDir, "cred", "supervisor.kubeconfig") runtime.KubeConfigController = filepath.Join(config.DataDir, "cred", "controller.kubeconfig") runtime.KubeConfigScheduler = filepath.Join(config.DataDir, "cred", "scheduler.kubeconfig") runtime.KubeConfigAPIServer = filepath.Join(config.DataDir, "cred", "api-server.kubeconfig") @@ -125,6 +126,8 @@ func CreateRuntimeCertFiles(config *config.Control) { runtime.ClientAdminCert = filepath.Join(config.DataDir, "tls", "client-admin.crt") runtime.ClientAdminKey = filepath.Join(config.DataDir, "tls", "client-admin.key") + runtime.ClientSupervisorCert = filepath.Join(config.DataDir, "tls", "client-supervisor.crt") + runtime.ClientSupervisorKey = filepath.Join(config.DataDir, "tls", "client-supervisor.key") runtime.ClientControllerCert = filepath.Join(config.DataDir, "tls", "client-controller.crt") runtime.ClientControllerKey = filepath.Join(config.DataDir, "tls", "client-controller.key") runtime.ClientCloudControllerCert = filepath.Join(config.DataDir, "tls", "client-"+version.Program+"-cloud-controller.crt") @@ -350,6 +353,16 @@ func genClientCerts(config *config.Control) error { } } + certGen, err = factory("system:"+version.Program+"-supervisor", []string{user.SystemPrivilegedGroup}, runtime.ClientSupervisorCert, runtime.ClientSupervisorKey) + if err != nil { + return err + } + if certGen { + if err := KubeConfig(runtime.KubeConfigSupervisor, apiEndpoint, runtime.ServerCA, runtime.ClientSupervisorCert, runtime.ClientSupervisorKey); err != nil { + return err + } + } + certGen, err = factory(user.KubeControllerManager, nil, runtime.ClientControllerCert, runtime.ClientControllerKey) if err != nil { return err diff --git a/pkg/daemons/control/server.go b/pkg/daemons/control/server.go index c7685070d0..265185f2be 100644 --- a/pkg/daemons/control/server.go +++ b/pkg/daemons/control/server.go @@ -371,7 +371,7 @@ func cloudControllerManager(ctx context.Context, cfg *config.Control) error { // If the CCM RBAC changes, the ResourceAttributes checked for by this function should // be modified to check for the most recently added privilege. func checkForCloudControllerPrivileges(ctx context.Context, runtime *config.ControlRuntime, timeout time.Duration) error { - return util.WaitForRBACReady(ctx, runtime.KubeConfigAdmin, timeout, authorizationv1.ResourceAttributes{ + return util.WaitForRBACReady(ctx, runtime.KubeConfigSupervisor, timeout, authorizationv1.ResourceAttributes{ Namespace: metav1.NamespaceSystem, Verb: "watch", Resource: "endpointslices", @@ -412,7 +412,7 @@ func waitForAPIServerInBackground(ctx context.Context, runtime *config.ControlRu select { case <-ctx.Done(): return - case err := <-promise(func() error { return util.WaitForAPIServerReady(ctx, runtime.KubeConfigAdmin, 30*time.Second) }): + case err := <-promise(func() error { return util.WaitForAPIServerReady(ctx, runtime.KubeConfigSupervisor, 30*time.Second) }): if err != nil { logrus.Infof("Waiting for API server to become available") continue diff --git a/pkg/server/server.go b/pkg/server/server.go index 4518f8ab23..81f16697d4 100644 --- a/pkg/server/server.go +++ b/pkg/server/server.go @@ -70,10 +70,10 @@ func StartServer(ctx context.Context, config *Config, cfg *cmds.Server) error { config.ControlConfig.Runtime.StartupHooksWg = wg shArgs := cmds.StartupHookArgs{ - APIServerReady: config.ControlConfig.Runtime.APIServerReady, - KubeConfigAdmin: config.ControlConfig.Runtime.KubeConfigAdmin, - Skips: config.ControlConfig.Skips, - Disables: config.ControlConfig.Disables, + APIServerReady: config.ControlConfig.Runtime.APIServerReady, + KubeConfigSupervisor: config.ControlConfig.Runtime.KubeConfigSupervisor, + Skips: config.ControlConfig.Skips, + Disables: config.ControlConfig.Disables, } for _, hook := range config.StartupHooks { if err := hook(ctx, wg, shArgs); err != nil { @@ -104,7 +104,7 @@ func startOnAPIServerReady(ctx context.Context, config *Config) { func runControllers(ctx context.Context, config *Config) error { controlConfig := &config.ControlConfig - sc, err := NewContext(ctx, controlConfig.Runtime.KubeConfigAdmin) + sc, err := NewContext(ctx, controlConfig.Runtime.KubeConfigSupervisor) if err != nil { return errors.Wrap(err, "failed to create new server context") } @@ -212,7 +212,7 @@ func coreControllers(ctx context.Context, sc *Context, config *Config) error { } if !config.ControlConfig.DisableHelmController { - restConfig, err := clientcmd.BuildConfigFromFlags("", config.ControlConfig.Runtime.KubeConfigAdmin) + restConfig, err := clientcmd.BuildConfigFromFlags("", config.ControlConfig.Runtime.KubeConfigSupervisor) if err != nil { return err } @@ -293,7 +293,7 @@ func stageFiles(ctx context.Context, sc *Context, controlConfig *config.Control) return err } - restConfig, err := clientcmd.BuildConfigFromFlags("", controlConfig.Runtime.KubeConfigAdmin) + restConfig, err := clientcmd.BuildConfigFromFlags("", controlConfig.Runtime.KubeConfigSupervisor) if err != nil { return err }