adopt signers from installer for rotating serving certs

bindata/bootkube/manifests/secret-loadbalancer-serving-signer.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: loadbalancer-serving-signer
+  namespace: openshift-kube-apiserver-operator
+  annotations:
+    "auth.openshift.io/certificate-not-before": {{ .Assets | load "kube-apiserver-lb-host-ip-signer.crt" | notBefore }}
+    "auth.openshift.io/certificate-not-after": {{ .Assets | load "kube-apiserver-lb-host-ip-signer.crt" | notAfter }}
+    "auth.openshift.io/certificate-issuer": {{ .Assets | load "kube-apiserver-lb-host-ip-signer.crt" | issuer }}
+type: SecretTypeTLS
+data:
+  tls.crt: {{ .Assets | load "kube-apiserver-lb-host-ip-signer.crt" | base64 }}
+  tls.key: {{ .Assets | load "kube-apiserver-lb-host-ip-signer.key" | base64 }}

bindata/bootkube/manifests/secret-localhost-serving-signer.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: localhost-serving-signer
+  namespace: openshift-kube-apiserver-operator
+  annotations:
+    "auth.openshift.io/certificate-not-before": {{ .Assets | load "kube-apiserver-localhost-signer.crt" | notBefore }}
+    "auth.openshift.io/certificate-not-after": {{ .Assets | load "kube-apiserver-localhost-signer.crt" | notAfter }}
+    "auth.openshift.io/certificate-issuer": {{ .Assets | load "kube-apiserver-localhost-signer.crt" | issuer }}
+type: SecretTypeTLS
+data:
+  tls.crt: {{ .Assets | load "kube-apiserver-localhost-signer.crt" | base64 }}
+  tls.key: {{ .Assets | load "kube-apiserver-localhost-signer.key" | base64 }}

bindata/bootkube/manifests/secret-service-network-serving-signer.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: service-network-serving-signer
+  namespace: openshift-kube-apiserver-operator
+  annotations:
+    "auth.openshift.io/certificate-not-before": {{ .Assets | load "kube-apiserver-service-network-signer.crt" | notBefore }}
+    "auth.openshift.io/certificate-not-after": {{ .Assets | load "kube-apiserver-service-network-signer.crt" | notAfter }}
+    "auth.openshift.io/certificate-issuer": {{ .Assets | load "kube-apiserver-service-network-signer.crt" | issuer }}
+type: SecretTypeTLS
+data:
+  tls.crt: {{ .Assets | load "kube-apiserver-service-network-signer.crt" | base64 }}
+  tls.key: {{ .Assets | load "kube-apiserver-service-network-signer.key" | base64 }}

pkg/operator/certrotationcontroller/certrotationcontroller.go

@@ -3,14 +3,15 @@ package certrotationcontroller
 import (
 	"time"
 
-	"github.com/openshift/library-go/pkg/operator/events"
-	"github.com/openshift/library-go/pkg/operator/v1helpers"
+	"github.com/golang/glog"
 
+	"k8s.io/apiserver/pkg/authentication/user"
 	"k8s.io/client-go/kubernetes"
 
 	"github.com/openshift/cluster-kube-apiserver-operator/pkg/operator/operatorclient"
 	"github.com/openshift/library-go/pkg/operator/certrotation"
-	"k8s.io/apiserver/pkg/authentication/user"
+	"github.com/openshift/library-go/pkg/operator/events"
+	"github.com/openshift/library-go/pkg/operator/v1helpers"
 )
 
 type CertRotationController struct {
@@ -65,6 +66,128 @@ func NewCertRotationController(
 	}
 	ret.certRotators = append(ret.certRotators, certRotator)
 
+	certRotator, err = certrotation.NewCertRotationController(
+		"LocalhostServing",
+		certrotation.SigningRotation{
+			Namespace:         operatorclient.OperatorNamespace,
+			Name:              "localhost-serving-signer",
+			Validity:          10 * 365 * 24 * time.Hour,
+			RefreshPercentage: 0.5,
+			Informer:          kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets(),
+			Lister:            kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
+			Client:            kubeClient.CoreV1(),
+			EventRecorder:     eventRecorder,
+		},
+		certrotation.CABundleRotation{
+			Namespace:     operatorclient.OperatorNamespace,
+			Name:          "localhost-serving-ca",
+			Informer:      kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
+			Lister:        kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
+			Client:        kubeClient.CoreV1(),
+			EventRecorder: eventRecorder,
+		},
+		certrotation.TargetRotation{
+			Namespace:         operatorclient.TargetNamespace,
+			Name:              "localhost-serving-cert-certkey",
+			Validity:          1 * 4 * time.Hour,
+			RefreshPercentage: 0.5,
+			ServingRotation: &certrotation.ServingRotation{
+				Hostnames: []string{"localhost", "127.0.0.1"},
+			},
+			Informer:      kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets(),
+			Lister:        kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
+			Client:        kubeClient.CoreV1(),
+			EventRecorder: eventRecorder,
+		},
+		operatorClient,
+	)
+	if err != nil {
+		return nil, err
+	}
+	ret.certRotators = append(ret.certRotators, certRotator)
+
+	certRotator, err = certrotation.NewCertRotationController(
+		"ServiceNetworkServing",
+		certrotation.SigningRotation{
+			Namespace:         operatorclient.OperatorNamespace,
+			Name:              "service-network-serving-signer",
+			Validity:          10 * 365 * 24 * time.Hour,
+			RefreshPercentage: 0.5,
+			Informer:          kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets(),
+			Lister:            kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
+			Client:            kubeClient.CoreV1(),
+			EventRecorder:     eventRecorder,
+		},
+		certrotation.CABundleRotation{
+			Namespace:     operatorclient.OperatorNamespace,
+			Name:          "service-network-serving-ca",
+			Informer:      kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
+			Lister:        kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
+			Client:        kubeClient.CoreV1(),
+			EventRecorder: eventRecorder,
+		},
+		certrotation.TargetRotation{
+			Namespace:         operatorclient.TargetNamespace,
+			Name:              "service-network-serving-certkey",
+			Validity:          1 * 4 * time.Hour,
+			RefreshPercentage: 0.5,
+			ServingRotation: &certrotation.ServingRotation{
+				// TODO, this needs to be late binding so we can keep it up to date as network configuration changes
+				Hostnames: []string{"kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster.local"},
+			},
+			Informer:      kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets(),
+			Lister:        kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
+			Client:        kubeClient.CoreV1(),
+			EventRecorder: eventRecorder,
+		},
+		operatorClient,
+	)
+	if err != nil {
+		return nil, err
+	}
+	ret.certRotators = append(ret.certRotators, certRotator)
+
+	certRotator, err = certrotation.NewCertRotationController(
+		"LoadBalancerServing",
+		certrotation.SigningRotation{
+			Namespace:         operatorclient.OperatorNamespace,
+			Name:              "loadbalancer-serving-signer",
+			Validity:          10 * 365 * 24 * time.Hour,
+			RefreshPercentage: 0.5,
+			Informer:          kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets(),
+			Lister:            kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
+			Client:            kubeClient.CoreV1(),
+			EventRecorder:     eventRecorder,
+		},
+		certrotation.CABundleRotation{
+			Namespace:     operatorclient.OperatorNamespace,
+			Name:          "loadbalancer-serving-ca",
+			Informer:      kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps(),
+			Lister:        kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().ConfigMaps().Lister(),
+			Client:        kubeClient.CoreV1(),
+			EventRecorder: eventRecorder,
+		},
+		certrotation.TargetRotation{
+			Namespace:         operatorclient.TargetNamespace,
+			Name:              "loadbalancer-serving-serving-certkey",
+			Validity:          1 * 4 * time.Hour,
+			RefreshPercentage: 0.5,
+			ServingRotation: &certrotation.ServingRotation{
+				// TODO, this needs to be late binding so we can keep it up to date as network configuration changes
+				Hostnames: []string{"api"}, // this isn't correct, but we need something to get certs started
+			},
+			Informer:      kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets(),
+			Lister:        kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
+			Client:        kubeClient.CoreV1(),
+			EventRecorder: eventRecorder,
+		},
+		operatorClient,
+	)
+	if err != nil {
+		return nil, err
+	}
+	ret.certRotators = append(ret.certRotators, certRotator)
+
 	certRotator, err = certrotation.NewCertRotationController(
 		"KubeControllerManagerClient",
 		certrotation.SigningRotation{
@@ -191,6 +314,9 @@ func NewCertRotationController(
 }
 
 func (c *CertRotationController) Run(workers int, stopCh <-chan struct{}) {
+	glog.Infof("Starting CertRotation")
+	defer glog.Infof("Shutting down CertRotation")
+
 	for _, certRotator := range c.certRotators {
 		go certRotator.Run(workers, stopCh)
 	}