diff --git a/docs/design/resource_dep.svg b/docs/design/resource_dep.svg index b96324c0543..06d4a1a31b1 100644 --- a/docs/design/resource_dep.svg +++ b/docs/design/resource_dep.svg @@ -4,1293 +4,1851 @@ - - + + G - + cluster_Target - -Target + +Target cluster_bootkube - -bootkube + +bootkube cluster_bootstrap - -bootstrap + +bootstrap cluster_cluster - -cluster + +cluster cluster_installconfig - -installconfig + +installconfig cluster_kubeconfig - -kubeconfig + +kubeconfig cluster_machine - -machine + +machine cluster_machines - -machines + +machines cluster_manifests - -manifests + +manifests cluster_openshift - -openshift + +openshift cluster_password - -password + +password cluster_rhcos - -rhcos + +rhcos cluster_tls - -tls + +tls installconfig.InstallConfig - -installconfig.InstallConfig + +installconfig.InstallConfig Target Install Config - -Target Install Config + +Target Install Config installconfig.InstallConfig->Target Install Config - - + + - + +machines.Master + +machines.Master + + + +installconfig.InstallConfig->machines.Master + + + + + +installconfig.PlatformCredsCheck + +installconfig.PlatformCredsCheck + + + +installconfig.InstallConfig->installconfig.PlatformCredsCheck + + + + + +rhcos.Image + +rhcos.Image + + + +installconfig.InstallConfig->rhcos.Image + + + + + +machine.Master + +machine.Master + + + +installconfig.InstallConfig->machine.Master + + + + + manifests.Manifests - -manifests.Manifests + +manifests.Manifests - + installconfig.InstallConfig->manifests.Manifests - - + + - + manifests.Ingress - -manifests.Ingress + +manifests.Ingress - + installconfig.InstallConfig->manifests.Ingress - - + + - + manifests.DNS - -manifests.DNS + +manifests.DNS - + installconfig.InstallConfig->manifests.DNS - - + + - + manifests.Infrastructure - -manifests.Infrastructure + +manifests.Infrastructure - + installconfig.InstallConfig->manifests.Infrastructure - - + + - + manifests.Networking - -manifests.Networking + +manifests.Networking - + installconfig.InstallConfig->manifests.Networking - - - - - -tls.IngressCertKey - -tls.IngressCertKey - - - -installconfig.InstallConfig->tls.IngressCertKey - - + + - + tls.MCSCertKey - -tls.MCSCertKey + +tls.MCSCertKey - + installconfig.InstallConfig->tls.MCSCertKey - - + + manifests.Openshift - -manifests.Openshift + +manifests.Openshift - + installconfig.InstallConfig->manifests.Openshift - - + + manifests.ClusterK8sIO - -manifests.ClusterK8sIO + +manifests.ClusterK8sIO - + installconfig.InstallConfig->manifests.ClusterK8sIO - - + + machines.Worker - -machines.Worker + +machines.Worker - + installconfig.InstallConfig->machines.Worker - - - - - -installconfig.PlatformCredsCheck - -installconfig.PlatformCredsCheck - - - -installconfig.InstallConfig->installconfig.PlatformCredsCheck - - - - - -rhcos.Image - -rhcos.Image - - - -installconfig.InstallConfig->rhcos.Image - - + + - + machine.Worker - -machine.Worker + +machine.Worker - + installconfig.InstallConfig->machine.Worker - - - - - -machines.Master - -machines.Master - - - -installconfig.InstallConfig->machines.Master - - - - - -machine.Master - -machine.Master - - - -installconfig.InstallConfig->machine.Master - - + + - + kubeconfig.Admin - -kubeconfig.Admin + +kubeconfig.Admin - + installconfig.InstallConfig->kubeconfig.Admin - - + + - + bootstrap.Bootstrap - -bootstrap.Bootstrap + +bootstrap.Bootstrap - + installconfig.InstallConfig->bootstrap.Bootstrap - - + + - - -tls.APIServerCertKey - -tls.APIServerCertKey + + +kubeconfig.AdminClient + +kubeconfig.AdminClient - - -installconfig.InstallConfig->tls.APIServerCertKey - - + + +installconfig.InstallConfig->kubeconfig.AdminClient + + - + kubeconfig.Kubelet - -kubeconfig.Kubelet + +kubeconfig.Kubelet - + installconfig.InstallConfig->kubeconfig.Kubelet - - + + + + + +kubeconfig.KubeletClient + +kubeconfig.KubeletClient + + + +installconfig.InstallConfig->kubeconfig.KubeletClient + + + + + +tls.APIServerCertKey + +tls.APIServerCertKey + + + +installconfig.InstallConfig->tls.APIServerCertKey + + + + + +tls.KubeAPIServerLBServerCertKey + +tls.KubeAPIServerLBServerCertKey + + + +installconfig.InstallConfig->tls.KubeAPIServerLBServerCertKey + + + + + +tls.KubeAPIServerServiceNetworkServerCertKey + +tls.KubeAPIServerServiceNetworkServerCertKey + + + +installconfig.InstallConfig->tls.KubeAPIServerServiceNetworkServerCertKey + + - + cluster.Metadata - -cluster.Metadata + +cluster.Metadata - + installconfig.InstallConfig->cluster.Metadata - - + + - + cluster.TerraformVariables - -cluster.TerraformVariables + +cluster.TerraformVariables - + installconfig.InstallConfig->cluster.TerraformVariables - - + + - + cluster.Cluster - -cluster.Cluster + +cluster.Cluster - + installconfig.InstallConfig->cluster.Cluster - - + + installconfig.sshPublicKey - -installconfig.sshPublicKey + +installconfig.sshPublicKey installconfig.sshPublicKey->installconfig.InstallConfig - - + + installconfig.baseDomain - -installconfig.baseDomain + +installconfig.baseDomain installconfig.baseDomain->installconfig.InstallConfig - - + + + + + +installconfig.clusterName + +installconfig.clusterName + + + +installconfig.baseDomain->installconfig.clusterName + + installconfig.platform - -installconfig.platform + +installconfig.platform - + installconfig.platform->installconfig.InstallConfig - - + + installconfig.platform->installconfig.baseDomain - - - - - -installconfig.clusterName - -installconfig.clusterName + + installconfig.clusterName->installconfig.InstallConfig - - + + installconfig.pullSecret - -installconfig.pullSecret + +installconfig.pullSecret - + installconfig.pullSecret->installconfig.InstallConfig - - + + bootkube.KubeCloudConfig - -bootkube.KubeCloudConfig + +bootkube.KubeCloudConfig Target Manifest templates - -Target Manifest templates + +Target Manifest templates - + bootkube.KubeCloudConfig->Target Manifest templates - - + + - + bootkube.KubeCloudConfig->manifests.Manifests - - + + bootkube.MachineConfigServerTLSSecret - -bootkube.MachineConfigServerTLSSecret + +bootkube.MachineConfigServerTLSSecret - + bootkube.MachineConfigServerTLSSecret->Target Manifest templates - - + + - + bootkube.MachineConfigServerTLSSecret->manifests.Manifests - - + + bootkube.Pull - -bootkube.Pull + +bootkube.Pull - + bootkube.Pull->Target Manifest templates - - + + - + bootkube.Pull->manifests.Manifests - - + + bootkube.CVOOverrides - -bootkube.CVOOverrides + +bootkube.CVOOverrides - + bootkube.CVOOverrides->Target Manifest templates - - + + - + bootkube.CVOOverrides->manifests.Manifests - - + + bootkube.HostEtcdServiceEndpointsKubeSystem - -bootkube.HostEtcdServiceEndpointsKubeSystem + +bootkube.HostEtcdServiceEndpointsKubeSystem - + bootkube.HostEtcdServiceEndpointsKubeSystem->Target Manifest templates - - + + - + bootkube.HostEtcdServiceEndpointsKubeSystem->manifests.Manifests - - + + bootkube.KubeSystemConfigmapEtcdServingCA - -bootkube.KubeSystemConfigmapEtcdServingCA + +bootkube.KubeSystemConfigmapEtcdServingCA - + bootkube.KubeSystemConfigmapEtcdServingCA->Target Manifest templates - - + + - + bootkube.KubeSystemConfigmapEtcdServingCA->manifests.Manifests - - + + bootkube.KubeSystemConfigmapRootCA - -bootkube.KubeSystemConfigmapRootCA + +bootkube.KubeSystemConfigmapRootCA - + bootkube.KubeSystemConfigmapRootCA->Target Manifest templates - - + + - + bootkube.KubeSystemConfigmapRootCA->manifests.Manifests - - + + bootkube.KubeSystemSecretEtcdClient - -bootkube.KubeSystemSecretEtcdClient + +bootkube.KubeSystemSecretEtcdClient - + bootkube.KubeSystemSecretEtcdClient->Target Manifest templates - - + + - + bootkube.KubeSystemSecretEtcdClient->manifests.Manifests - - + + bootkube.OpenshiftMachineConfigOperator - -bootkube.OpenshiftMachineConfigOperator + +bootkube.OpenshiftMachineConfigOperator - + bootkube.OpenshiftMachineConfigOperator->Target Manifest templates - - + + - + bootkube.OpenshiftMachineConfigOperator->manifests.Manifests - - + + bootkube.EtcdServiceKubeSystem - -bootkube.EtcdServiceKubeSystem + +bootkube.EtcdServiceKubeSystem - + bootkube.EtcdServiceKubeSystem->Target Manifest templates - - + + - + bootkube.EtcdServiceKubeSystem->manifests.Manifests - - + + bootkube.HostEtcdServiceKubeSystem - -bootkube.HostEtcdServiceKubeSystem + +bootkube.HostEtcdServiceKubeSystem - + bootkube.HostEtcdServiceKubeSystem->Target Manifest templates - - + + - + bootkube.HostEtcdServiceKubeSystem->manifests.Manifests - - + + openshift.BindingDiscovery - -openshift.BindingDiscovery + +openshift.BindingDiscovery - + openshift.BindingDiscovery->Target Manifest templates - - + + - + openshift.BindingDiscovery->manifests.Openshift - - + + openshift.CloudCredsSecret - -openshift.CloudCredsSecret + +openshift.CloudCredsSecret - + openshift.CloudCredsSecret->Target Manifest templates - - + + - + openshift.CloudCredsSecret->manifests.Openshift - - + + openshift.KubeadminPasswordSecret - -openshift.KubeadminPasswordSecret + +openshift.KubeadminPasswordSecret - + openshift.KubeadminPasswordSecret->Target Manifest templates - - + + - + openshift.KubeadminPasswordSecret->manifests.Openshift - - + + openshift.RoleCloudCredsSecretReader - -openshift.RoleCloudCredsSecretReader + +openshift.RoleCloudCredsSecretReader - + openshift.RoleCloudCredsSecretReader->Target Manifest templates - - + + - + openshift.RoleCloudCredsSecretReader->manifests.Openshift - - + + Target Manifests - -Target Manifests + +Target Manifests - - -manifests.Manifests->Target Manifests - - + + +machines.Master->Target Manifests + + - - -manifests.Manifests->bootstrap.Bootstrap - - + + +machines.Master->bootstrap.Bootstrap + + + + + +machines.Master->cluster.TerraformVariables + + installconfig.ClusterID - -installconfig.ClusterID + +installconfig.ClusterID + + + +installconfig.ClusterID->machines.Master + + - + installconfig.ClusterID->manifests.Manifests - - + + + + + +installconfig.ClusterID->manifests.DNS + + - + installconfig.ClusterID->machines.Worker - - - - - -installconfig.ClusterID->machines.Master - - + + - + installconfig.ClusterID->cluster.Metadata - - + + - + installconfig.ClusterID->cluster.TerraformVariables - - + + - + installconfig.ClusterID->cluster.Cluster - - + + - + -manifests.Ingress->manifests.Manifests - - +installconfig.PlatformCredsCheck->machines.Master + + - - -manifests.DNS->manifests.Manifests - - + + +installconfig.PlatformCredsCheck->manifests.DNS + + - - -manifests.Infrastructure->manifests.Manifests - - + + +installconfig.PlatformCredsCheck->machines.Worker + + - - -openshift.InfrastructureCRD - -openshift.InfrastructureCRD + + +installconfig.PlatformCredsCheck->cluster.Cluster + + - - -openshift.InfrastructureCRD->manifests.Infrastructure - - + + +rhcos.Image->machines.Master + + - - -manifests.Networking->manifests.Manifests - - + + +rhcos.Image->machines.Worker + + - - -manifests.Networking->manifests.ClusterK8sIO - - + + +rhcos.Image->cluster.TerraformVariables + + - - -openshift.NetworkCRDs - -openshift.NetworkCRDs + + +machine.Master->machines.Master + + - - -openshift.NetworkCRDs->manifests.Networking - - + + +Target Ignition Configs + +Target Ignition Configs + + + +machine.Master->Target Ignition Configs + + + + + +machine.Master->cluster.TerraformVariables + + - + tls.RootCA - -tls.RootCA + +tls.RootCA + + + +tls.RootCA->machine.Master + + - + tls.RootCA->manifests.Manifests - - + + - + tls.EtcdCA - -tls.EtcdCA + +tls.EtcdCA - + tls.RootCA->tls.EtcdCA - - - - - -tls.KubeCA - -tls.KubeCA - - - -tls.RootCA->tls.KubeCA - - + + - + tls.RootCA->tls.MCSCertKey - - + + - + tls.RootCA->machine.Worker - - - - - -tls.RootCA->machine.Master - - - - - -tls.RootCA->kubeconfig.Admin - - + + - + tls.RootCA->bootstrap.Bootstrap - - + + - + tls.AggregatorCA - -tls.AggregatorCA + +tls.AggregatorCA - + tls.RootCA->tls.AggregatorCA - - + + - + tls.JournalCertKey - -tls.JournalCertKey + +tls.JournalCertKey - + tls.RootCA->tls.JournalCertKey - - - - - -tls.RootCA->kubeconfig.Kubelet - - + + - - -tls.EtcdCA->manifests.Manifests - - - - - -tls.EtcdClientCertKey - -tls.EtcdClientCertKey + + +manifests.Manifests->Target Manifests + + - - -tls.EtcdCA->tls.EtcdClientCertKey - - + + +manifests.Manifests->bootstrap.Bootstrap + + - - -tls.EtcdCA->bootstrap.Bootstrap - - + + +manifests.Ingress->manifests.Manifests + + - + -tls.IngressCertKey->manifests.Manifests - - +manifests.DNS->manifests.Manifests + + - + -tls.KubeCA->manifests.Manifests - - +manifests.Infrastructure->manifests.Manifests + + - - -tls.KubeCA->tls.IngressCertKey - - + + +manifests.Networking->manifests.Manifests + + - - -tls.KubeletCertKey - -tls.KubeletCertKey + + +manifests.Networking->manifests.ClusterK8sIO + + - - -tls.KubeCA->tls.KubeletCertKey - - + + +openshift.NetworkCRDs + +openshift.NetworkCRDs - - -tls.AdminCertKey - -tls.AdminCertKey + + +openshift.NetworkCRDs->manifests.Networking + + - - -tls.KubeCA->tls.AdminCertKey - - + + +tls.EtcdCA->manifests.Manifests + + - - -tls.KubeCA->bootstrap.Bootstrap - - + + +tls.EtcdClientCertKey + +tls.EtcdClientCertKey - - -tls.KubeCA->tls.APIServerCertKey - - + + +tls.EtcdCA->tls.EtcdClientCertKey + + + + + +tls.EtcdCA->bootstrap.Bootstrap + + - + tls.EtcdClientCertKey->manifests.Manifests - - + + - + tls.EtcdClientCertKey->bootstrap.Bootstrap - - + + - + tls.MCSCertKey->manifests.Manifests - - + + - + tls.MCSCertKey->bootstrap.Bootstrap - - - - - -tls.KubeletCertKey->manifests.Manifests - - - - - -tls.KubeletCertKey->bootstrap.Bootstrap - - - - - -tls.KubeletCertKey->kubeconfig.Kubelet - - + + - + manifests.Openshift->Target Manifests - - + + - + manifests.Openshift->bootstrap.Bootstrap - - + + - + manifests.ClusterK8sIO->manifests.Openshift - - + + - -machines.Worker->manifests.Openshift - - - - - -installconfig.PlatformCredsCheck->machines.Worker - - - - - -installconfig.PlatformCredsCheck->machines.Master - - - - - -installconfig.PlatformCredsCheck->cluster.Cluster - - - - -rhcos.Image->machines.Worker - - - - - -rhcos.Image->machines.Master - - - - - -rhcos.Image->cluster.TerraformVariables - - +machines.Worker->manifests.Openshift + + - + machine.Worker->machines.Worker - - - - - -Target Ignition Configs - -Target Ignition Configs + + - + machine.Worker->Target Ignition Configs - - - - - -machines.Master->manifests.Openshift - - - - - -machines.Master->cluster.TerraformVariables - - - - - -machine.Master->machines.Master - - - - - -machine.Master->Target Ignition Configs - - - - - -machine.Master->cluster.TerraformVariables - - + + - + password.KubeadminPassword - -password.KubeadminPassword + +password.KubeadminPassword - + password.KubeadminPassword->manifests.Openshift - - + + - + password.KubeadminPassword->cluster.Cluster - - + + - + kubeconfig.Admin->Target Ignition Configs - - + + - + kubeconfig.Admin->bootstrap.Bootstrap - - + + - + Target Cluster - -Target Cluster + +Target Cluster - + kubeconfig.Admin->Target Cluster - - + + - - -tls.AdminCertKey->kubeconfig.Admin - - + + +tls.KubeCA + +tls.KubeCA + + + +tls.KubeCA->kubeconfig.Admin + + + + + +tls.AdminCertKey + +tls.AdminCertKey + + + +tls.KubeCA->tls.AdminCertKey + + - + + +tls.KubeCA->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerCompleteCABundle + +tls.KubeAPIServerCompleteCABundle + + + +tls.KubeCA->tls.KubeAPIServerCompleteCABundle + + + + + +tls.KubeCA->kubeconfig.Kubelet + + + + + +tls.KubeletCertKey + +tls.KubeletCertKey + + -tls.AdminCertKey->bootstrap.Bootstrap - - +tls.KubeCA->tls.KubeletCertKey + + + + + +tls.KubeCA->tls.APIServerCertKey + + + + + +tls.AdminCertKey->kubeconfig.Admin + + - + bootstrap.Bootstrap->Target Ignition Configs - - + + - + bootstrap.Bootstrap->cluster.TerraformVariables - - + + - + + +kubeconfig.AdminClient->bootstrap.Bootstrap + + + + + +tls.AdminKubeConfigClientCertKey + +tls.AdminKubeConfigClientCertKey + + + +tls.AdminKubeConfigClientCertKey->kubeconfig.AdminClient + + + + + +tls.AdminKubeConfigSignerCertKey + +tls.AdminKubeConfigSignerCertKey + + + +tls.AdminKubeConfigSignerCertKey->tls.AdminKubeConfigClientCertKey + + + + + +tls.AdminKubeConfigCABundle + +tls.AdminKubeConfigCABundle + + + +tls.AdminKubeConfigSignerCertKey->tls.AdminKubeConfigCABundle + + + + + +tls.KubeAPIServerCompleteCABundle->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerCompleteCABundle->kubeconfig.AdminClient + + + + + +tls.KubeAPIServerCompleteCABundle->kubeconfig.KubeletClient + + + + + +tls.KubeAPIServerLocalhostCABundle + +tls.KubeAPIServerLocalhostCABundle + + + +tls.KubeAPIServerLocalhostCABundle->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerLocalhostCABundle->tls.KubeAPIServerCompleteCABundle + + + + + +tls.KubeAPIServerLocalhostSignerCertKey + +tls.KubeAPIServerLocalhostSignerCertKey + + + +tls.KubeAPIServerLocalhostSignerCertKey->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerLocalhostSignerCertKey->tls.KubeAPIServerLocalhostCABundle + + + + + +tls.KubeletClientCertKey + +tls.KubeletClientCertKey + + + +tls.KubeAPIServerLocalhostSignerCertKey->tls.KubeletClientCertKey + + + + + +tls.KubeAPIServerLocalhostServerCertKey + +tls.KubeAPIServerLocalhostServerCertKey + + + +tls.KubeAPIServerLocalhostSignerCertKey->tls.KubeAPIServerLocalhostServerCertKey + + + + + +tls.KubeControlPlaneCABundle + +tls.KubeControlPlaneCABundle + + + +tls.KubeAPIServerLocalhostSignerCertKey->tls.KubeControlPlaneCABundle + + + + + +tls.KubeAPIServerServiceNetworkCABundle + +tls.KubeAPIServerServiceNetworkCABundle + + + +tls.KubeAPIServerServiceNetworkCABundle->bootstrap.Bootstrap + + + + +tls.KubeAPIServerServiceNetworkCABundle->tls.KubeAPIServerCompleteCABundle + + + + + +tls.KubeAPIServerServiceNetworkSignerCertKey + +tls.KubeAPIServerServiceNetworkSignerCertKey + + + +tls.KubeAPIServerServiceNetworkSignerCertKey->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerServiceNetworkSignerCertKey->tls.KubeAPIServerServiceNetworkCABundle + + + + + +tls.KubeAPIServerServiceNetworkSignerCertKey->tls.KubeAPIServerServiceNetworkServerCertKey + + + + + +tls.KubeAPIServerServiceNetworkSignerCertKey->tls.KubeControlPlaneCABundle + + + + + +tls.KubeAPIServerLBCABundle + +tls.KubeAPIServerLBCABundle + + + +tls.KubeAPIServerLBCABundle->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerLBCABundle->tls.KubeAPIServerCompleteCABundle + + + + + +tls.KubeAPIServerLBSignerCertKey + +tls.KubeAPIServerLBSignerCertKey + + + +tls.KubeAPIServerLBSignerCertKey->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerLBSignerCertKey->tls.KubeAPIServerLBCABundle + + + + + +tls.KubeAPIServerLBSignerCertKey->tls.KubeletClientCertKey + + + + + +tls.KubeAPIServerLBSignerCertKey->tls.KubeAPIServerLBServerCertKey + + + + + +tls.KubeAPIServerLBSignerCertKey->tls.KubeControlPlaneCABundle + + + + + +kubeconfig.Kubelet->bootstrap.Bootstrap + + + + + +tls.KubeletCertKey->bootstrap.Bootstrap + + + + + +tls.KubeletCertKey->kubeconfig.Kubelet + + + + + +kubeconfig.KubeletClient->bootstrap.Bootstrap + + + + + +tls.KubeletClientCertKey->bootstrap.Bootstrap + + + + + +tls.KubeletClientCertKey->kubeconfig.KubeletClient + + + + + +tls.KubeletCSRSignerCertKey + +tls.KubeletCSRSignerCertKey + + + +tls.KubeletCSRSignerCertKey->bootstrap.Bootstrap + + + + + +tls.KubeletCSRSignerCertKey->tls.KubeletClientCertKey + + + + + +tls.KubeletClientCABundle + +tls.KubeletClientCABundle + + + +tls.KubeletCSRSignerCertKey->tls.KubeletClientCABundle + + + + + +tls.KubeletServingCABundle + +tls.KubeletServingCABundle + + + +tls.KubeletCSRSignerCertKey->tls.KubeletServingCABundle + + + + + +tls.AdminKubeConfigCABundle->bootstrap.Bootstrap + + + + + tls.AggregatorCA->bootstrap.Bootstrap - - + + - + tls.APIServerProxyCertKey - -tls.APIServerProxyCertKey + +tls.APIServerProxyCertKey - + tls.AggregatorCA->tls.APIServerProxyCertKey - - + + + + + +tls.AggregatorCABundle + +tls.AggregatorCABundle + + + +tls.AggregatorCABundle->bootstrap.Bootstrap + + + + + +tls.AggregatorSignerCertKey + +tls.AggregatorSignerCertKey + + + +tls.AggregatorSignerCertKey->bootstrap.Bootstrap + + + + + +tls.AggregatorSignerCertKey->tls.AggregatorCABundle + + + + + +tls.AggregatorClientCertKey + +tls.AggregatorClientCertKey + + + +tls.AggregatorSignerCertKey->tls.AggregatorClientCertKey + + + + + +tls.AggregatorClientCertKey->bootstrap.Bootstrap + + - + tls.APIServerCertKey->bootstrap.Bootstrap - - + + - + tls.APIServerProxyCertKey->bootstrap.Bootstrap - - + + - - -tls.ServiceAccountKeyPair - -tls.ServiceAccountKeyPair + + +tls.EtcdCABundle + +tls.EtcdCABundle - - -tls.ServiceAccountKeyPair->bootstrap.Bootstrap - - + + +tls.EtcdCABundle->bootstrap.Bootstrap + + + + + +tls.EtcdSignerCertKey + +tls.EtcdSignerCertKey + + + +tls.EtcdSignerCertKey->bootstrap.Bootstrap + + + + + +tls.EtcdSignerCertKey->tls.EtcdCABundle + + + + + +tls.EtcdSignerClientCertKey + +tls.EtcdSignerClientCertKey + + + +tls.EtcdSignerCertKey->tls.EtcdSignerClientCertKey + + + + + +tls.EtcdSignerClientCertKey->bootstrap.Bootstrap + + - + tls.JournalCertKey->bootstrap.Bootstrap - - + + - + tls.JournalCertKey->Target Cluster - - + + + + + +tls.KubeAPIServerLBServerCertKey->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerLocalhostServerCertKey->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerServiceNetworkServerCertKey->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerToKubeletCABundle + +tls.KubeAPIServerToKubeletCABundle + + + +tls.KubeAPIServerToKubeletCABundle->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerToKubeletSignerCertKey + +tls.KubeAPIServerToKubeletSignerCertKey + + + +tls.KubeAPIServerToKubeletSignerCertKey->bootstrap.Bootstrap + + + + + +tls.KubeAPIServerToKubeletSignerCertKey->tls.KubeAPIServerToKubeletCABundle + + + + + +tls.KubeAPIServerToKubeletClientCertKey + +tls.KubeAPIServerToKubeletClientCertKey + + + +tls.KubeAPIServerToKubeletSignerCertKey->tls.KubeAPIServerToKubeletClientCertKey + + + + + +tls.KubeAPIServerToKubeletClientCertKey->bootstrap.Bootstrap + + + + + +tls.KubeControlPlaneCABundle->bootstrap.Bootstrap + + + + + +tls.KubeControlPlaneSignerCertKey + +tls.KubeControlPlaneSignerCertKey + + + +tls.KubeControlPlaneSignerCertKey->bootstrap.Bootstrap + + + + + +tls.KubeControlPlaneSignerCertKey->tls.KubeControlPlaneCABundle + + + + + +tls.KubeControlPlaneKubeControllerManagerClientCertKey + +tls.KubeControlPlaneKubeControllerManagerClientCertKey + + + +tls.KubeControlPlaneSignerCertKey->tls.KubeControlPlaneKubeControllerManagerClientCertKey + + + + + +tls.KubeControlPlaneKubeSchedulerClientCertKey + +tls.KubeControlPlaneKubeSchedulerClientCertKey + + + +tls.KubeControlPlaneSignerCertKey->tls.KubeControlPlaneKubeSchedulerClientCertKey + + + + + +tls.KubeControlPlaneKubeControllerManagerClientCertKey->bootstrap.Bootstrap + + + + + +tls.KubeControlPlaneKubeSchedulerClientCertKey->bootstrap.Bootstrap + + + + + +tls.KubeletClientCABundle->bootstrap.Bootstrap + + + + + +tls.KubeletServingCABundle->bootstrap.Bootstrap + + - - -kubeconfig.Kubelet->bootstrap.Bootstrap - - + + +tls.ServiceAccountKeyPair + +tls.ServiceAccountKeyPair + + + +tls.ServiceAccountKeyPair->bootstrap.Bootstrap + + - + cluster.Metadata->Target Ignition Configs - - + + - + cluster.Metadata->Target Cluster - - + + - + cluster.TerraformVariables->Target Cluster - - + + - + cluster.TerraformVariables->cluster.Cluster - - + + - + cluster.Cluster->Target Cluster - - + + diff --git a/pkg/asset/ignition/bootstrap/bootstrap.go b/pkg/asset/ignition/bootstrap/bootstrap.go index 6b9009b575c..77468efd9d6 100644 --- a/pkg/asset/ignition/bootstrap/bootstrap.go +++ b/pkg/asset/ignition/bootstrap/bootstrap.go @@ -69,6 +69,7 @@ func (a *Bootstrap) Dependencies() []asset.Asset { &machines.Master{}, &manifests.Manifests{}, &manifests.Openshift{}, + &tls.AdminKubeConfigCABundle{}, &tls.AggregatorCA{}, &tls.AggregatorCABundle{}, &tls.AggregatorClientCertKey{}, @@ -90,6 +91,7 @@ func (a *Bootstrap) Dependencies() []asset.Asset { &tls.KubeAPIServerServiceNetworkCABundle{}, &tls.KubeAPIServerServiceNetworkServerCertKey{}, &tls.KubeAPIServerServiceNetworkSignerCertKey{}, + &tls.KubeAPIServerCompleteCABundle{}, &tls.KubeAPIServerToKubeletCABundle{}, &tls.KubeAPIServerToKubeletClientCertKey{}, &tls.KubeAPIServerToKubeletSignerCertKey{}, @@ -375,6 +377,7 @@ func (a *Bootstrap) addParentFiles(dependencies asset.Parents) { &kubeconfig.Kubelet{}, &kubeconfig.KubeletClient{}, &kubeconfig.KubeletClient{}, + &tls.AdminKubeConfigCABundle{}, &tls.AggregatorCA{}, &tls.AggregatorCABundle{}, &tls.AggregatorClientCertKey{}, @@ -395,6 +398,7 @@ func (a *Bootstrap) addParentFiles(dependencies asset.Parents) { &tls.KubeAPIServerServiceNetworkCABundle{}, &tls.KubeAPIServerServiceNetworkServerCertKey{}, &tls.KubeAPIServerServiceNetworkSignerCertKey{}, + &tls.KubeAPIServerCompleteCABundle{}, &tls.KubeAPIServerToKubeletCABundle{}, &tls.KubeAPIServerToKubeletClientCertKey{}, &tls.KubeAPIServerToKubeletSignerCertKey{}, diff --git a/pkg/asset/kubeconfig/admin.go b/pkg/asset/kubeconfig/admin.go index ffb359f7628..b9cbfeba5ed 100644 --- a/pkg/asset/kubeconfig/admin.go +++ b/pkg/asset/kubeconfig/admin.go @@ -67,14 +67,14 @@ var _ asset.WritableAsset = (*AdminClient)(nil) func (k *AdminClient) Dependencies() []asset.Asset { return []asset.Asset{ &tls.AdminKubeConfigClientCertKey{}, - &tls.AdminKubeConfigCABundle{}, + &tls.KubeAPIServerCompleteCABundle{}, &installconfig.InstallConfig{}, } } // Generate generates the kubeconfig. func (k *AdminClient) Generate(parents asset.Parents) error { - ca := &tls.AdminKubeConfigCABundle{} + ca := &tls.KubeAPIServerCompleteCABundle{} clientCertKey := &tls.AdminKubeConfigClientCertKey{} installConfig := &installconfig.InstallConfig{} parents.Get(ca, clientCertKey, installConfig) diff --git a/pkg/asset/kubeconfig/kubelet.go b/pkg/asset/kubeconfig/kubelet.go index 5b64ad2acda..2dcddee3cb2 100644 --- a/pkg/asset/kubeconfig/kubelet.go +++ b/pkg/asset/kubeconfig/kubelet.go @@ -66,7 +66,7 @@ var _ asset.WritableAsset = (*KubeletClient)(nil) // Dependencies returns the dependency of the kubeconfig. func (k *KubeletClient) Dependencies() []asset.Asset { return []asset.Asset{ - &tls.KubeletClientCABundle{}, + &tls.KubeAPIServerCompleteCABundle{}, &tls.KubeletClientCertKey{}, &installconfig.InstallConfig{}, } @@ -74,7 +74,7 @@ func (k *KubeletClient) Dependencies() []asset.Asset { // Generate generates the kubeconfig. func (k *KubeletClient) Generate(parents asset.Parents) error { - ca := &tls.KubeletClientCABundle{} + ca := &tls.KubeAPIServerCompleteCABundle{} clientcertkey := &tls.KubeletClientCertKey{} installConfig := &installconfig.InstallConfig{} parents.Get(ca, clientcertkey, installConfig) diff --git a/pkg/asset/tls/adminkubeconfig.go b/pkg/asset/tls/adminkubeconfig.go index 9b0e071ca70..cd5fcfc3afd 100644 --- a/pkg/asset/tls/adminkubeconfig.go +++ b/pkg/asset/tls/adminkubeconfig.go @@ -85,9 +85,6 @@ var _ asset.Asset = (*AdminKubeConfigCABundle)(nil) func (a *AdminKubeConfigCABundle) Dependencies() []asset.Asset { return []asset.Asset{ &AdminKubeConfigSignerCertKey{}, - &KubeAPIServerLBSignerCertKey{}, - &KubeAPIServerLocalhostSignerCertKey{}, - &KubeAPIServerServiceNetworkSignerCertKey{}, } } diff --git a/pkg/asset/tls/apiserver.go b/pkg/asset/tls/apiserver.go index a5196f05c06..ba7a0b8f2e1 100644 --- a/pkg/asset/tls/apiserver.go +++ b/pkg/asset/tls/apiserver.go @@ -454,3 +454,36 @@ func (a *KubeAPIServerLBServerCertKey) Generate(dependencies asset.Parents) erro func (a *KubeAPIServerLBServerCertKey) Name() string { return "Certificate (kube-apiserver-lb-server)" } + +// KubeAPIServerCompleteCABundle is the asset the generates the kube-apiserver-complete-server-ca-bundle, +// which contains all the certs that are valid to confirm the kube-apiserver identity. +type KubeAPIServerCompleteCABundle struct { + CertBundle +} + +var _ asset.Asset = (*KubeAPIServerCompleteCABundle)(nil) + +// Dependencies returns the dependency of the cert bundle. +func (a *KubeAPIServerCompleteCABundle) Dependencies() []asset.Asset { + return []asset.Asset{ + &KubeCA{}, // TODO this should be removed once the KAS no longer serves with it + &KubeAPIServerLocalhostCABundle{}, + &KubeAPIServerServiceNetworkCABundle{}, + &KubeAPIServerLBCABundle{}, + } +} + +// Generate generates the cert bundle based on its dependencies. +func (a *KubeAPIServerCompleteCABundle) Generate(deps asset.Parents) error { + var certs []CertInterface + for _, asset := range a.Dependencies() { + deps.Get(asset) + certs = append(certs, asset.(CertInterface)) + } + return a.CertBundle.Generate("kube-apiserver-complete-server-ca-bundle", certs...) +} + +// Name returns the human-friendly name of the asset. +func (a *KubeAPIServerCompleteCABundle) Name() string { + return "Certificate (kube-apiserver-complete-server-ca-bundle)" +}