tls: remove serving capability from deprecated apiserver cert, also fix Complete ClientCA bundle for apiserver #1640
Conversation
As we're fixing the kubelet TLS files, we've noticed places that are over-signing and trusting the wrong thing. This updates the next case we can use to ratchet the fixes into the MCO.
openshift-ci-robot
added
the
size/XXL
pkg/asset/tls/apiserver.go
Outdated
There was a problem hiding this comment.
We've ratcheted through changes in kas-o, mco, kubelet, kas-o, and now we can fix this. It's never used to serve anymore
pkg/asset/tls/apiserver.go
Outdated
There was a problem hiding this comment.
This prevents kas-o from rotating client cert/key pairs.
pkg/asset/tls/apiserver.go
Outdated
There was a problem hiding this comment.
@sjenning this is the one it is legal to depend upon.
|
This removes usages from a deprecated cert ? |
Yeah, tightening things up so they can't grow back while we're working out full removal. |
|
Not very clear to me, but it's been open for a while, and CI is green, so: /lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: deads2k, wking The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
|
/hold |
openshift-ci-robot
added
the
do-not-merge/hold
|
Just wanna take a quick look. Will hold cancel asap |
| // Generate generates the cert/key pair based on its dependencies. | ||
| func (a *APIServerCertKey) Generate(dependencies asset.Parents) error { | ||
| kubeCA := &KubeCA{} | ||
| installConfig := &installconfig.InstallConfig{} |
There was a problem hiding this comment.
you should also drop the dependency from https://github.com/openshift/installer/pull/1640/files#diff-c7316d3d0bee102140cf53dc3ae5edf9R27
abhinavdahiya
changed the title
|
#1640 (comment) is non-blocking. /hold cancel |
openshift-ci-robot
removed
the
do-not-merge/hold
5 participants
The kubelet terminates mTLS to determine the identity of the caller. This fixes the combined client bundle that can provide a stepping stone to getting the kubelet restricting properly.
@sjenning as we discussed yesterday
/assign @wking