Generate an ignition-auth key and provide it to the MCS

[cgwalters]

This is an optional hardening for access to Ignition; the installer
generates a random key (separately for master/worker pool) and installs
it into the openshift-machine-config-operator namespace. If the MCS
finds an ignition-auth secret with the master/worker keys, it will use it:
openshift/machine-config-operator#736

This PR just generates those secrets, so we can land it before the
MCO PR as well.

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cgwalters
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: crawford

If they are not already assigned, you can assign the PR to them by writing /assign @crawford in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ashcrow]

Just to double check, is there any need to utilrand.Seed before or between generations?

[abhinavdahiya]

/hold

We will evaluate this for 4.2
Installer treats the master and worker ign configs as "not a secret" and changing that needs more thought.

[ashcrow]

Unit failure:

--- FAIL: TestMasterGenerate (0.89s)
panic: reflect: call of reflect.Value.Elem on zero Value [recovered]
	panic: reflect: call of reflect.Value.Elem on zero Value

goroutine 30 [running]:
testing.tRunner.func1(0xc4202221e0)
	/usr/local/go/src/testing/testing.go:742 +0x29d
panic(0x1291de0, 0xc420160a20)
	/usr/local/go/src/runtime/panic.go:502 +0x229
reflect.Value.Elem(0x0, 0x0, 0x0, 0x0, 0x0, 0x199)
	/usr/local/go/src/reflect/value.go:775 +0x1b7
github.com/openshift/installer/pkg/asset.Parents.Get(0xc420501e58, 0xc420501cd8, 0x3, 0x3)
	/go/src/github.com/openshift/installer/pkg/asset/parents.go:22 +0x73
github.com/openshift/installer/pkg/asset/ignition/machine.(*Master).Generate(0xc420501dc8, 0xc420501e58, 0x2, 0x2)
	/go/src/github.com/openshift/installer/pkg/asset/ignition/machine/master.go:41 +0x10e
github.com/openshift/installer/pkg/asset/ignition/machine.TestMasterGenerate(0xc4202221e0)
	/go/src/github.com/openshift/installer/pkg/asset/ignition/machine/master_test.go:49 +0x410
testing.tRunner(0xc4202221e0, 0x14d85f8)
	/usr/local/go/src/testing/testing.go:777 +0xd0
created by testing.(*T).Run
	/usr/local/go/src/testing/testing.go:824 +0x2e0
FAIL	github.com/openshift/installer/pkg/asset/ignition/machine	1.144s

[openshift-ci-robot]

@cgwalters: The following tests failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
ci/prow/unit	1ff2f25	link	/test unit
ci/prow/e2e-aws	1ff2f25	link	/test e2e-aws

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[abhinavdahiya]

I would love to see a overall design doc where this fits in. Otherwise this is no being actively worked on... Feel free to reopen.

/close

[openshift-ci-robot]

@abhinavdahiya: Closed this PR.

Details

In response to this:

I would love to see a overall design doc where this fits in. Otherwise this is no being actively worked on... Feel free to reopen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[cgwalters]

Yep that's fine - see openshift/machine-config-operator#784 for a new approach that while not quite as strong, it also doesn't have the ergonomic hit for UPI scenarios that would be required with this PR.