Run node/etcd over https #1383

liggitt · 2015-03-19T16:33:03Z

Follow-ups:

Separate listen args for etcd and node to allow starting them in http-mode when the master is in https mode

liggitt · 2015-03-19T20:33:56Z

@rajatchopra can you look at the commit with the vagrant sdn changes to pass in etcd certs?

rajatchopra · 2015-03-19T21:51:21Z

vagrant sdn changes look good.
Need to try it out manually though. openshift-sdn itself has not been tested much with etcd certs.

liggitt · 2015-03-27T04:42:09Z

@deads2k review config/create-node-config bits
@smarterclayton review buildlogs change

smarterclayton · 2015-03-27T04:55:40Z

For the name

liggitt · 2015-03-27T04:59:26Z

done

TomasTomecek · 2015-03-27T08:16:50Z

@liggitt
What will be the new way to get logs through API?

One of the issues I had with previous method was that once I submitted a build, I had to wait like ~30 seconds for kubelet to orchestrate the build pod (otherwise I got 500: https://github.com/DBuildService/osbs/blob/master/osbs/core.py#L137). Will that work the same way?

openshift-bot · 2015-03-27T13:00:43Z

continuous-integration/openshift-jenkins/test Running (https://ci.openshift.redhat.com/jenkins/job/test_pull_requests_openshift3/1567/)

liggitt · 2015-03-27T14:25:44Z

@TomasTomecek build logs would be retrieved the same way pod logs are, by proxying through the API server to the node. This doesn't change anything with that, except that you have to go through the API rather than directly to the node.

liggitt · 2015-03-27T14:28:24Z

In your code, you would stream from this URL rather than redirecting and contacting the node yourself: self._build_url("proxy/buildLogs/%s" % build_id)

liggitt · 2015-03-27T14:29:48Z

The direction we're moving for things like build logs is a subresource of the build itself, so you could stream this URL directly: /namespaces/[ns]/builds/[build]/logs, but we're not quite there yet

TomasTomecek · 2015-03-27T14:59:57Z

In your code, you would stream from this URL rather than redirecting and contacting the node yourself: self._build_url("proxy/buildLogs/%s" % build_id)

Thanks. Will try.

The direction we're moving for things like build logs is a subresource of the build itself, so you could stream this URL directly: /namespaces/[ns]/builds/[build]/logs, but we're not quite there yet

That would be awesome! Is there a trello card/PR/issue for that?

deads2k · 2015-03-30T20:23:06Z

pkg/cmd/server/start/master_args.go

This should be based on whether etcd's bind address scheme is https.

GetEtcdBindAddress derives from ListenArg...

GetEtcdBindAddress derives from ListenArg...

So.... I need to make sure that etcdAddr matches what will be produced by twisting up the listenAddr for my master? I really want to be free of this, but do we need to try to figure out which configurations we want to support from the command line and then come up with some sane arguments to describe them?

from args, you get no options for etcd server addresses... it uses the scheme and host from --listen and port 4001. I'll add a follow up item to split listen args for etcd and node if we think it's important

liggitt · 2015-03-31T03:21:30Z

rebased, tweaked param name for client ca in create-node-config

deads2k · 2015-03-31T12:01:00Z

pkg/cmd/server/api/validation/master.go

Shouldn't (probably can't here) use a cert without a CA.

If the etcd server is using a cert signed by a recognized authority, you don't need a custom CA

deads2k · 2015-03-31T12:11:38Z

Nothing significant. A few questions, not all of them directly related to this pull.

Otherwise, lgtm

liggitt · 2015-03-31T20:47:00Z

Rebased, tests updated, comments addressed

liggitt · 2015-03-31T21:10:32Z

[merge]

openshift-bot · 2015-03-31T21:10:46Z

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/merge_pull_requests_openshift3/1374/) (Image: devenv-fedora_1182)

liggitt · 2015-03-31T21:39:56Z

@sdodson @detiber you'll want to add --node-client-certificate-authority to the create-node-config call

openshift-bot · 2015-04-01T00:55:44Z

Evaluated for origin up to e0e1955

Merged by openshift-bot

…service-catalog/' changes from 3aacfedec6..aa27078754 aa27078754 origin build: add origin tooling bcf37fd 0.1.0-rc2 chart updates (openshift#1410) 4ab0a0a add back 'Processing' message for instance deletion (openshift#1332) 0ecbcb1 Update logs for Cluster service plans. (openshift#1389) 8b491ef Fix a quoting nit (openshift#1400) 63685e4 add orphan mitigation-specific conditions for instances (openshift#1378) adee662 Updated missed fields in service and plan specs (openshift#1406) 2095919 Handle default plan setting when using k8s names (openshift#1405) 607ba66 Document rbacEnable. (openshift#1404) 268294e Adding rbac definition for v1 api endpoint. (openshift#1284) 103288d differentiate between failed updates and provisions during deletion (openshift#1383) eba8ba4 enable API aggregation and Service Catalog RBAC on Jenkins (openshift#1333) 5a93315 Validate relistDuration is non-negative (openshift#1395) e279d21 Fix log messages for secrets (openshift#1385) 87fa8c9 fix status update when starting orphan mitigation (openshift#1372) 11f18f3 Switch to wget for integration apiserver checks (openshift#1384) 8c44a7d update OSB client to 2.13 (openshift#1392) e64bbd1 default plan admission controller: filter list of service plans/service classes by the class name (openshift#1351) 6648c0e Check field names. Fix issue 1291 (openshift#1379) 5319841 update comment for instance generation check (openshift#1382) 7d5823f remove internal poll method (openshift#1381) 07d3068 Rework the logging for controller_instance. (openshift#1371) 5f4ca01 address PR comment as a followup (openshift#1380) 485d5e6 Add support for specifying plan using K8S names. (openshift#1377) 662bba8 Log number of secret keys created for binding credential (openshift#1375) 8ad6a31 Move controller constants into correct files (openshift#1373) 7bd66dd Adding type to log. (openshift#1339) 1ce5c4d Remove k8s/k8s dependency (openshift#1355) b458323 Adding log formatting for BindingController. (openshift#1352) 275eb11 rename test variables to be consistent (openshift#1315) ffd6b8b travis: skip cleanup before deploy (openshift#1368) d5ecc04 fix travis tag checker (openshift#1365) 2cae0ee Minor updates to README (openshift#1360) REVERT: 3aacfedec6 carry: Set external plan name for service-catalog walkthrough REVERT: 3ec9e5b07a origin build: add origin tooling git-subtree-dir: cmd/service-catalog/go/src/github.com/kubernetes-incubator/service-catalog git-subtree-split: aa2707875461dd51be3731b1d94b5cfc3b9a3976

…penshift#1383)

liggitt changed the title ~~WIP - Run node/etcd over https~~ Run node/etcd over https Mar 19, 2015

liggitt closed this Mar 27, 2015

liggitt reopened this Mar 27, 2015

TomasTomecek mentioned this pull request Mar 27, 2015

Use new way of getting build logs containerbuildsystem/osbs-client#22

Closed

deads2k reviewed Mar 30, 2015
View reviewed changes

deads2k reviewed Mar 31, 2015
View reviewed changes

liggitt added 4 commits March 31, 2015 20:53

Serve node/etcd over https

53c7aa3

Fix build logs with authenticated node

e0e1955

Update vagrant cert wiring

cb1a5e1

Add helper for p12 cert creation

31f8db8

openshift-bot pushed a commit that referenced this pull request Apr 1, 2015

Merge pull request #1383 from liggitt/node_https

0a0f028

Merged by openshift-bot

openshift-bot merged commit 0a0f028 into openshift:master Apr 1, 2015

liggitt deleted the node_https branch April 1, 2015 01:34

smarterclayton added the enhancement label Apr 8, 2015

liggitt mentioned this pull request Apr 11, 2015

Proxy build logs through master #803

Closed

jpeeler pushed a commit to jpeeler/origin that referenced this pull request Feb 1, 2018

differentiate between failed updates and provisions during deletion (o…

103288d

…penshift#1383)

Run node/etcd over https #1383

Run node/etcd over https #1383

Uh oh!

Conversation

liggitt commented Mar 19, 2015

Uh oh!

liggitt commented Mar 19, 2015

Uh oh!

rajatchopra commented Mar 19, 2015

Uh oh!

liggitt commented Mar 27, 2015

Uh oh!

smarterclayton commented Mar 27, 2015

Uh oh!

liggitt commented Mar 27, 2015

Uh oh!

TomasTomecek commented Mar 27, 2015

Uh oh!

openshift-bot commented Mar 27, 2015

Uh oh!

liggitt commented Mar 27, 2015

Uh oh!

liggitt commented Mar 27, 2015

Uh oh!

liggitt commented Mar 27, 2015

Uh oh!

TomasTomecek commented Mar 27, 2015

Uh oh!

deads2k Mar 30, 2015

Choose a reason for hiding this comment

Uh oh!

liggitt Mar 31, 2015

Choose a reason for hiding this comment

Uh oh!

deads2k Mar 31, 2015

Choose a reason for hiding this comment

Uh oh!

liggitt Mar 31, 2015

Choose a reason for hiding this comment

Uh oh!

liggitt commented Mar 31, 2015

Uh oh!

deads2k Mar 31, 2015

Choose a reason for hiding this comment

Uh oh!

liggitt Mar 31, 2015

Choose a reason for hiding this comment

Uh oh!

deads2k commented Mar 31, 2015

Uh oh!

liggitt commented Mar 31, 2015

Uh oh!

liggitt commented Mar 31, 2015

Uh oh!

openshift-bot commented Mar 31, 2015

Uh oh!

liggitt commented Mar 31, 2015

Uh oh!

openshift-bot commented Apr 1, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants