Skip to content

Commit 77c6ef2

Browse files
kvapskvaps
committed
generate client certs using cert-manager
1 parent c181314 commit 77c6ef2

12 files changed

+340
-46
lines changed

‎deploy/helm/kubernetes/scripts/configure-cluster.sh‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -39,39 +39,6 @@ if ! kubectl get secret "${FULL_NAME}-pki-sa" >/dev/null; then
3939
fi
4040
{{- end }}
4141

42-
# generate cluster-admin kubeconfig
43-
rm -f /etc/kubernetes/admin.conf
44-
kubeadm init phase kubeconfig admin --config kubeadmcfg.yaml
45-
kubectl --kubeconfig=/etc/kubernetes/admin.conf config set-cluster kubernetes --server "https://${FULL_NAME}-apiserver:6443"
46-
kubectl create secret generic "${FULL_NAME}-admin-conf" --from-file=/etc/kubernetes/admin.conf --dry-run=client -o yaml | kubectl apply -f -
47-
48-
{{- if .Values.controllerManager.enabled }}{{"\n"}}
49-
# generate controller-manager kubeconfig
50-
rm -f /etc/kubernetes/controller-manager.conf
51-
kubeadm init phase kubeconfig controller-manager --config kubeadmcfg.yaml
52-
kubectl --kubeconfig=/etc/kubernetes/controller-manager.conf config set-cluster kubernetes --server "https://${FULL_NAME}-apiserver:6443"
53-
kubectl create secret generic "${FULL_NAME}-controller-manager-conf" --from-file=/etc/kubernetes/controller-manager.conf --dry-run=client -o yaml | kubectl apply -f -
54-
{{- end }}
55-
56-
{{- if .Values.scheduler.enabled }}{{"\n"}}
57-
# generate scheduler kubeconfig
58-
rm -f /etc/kubernetes/scheduler.conf
59-
kubeadm init phase kubeconfig scheduler --config kubeadmcfg.yaml
60-
kubectl --kubeconfig=/etc/kubernetes/scheduler.conf config set-cluster kubernetes --server "https://${FULL_NAME}-apiserver:6443"
61-
kubectl create secret generic "${FULL_NAME}-scheduler-conf" --from-file=/etc/kubernetes/scheduler.conf --dry-run=client -o yaml | kubectl apply -f -
62-
{{- end }}
63-
64-
{{- if .Values.konnectivityServer.enabled }}{{"\n"}}
65-
# generate konnectivity-server kubeconfig
66-
openssl req -subj "/CN=system:konnectivity-server" -new -newkey rsa:2048 -nodes -out konnectivity.csr -keyout konnectivity.key -out konnectivity.csr
67-
openssl x509 -req -in konnectivity.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out konnectivity.crt -days 375 -sha256
68-
kubectl --kubeconfig /etc/kubernetes/konnectivity-server.conf config set-credentials system:konnectivity-server --client-certificate konnectivity.crt --client-key konnectivity.key --embed-certs=true
69-
kubectl --kubeconfig /etc/kubernetes/konnectivity-server.conf config set-cluster kubernetes --server "https://${FULL_NAME}-apiserver:6443" --certificate-authority /etc/kubernetes/pki/ca.crt --embed-certs=true
70-
kubectl --kubeconfig /etc/kubernetes/konnectivity-server.conf config set-context system:konnectivity-server@kubernetes --cluster kubernetes --user system:konnectivity-server
71-
kubectl --kubeconfig /etc/kubernetes/konnectivity-server.conf config use-context system:konnectivity-server@kubernetes
72-
kubectl create secret generic "${FULL_NAME}-konnectivity-server-conf" --from-file=/etc/kubernetes/konnectivity-server.conf --dry-run=client -o yaml | kubectl apply -f -
73-
{{- end }}
74-
7542
# wait for cluster
7643
echo "Waiting for api-server endpoint ${FULL_NAME}-apiserver:6443..."
7744
until kubectl --kubeconfig /etc/kubernetes/admin.conf cluster-info >/dev/null 2>/dev/null; do

‎deploy/helm/kubernetes/templates/admin-configmap.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{{- if .Values.admin.enabled }}
2+
{{- $fullName := include "kubernetes.fullname" . -}}
3+
---
4+
apiVersion: v1
5+
kind: ConfigMap
6+
metadata:
7+
name: {{ $fullName }}-admin-conf
8+
data:
9+
admin.conf: |
10+
apiVersion: v1
11+
clusters:
12+
- cluster:
13+
certificate-authority: /pki/admin-client/ca.crt
14+
server: https://{{ $fullName }}-apiserver:{{ .Values.apiServer.service.port }}
15+
name: default-cluster
16+
contexts:
17+
- context:
18+
cluster: default-cluster
19+
namespace: default
20+
user: default-auth
21+
name: default-context
22+
current-context: default-context
23+
kind: Config
24+
preferences: {}
25+
users:
26+
- name: default-auth
27+
user:
28+
client-certificate: /pki/admin-client/tls.crt
29+
client-key: /pki/admin-client/tls.key
30+
{{- end }}

‎deploy/helm/kubernetes/templates/admin-deployment.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,16 +80,21 @@ spec:
8080
- mountPath: /etc/kubernetes/
8181
name: kubeconfig
8282
readOnly: true
83+
- mountPath: /pki/admin-client
84+
name: pki-admin-client
8385
{{- with .Values.admin.extraVolumeMounts }}
8486
{{- toYaml . | nindent 8 }}
8587
{{- end }}
8688
{{- with .Values.admin.sidecars }}
8789
{{- toYaml . | nindent 6 }}
8890
{{- end }}
8991
volumes:
90-
- secret:
91-
secretName: "{{ $fullName }}-admin-conf"
92+
- configMap:
93+
name: "{{ $fullName }}-admin-conf"
9294
name: kubeconfig
95+
- secret:
96+
secretName: "{{ $fullName }}-pki-admin-client"
97+
name: pki-admin-client
9398
{{- with .Values.admin.extraVolumes }}
9499
{{- toYaml . | nindent 6 }}
95100
{{- end }}

‎deploy/helm/kubernetes/templates/apiserver-deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ spec:
146146
secretName: "{{ $fullName }}-pki-front-proxy-client"
147147
name: pki-front-proxy-client
148148
- secret:
149-
secretName: "{{ $fullName }}-pki-apiserver"
149+
secretName: "{{ $fullName }}-pki-apiserver-server"
150150
name: pki-apiserver
151151
- secret:
152152
secretName: "{{ $fullName }}-pki-apiserver-etcd-client"

‎deploy/helm/kubernetes/templates/controller-manager-configmap.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{{- if .Values.controllerManager.enabled }}
2+
{{- $fullName := include "kubernetes.fullname" . -}}
3+
---
4+
apiVersion: v1
5+
kind: ConfigMap
6+
metadata:
7+
name: {{ $fullName }}-controller-manager-conf
8+
data:
9+
controller-manager.conf: |
10+
apiVersion: v1
11+
clusters:
12+
- cluster:
13+
certificate-authority: /pki/controller-manager-client/ca.crt
14+
server: https://{{ $fullName }}-apiserver:{{ .Values.apiServer.service.port }}
15+
name: default-cluster
16+
contexts:
17+
- context:
18+
cluster: default-cluster
19+
namespace: default
20+
user: default-auth
21+
name: default-context
22+
current-context: default-context
23+
kind: Config
24+
preferences: {}
25+
users:
26+
- name: default-auth
27+
user:
28+
client-certificate: /pki/controller-manager-client/tls.crt
29+
client-key: /pki/controller-manager-client/tls.key
30+
{{- end }}

‎deploy/helm/kubernetes/templates/controller-manager-deployment.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,10 @@ spec:
9292
- mountPath: /etc/kubernetes/
9393
name: kubeconfig
9494
readOnly: true
95+
- mountPath: /pki/controller-manager-server
96+
name: pki-controller-manager-server
97+
- mountPath: /pki/controller-manager-client
98+
name: pki-controller-manager-client
9599
- mountPath: /pki/ca
96100
name: pki-ca
97101
- mountPath: /pki/front-proxy-client
@@ -105,9 +109,15 @@ spec:
105109
{{- toYaml . | nindent 6 }}
106110
{{- end }}
107111
volumes:
108-
- secret:
109-
secretName: "{{ $fullName }}-controller-manager-conf"
112+
- configMap:
113+
name: "{{ $fullName }}-controller-manager-conf"
110114
name: kubeconfig
115+
- secret:
116+
secretName: "{{ $fullName }}-pki-controller-manager-server"
117+
name: pki-controller-manager-server
118+
- secret:
119+
secretName: "{{ $fullName }}-pki-controller-manager-client"
120+
name: pki-controller-manager-client
111121
- secret:
112122
secretName: "{{ $fullName }}-pki-ca"
113123
name: pki-ca

‎deploy/helm/kubernetes/templates/konnectivity-server-configmap.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{{- if .Values.konnectivityServer.enabled }}
2+
{{- $fullName := include "kubernetes.fullname" . -}}
3+
---
4+
apiVersion: v1
5+
kind: ConfigMap
6+
metadata:
7+
name: {{ $fullName }}-konnectivity-server-conf
8+
data:
9+
konnectivity-server.conf: |
10+
apiVersion: v1
11+
clusters:
12+
- cluster:
13+
certificate-authority: /pki/konnectivity-server-client/ca.crt
14+
server: https://{{ $fullName }}-apiserver:{{ .Values.apiServer.service.port }}
15+
name: default-cluster
16+
contexts:
17+
- context:
18+
cluster: default-cluster
19+
namespace: default
20+
user: default-auth
21+
name: default-context
22+
current-context: default-context
23+
kind: Config
24+
preferences: {}
25+
users:
26+
- name: default-auth
27+
user:
28+
client-certificate: /pki/konnectivity-server-client/tls.crt
29+
client-key: /pki/konnectivity-server-client/tls.key
30+
{{- end }}

‎deploy/helm/kubernetes/templates/konnectivity-server-deployment.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,8 @@ spec:
108108
name: pki-apiserver
109109
- mountPath: /pki/konnectivity-server
110110
name: pki-konnectivity-server
111+
- mountPath: /pki/konnectivity-server-client
112+
name: pki-konnectivity-server-client
111113
- mountPath: /etc/kubernetes/
112114
name: kubeconfig
113115
readOnly: true
@@ -119,13 +121,16 @@ spec:
119121
{{- end }}
120122
volumes:
121123
- secret:
122-
secretName: "{{ $fullName }}-pki-apiserver"
124+
secretName: "{{ $fullName }}-pki-apiserver-server"
123125
name: pki-apiserver
124126
- secret:
125127
secretName: "{{ $fullName }}-pki-konnectivity-server"
126128
name: pki-konnectivity-server
127129
- secret:
128-
secretName: "{{ $fullName }}-konnectivity-server-conf"
130+
secretName: "{{ $fullName }}-pki-konnectivity-server-client"
131+
name: pki-konnectivity-server-client
132+
- configMap:
133+
name: "{{ $fullName }}-konnectivity-server-conf"
129134
name: kubeconfig
130135
{{- with .Values.konnectivityServer.extraVolumes }}
131136
{{- toYaml . | nindent 6 }}

‎deploy/helm/kubernetes/templates/kubeadm-job.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ spec:
9292
secretName: "{{ $fullName }}-pki-front-proxy-client"
9393
name: pki-front-proxy-client
9494
- secret:
95-
secretName: "{{ $fullName }}-pki-apiserver"
95+
secretName: "{{ $fullName }}-pki-apiserver-server"
9696
name: pki-apiserver
9797
- secret:
9898
secretName: "{{ $fullName }}-pki-apiserver-etcd-client"

0 commit comments

Comments
 (0)