github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

kubeadm: fix the generation of ECDSA keys in kubeconfig files

Browse Source 
When the PublicKeysECDSA feature gate is used or the new
v1beta4.ClusterConfiguration.EncryptionAlgorithm field is used
with "ECDSA-P256" as value, make sure that this is reflected
in the "cert spec" used to generate private keys and they end
up as "EC keys".
This commit is contained in:
Lubomir I. Ivanov
2024-06-07 19:31:04 +03:00
parent 51f89c3b2d
commit 02ed1aee71
2 changed files with 36 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
cmd/kubeadm/app/phases/kubeconfig/kubeconfig.go
View File

@@ -66,12 +66,13 @@ type tokenAuth struct {
// kubeConfigSpec struct holds info required to build a KubeConfig object // kubeConfigSpec struct holds info required to build a KubeConfig object
type kubeConfigSpec struct { type kubeConfigSpec struct {
CACert *x509.Certificate CACert *x509.Certificate
APIServer string APIServer string
ClientName string ClientName string
ClientCertNotAfter time.Time ClientCertNotAfter time.Time
TokenAuth *tokenAuth `datapolicy:"token"` TokenAuth *tokenAuth `datapolicy:"token"`
ClientCertAuth *clientCertAuth `datapolicy:"security-key"` ClientCertAuth *clientCertAuth `datapolicy:"security-key"`
EncryptionAlgorithm kubeadmapi.EncryptionAlgorithmType
} }
// CreateJoinControlPlaneKubeConfigFiles will create and write to disk the kubeconfig files required by kubeadm // CreateJoinControlPlaneKubeConfigFiles will create and write to disk the kubeconfig files required by kubeadm
@@ -212,7 +213,8 @@ func newClientCertConfigFromKubeConfigSpec(spec *kubeConfigSpec) pkiutil.CertCon
Organization: spec.ClientCertAuth.Organizations, Organization: spec.ClientCertAuth.Organizations,
Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}, Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
}, },
NotAfter: spec.ClientCertNotAfter, NotAfter: spec.ClientCertNotAfter,
EncryptionAlgorithm: spec.EncryptionAlgorithm,
} }
} }
@@ -324,7 +326,8 @@ func WriteKubeConfigWithClientCert(out io.Writer, cfg *kubeadmapi.InitConfigurat
CAKey: caKey, CAKey: caKey,
Organizations: organizations, Organizations: organizations,
}, },
ClientCertNotAfter: notAfter, ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
} }
return writeKubeConfigFromSpec(out, spec, cfg.ClusterName) return writeKubeConfigFromSpec(out, spec, cfg.ClusterName)
@@ -353,7 +356,8 @@ func WriteKubeConfigWithToken(out io.Writer, cfg *kubeadmapi.InitConfiguration,
TokenAuth: &tokenAuth{ TokenAuth: &tokenAuth{
Token: token, Token: token,
}, },
ClientCertNotAfter: notAfter, ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
} }
return writeKubeConfigFromSpec(out, spec, cfg.ClusterName) return writeKubeConfigFromSpec(out, spec, cfg.ClusterName)
@@ -452,7 +456,8 @@ func getKubeConfigSpecsBase(cfg *kubeadmapi.InitConfiguration) (map[string]*kube
ClientCertAuth: &clientCertAuth{ ClientCertAuth: &clientCertAuth{
Organizations: []string{kubeadmconstants.ClusterAdminsGroupAndClusterRoleBinding}, Organizations: []string{kubeadmconstants.ClusterAdminsGroupAndClusterRoleBinding},
}, },
ClientCertNotAfter: notAfter, ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
}, },
kubeadmconstants.SuperAdminKubeConfigFileName: { kubeadmconstants.SuperAdminKubeConfigFileName: {
APIServer: controlPlaneEndpoint, APIServer: controlPlaneEndpoint,
@@ -460,7 +465,8 @@ func getKubeConfigSpecsBase(cfg *kubeadmapi.InitConfiguration) (map[string]*kube
ClientCertAuth: &clientCertAuth{ ClientCertAuth: &clientCertAuth{
Organizations: []string{kubeadmconstants.SystemPrivilegedGroup}, Organizations: []string{kubeadmconstants.SystemPrivilegedGroup},
}, },
ClientCertNotAfter: notAfter, ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
}, },
kubeadmconstants.KubeletKubeConfigFileName: { kubeadmconstants.KubeletKubeConfigFileName: {
APIServer: controlPlaneEndpoint, APIServer: controlPlaneEndpoint,
@@ -468,19 +474,22 @@ func getKubeConfigSpecsBase(cfg *kubeadmapi.InitConfiguration) (map[string]*kube
ClientCertAuth: &clientCertAuth{ ClientCertAuth: &clientCertAuth{
Organizations: []string{kubeadmconstants.NodesGroup}, Organizations: []string{kubeadmconstants.NodesGroup},
}, },
ClientCertNotAfter: notAfter, ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
}, },
kubeadmconstants.ControllerManagerKubeConfigFileName: { kubeadmconstants.ControllerManagerKubeConfigFileName: {
APIServer: localAPIEndpoint, APIServer: localAPIEndpoint,
ClientName: kubeadmconstants.ControllerManagerUser, ClientName: kubeadmconstants.ControllerManagerUser,
ClientCertAuth: &clientCertAuth{}, ClientCertAuth: &clientCertAuth{},
ClientCertNotAfter: notAfter, ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
}, },
kubeadmconstants.SchedulerKubeConfigFileName: { kubeadmconstants.SchedulerKubeConfigFileName: {
APIServer: localAPIEndpoint, APIServer: localAPIEndpoint,
ClientName: kubeadmconstants.SchedulerUser, ClientName: kubeadmconstants.SchedulerUser,
ClientCertAuth: &clientCertAuth{}, ClientCertAuth: &clientCertAuth{},
ClientCertNotAfter: notAfter, ClientCertNotAfter: notAfter,
EncryptionAlgorithm: cfg.ClusterConfiguration.EncryptionAlgorithmType(),
}, },
}, nil }, nil
} }

8
cmd/kubeadm/app/phases/kubeconfig/kubeconfig_test.go
View File

@@ -84,7 +84,8 @@ func TestGetKubeConfigSpecs(t *testing.T) {
{ {
LocalAPIEndpoint: kubeadmapi.APIEndpoint{AdvertiseAddress: "1.2.3.4", BindPort: 1234}, LocalAPIEndpoint: kubeadmapi.APIEndpoint{AdvertiseAddress: "1.2.3.4", BindPort: 1234},
ClusterConfiguration: kubeadmapi.ClusterConfiguration{ ClusterConfiguration: kubeadmapi.ClusterConfiguration{
CertificatesDir: pkidir, CertificatesDir: pkidir,
EncryptionAlgorithm: kubeadmapi.EncryptionAlgorithmECDSAP256,
}, },
NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: "valid-node-name"}, NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: "valid-node-name"},
}, },
@@ -180,6 +181,11 @@ func TestGetKubeConfigSpecs(t *testing.T) {
t.Errorf("getKubeConfigSpecs for %s Organizations is %v, expected %v", assertion.kubeConfigFile, spec.ClientCertAuth.Organizations, assertion.organizations) t.Errorf("getKubeConfigSpecs for %s Organizations is %v, expected %v", assertion.kubeConfigFile, spec.ClientCertAuth.Organizations, assertion.organizations)
} }
// Assert EncryptionAlgorithm
if spec.EncryptionAlgorithm != cfg.EncryptionAlgorithm {
t.Errorf("getKubeConfigSpecs for %s EncryptionAlgorithm is %s, expected %s", assertion.kubeConfigFile, spec.EncryptionAlgorithm, cfg.EncryptionAlgorithm)
}
// Asserts InitConfiguration values injected into spec // Asserts InitConfiguration values injected into spec
controlPlaneEndpoint, err := kubeadmutil.GetControlPlaneEndpoint(cfg.ControlPlaneEndpoint, &cfg.LocalAPIEndpoint) controlPlaneEndpoint, err := kubeadmutil.GetControlPlaneEndpoint(cfg.ControlPlaneEndpoint, &cfg.LocalAPIEndpoint)
if err != nil { if err != nil {