github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #10711 from eparis/self-sign-cert-san

Browse Source 
Do not create subject alt dns names for kubelet self signed certs
This commit is contained in:
Yu-Ju Hong
2015-07-06 11:40:34 -07:00
parent 4d86127098 cde68d294b
commit 97baadab46
3 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/util/crypto.go
View File

@@ -35,10 +35,11 @@ import (
// GenerateSelfSignedCert creates a self-signed certificate and key for the given host.
// Host may be an IP or a DNS name
// You may also specify additional subject alt names (either ip or dns names) for the certificate
// The certificate will be created with file mode 0644. The key will be created with file mode 0600.
// If the certificate or key files already exist, they will be overwritten.
// Any parent directories of the certPath or keyPath will be created as needed with file mode 0755.
func GenerateSelfSignedCert(host, certPath, keyPath string, ServiceReadWriteIP net.IP) error {
func GenerateSelfSignedCert(host, certPath, keyPath string, alternateIPs []net.IP, alternateDNS []string) error {
priv, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
return err
@@ -63,14 +64,8 @@ func GenerateSelfSignedCert(host, certPath, keyPath string, ServiceReadWriteIP n
template.DNSNames = append(template.DNSNames, host)
}
if ServiceReadWriteIP != nil {
template.IPAddresses = append(template.IPAddresses, ServiceReadWriteIP)
}
// It would be nice to have the next line, but only the kubelets know the fqdn, the apiserver is clueless
// template.DNSNames = append(template.DNSNames, "kubernetes.default.svc.CLUSTER.DNS.NAME")
template.DNSNames = append(template.DNSNames, "kubernetes.default.svc")
template.DNSNames = append(template.DNSNames, "kubernetes.default")
template.DNSNames = append(template.DNSNames, "kubernetes")
template.IPAddresses = append(template.IPAddresses, alternateIPs...)
template.DNSNames = append(template.DNSNames, alternateDNS...)
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
if err != nil {