Commit Graph

81 Commits

Author SHA1 Message Date
Chuck Ha
125f5ac61a Replace glog.Info{f,ln} with fmt.Print{f,ln}
This follows the pattern `kubectl` uses for logging.

There are two remaining glog.Infof call that cannot be removed easily.

One glog call comes from kubelet validation which calls features.SetFromMap.
The other comes from test/e2e during kernel validation.

Mostly fixes kubernetes/kubeadm#852

Signed-off-by: Chuck Ha <ha.chuck@gmail.com>
2018-06-04 10:34:31 -04:00
Lucas Käldström
099e60b1db kubeadm: Refactor the .Etcd substruct in the v1alpha2 API 2018-05-23 21:13:32 +03:00
Jason DeTiberus
187ef17ed8 kubeadm - do not generate etcd ca/certs for external etcd
Only generate the etcd CA and certificates if not configured for external
etcd.
2018-05-14 11:56:29 -04:00
xiangpengzhao
511ac8a064 Not validating front proxy CA Key when using External CA. 2018-04-17 15:25:30 +08:00
Kubernetes Submit Queue
0023c4112b Merge pull request #57661 from vbmade2000/KUBE-ISSUE-340
Automatic merge from submit-queue (batch tested with PRs 59027, 62333, 57661, 62086, 61584). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Implement verbosity feature for kubeadm

[WIP] Adds verbosity feature to init command hierarchy of kubeadm utility.



**What this PR does / why we need it**:
Implements verbosity feature to kubeadm

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#340

**Special notes for your reviewer**:
I will be splitting this work into a smaller PR to keep it separate and clean.

**Release note**:

```release-note
Implements verbosity logging feature for kubeadm commands
```
2018-04-10 22:53:19 -07:00
Malhar Vora
9c4706f519 Implement verbosity feature for kubeadm init
Fixes #340

Adds functionality to see logs with various level of verbosity.

Currently there are two verbosity levels: 0 and 1
2018-03-25 09:43:31 -07:00
leigh schrandt
7a1a3aa3df Generate client certificates for healthchecking kubeadm etcd static pods
Add new phase command: `certs etcd-healthcheck`
Certs are placed at /etc/kubernetes/pki/etcd/healthcheck-client.{crt,key}
2018-03-04 19:25:16 -07:00
leigh schrandt
41974cb91f Fix typos 2018-02-27 17:56:16 -07:00
leigh schrandt
2d9b2d9fef Switch to a dedicated CA for kubeadm etcd identities 2018-02-27 17:42:43 -07:00
leigh schrandt
f61430d7c8 Fix typos
- Fix typos in tests for upgrade phase
- Rename loadCertificateAuthorithy() --> loadCertificateAuthority()
- Disambiguate apiKubeletClientCert & apiEtcdClientCert
- Parameterize hard-coded certs_test config + log tempCertsDir
2018-02-23 17:05:43 -07:00
leigh schrandt
f5e11a0ce0 Change SANs for etcd serving and peer certs
- Place etcd server and peer certs & keys into pki subdir
- Move certs.altName functions to pkiutil + add appendSANstoAltNames()
    Share the append logic for the getAltName functions as suggested by
    @jamiehannaford.
    Move functions/tests to certs/pkiutil as suggested by @luxas.

    Update Bazel BUILD deps

- Warn when an APIServerCertSANs or EtcdCertSANs entry is unusable
- Add MasterConfiguration.EtcdPeerCertSANs
- Move EtcdServerCertSANs and EtcdPeerCertSANs under MasterConfiguration.Etcd
2018-02-23 17:05:39 -07:00
leigh schrandt
bb689eb2bb Secure etcd API /w TLS on kubeadm init [kubeadm/#594]
- Generate Server and Peer cert for etcd
- Generate Client cert for apiserver
- Add flags / hostMounts for etcd static pod
- Add flags / hostMounts for apiserver static pod

- Generate certs on upgrade of static-pods for etcd/kube-apiserver
- Modify logic for appending etcd flags to staticpod to be safer for external etcd
2018-02-23 16:06:55 -07:00
Steve Sloka
2fd29a0406 Add configuration item to allow kubeadm join to use a dns name pointing to control plane 2018-02-15 12:03:32 -05:00
Di Xu
48388fec7e fix all the typos across the project 2018-02-11 11:04:14 +08:00
cheyang
4ca3903eab fix typo in kubeadm
Signed-off-by: cheyang <cheyang@163.com>
2018-02-06 13:48:18 +08:00
mattjmcnaughton
8323fb4b4f Modify apimachinery imports using staging
Currently some of the imports of `apimachinery` use
`k8s.io/kubernetes/staging/src/k8s.io/apimachinery...`. Replace
these with `k8s.io/apimachinery`, as is in use throughout the rest
of the code base.

Signed-off-by: mattjmcnaughton <mattjmcnaughton@gmail.com>
2017-09-10 10:19:30 -04:00
Nick Turner
e0ab0b57ab Adds check for external CA
We allow a kubeadm user to use an external CA by checking to see if ca.key is missing and skipping cert checks and kubeconfig generation if ca.key is missing.
2017-08-31 17:12:24 +00:00
fabriziopandini
5fac458f5f Main work -- refactor certs phase 2017-08-18 09:13:49 +02:00
Ghe Rivero
8181fd29b2 Add node-name flag to init phase
Allow to specify a node-name instead of relaying in `os.Hostname()`
This is useful where kubelet use the name given by the cloud-provider to
register the node.

Partially fix: kubernetes/kubeadm#64
2017-07-12 12:40:25 +02:00
fabriziopandini
c2e9052aea fully implement kubeadm-phase-certs - stash 2017-07-08 14:58:11 +02:00
Lucas Käldström
579a743482 kubeadm: Add --cert-dir, --apiserver-cert-extra-sans, remove --api-external-dns-names and add the phase command for certs. Also use the CertificatesDir var everywhere instead of the HostPKIPath variable and fix some bugs in certs.go 2017-03-02 20:51:02 +02:00
Lucas Käldström
5cbefbcbca kubeadm: Rename --api-advertise-addresses to --apiserver-advertise-address and --api-port to --apiserver-bind-port 2017-03-01 14:33:19 +02:00
Lucas Käldström
42cb8c8cb0 kubeadm: Generate kubeconfig files for controller-manager and scheduler and use them; secures the control plane communication 2017-02-23 21:28:03 +02:00
deads2k
affdf829a3 add front proxy to kubeadm created kube-apiservers 2017-02-15 11:02:03 -05:00
Andrew Rynhard
3ea7b29e8e Use a dedicated key for service account token signing 2017-02-13 08:39:46 -08:00
deads2k
5a8f075197 move authoritative client-go utils out of pkg 2017-01-24 08:59:18 -05:00
Lucas Käldström
695fb7440e Fix up the misunderstanding about the apiserver kubelet client cert 2017-01-23 21:45:48 +02:00
Lucas Käldström
6a37f450ae Add --kubelet-client-{certificate,key} to the apiserver args and make it allowed to access the kubelets 2017-01-23 13:16:04 +02:00
Lucas Käldström
13499f443a Generate two certs and two private keys; only the necessary ones; make the certs and kubeconfig phases work with valid files already on-disk and some cleanup 2017-01-21 00:33:06 +02:00
deads2k
ee6752ef20 find and replace 2017-01-20 08:04:53 -05:00
Lucas Käldström
720f3b45aa Refactor the pki, cert, kubeconfig code in the kubeadm binary into two separate and logically independent phases 2017-01-03 23:40:07 +02:00