Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set the required RBAC to enable the certificate signing request #2357

Merged
merged 1 commit into from
Aug 22, 2022
Merged

Set the required RBAC to enable the certificate signing request #2357

merged 1 commit into from
Aug 22, 2022

Conversation

lonelyCZ
Copy link
Member

@lonelyCZ lonelyCZ commented Aug 9, 2022

Signed-off-by: lonelyCZ 531187475@qq.com

What type of PR is this?
/kind feature

What this PR does / why we need it:

Use the bootstrap token to create CertificateSigningRequest

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: member68
spec:
  request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ256Q0NBWWNDQVFBd1dqRUxNQWtHQTFVRUJoTUNXRmd4RlRBVEJnTlZCQWNNREVSbFptRjFiSFFnUTJsMAplVEVWTUJNR0ExVUVDZ3dNYzNsemRHVnRPbTV2WkdWek1SMHdHd1lEVlFRRERCUnplWE4wWlcwNmJtOWtaVHB0ClpXMWlaWEkyT0RDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTG1QRThpcklMeUQKVmRUR2p0ZjcvQm5ST2VjT1U0ZkNlazBkNFRIUmRQL3BZRHV2WmVoOFFBaWFxaFBjVXBSaHpKeVZvSXNpaUJVbAp6YkJTRCtydVl0dncraWlEK3lTMEc1WUN1VHlCSTRjSW5BY2I2akM3ejd0em5tczFjUGUvMXY4dnFHNHVLdW1yCmVONDBXN0hTRGNYdHhGTE4ybmk5VEczdklLcUFaTGJ0a3dhM0VFR05iQWYzMm8rVHAxWElJZmJHV1dqQ3gzQk8KZExBYVAyd1ZHZDU2LzJMU0dycTAveUh6bXhTSWtqQ2Nnc3BGbU5BTldxemQrOWpGdWlQYTRyenYwZ0N2YjZzeApNMmFtTTRHQmxJOEc1dGNBL3ZMcnZzclpSQ1o1RVZ3TDcvOHoxQWkwNC9JRVZ6alRHOXp1SWh2ZGY1REd2d05xCmFZczNqNytyME4wQ0F3RUFBYUFBTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDNVlFSFNhOGk4djVWMzVpNU0Kb081Q1Z5UitIRXR0RUxnV2Y0dzNWemFjT2w0MTFCRU9iMFFETEU5YVRuU3FuUmgwb2FDRGs2NUZKM1hFWHJ2OQpuWG5uY1hHOFNkZEU5RFJPV0ZIcXA5SnBkKy9kNjFrSG9Ec1JHL1IrVDNmd1dhbTdkc1ZtN2JoOTFGQW1zeWpYCmpOT0cyU0FDRnlkZmZaVFF3djFZUjV1dnlsR29GVEZtcUFBTFFxTk5kVElqYmlFSEtrM2tXeEwxR0hoVldsV1IKa29OcEZqWEc5MW54KzhObzNpZlROemFXUG1pNGluTjdlMGNnZExoY2hDNFlnankrNjRUZW5MbXo3L3duN2lsWQpVaDY2b3RRRVpaRnloUHNHd1JOd3lFNmlONU9YZDRYTHBHUUxlUUdqNjZoVHJvWTEvTWNyTTR5T0V4UU1nTjEyCkxIUjYKLS0tLS1FTkQgQ0VSVElGSUNBVEUgUkVRVUVTVC0tLS0tCg==
  signerName: kubernetes.io/kube-apiserver-client-kubelet
  expirationSeconds: 86400
  usages:
  - client auth
  - digital signature
  - key encipherment

The csr can be signed automatically by reusing kubernetes.io/kube-apiserver-client-kubelet.

[root@master68 karmada]# kubectl get csr --kubeconfig /root/.kube/token_config
NAME       AGE   SIGNERNAME                                    REQUESTOR                 REQUESTEDDURATION   CONDITION
member68   35m   kubernetes.io/kube-apiserver-client-kubelet   system:bootstrap:uh35ln   24h                 Approved,Issued

Which issue(s) this PR fixes:
Part of #2282

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

@karmada-bot karmada-bot added the kind/feature Categorizes issue or PR as related to a new feature. label Aug 9, 2022
@karmada-bot karmada-bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Aug 9, 2022
@lonelyCZ lonelyCZ mentioned this pull request Aug 9, 2022
Closed
8 tasks
@prodanlabs
Copy link
Member

I've been busy lately and have missed a lot of information.

Looks like the CertificateRotation feature is starting to be implemented, great.

@RainbowMango
Copy link
Member

Does this ready for review?
You might have to resolve the conflicts.

@lonelyCZ
Copy link
Member Author

Does this ready for review? You might have to resolve the conflicts.

Ok, I will fix it ASAP.

@lonelyCZ lonelyCZ force-pushed the pr-join-pull-rbac branch 2 times, most recently from 4044c06 to 2dfa965 Compare August 21, 2022 09:45
@lonelyCZ
Copy link
Member Author

/cc @RainbowMango

RainbowMango
RainbowMango reviewed Aug 22, 2022
View reviewed changes
pkg/karmadactl/cmdinit/kubernetes/deployments.go
@@ -65,7 +65,6 @@ func (i *CommandInitOption) karmadaAPIServerContainerCommand() []string {
"--allow-privileged=true",
"--authorization-mode=Node,RBAC",
fmt.Sprintf("--client-ca-file=%s/%s.crt", karmadaCertsVolumeMountPath, options.CaCertAndKeyName),
"--enable-admission-plugins=NodeRestriction",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't remember why we need the NodeRestriction plugin for karmada-apiserver. @mrlihanbo can you remind me?

@lonelyCZ Can you explain why you remove it?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mainly lease is restricted at kube-node-lease namespace.

I0822 07:30:51.558065       1 leaderelection.go:253] failed to acquire lease karmada-system/karmada-agent-member68
E0822 07:30:54.921883       1 leaderelection.go:367] Failed to update lock: leases.coordination.k8s.io "karmada-agent-member68" is forbidden: can only access leases in the "kube-node-lease" system namespace

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because it can only use system:node: CN and system:nodes OG for agent cert, to reuse the controller of automatically approving csr.

pkg/karmadactl/cmdinit/kubernetes/deployments.go
@@ -268,7 +267,7 @@ func (i *CommandInitOption) makeKarmadaKubeControllerManagerDeployment() *appsv1
fmt.Sprintf("--cluster-name=%s", options.ClusterName),
fmt.Sprintf("--cluster-signing-cert-file=%s/%s.crt", karmadaCertsVolumeMountPath, options.CaCertAndKeyName),
fmt.Sprintf("--cluster-signing-key-file=%s/%s.key", karmadaCertsVolumeMountPath, options.CaCertAndKeyName),
"--controllers=namespace,garbagecollector,serviceaccount-token",
"--controllers=namespace,garbagecollector,serviceaccount-token,ttl-after-finished,bootstrapsigner,tokencleaner,csrapproving,csrcleaner,csrsigning",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these controllers are required controllers or optinal controllers?

Can you explain why they are needed for this feature?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These controllers are exclusively used by new register workflow. If there aren't the controllers, the new register process prossiblly will be not executed.

I think they are optinal, only enabling new register process need them.

Can you explain why they are needed for this feature?

bootstrapsigner: be used to sign csr automatically.
tokencleaner: be used to clean the tokens that are expired automatically.
csrapproving,csrcleaner,csrsigning: enable csr function.

I will also explain them in the document after this pr.

pkg/karmadactl/cmdinit/karmada/rbac.go Outdated Show resolved Hide resolved
@lonelyCZ
Set the required RBAC to enable the certificate signing request
59c17d9 
Signed-off-by: lonelyCZ <531187475@qq.com>
RainbowMango
RainbowMango approved these changes Aug 22, 2022
View reviewed changes
Copy link
Member

@RainbowMango RainbowMango left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@karmada-bot karmada-bot added the lgtm Indicates that a PR is ready to be merged. label Aug 22, 2022
@karmada-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RainbowMango

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@karmada-bot karmada-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 22, 2022
@karmada-bot karmada-bot merged commit cc74041 into karmada-io:master Aug 22, 2022
@lonelyCZ lonelyCZ deleted the pr-join-pull-rbac branch September 1, 2022 02:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@RainbowMango RainbowMango RainbowMango approved these changes

@carlory carlory Awaiting requested review from carlory

@prodanlabs prodanlabs Awaiting requested review from prodanlabs

Assignees

@RainbowMango RainbowMango

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/feature Categorizes issue or PR as related to a new feature. lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@lonelyCZ @prodanlabs @RainbowMango @karmada-bot