Refactor service-account signing key

nodeup/pkg/model/convenience.go

@@ -73,23 +73,6 @@ func addHostPathMapping(pod *v1.Pod, container *v1.Container, name, path string)
 	return &container.VolumeMounts[len(container.VolumeMounts)-1]
 }
 
-// addHostPathVolume is shorthand for mapping a host path into a container
-func addHostPathVolume(pod *v1.Pod, container *v1.Container, hostPath v1.HostPathVolumeSource, volumeMount v1.VolumeMount) {
-	vol := v1.Volume{
-		Name: volumeMount.Name,
-		VolumeSource: v1.VolumeSource{
-			HostPath: &hostPath,
-		},
-	}
-
-	if volumeMount.MountPath == "" {
-		volumeMount.MountPath = hostPath.Path
-	}
-
-	pod.Spec.Volumes = append(pod.Spec.Volumes, vol)
-	container.VolumeMounts = append(container.VolumeMounts, volumeMount)
-}
-
 // convEtcdSettingsToMs converts etcd settings to a string rep of int milliseconds
 func convEtcdSettingsToMs(dur *metav1.Duration) string {
 	return strconv.FormatInt(dur.Nanoseconds()/1000000, 10)

nodeup/pkg/model/kube_apiserver.go

@@ -95,6 +95,17 @@ func (b *KubeAPIServerBuilder) Build(c *fi.ModelBuilderContext) error {
 		Mode:     s("0600"),
 	})
 
+	// Set the signing key if we're using Service Account Token VolumeProjection
+	if kubeAPIServer.ServiceAccountSigningKeyFile == nil {
+		if fi.StringValue(kubeAPIServer.ServiceAccountIssuer) != "" {
+			s := filepath.Join(pathSrvKAPI, "service-account.key")
+			kubeAPIServer.ServiceAccountSigningKeyFile = &s
+			if err := b.BuildPrivateKeyTask(c, "service-account", pathSrvKAPI, "service-account", nil, nil); err != nil {
+				return err
+			}
+		}
+	}
+
 	if b.UseEtcdManager() {
 		c.AddTask(&nodetasks.File{
 			Path:     filepath.Join(pathSrvKAPI, "etcd-ca.crt"),
@@ -349,13 +360,6 @@ func (b *KubeAPIServerBuilder) writeAuthenticationConfig(c *fi.ModelBuilderConte
 
 // buildPod is responsible for generating the kube-apiserver pod and thus manifest file
 func (b *KubeAPIServerBuilder) buildPod(kubeAPIServer *kops.KubeAPIServerConfig) (*v1.Pod, error) {
-	// Set the signing key if we're using Service Account Token VolumeProjection
-	if kubeAPIServer.ServiceAccountSigningKeyFile == nil {
-		if fi.StringValue(kubeAPIServer.ServiceAccountIssuer) != "" {
-			s := filepath.Join(b.PathSrvKubernetes(), "service-account.key")
-			kubeAPIServer.ServiceAccountSigningKeyFile = &s
-		}
-	}
 	// If clientCAFile is not specified, set it to the default value ${PathSrvKubernetes}/ca.crt
 	if kubeAPIServer.ClientCAFile == "" {
 		kubeAPIServer.ClientCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt")
@@ -545,19 +549,6 @@ func (b *KubeAPIServerBuilder) buildPod(kubeAPIServer *kops.KubeAPIServerConfig)
 		addHostPathMapping(pod, container, name, path)
 	}
 
-	if b.UseEtcdManager() {
-		volumeType := v1.HostPathDirectoryOrCreate
-		addHostPathVolume(pod, container,
-			v1.HostPathVolumeSource{
-				Path: "/etc/kubernetes/pki/kube-apiserver",
-				Type: &volumeType,
-			},
-			v1.VolumeMount{
-				Name:     "pki",
-				ReadOnly: false,
-			})
-	}
-
 	// Add cloud config file if needed
 	if b.Cluster.Spec.CloudConfig != nil {
 		addHostPathMapping(pod, container, "cloudconfig", CloudConfigFilePath)

nodeup/pkg/model/kube_controller_manager.go

@@ -58,7 +58,7 @@ func (b *KubeControllerManagerBuilder) Build(c *fi.ModelBuilderContext) error {
 		return err
 	}
 
-	if err := b.BuildLegacyPrivateKeyTask(c, "service-account", filepath.Join(pathSrvKCM, "service-account.key"), nil); err != nil {
+	if err := b.BuildPrivateKeyTask(c, "service-account", pathSrvKCM, "service-account", nil, nil); err != nil {
 		return err
 	}
 

nodeup/pkg/model/kubelet_test.go

@@ -290,6 +290,7 @@ func BuildNodeupModelContext(model *testutils.Model) (*NodeupModelContext, error
 	// Are we mocking out too much of the apply_cluster logic?
 	nodeupModelContext.NodeupConfig.CAs["kubernetes-ca"] = dummyCertificate + nextCertificate
 	nodeupModelContext.NodeupConfig.KeypairIDs["kubernetes-ca"] = "3"
+	nodeupModelContext.NodeupConfig.KeypairIDs["service-account"] = "2"
 
 	if nodeupModelContext.NodeupConfig.APIServerConfig != nil {
 		saPublicKeys, _ := rotatingPrivateKeyset().ToPublicKeys()

nodeup/pkg/model/secrets.go

@@ -134,10 +134,6 @@ func (b *SecretBuilder) Build(c *fi.ModelBuilderContext) error {
 		}
 	}
 
-	if err := b.BuildLegacyPrivateKeyTask(c, "service-account", "service-account.key", nil); err != nil {
-		return err
-	}
-
 	// Support for basic auth was deprecated 1.16 and removed in 1.19
 	// https://github.com/kubernetes/kubernetes/pull/89069
 	if b.IsKubernetesLT("1.19") && b.SecretStore != nil {

nodeup/pkg/model/tests/golden/awsiam/tasks-kube-apiserver.yaml

@@ -120,8 +120,6 @@ contents: |
       - mountPath: /etc/openssl
         name: etcopenssl
         readOnly: true
-      - mountPath: /etc/kubernetes/pki/kube-apiserver
-        name: pki
       - mountPath: /etc/kubernetes/cloud.config
         name: cloudconfig
         readOnly: true
@@ -170,10 +168,6 @@ contents: |
     - hostPath:
         path: /etc/openssl
       name: etcopenssl
-    - hostPath:
-        path: /etc/kubernetes/pki/kube-apiserver
-        type: DirectoryOrCreate
-      name: pki
     - hostPath:
         path: /etc/kubernetes/cloud.config
       name: cloudconfig

nodeup/pkg/model/tests/golden/dedicated-apiserver/tasks-kube-apiserver.yaml

@@ -98,8 +98,6 @@ contents: |
       - mountPath: /etc/openssl
         name: etcopenssl
         readOnly: true
-      - mountPath: /etc/kubernetes/pki/kube-apiserver
-        name: pki
       - mountPath: /etc/kubernetes/cloud.config
         name: cloudconfig
         readOnly: true
@@ -145,10 +143,6 @@ contents: |
     - hostPath:
         path: /etc/openssl
       name: etcopenssl
-    - hostPath:
-        path: /etc/kubernetes/pki/kube-apiserver
-        type: DirectoryOrCreate
-      name: pki
     - hostPath:
         path: /etc/kubernetes/cloud.config
       name: cloudconfig

nodeup/pkg/model/tests/golden/minimal/tasks-kube-apiserver.yaml

@@ -98,8 +98,6 @@ contents: |
       - mountPath: /etc/openssl
         name: etcopenssl
         readOnly: true
-      - mountPath: /etc/kubernetes/pki/kube-apiserver
-        name: pki
       - mountPath: /etc/kubernetes/cloud.config
         name: cloudconfig
         readOnly: true
@@ -145,10 +143,6 @@ contents: |
     - hostPath:
         path: /etc/openssl
       name: etcopenssl
-    - hostPath:
-        path: /etc/kubernetes/pki/kube-apiserver
-        type: DirectoryOrCreate
-      name: pki
     - hostPath:
         path: /etc/kubernetes/cloud.config
       name: cloudconfig

nodeup/pkg/model/tests/golden/minimal/tasks-secret.yaml

@@ -77,20 +77,6 @@ mode: "0600"
 path: /srv/kubernetes/server.key
 type: file
 ---
-contents: |
-  -----BEGIN RSA PRIVATE KEY-----
-  MIIBPQIBAAJBANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m4
-  9pAEeIMsvwvDMaLsb2v6JvXe0qvCmueU+/sCAwEAAQJBAKt/gmpHqP3qA3u8RA5R
-  2W6L360Z2Mnza1FmkI/9StCCkJGjuE5yDhxU4JcVnFyX/nMxm2ockEEQDqRSu7Oo
-  xTECIQD2QsUsgFL4FnXWzTclySJ6ajE4Cte3gSDOIvyMNMireQIhAOEnsV8UaSI+
-  ZyL7NMLzMPLCgtsrPnlamr8gdrEHf9ITAiEAxCCLbpTI/4LL2QZZrINTLVGT34Fr
-  Kl/yI5pjrrp/M2kCIQDfOktQyRuzJ8t5kzWsUxCkntS+FxHJn1rtQ3Jp8dV4oQIh
-  AOyiVWDyLZJvg7Y24Ycmp86BZjM9Wk/BfWpBXKnl9iDY
-  -----END RSA PRIVATE KEY-----
-mode: "0600"
-path: /srv/kubernetes/service-account.key
-type: file
----
 Name: master
 alternateNames:
 - kubernetes

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-apiserver-amd64.yaml

@@ -98,8 +98,6 @@ contents: |
       - mountPath: /etc/openssl
         name: etcopenssl
         readOnly: true
-      - mountPath: /etc/kubernetes/pki/kube-apiserver
-        name: pki
       - mountPath: /etc/kubernetes/cloud.config
         name: cloudconfig
         readOnly: true
@@ -145,10 +143,6 @@ contents: |
     - hostPath:
         path: /etc/openssl
       name: etcopenssl
-    - hostPath:
-        path: /etc/kubernetes/pki/kube-apiserver
-        type: DirectoryOrCreate
-      name: pki
     - hostPath:
         path: /etc/kubernetes/cloud.config
       name: cloudconfig

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-apiserver-arm64.yaml

@@ -98,8 +98,6 @@ contents: |
       - mountPath: /etc/openssl
         name: etcopenssl
         readOnly: true
-      - mountPath: /etc/kubernetes/pki/kube-apiserver
-        name: pki
       - mountPath: /etc/kubernetes/cloud.config
         name: cloudconfig
         readOnly: true
@@ -145,10 +143,6 @@ contents: |
     - hostPath:
         path: /etc/openssl
       name: etcopenssl
-    - hostPath:
-        path: /etc/kubernetes/pki/kube-apiserver
-        type: DirectoryOrCreate
-      name: pki
     - hostPath:
         path: /etc/kubernetes/cloud.config
       name: cloudconfig

nodeup/pkg/model/tests/golden/without-etcd-events/tasks-kube-apiserver.yaml

@@ -97,8 +97,6 @@ contents: |
       - mountPath: /etc/openssl
         name: etcopenssl
         readOnly: true
-      - mountPath: /etc/kubernetes/pki/kube-apiserver
-        name: pki
       - mountPath: /etc/kubernetes/cloud.config
         name: cloudconfig
         readOnly: true
@@ -144,10 +142,6 @@ contents: |
     - hostPath:
         path: /etc/openssl
       name: etcopenssl
-    - hostPath:
-        path: /etc/kubernetes/pki/kube-apiserver
-        type: DirectoryOrCreate
-      name: pki
     - hostPath:
         path: /etc/kubernetes/cloud.config
       name: cloudconfig

pkg/model/components/discovery.go

@@ -42,6 +42,8 @@ func (b *DiscoveryOptionsBuilder) BuildOptions(o interface{}) error {
 	}
 
 	if b.IsKubernetesLT("1.20") {
+		// TODO when dropping support for 1.19, remove the logic in nodeup's KubeAPIServerBuilder
+		// and apply_cluster for handling an empty ServiceAccountIssuer.
 		if clusterSpec.KubeAPIServer.FeatureGates == nil {
 			return nil
 		}

tests/integration/update_cluster/apiservernodes/cloudformation.json.extracted.yaml

@@ -163,7 +163,7 @@ Resources.AWSEC2LaunchTemplateapiserverapiserversminimalexamplecom.Properties.La
   ConfigBase: memfs://clusters.example.com/minimal.example.com
   InstanceGroupName: apiserver
   InstanceGroupRole: APIServer
-  NodeupConfigHash: UIF8A5ED1w9P2fRrndYHLCBGNaSVTRplgwToLmlmEms=
+  NodeupConfigHash: uyxw2QanaxrAyTUMA6EDpzkUiyyKtGgpHZrmzW9MF5Y=
 
   __EOF_KUBE_ENV
 
@@ -416,7 +416,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersminimalexamplecom.Properties.
   ConfigBase: memfs://clusters.example.com/minimal.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: iiiX7Yvik7SPQ07+PQGgYQJwTzRaaaOpwnet/rDo4Ww=
+  NodeupConfigHash: KBozjKWIT5RV02kzo6rSvQfYQ73jyPDSApqfyg9E1OE=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/aws-lb-controller/data/aws_launch_template_master-us-test-1a.masters.minimal.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/minimal.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: eTB2DBfNtMJN6u7mVWuc7LBvrNLKT1TZRHERRX43VLk=
+NodeupConfigHash: 3m0TihmabfHydii80nmac7Irnyfk+xv26p+62zf+H20=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/aws-lb-controller/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -229,6 +229,7 @@ KeypairIDs:
   etcd-peers-ca-events: "6982279353999767935825892873"
   etcd-peers-ca-main: "6982279353998887468930183660"
   kubernetes-ca: "6982820025135291416230495506"
+  service-account: "2"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/bastionadditional_user-data/data/aws_launch_template_master-us-test-1a.masters.bastionuserdata.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/bastionuserdata.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: uTtJ8axCo3osmPKeLJu7hPMDSjR5SgkoV4eKh3ts4iE=
+NodeupConfigHash: EP79BKlgvRMGBAm4LXU10tdowJNK8Dhy9plSYDjZMzQ=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/bastionadditional_user-data/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -229,6 +229,7 @@ KeypairIDs:
   etcd-peers-ca-events: "6982279353999767935825892873"
   etcd-peers-ca-main: "6982279353998887468930183660"
   kubernetes-ca: "6982820025135291416230495506"
+  service-account: "2"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/complex/cloudformation.json.extracted.yaml

@@ -260,7 +260,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscomplexexamplecom.Properties.
   ConfigBase: memfs://clusters.example.com/complex.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: vrjO+00Fqv07UAc6etTtZaOgUsYpoDmVCrf3IxEQrGA=
+  NodeupConfigHash: aR6/gCas//cB6aSxSoWWUgGfKbYTJjQiE5oSTZ6bs58=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/complex/data/aws_launch_template_master-us-test-1a.masters.complex.example.com_user_data

@@ -259,7 +259,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/complex.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: vrjO+00Fqv07UAc6etTtZaOgUsYpoDmVCrf3IxEQrGA=
+NodeupConfigHash: aR6/gCas//cB6aSxSoWWUgGfKbYTJjQiE5oSTZ6bs58=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/complex/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -235,6 +235,7 @@ KeypairIDs:
   etcd-peers-ca-events: "6982279353999767935825892873"
   etcd-peers-ca-main: "6982279353998887468930183660"
   kubernetes-ca: "6982820025135291416230495506"
+  service-account: "2"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/compress/data/aws_launch_template_master-us-test-1a.masters.compress.example.com_user_data

@@ -133,7 +133,7 @@ ensure-install-dir
 
 echo "H4sIAAAAAAAA/+xWTXPbNhC961dgppPJJSbFxE1bTg5V5LRWY6WslI9eIWBFoQIBZgFQVn99ZwFSH47VTKfHdjxjW7uLxe7btw8S2gY5tWat6nLEGN+5N6+X0+XsBlUHSCbGwPCVBlmyNdcORow13PAalt4ir2GquXPgSuYxwEhY47kygItgvGqgZAeLPDolJda2voMOdMmUWdsRYx2gU9aUrMius5cjacU2leC2qp0Z57nW/TVgBO5br6zpa2cmaD0CL+RUB+cBHR2EDox3qYtD9hfZdVa8iG0o87hvG1YwqWZLwB4ErrXdVag6paEmKGIVjHFjzb6xwU2C3xwB4q2aBKnACIi3XzHKiAY8uMx1IpOw5kH7FJqumdpgfMkKsgW/saj+5NTg3Eoo2UTv+N5NqIwRYytl5ERKBOdKNs7iz4ixOMwKbackYEnDHA3Tm8hGOeqx0qFWpq/qHW/AtVzAnVqD2AsN0XynGuUX3NSA8TMVqARMhKAao6kixJwH4z9aHRq44yvQ0XOTWjtlx6n9vdWAsbElCGtkcs6D516Z+lDmJ1htrN1G50eulbzsfmclLMB5VILSRtsCnA0o4LdgPScQvJAJ5r7zjfetK/O8eP5dhK8or8fj4jzy1w4QlRxGmCc2ffPo0ecjxlTDayjZ9nuX1QIzZXOa+hVvlUtE6orseREnRQ4NvkJYAyIMw3y/b4fbZsYDGq5nVfx4a503vEnzeXN/4juuEdWA8DmA8xvgEjDSBWSccsrK6xqh5t7iw9g39x75bfyXqlL3w5HfrxbQWA9XMeLq4bmf0YY2nXt4ILoexn9wVHoDjx8hLy08iIBQWfQlu75+ES2nFJw5F4jhwyh4qzLVA5YJ27QEZgb3vGk1kOGLDL98erv8sJj9gxS5bcEomXdF/sdu644Ze8GZVXFjSlaMx9nLa6JGHmXGpU14zcUWjCwjw5LETK3xaLUGnEdFPUiN4B6I1tPZzcIdxcZ7LjY3QL8XtDxCaVjujagAlZUlK5qxuyQDIlVJGVOJP7xMJRZHJxGFBPtR/EQU2oAwpfQLGzyJ/qB4F7gvDh1eNX2LxyXQiXga4t4mJT6xHfo+Z3hwcK5HUwQJxiuuB6jo6grt/b78auNtWCR2Rh/1uek3bdj+kj39ke/c08tNtvGqk75O6qWApdiADDqN90IOd4j5d/j0wlJefptETWvZv+/M7Z2HRh7sC2t9yfKvsOjm3fKE58X4xGPjqzp8zIjL+vAK3cAq1LUy9S03UtP6Dz1Al9T7lqMsWQONxX3GO640nXtVjMdz9cxYCWt3Zn4yGBX9dT8hwKtvnzyLKH8ROljPYv9+5IRnYn7FCcW845hrtcp7oPNjwBdMNeB3Frfpxe13yyhyWDPn7nMA5GnHz0WD4GytnHOj1uB8fzF4kR+/ReRN73WjhhPSb/8f/H9t8PSy1vQlDHuFoX6Hef8FAAD//wEAAP//MYvDU9kLAAA=" | base64 -d | gzip -d > conf/cluster_spec.yaml
 
-echo "H4sIAAAAAAAA/1TOzUrEMBQF4H2eIi/QaYdRBgJuHKk/tCVa8Gd5TW5rIekNuYktPr1UV90evnM4F0fZ6kjfk8WoJCwsLjQP03gLjEp69AOrsjQuc8LIB1zBB4cHQ7405ENE3oXiceYEs8H7SDl04LcR2LpF5iIhp+IIe/RCDpVs/5DoyGIO/xcegL+UvOvr9Wg0fGpIH9qH9vV9Of1Une2r8ent+XxuTld1SnjdVDfiFwAA//8BAAD//+NR7mLPAAAA" | base64 -d | gzip -d > conf/kube_env.yaml
+echo "H4sIAAAAAAAA/1TOzU7DMBAE4Lufwi+QplRCRZY4lBJ+JKhcDpXgtjjb1Io3a7w2yeOj0FOuo29Gsw9cWpv417eYjIZR1J6Hs+8eQNBoQjqLqWsXimRMssIJKAZcOabaMcWEsgjV6yAZBofPiUs8AM0jMHerIlVGydUNLNEHBzT6/R+pA7dY4vXCC8jF6NEfd4/r4w/feSsbuu3Xl21HZQent63tvzu7aZqn09eUP5t79QcAAP//AQAA//8UHNlZzwAAAA==" | base64 -d | gzip -d > conf/kube_env.yaml
 
 download-release
 echo "== nodeup node config done =="

tests/integration/update_cluster/compress/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -229,6 +229,7 @@ KeypairIDs:
   etcd-peers-ca-events: "6982279353999767935825892873"
   etcd-peers-ca-main: "6982279353998887468930183660"
   kubernetes-ca: "6982820025135291416230495506"
+  service-account: "2"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/containerd-custom/cloudformation.json.extracted.yaml

@@ -253,7 +253,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscontainerdexamplecom.Properti
   ConfigBase: memfs://clusters.example.com/containerd.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: AT7DYq7rR8a2Hsz6SojkkA9etLAjU+GB4AZbEXKxiEw=
+  NodeupConfigHash: D8ZatkSJhO0kShbDZ7xKtdA2xor1d6SK3a3Rfs3HhUA=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/containerd/cloudformation.json.extracted.yaml

@@ -245,7 +245,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscontainerdexamplecom.Properti
   ConfigBase: memfs://clusters.example.com/containerd.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: s4V7ws1HxBsVMPFxBfHA29vgDC/xrmTzpjuJ7dJx/f4=
+  NodeupConfigHash: kwu0YqIcc5eKz6NysUQ1Le8Fqt7PH4BplfJiklzvOCs=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/docker-custom/cloudformation.json.extracted.yaml

@@ -263,7 +263,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersdockerexamplecom.Properties.L
   ConfigBase: memfs://clusters.example.com/docker.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: uCB+we8vSi2ma1kTwMxs06dtg6q/GgBUeXEITs8/r0Q=
+  NodeupConfigHash: TfZGDw3iiaRxHwVY1pkcET3l4TWwrcyG7CCxWZjQDs0=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_iam/data/aws_launch_template_master-us-test-1a.masters.existing-iam.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://tests/existing-iam.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: 1Wlk2kMJPVyJ8K4Y1N/PkzEljHxuqfk+L5HR3d25nx0=
+NodeupConfigHash: DQR5kzzU7etNvPPGUfeut4+mAK89QMhd/403v9gm1Fk=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_iam/data/aws_launch_template_master-us-test-1b.masters.existing-iam.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://tests/existing-iam.example.com
 InstanceGroupName: master-us-test-1b
 InstanceGroupRole: Master
-NodeupConfigHash: 1Wlk2kMJPVyJ8K4Y1N/PkzEljHxuqfk+L5HR3d25nx0=
+NodeupConfigHash: DQR5kzzU7etNvPPGUfeut4+mAK89QMhd/403v9gm1Fk=
 
 __EOF_KUBE_ENV