Allows additional Subject Alternate Names

pkg/apis/kops/cluster.go

@@ -87,6 +87,8 @@ type ClusterSpec struct {
 	// Note that DNSZone can either by the host name of the zone (containing dots),
 	// or can be an identifier for the zone.
 	DNSZone string `json:"dnsZone,omitempty"`
+	// AdditionalSANs adds additional Subject Alternate Names to apiserver cert that kops generates
+	AdditionalSANs []string `json:"additionalSans,omitempty"`
 	// ClusterDNSDomain is the suffix we use for internal DNS names (normally cluster.local)
 	ClusterDNSDomain string `json:"clusterDNSDomain,omitempty"`
 	// ServiceClusterIPRange is the CIDR, from the internal network, where we allocate IPs for services

pkg/apis/kops/v1alpha1/cluster.go

@@ -86,6 +86,8 @@ type ClusterSpec struct {
 	// Note that DNSZone can either by the host name of the zone (containing dots),
 	// or can be an identifier for the zone.
 	DNSZone string `json:"dnsZone,omitempty"`
+	// AdditionalSANs adds additional Subject Alternate Names to apiserver cert that kops generates
+	AdditionalSANs []string `json:"additionalSans,omitempty"`
 	// ClusterDNSDomain is the suffix we use for internal DNS names (normally cluster.local)
 	ClusterDNSDomain string `json:"clusterDNSDomain,omitempty"`
 	// ClusterName is a unique identifier for the cluster, and currently must be a DNS name

pkg/apis/kops/v1alpha1/zz_generated.conversion.go

@@ -587,6 +587,7 @@ func autoConvert_v1alpha1_ClusterSpec_To_kops_ClusterSpec(in *ClusterSpec, out *
 	out.Project = in.Project
 	out.MasterPublicName = in.MasterPublicName
 	out.MasterInternalName = in.MasterInternalName
+	out.AdditionalSANs = in.AdditionalSANs
 	out.NetworkCIDR = in.NetworkCIDR
 	out.NetworkID = in.NetworkID
 	if in.Topology != nil {
@@ -821,6 +822,7 @@ func autoConvert_kops_ClusterSpec_To_v1alpha1_ClusterSpec(in *kops.ClusterSpec,
 	out.Project = in.Project
 	out.MasterPublicName = in.MasterPublicName
 	out.MasterInternalName = in.MasterInternalName
+	out.AdditionalSANs = in.AdditionalSANs
 	out.NetworkCIDR = in.NetworkCIDR
 	out.NetworkID = in.NetworkID
 	if in.Topology != nil {

pkg/apis/kops/v1alpha2/cluster.go

@@ -84,6 +84,8 @@ type ClusterSpec struct {
 	// Note that DNSZone can either by the host name of the zone (containing dots),
 	// or can be an identifier for the zone.
 	DNSZone string `json:"dnsZone,omitempty"`
+	// AdditionalSANs adds additional Subject Alternate Names to apiserver cert that kops generates
+	AdditionalSANs []string `json:"additionalSans,omitempty"`
 	// ClusterDNSDomain is the suffix we use for internal DNS names (normally cluster.local)
 	ClusterDNSDomain string `json:"clusterDNSDomain,omitempty"`
 	// ServiceClusterIPRange is the CIDR, from the internal network, where we allocate IPs for services

pkg/apis/kops/v1alpha2/zz_generated.conversion.go

@@ -633,6 +633,7 @@ func autoConvert_v1alpha2_ClusterSpec_To_kops_ClusterSpec(in *ClusterSpec, out *
 	out.Project = in.Project
 	out.MasterPublicName = in.MasterPublicName
 	out.MasterInternalName = in.MasterInternalName
+	out.AdditionalSANs = in.AdditionalSANs
 	out.NetworkCIDR = in.NetworkCIDR
 	out.NetworkID = in.NetworkID
 	if in.Topology != nil {
@@ -883,6 +884,7 @@ func autoConvert_kops_ClusterSpec_To_v1alpha2_ClusterSpec(in *kops.ClusterSpec,
 	out.Project = in.Project
 	out.MasterPublicName = in.MasterPublicName
 	out.MasterInternalName = in.MasterInternalName
+	out.AdditionalSANs = in.AdditionalSANs
 	out.NetworkCIDR = in.NetworkCIDR
 	out.NetworkID = in.NetworkID
 	if in.Topology != nil {

pkg/model/pki.go

@@ -207,6 +207,7 @@ func (b *PKIModelBuilder) Build(c *fi.ModelBuilderContext) error {
 		// Names specified in the cluster spec
 		alternateNames = append(alternateNames, b.Cluster.Spec.MasterPublicName)
 		alternateNames = append(alternateNames, b.Cluster.Spec.MasterInternalName)
+		alternateNames = append(alternateNames, b.Cluster.Spec.AdditionalSANs...)
 
 		// Referencing it by internal IP should work also
 		{

tests/integration/conversion/minimal/v1alpha0.yaml

@@ -3,6 +3,8 @@ metadata:
   creationTimestamp: 2016-12-10T22:42:27Z
   name: minimal.example.com
 spec:
+  additionalSans:
+  - proxy.api.minimal.example.com
   adminAccess:
   - 0.0.0.0/0
   channel: stable

tests/integration/conversion/minimal/v1alpha1.yaml

@@ -4,6 +4,8 @@ metadata:
   creationTimestamp: 2016-12-10T22:42:27Z
   name: minimal.example.com
 spec:
+  additionalSans:
+  - proxy.api.minimal.example.com
   adminAccess:
   - 0.0.0.0/0
   api:

tests/integration/conversion/minimal/v1alpha2.yaml

@@ -4,6 +4,8 @@ metadata:
   creationTimestamp: 2016-12-10T22:42:27Z
   name: minimal.example.com
 spec:
+  additionalSans:
+  - proxy.api.minimal.example.com
   api:
     dns: {}
   authorization:

upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/cluster.yaml

@@ -21,6 +21,8 @@ spec:
   kubernetesVersion: v1.4.6
   masterInternalName: api.internal.minimal.example.com
   masterPublicName: api.minimal.example.com
+  additionalSans:
+  - proxy.api.minimal.example.com
   networkCIDR: 172.20.0.0/16
   networking:
     kopeio: {}

upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/cluster.yaml

@@ -21,6 +21,8 @@ spec:
   kubernetesVersion: v1.4.6
   masterInternalName: api.internal.minimal.example.com
   masterPublicName: api.minimal.example.com
+  additionalSans:
+  - proxy.api.minimal.example.com
   networkCIDR: 172.20.0.0/16
   networking:
     kubenet: {}