kubeadm: etcd certs missing in self-hosted deploy

[andrewrynhard]

Is this a BUG REPORT or FEATURE REQUEST?:
/kind bug

What happened:
In #60385, certs for etcd get created but are not projected into the apiserver pod when StoreCertsInSecrets is set to true.

What you expected to happen:
The certs should be created as secrets when StoreCertsInSecrets is set to true, and then they should be projected in the apiserver.

How to reproduce it (as minimally and precisely as possible):
kubeadm init --feature-gates=SelfHosting=true,StoreCertsInSecrets=true

Anything else we need to know?:

Environment:

• Kubernetes version (use kubectl version):

$ kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"10+", GitVersion:"v1.10.0-beta.4", GitCommit:"a2dacb6f846e9d64d02c5dc5ab3972287d337405", GitTreeState:"clean", BuildDate:"2018-03-14T05:45:34Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}

• Cloud provider or hardware configuration:
• OS (e.g. from /etc/os-release):
• Kernel (e.g. uname -a):
• Install tools:
• Others:

/cc @stealthybox

[stealthybox]

/area etcd
/area kubeadm
/area security
/sig cluster-lifecycle

[stealthybox]

This bug was first introduced with #57415

[tpepper]

For the record, discussed on slack in #sig-cluster-lifecycle and @liggitt summarizes as "It is very late in 1.10 cycle to be adding things into the milestone… I wouldn't expect anything on an alpha feature to make the cut unless it was breaking CI in a way that lost signal on other non-alpha features." So, not expecting this in 1.10, but should fix in subsequent point release.

[timothysc]

/assign @stealthybox @detiber

[timothysc]

@stealthybox @detiber close?

[stealthybox]

@timothysc this is still a valid bug -- we haven't put more cycles toward it.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[stealthybox]

still valid:
/remove-lifecycle stale

[timothysc]

Closing here (WRT) StoreCertsInSecrets I have ideas on how to better approach this for to encrypt the secret on init and only give the shared secret on output of init.

Also self-hosting is going to remain as an unsupported feature due to the security implications around check pointing certain data.