Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix local-cluster-up on Mac and discovery on all systems #38389

Merged
merged 3 commits into from Dec 8, 2016
Merged

Fix local-cluster-up on Mac and discovery on all systems #38389

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8fefc4f
Do not use cfssl in Docker, but directly
sttts Dec 8, 2016
cdc2d4c
Fix startup of discovery server
sttts Dec 8, 2016
983fc20
Be more defensive during kubernetes discovery server start
xilabao Dec 8, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
33 changes: 27 additions & 6 deletions hack/local-up-cluster.sh
View file
Open in desktop
Expand Up @@ -147,6 +147,14 @@ function test_docker {
fi
}

function test_cfssl_installed {
if ! command -v cfssl &>/dev/null || ! command -v cfssljson &>/dev/null; then
echo "Failed to successfully run 'cfssl', please verify that cfssl and cfssljson are in \$PATH."
echo "Hint: export PATH=\$PATH:\$GOPATH/bin; go get -u github.com/cloudflare/cfssl/cmd/..."
exit 1
fi
}

function test_rkt {
if [[ -n "${RKT_PATH}" ]]; then
${RKT_PATH} list 2> /dev/null 1> /dev/null
Expand Down Expand Up @@ -359,11 +367,12 @@ function create_client_certkey {
SEP=","
shift 1
done
echo "{\"CN\":\"${CN}\",\"names\":[${NAMES}],\"hosts\":[\"\"],\"key\":{\"algo\":\"rsa\",\"size\":2048}}" | docker run -i --entrypoint /bin/bash -v "${CERT_DIR}:/certs" -w /certs cfssl/cfssl:latest -ec "cfssl gencert -ca=${CA}.crt -ca-key=${CA}.key -config=client-ca-config.json - | cfssljson -bare client-${ID}"
${CONTROLPLANE_SUDO} /bin/bash -e <<EOF
mv "${CERT_DIR}/client-${ID}-key.pem" "${CERT_DIR}/client-${ID}.key"
mv "${CERT_DIR}/client-${ID}.pem" "${CERT_DIR}/client-${ID}.crt"
rm -f "${CERT_DIR}/client-${ID}.csr"
cd ${CERT_DIR}
echo '{"CN":"${CN}","names":[${NAMES}],"hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -ca=${CA}.crt -ca-key=${CA}.key -config=client-ca-config.json - | cfssljson -bare client-${ID}
mv "client-${ID}-key.pem" "client-${ID}.key"
mv "client-${ID}.pem" "client-${ID}.crt"
rm -f "client-${ID}.csr"
EOF
}

Expand Down Expand Up @@ -514,12 +523,22 @@ function start_discovery {
write_client_kubeconfig discovery-auth

# grant permission to run delegated authentication and authorization checks
kubectl create clusterrolebinding discovery:system:auth-delegator --clusterrole=system:auth-delegator --user=system:discovery-auth
if [[ "${ENABLE_RBAC}" = true ]]; then
${KUBECTL} ${AUTH_ARGS} create clusterrolebinding discovery:system:auth-delegator --clusterrole=system:auth-delegator --user=system:discovery-auth
fi

curl --silent -k -g $API_HOST:$DISCOVERY_SECURE_PORT
if [ ! $? -eq 0 ]; then
echo "Kubernetes Discovery secure port is free, proceeding..."
else
echo "ERROR starting Kubernetes Discovery, exiting. Some process on $API_HOST is serving already on $DISCOVERY_SECURE_PORT"
return
fi

DISCOVERY_SERVER_LOG=/tmp/kubernetes-discovery.log
${CONTROLPLANE_SUDO} "${GO_OUT}/kubernetes-discovery" \
--cert-dir="${CERT_DIR}" \
--client-ca-file="${CERT_DIR}/client-ca-bundle.crt" \
--client-ca-file="${CERT_DIR}/client-ca.crt" \
--authentication-kubeconfig="${CERT_DIR}/discovery-auth.kubeconfig" \
--authorization-kubeconfig="${CERT_DIR}/discovery-auth.kubeconfig" \
--requestheader-username-headers=X-Remote-User \
Expand Down Expand Up @@ -749,6 +768,7 @@ Logs:
${CTLRMGR_LOG:-}
${PROXY_LOG:-}
${SCHEDULER_LOG:-}
${DISCOVERY_SERVER_LOG:-}
EOF
fi

Expand Down Expand Up @@ -796,6 +816,7 @@ if [[ "${START_MODE}" != "kubeletonly" ]]; then
fi

test_openssl_installed
test_cfssl_installed

### IF the user didn't supply an output/ for the build... Then we detect.
if [ "$GO_OUT" == "" ]; then
Expand Down