Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds a mechanism in vSphere Cloud Provider to get credentials from Kubernetes secrets #63902

Merged
merged 7 commits into from May 18, 2018

Conversation

Projects
None yet
5 participants
@abrarshivani
Copy link
Member

abrarshivani commented May 16, 2018

What this PR does / why we need it:
Currently, vCenter credentials are stored in plain text in vsphere.conf. This PR adds a mechanism in vSphere Cloud Provider to get vCenter credentials from Kubernetes secrets.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:
Internally review here: vmware#484
Workflow:

  1. Create vsphere.conf file with secret-name and secret-namespace.

    [Global]
    insecure-flag = 1
    secret-name = "vcconf"
    secret-namespace = "kube-system"
    
    [VirtualCenter "10.160.45.119"]
    port = 443
    datacenters = k8s-dc-1
    
    [Workspace]
    server = 10.160.45.119
    datacenter = k8s-dc-1
    default-datastore = sharedVMFS-0
    folder = Discovered virtual machine
    
  2. Launch Kubernetes cluster with vSphere Cloud Provider Configured.

  3. Create secret with vCenter credentials.
    a. Create base64 encoding for username and password:
    username:

    	> echo -n 'admin' | base64
    	YWRtaW4= 
    

    password:

    	> echo -n 'vsphere' | base64
    	dnNwaGVyZQ==
    

    b. kubectl create -f vccredentials.yaml

    	#vccredentials.yaml
    	apiVersion: v1
    	kind: Secret
    	metadata:
    		name: vcconf
    	type: Opaque
    	data:
    		10.192.44.199.username: YWRtaW4=
    		10.192.44.199.password: dnNwaGVyZQ==
    
  4. vSphere Cloud Provider can be used now.

Note:
Secrets info can be provided with both (old and new) vSphere Cloud provider configuration formats.

Tests Done:

  • vSphere Cloud Provider unit test.
  • Volume lifecyle with Username and Password in vsphere.conf (for backward compability)
  • Volume lifecyle with secrets information in vsphere.conf.
  • Update secrets workflow

Release note:

Adds a mechanism in vSphere Cloud Provider to get credentials from Kubernetes secrets
@abrarshivani

This comment has been minimized.

Copy link
Member Author

abrarshivani commented May 16, 2018

//cc @kubernetes/vmware

@k8s-ci-robot k8s-ci-robot added size/XXL and removed size/XL labels May 16, 2018

@abrarshivani abrarshivani force-pushed the vmware:vcp_secrets branch 2 times, most recently from 6edf469 to e5e001c May 16, 2018

@abrarshivani

This comment has been minimized.

Copy link
Member Author

abrarshivani commented May 16, 2018

/retest

@abrarshivani abrarshivani force-pushed the vmware:vcp_secrets branch from e5e001c to 99076ce May 17, 2018

@abrarshivani

This comment has been minimized.

Copy link
Member Author

abrarshivani commented May 17, 2018

/retest

@divyenpatel

This comment has been minimized.

Copy link
Member

divyenpatel commented May 17, 2018

/lgtm

@k8s-ci-robot

This comment has been minimized.

Copy link
Contributor

k8s-ci-robot commented May 17, 2018

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abrarshivani, divyenpatel

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-github-robot

This comment has been minimized.

Copy link
Contributor

k8s-github-robot commented May 18, 2018

Automatic merge from submit-queue (batch tested with PRs 63969, 63902, 63689, 63973, 63978). If you want to cherry-pick this change to another branch, please follow the instructions here.

@k8s-github-robot k8s-github-robot merged commit 2d1f42e into kubernetes:master May 18, 2018

18 checks passed

Submit Queue Queued to run github e2e tests a second time.
Details
cla/linuxfoundation abrarshivani authorized
Details
pull-kubernetes-bazel-build Job succeeded.
Details
pull-kubernetes-bazel-test Job succeeded.
Details
pull-kubernetes-cross Skipped
pull-kubernetes-e2e-gce Job succeeded.
Details
pull-kubernetes-e2e-gce-100-performance Job succeeded.
Details
pull-kubernetes-e2e-gce-device-plugin-gpu Job succeeded.
Details
pull-kubernetes-e2e-gke Skipped
pull-kubernetes-e2e-kops-aws Job succeeded.
Details
pull-kubernetes-integration Job succeeded.
Details
pull-kubernetes-kubemark-e2e-gce Job succeeded.
Details
pull-kubernetes-kubemark-e2e-gce-big Job succeeded.
Details
pull-kubernetes-local-e2e Skipped
pull-kubernetes-local-e2e-containerized Skipped
pull-kubernetes-node-e2e Job succeeded.
Details
pull-kubernetes-typecheck Job succeeded.
Details
pull-kubernetes-verify Job succeeded.
Details
@dkirrane

This comment has been minimized.

Copy link

dkirrane commented Aug 2, 2018

Question is this available as part of K8s 1.10.3?

And can the Secret be Global i.e. not for specific VirtualCenter:

[Global]
insecure-flag = 1
secret-name = "vcconf"
secret-namespace = "kube-system"
	apiVersion: v1
	kind: Secret
	metadata:
		name: vcconf
	type: Opaque
	data:
		username: YWRtaW4=
		password: dnNwaGVyZQ==
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.