Add kubeadm alpha certs certificate-key command #77848

yagonobre · 2019-05-14T04:46:11Z

What type of PR is this?
/kind feature

What this PR does / why we need it:
Add kubeadm certificate-key command to generate secure random key to use on kubeadm init --experimental-upload-certs

Which issue(s) this PR fixes:
Does this PR introduce a user-facing change?:

Add `kubeadm alpha certs certificate-key` command to generate secure random key to use on `kubeadm init --experimental-upload-certs`

/priority important-longterm

yagonobre · 2019-05-14T14:22:43Z

/assign @neolit123 @fabriziopandini

neolit123 · 2019-05-14T15:28:07Z

cmd/kubeadm/app/cmd/certificatekey.go

+// NewCmdCertificateKey returns cobra.Command for certificate key generate
+func NewCmdCertificateKey() *cobra.Command {
+	return &cobra.Command{
+		Use:   "certificate-key",


hm, i wonder if we should just use the init phase for this.
adding a top level command would be fine if has more than one sub commands and multiple flags, but right now it would only serve this single purpose.

on the other hand we already have kubeadm token which covers existing functionality in init.

we also have the option here to have kubeadm certificate-key do multiple things:

only generate key

upload the certs & generate key (duplicates what the init phase does)

also, a problem related to UX that i've been seeing is that users want the new full join command when generating a new cert-key.

so they use token ... --print-join-command and combine it with the new cert key manually.

there are no good solutions for this unless we have a command that generates both a new bootstrap token + hash + cert key.

this command just generate a certificate-key, so user can only use it on init and init print the join command, we can print the init command but token generate just print the token.

due that the certificate-key can't be manually generate on a easy way, it would be nice to have a command for it, but I agree that a top level command only for this seems weird.

I agree with @neolit123 . My idea is that this is an utility for certificates and should go with the rest of the certs commands. Probably adding it under kubeadm alpha certs is a good idea.
@fabriziopandini @yagonobre @neolit123 WDYT?

+1 to move to kubeadm alpha certs

yagonobre · 2019-05-27T00:46:20Z

@neolit123 @rosti updated!

neolit123

@yagonobre one minor comment about date but LGTM.
/approve

neolit123 · 2019-05-27T12:57:46Z

cmd/kubeadm/app/cmd/alpha/certs.go

@@ -1,5 +1,5 @@
 /*
-Copyright 2018 The Kubernetes Authors.
+Copyright 2019 The Kubernetes Authors.


apparently, the project does not change dates of old source files.
2018 should be kept here.

k8s-ci-robot · 2019-05-27T13:00:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: neolit123, yagonobre

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~cmd/kubeadm/OWNERS~~ [neolit123]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rosti

Thanks @yagonobre !
Given that this is an alpha command ATM, it's late in the cycle and it's simple enough, I think that it's OK to merge it as is (although it needs a simple test case and some UX polishing upon graduation).
/lgtm
/hold
for the release note to be reflecting kubeadm alpha certs certificate-key instead of kubeadm certificate-key.

rosti · 2019-05-27T15:50:12Z

Thanks @yagonobre !
/hold cancel

rosti · 2019-05-27T15:50:22Z

/test pull-kubernetes-kubemark-e2e-gce-big

neolit123 · 2019-05-27T17:04:04Z

/retest

neolit123 · 2019-05-27T18:35:24Z

/retest

yagonobre · 2019-05-27T19:41:36Z

/test pull-kubernetes-kubemark-e2e-gce-big

neolit123 · 2019-05-27T20:31:36Z

/retest

neolit123 · 2019-05-27T22:37:46Z

/retest

fejta-bot · 2019-05-28T01:26:35Z

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

fejta-bot · 2019-05-28T04:56:36Z

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

fejta-bot · 2019-05-28T09:08:40Z

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

k8s-ci-robot requested review from liztio and luxas May 14, 2019 04:46

k8s-ci-robot added area/kubeadm sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels May 14, 2019

k8s-ci-robot assigned fabriziopandini and neolit123 May 14, 2019

neolit123 reviewed May 14, 2019

View reviewed changes

yagonobre force-pushed the certificate-key-command branch from d2864b6 to 81c4b37 Compare May 27, 2019 00:31

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 27, 2019

yagonobre force-pushed the certificate-key-command branch 2 times, most recently from f746458 to b6e6b46 Compare May 27, 2019 00:45

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 27, 2019

neolit123 reviewed May 27, 2019

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 27, 2019

Add kubeadm certificate-key command

0a005e3

yagonobre force-pushed the certificate-key-command branch from b6e6b46 to 0a005e3 Compare May 27, 2019 14:29

yagonobre changed the title ~~Add kubeadm certificate-key command~~ Add kubeadm alpha phase certs certificate-key command May 27, 2019

rosti approved these changes May 27, 2019

View reviewed changes

k8s-ci-robot assigned rosti May 27, 2019

k8s-ci-robot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm "Looks good to me", indicates that a PR is ready to be merged. labels May 27, 2019

yagonobre changed the title ~~Add kubeadm alpha phase certs certificate-key command~~ Add kubeadm alpha certs certificate-key command May 27, 2019

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 27, 2019

k8s-ci-robot merged commit 6118b8a into kubernetes:master May 29, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add kubeadm alpha certs certificate-key command #77848

Add kubeadm alpha certs certificate-key command #77848

yagonobre commented May 14, 2019 •

edited

yagonobre commented May 14, 2019

neolit123 May 14, 2019

neolit123 May 14, 2019

yagonobre May 14, 2019

yagonobre May 14, 2019

rosti May 22, 2019

yagonobre May 22, 2019

neolit123 May 25, 2019

yagonobre commented May 27, 2019

neolit123 left a comment

neolit123 May 27, 2019

yagonobre May 27, 2019

yagonobre May 27, 2019

k8s-ci-robot commented May 27, 2019

rosti left a comment

rosti commented May 27, 2019

rosti commented May 27, 2019

neolit123 commented May 27, 2019

neolit123 commented May 27, 2019

yagonobre commented May 27, 2019

neolit123 commented May 27, 2019

neolit123 commented May 27, 2019

fejta-bot commented May 28, 2019

fejta-bot commented May 28, 2019

fejta-bot commented May 28, 2019

Add kubeadm alpha certs certificate-key command #77848

Add kubeadm alpha certs certificate-key command #77848

Conversation

yagonobre commented May 14, 2019 • edited

yagonobre commented May 14, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yagonobre commented May 27, 2019

neolit123 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented May 27, 2019

rosti left a comment

Choose a reason for hiding this comment

rosti commented May 27, 2019

rosti commented May 27, 2019

neolit123 commented May 27, 2019

neolit123 commented May 27, 2019

yagonobre commented May 27, 2019

neolit123 commented May 27, 2019

neolit123 commented May 27, 2019

fejta-bot commented May 28, 2019

fejta-bot commented May 28, 2019

fejta-bot commented May 28, 2019

yagonobre commented May 14, 2019 •

edited