service_account: Use go code to generate service account key pairs - #89
Merged
Merged
Conversation
openshift-ci-robot
added
approved
openshift-bot
added
the
needs-rebase
yifan-gu
force-pushed
the
svc_account_tls
branch
2 times, most recently
from
July 31, 2018 22:26
4770ce1 to
4886457
Compare
openshift-bot
removed
the
needs-rebase
yifan-gu
removed
the
approved
yifan-gu
force-pushed
the
svc_account_tls
branch
from
July 31, 2018 22:28
4886457 to
d42b1ae
Compare
openshift-ci-robot
added
the
approved
Contributor
Author
|
/retest |
Member
|
Is the move from Terraform to Go just to make it easier for callers to provide their own keys? |
Contributor
Author
|
@wking Yeah, it will be easier, so the goal is not to use terraform for any assets generation. |
Contributor
Author
|
/retest |
yifan-gu
force-pushed
the
svc_account_tls
branch
from
August 1, 2018 00:09
d42b1ae to
7b70a7e
Compare
Contributor
Author
|
Looks like the cluster can't bootup now, debugging. |
yifan-gu
force-pushed
the
svc_account_tls
branch
from
August 1, 2018 23:26
7b70a7e to
d44202b
Compare
Contributor
core@adahiya-0-master-0 /opt/tectonic/tls $ cat service-account.pub
-----BEGIN PUBLIC KEY-----
MIIBCgKCAQEA4LlFhUglModjo2ck78s1qEimYLgQOiE88mzUOfw7ajEcTR/zhzhD
Dd6EGOUNHDHyPyedhaIrL4zUkB25hk61mbxEnnzi/44UiLyFJHa4gqWc//BPyhrD
J54CXZWPdpdgOLfdjDb/3Vdv5V2/y6tO9AtPgqVB8DxAArv8vHb7bZrpjx8cOHfV
WNE5Y8Wa+IVVAtfwfgGkApdKXPEp9FUpPC/tERddwZ/fXvI0+Mogy+z40saHAhKZ
HAMWOU/ePe16b0xUKeXHlG9JZ3or++wFPlmATVa3WaYdHL9K6aJL0MWZ32u33lHE
+eRR77TxO+nVI2yHAcXTFWcVgvE2WoRW4QIDAQAB
-----END PUBLIC KEY-----
core@adahiya-0-master-0 /opt/tectonic/tls $ openssl rsa -in service-account.key -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4LlFhUglModjo2ck78s1
qEimYLgQOiE88mzUOfw7ajEcTR/zhzhDDd6EGOUNHDHyPyedhaIrL4zUkB25hk61
mbxEnnzi/44UiLyFJHa4gqWc//BPyhrDJ54CXZWPdpdgOLfdjDb/3Vdv5V2/y6tO
9AtPgqVB8DxAArv8vHb7bZrpjx8cOHfVWNE5Y8Wa+IVVAtfwfgGkApdKXPEp9FUp
PC/tERddwZ/fXvI0+Mogy+z40saHAhKZHAMWOU/ePe16b0xUKeXHlG9JZ3or++wF
PlmATVa3WaYdHL9K6aJL0MWZ32u33lHE+eRR77TxO+nVI2yHAcXTFWcVgvE2WoRW
4QIDAQAB
-----END PUBLIC KEY-----
core@adahiya-0-master-0 /opt/tectonic/tls $The generated public key doesn't match the actual public key as shown by openssl. |
Previously, the service account key pairs are generated by terraform in the bootkube module. This PR replace the generation using go code. Also cleaned up some of the tls and ignition terraform files.
yifan-gu
force-pushed
the
svc_account_tls
branch
from
August 2, 2018 02:52
d44202b to
263d7ad
Compare
Contributor
Author
|
@abhinavdahiya Looks like I need to use |
wking
reviewed
Aug 2, 2018
Member
There was a problem hiding this comment.
There are a few other occurrences of eu-west-1:
$ git grep eu-west origin/pr/89
origin/pr/89:examples/tectonic.aws.yaml: # `{ eu-west-1a = "10.0.0.0/20", eu-west-1b = "10.0.16.0/20" }`
origin/pr/89:examples/tectonic.aws.yaml: region: eu-west-1
origin/pr/89:examples/tectonic.aws.yaml: # Example: `{ eu-west-1a = "10.0.64.0/20", eu-west-1b = "10.0.80.0/20" }`
origin/pr/89:installer/pkg/config-generator/fixtures/test-aws.yaml: region: eu-west-1
origin/pr/89:installer/pkg/config/aws/aws.go: DefaultRegion = "eu-west-1"
origin/pr/89:installer/pkg/workflow/fixtures/terraform.tfvars: "tectonic_aws_region": "eu-west-1",
origin/pr/89:steps/variables-aws.tf:`{ eu-west-1a = "10.0.0.0/20", eu-west-1b = "10.0.16.0/20" }`
origin/pr/89:steps/variables-aws.tf:Example: `{ eu-west-1a = "10.0.64.0/20", eu-west-1b = "10.0.80.0/20" }`
origin/pr/89:tests/jenkins-jobs/maintenance/tag_clean_aws_grafiti_job.groovy: "ap-northeast-1" "eu-central-1" "eu-west-1" "eu-west-2" "sa-east-1" )You may want to update at least the the installer/ instances as well to stay consistent.
yifan-gu
force-pushed
the
svc_account_tls
branch
from
August 2, 2018 20:25
9db4d6c to
263d7ad
Compare
Contributor
Author
|
ok to test |
Contributor
|
/lgtm |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: abhinavdahiya, yifan-gu The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
stbenjam
pushed a commit
to stbenjam/installer
that referenced
this pull request
Feb 10, 2021
Bug 1866901: Don't do rolling updates of metal3 Deployment
clnperez
added a commit
to clnperez/installer
that referenced
this pull request
Dec 13, 2021
manual upstream sync
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, the service account key pairs are generated by terraform in the bootkube module.