-
Notifications
You must be signed in to change notification settings - Fork 452
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: handle bootkube recover correctly, support recovery from etcd
Bootkube recover process (and `talosctl recover`) was actually regenerating assets each time `recover` runs forcing control plane to be at the state when cluster got created. This PR fixes that by running recover process correctly. Recovery via etcd was fixed to handle encrypted etcd data: it follows the way `apiserver` handles encryption at rest, and as at the moment AES CBC is the only supported encryption method, code simply follows the same path. Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
- Loading branch information
Showing
9 changed files
with
207 additions
and
80 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,112 @@ | ||
| // This Source Code Form is subject to the terms of the Mozilla Public | ||
| // License, v. 2.0. If a copy of the MPL was not distributed with this | ||
| // file, You can obtain one at http://mozilla.org/MPL/2.0/. | ||
|
|
||
| package main | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "context" | ||
| "crypto/aes" | ||
| "encoding/base64" | ||
| "errors" | ||
| "fmt" | ||
| "os" | ||
|
|
||
| "github.com/kubernetes-sigs/bootkube/pkg/recovery" | ||
| "go.etcd.io/etcd/clientv3" | ||
| k8saes "k8s.io/apiserver/pkg/storage/value/encrypt/aes" | ||
|
|
||
| "github.com/talos-systems/talos/internal/pkg/etcd" | ||
| machineapi "github.com/talos-systems/talos/pkg/machinery/api/machine" | ||
| "github.com/talos-systems/talos/pkg/machinery/config" | ||
| "github.com/talos-systems/talos/pkg/machinery/constants" | ||
| ) | ||
|
|
||
| //nolint: gocyclo | ||
| func recoverAssets(config config.Provider) error { | ||
| // Ensure assets directory does not exist / is left over from a failed install | ||
| if err := os.RemoveAll(constants.AssetsDirectory); err != nil { | ||
| // Ignore if the directory does not exist | ||
| if !errors.Is(err, os.ErrNotExist) { | ||
| return err | ||
| } | ||
| } | ||
|
|
||
| var ( | ||
| backend recovery.Backend | ||
| err error | ||
| ) | ||
|
|
||
| switch *recoverSource { | ||
| case machineapi.RecoverRequest_ETCD.String(): | ||
| var client *clientv3.Client | ||
|
|
||
| client, err = etcd.NewClient([]string{"127.0.0.1:2379"}) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| var transform recovery.TransformerFromStorage | ||
|
|
||
| transform, err = aesTransformer(config.Cluster()) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| backend = recovery.NewEtcdBackendWithTransformer(client, "/registry", transform) | ||
| case machineapi.RecoverRequest_APISERVER.String(): | ||
| backend, err = recovery.NewAPIServerBackend(constants.RecoveryKubeconfig) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| } | ||
|
|
||
| as, err := recovery.Recover(context.Background(), backend, constants.RecoveryKubeconfig) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if err = os.MkdirAll(constants.AssetsDirectory, 0o600); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if err = as.WriteFiles(constants.AssetsDirectory); err != nil { | ||
| return fmt.Errorf("failed to write recovered assets: %w", err) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func aesTransformer(clusterConfig config.ClusterConfig) (recovery.TransformerFromStorage, error) { | ||
| key, err := base64.StdEncoding.DecodeString(clusterConfig.AESCBCEncryptionSecret()) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| cipher, err := aes.NewCipher(key) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| transformer := k8saes.NewCBCTransformer(cipher) | ||
|
|
||
| return func(value []byte) ([]byte, error) { | ||
| const ( | ||
| aesCBCTransformerPrefixV1 = "k8s:enc:aescbc:v1:" | ||
| aesCBCKeyName = "key1:" | ||
|
|
||
| aesCBCPrefix = aesCBCTransformerPrefixV1 + aesCBCKeyName | ||
| ) | ||
|
|
||
| if !bytes.HasPrefix(value, []byte(aesCBCPrefix)) { | ||
| return value, nil | ||
| } | ||
|
|
||
| value = value[len(aesCBCPrefix):] | ||
|
|
||
| value, _, e := transformer.TransformFromStorage(value, nil) | ||
|
|
||
| return value, e | ||
| }, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.