Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

kubelet: wipe/renew self-signed serving certificate #7235

Closed
smira opened this issue May 17, 2023 · 1 comment · Fixed by #7241
Closed

kubelet: wipe/renew self-signed serving certificate #7235

smira opened this issue May 17, 2023 · 1 comment · Fixed by #7241
Assignees
@smira

Comments

@smira
Copy link
Member

smira commented May 17, 2023

When kubelet is configured to use self-signed serving certificate, it issues one for itself, but never renews it automaitcally.

Talos needs to handle this case.
@smira smira self-assigned this May 17, 2023
@frezbo
Copy link
Member

frezbo commented May 17, 2023

Yesterday I learned this is why many set rotate-server-certificates: true for kubelet

@smira smira mentioned this issue May 18, 2023
Merged
ro11net added a commit to ro11net/talos that referenced this issue May 18, 2023
@ro11net
feat: create azure community gallery image version on release
ff50496 
Create Azure Community Gallery Image Version on release:
- Add /hack/cloud-image-uploader/azure.go
	- Upload vhd file to container for all architectures
	- Create managed disk from vhd file for all architectures
	- Create image version from managed disk for all architectures
- Modify /hack/cloud-image-uploader/main.go
	- Start Community Gallery processes concurently with AWS upload
- Modify /hack/cloud-image-uploader/options.go
	- Add additional Options for Community Gallery processes
- Modify .drone.jsonnet to use secrets for environment variables
	- The following secrets need to be created for this to work:
		- azure_subscription_id
		- azure_client_id
		- azure_client_secret
		- azure_tenant_id

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

chore: some refactorings

Refactor the code.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

chore: document azure pre reqs

Add pre-requisite documentation for resources which must be existing in Azure

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

chore: bump deps

- github.com/containerd/typeurl to v2.1.1
- github.com/aws/aws-sdk-go to v1.44.264
- alpine to 3.18.0
- node to 20.2.0-alpine
- github.com/containernetworking/plugins to v1.3.0
- github.com/docker/docker to v23.0.6+incompatible
- github.com/hetznercloud/hcloud-go to v1.45.1
- github.com/insomniacslk/dhcp to v0.0.0-20230516061539-49801966e6cb
- github.com/rivo/tview to v0.0.0-20230511053024-822bd067b165
- tools to v1.5.0-alpha.0-7-gd2dde48
- pkgs to v1.5.0-alpha.0-16-g7958db1

Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>

chore: drop deprecated stuff for Talos 1.5

* drop old resources API, which was deprecated long time ago
* use bootstrapped event in `talosctl get --watch` to better align
  columns in the table output

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

fix: refresh kubelet self-issued serving certificates

Kubelet doesn't refresh self-issued serving certificates, so force it by
removing the cert on each restart.

Fix the code which was forcing rejoin when the nodename changes, it was
broken, as it was checking serving certificate instead of client
certificate. It worked by accident when not using controlplane-issued
serving certificates.

Fixes siderolabs#7235

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
ro11net added a commit to ro11net/talos that referenced this issue May 18, 2023
@ro11net
feat: create azure community gallery image version on release
20e41da 
Create Azure Community Gallery Image Version on release:
- Add /hack/cloud-image-uploader/azure.go
	- Upload vhd file to container for all architectures
	- Create managed disk from vhd file for all architectures
	- Create image version from managed disk for all architectures
- Modify /hack/cloud-image-uploader/main.go
	- Start Community Gallery processes concurently with AWS upload
- Modify /hack/cloud-image-uploader/options.go
	- Add additional Options for Community Gallery processes
- Modify .drone.jsonnet to use secrets for environment variables
	- The following secrets need to be created for this to work:
		- azure_subscription_id
		- azure_client_id
		- azure_client_secret
		- azure_tenant_id

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

chore: some refactorings

Refactor the code.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

chore: document azure pre reqs

Add pre-requisite documentation for resources which must be existing in Azure

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

feat: create azure community gallery image version on release

Create Azure Community Gallery Image Version on release:
- Add /hack/cloud-image-uploader/azure.go
	- Upload vhd file to container for all architectures
	- Create managed disk from vhd file for all architectures
	- Create image version from managed disk for all architectures
- Modify /hack/cloud-image-uploader/main.go
	- Start Community Gallery processes concurently with AWS upload
- Modify /hack/cloud-image-uploader/options.go
	- Add additional Options for Community Gallery processes
- Modify .drone.jsonnet to use secrets for environment variables
	- The following secrets need to be created for this to work:
		- azure_subscription_id
		- azure_client_id
		- azure_client_secret
		- azure_tenant_id

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

chore: some refactorings

Refactor the code.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

chore: document azure pre reqs

Add pre-requisite documentation for resources which must be existing in Azure

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

chore: bump deps

- github.com/containerd/typeurl to v2.1.1
- github.com/aws/aws-sdk-go to v1.44.264
- alpine to 3.18.0
- node to 20.2.0-alpine
- github.com/containernetworking/plugins to v1.3.0
- github.com/docker/docker to v23.0.6+incompatible
- github.com/hetznercloud/hcloud-go to v1.45.1
- github.com/insomniacslk/dhcp to v0.0.0-20230516061539-49801966e6cb
- github.com/rivo/tview to v0.0.0-20230511053024-822bd067b165
- tools to v1.5.0-alpha.0-7-gd2dde48
- pkgs to v1.5.0-alpha.0-16-g7958db1

Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>

chore: drop deprecated stuff for Talos 1.5

* drop old resources API, which was deprecated long time ago
* use bootstrapped event in `talosctl get --watch` to better align
  columns in the table output

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

fix: refresh kubelet self-issued serving certificates

Kubelet doesn't refresh self-issued serving certificates, so force it by
removing the cert on each restart.

Fix the code which was forcing rejoin when the nodename changes, it was
broken, as it was checking serving certificate instead of client
certificate. It worked by accident when not using controlplane-issued
serving certificates.

Fixes siderolabs#7235

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
ro11net added a commit to ro11net/talos that referenced this issue May 18, 2023
@ro11net
feat: create azure community gallery image version on release
5662f44 
Create Azure Community Gallery Image Version on release:
- Add /hack/cloud-image-uploader/azure.go
	- Upload vhd file to container for all architectures
	- Create managed disk from vhd file for all architectures
	- Create image version from managed disk for all architectures
- Modify /hack/cloud-image-uploader/main.go
	- Start Community Gallery processes concurently with AWS upload
- Modify /hack/cloud-image-uploader/options.go
	- Add additional Options for Community Gallery processes
- Modify .drone.jsonnet to use secrets for environment variables
	- The following secrets need to be created for this to work:
		- azure_subscription_id
		- azure_client_id
		- azure_client_secret
		- azure_tenant_id

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

chore: some refactorings

Refactor the code.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

chore: document azure pre reqs

Add pre-requisite documentation for resources which must be existing in Azure

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

feat: create azure community gallery image version on release

Create Azure Community Gallery Image Version on release:
- Add /hack/cloud-image-uploader/azure.go
	- Upload vhd file to container for all architectures
	- Create managed disk from vhd file for all architectures
	- Create image version from managed disk for all architectures
- Modify /hack/cloud-image-uploader/main.go
	- Start Community Gallery processes concurently with AWS upload
- Modify /hack/cloud-image-uploader/options.go
	- Add additional Options for Community Gallery processes
- Modify .drone.jsonnet to use secrets for environment variables
	- The following secrets need to be created for this to work:
		- azure_subscription_id
		- azure_client_id
		- azure_client_secret
		- azure_tenant_id

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

chore: some refactorings

Refactor the code.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

chore: document azure pre reqs

Add pre-requisite documentation for resources which must be existing in Azure

Signed-off-by: Christian Rolland <christian.rolland@siderolabs.com>

chore: bump deps

- github.com/containerd/typeurl to v2.1.1
- github.com/aws/aws-sdk-go to v1.44.264
- alpine to 3.18.0
- node to 20.2.0-alpine
- github.com/containernetworking/plugins to v1.3.0
- github.com/docker/docker to v23.0.6+incompatible
- github.com/hetznercloud/hcloud-go to v1.45.1
- github.com/insomniacslk/dhcp to v0.0.0-20230516061539-49801966e6cb
- github.com/rivo/tview to v0.0.0-20230511053024-822bd067b165
- tools to v1.5.0-alpha.0-7-gd2dde48
- pkgs to v1.5.0-alpha.0-16-g7958db1

Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>

chore: drop deprecated stuff for Talos 1.5

* drop old resources API, which was deprecated long time ago
* use bootstrapped event in `talosctl get --watch` to better align
  columns in the table output

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

fix: refresh kubelet self-issued serving certificates

Kubelet doesn't refresh self-issued serving certificates, so force it by
removing the cert on each restart.

Fix the code which was forcing rejoin when the nodename changes, it was
broken, as it was checking serving certificate instead of client
certificate. It worked by accident when not using controlplane-issued
serving certificates.

Fixes siderolabs#7235

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

chore: bump deps

- github.com/containerd/typeurl to v2.1.1
- github.com/aws/aws-sdk-go to v1.44.264
- alpine to 3.18.0
- node to 20.2.0-alpine
- github.com/containernetworking/plugins to v1.3.0
- github.com/docker/docker to v23.0.6+incompatible
- github.com/hetznercloud/hcloud-go to v1.45.1
- github.com/insomniacslk/dhcp to v0.0.0-20230516061539-49801966e6cb
- github.com/rivo/tview to v0.0.0-20230511053024-822bd067b165
- tools to v1.5.0-alpha.0-7-gd2dde48
- pkgs to v1.5.0-alpha.0-16-g7958db1

Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>

chore: drop deprecated stuff for Talos 1.5

* drop old resources API, which was deprecated long time ago
* use bootstrapped event in `talosctl get --watch` to better align
  columns in the table output

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

fix: refresh kubelet self-issued serving certificates

Kubelet doesn't refresh self-issued serving certificates, so force it by
removing the cert on each restart.

Fix the code which was forcing rejoin when the nodename changes, it was
broken, as it was checking serving certificate instead of client
certificate. It worked by accident when not using controlplane-issued
serving certificates.

Fixes siderolabs#7235

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
smira added a commit to smira/talos that referenced this issue May 30, 2023
@smira
fix: refresh kubelet self-issued serving certificates
d249b14 
Kubelet doesn't refresh self-issued serving certificates, so force it by
removing the cert on each restart.

Fix the code which was forcing rejoin when the nodename changes, it was
broken, as it was checking serving certificate instead of client
certificate. It worked by accident when not using controlplane-issued
serving certificates.

Fixes siderolabs#7235

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
(cherry picked from commit dd8336c)
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jun 13, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@smira smira

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: refresh kubelet self-issued serving certificates smira/talos
2 participants
@smira @frezbo