Skip to content

Commit 179c130

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #20314 from deads2k/oc-01-serving-cert
use the service cert signing project
2 parents 893b40d + e1f0b61 commit 179c130

File tree

8 files changed

+599
-51
lines changed

8 files changed

+599
-51
lines changed

‎install/openshift-apiserver/install.yaml‎

Lines changed: 34 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,12 @@ objects:
5656
privileged: true
5757
runAsUser: 0
5858
volumeMounts:
59-
- mountPath: /etc/origin/master/
60-
name: master-config
61-
- mountPath: /etc/origin/cloudprovider/
62-
name: master-cloud-provider
59+
- mountPath: /var/serving-cert
60+
name: serving-cert
61+
- mountPath: /etc/origin/master/
62+
name: master-config
63+
- mountPath: /etc/origin/cloudprovider/
64+
name: master-cloud-provider
6365
readinessProbe:
6466
httpGet:
6567
path: /healthz
@@ -73,6 +75,9 @@ objects:
7375
- name: master-cloud-provider
7476
hostPath:
7577
path: /etc/origin/cloudprovider
78+
- name: serving-cert
79+
secret:
80+
secretName: serving-cert
7681

7782

7883
# to be able to assign powers to the process
@@ -88,7 +93,7 @@ objects:
8893
namespace: ${NAMESPACE}
8994
name: api
9095
annotations:
91-
service.alpha.openshift.io/serving-cert-secret-name: apiserver-serving-cert
96+
service.alpha.openshift.io/serving-cert-secret-name: serving-cert
9297
spec:
9398
selector:
9499
openshift.io/component: api
@@ -101,166 +106,178 @@ objects:
101106
kind: APIService
102107
metadata:
103108
name: v1.apps.openshift.io
109+
annotations:
110+
service.alpha.openshift.io/inject-cabundle: "true"
104111
spec:
105112
group: apps.openshift.io
106113
version: v1
107114
service:
108115
namespace: openshift-apiserver
109116
name: api
110-
insecureSkipTLSVerify: true
111117
groupPriorityMinimum: 9900
112118
versionPriority: 15
113119

114120
- apiVersion: apiregistration.k8s.io/v1beta1
115121
kind: APIService
116122
metadata:
117123
name: v1.authorization.openshift.io
124+
annotations:
125+
service.alpha.openshift.io/inject-cabundle: "true"
118126
spec:
119127
group: authorization.openshift.io
120128
version: v1
121129
service:
122130
namespace: openshift-apiserver
123131
name: api
124-
insecureSkipTLSVerify: true
125132
groupPriorityMinimum: 9900
126133
versionPriority: 15
127134

128135
- apiVersion: apiregistration.k8s.io/v1beta1
129136
kind: APIService
130137
metadata:
131138
name: v1.build.openshift.io
139+
annotations:
140+
service.alpha.openshift.io/inject-cabundle: "true"
132141
spec:
133142
group: build.openshift.io
134143
version: v1
135144
service:
136145
namespace: openshift-apiserver
137146
name: api
138-
insecureSkipTLSVerify: true
139147
groupPriorityMinimum: 9900
140148
versionPriority: 15
141149

142150
- apiVersion: apiregistration.k8s.io/v1beta1
143151
kind: APIService
144152
metadata:
145153
name: v1.image.openshift.io
154+
annotations:
155+
service.alpha.openshift.io/inject-cabundle: "true"
146156
spec:
147157
group: image.openshift.io
148158
version: v1
149159
service:
150160
namespace: openshift-apiserver
151161
name: api
152-
insecureSkipTLSVerify: true
153162
groupPriorityMinimum: 9900
154163
versionPriority: 15
155164

156165
- apiVersion: apiregistration.k8s.io/v1beta1
157166
kind: APIService
158167
metadata:
159168
name: v1.network.openshift.io
169+
annotations:
170+
service.alpha.openshift.io/inject-cabundle: "true"
160171
spec:
161172
group: network.openshift.io
162173
version: v1
163174
service:
164175
namespace: openshift-apiserver
165176
name: api
166-
insecureSkipTLSVerify: true
167177
groupPriorityMinimum: 9900
168178
versionPriority: 15
169179

170180
- apiVersion: apiregistration.k8s.io/v1beta1
171181
kind: APIService
172182
metadata:
173183
name: v1.oauth.openshift.io
184+
annotations:
185+
service.alpha.openshift.io/inject-cabundle: "true"
174186
spec:
175187
group: oauth.openshift.io
176188
version: v1
177189
service:
178190
namespace: openshift-apiserver
179191
name: api
180-
insecureSkipTLSVerify: true
181192
groupPriorityMinimum: 9900
182193
versionPriority: 15
183194

184195
- apiVersion: apiregistration.k8s.io/v1beta1
185196
kind: APIService
186197
metadata:
187198
name: v1.project.openshift.io
199+
annotations:
200+
service.alpha.openshift.io/inject-cabundle: "true"
188201
spec:
189202
group: project.openshift.io
190203
version: v1
191204
service:
192205
namespace: openshift-apiserver
193206
name: api
194-
insecureSkipTLSVerify: true
195207
groupPriorityMinimum: 9900
196208
versionPriority: 15
197209

198210
- apiVersion: apiregistration.k8s.io/v1beta1
199211
kind: APIService
200212
metadata:
201213
name: v1.quota.openshift.io
214+
annotations:
215+
service.alpha.openshift.io/inject-cabundle: "true"
202216
spec:
203217
group: quota.openshift.io
204218
version: v1
205219
service:
206220
namespace: openshift-apiserver
207221
name: api
208-
insecureSkipTLSVerify: true
209222
groupPriorityMinimum: 9900
210223
versionPriority: 15
211224

212225
- apiVersion: apiregistration.k8s.io/v1beta1
213226
kind: APIService
214227
metadata:
215228
name: v1.route.openshift.io
229+
annotations:
230+
service.alpha.openshift.io/inject-cabundle: "true"
216231
spec:
217232
group: route.openshift.io
218233
version: v1
219234
service:
220235
namespace: openshift-apiserver
221236
name: api
222-
insecureSkipTLSVerify: true
223237
groupPriorityMinimum: 9900
224238
versionPriority: 15
225239

226240
- apiVersion: apiregistration.k8s.io/v1beta1
227241
kind: APIService
228242
metadata:
229243
name: v1.security.openshift.io
244+
annotations:
245+
service.alpha.openshift.io/inject-cabundle: "true"
230246
spec:
231247
group: security.openshift.io
232248
version: v1
233249
service:
234250
namespace: openshift-apiserver
235251
name: api
236-
insecureSkipTLSVerify: true
237252
groupPriorityMinimum: 9900
238253
versionPriority: 15
239254

240255
- apiVersion: apiregistration.k8s.io/v1beta1
241256
kind: APIService
242257
metadata:
243258
name: v1.template.openshift.io
259+
annotations:
260+
service.alpha.openshift.io/inject-cabundle: "true"
244261
spec:
245262
group: template.openshift.io
246263
version: v1
247264
service:
248265
namespace: openshift-apiserver
249266
name: api
250-
insecureSkipTLSVerify: true
251267
groupPriorityMinimum: 9900
252268
versionPriority: 15
253269

254270
- apiVersion: apiregistration.k8s.io/v1beta1
255271
kind: APIService
256272
metadata:
257273
name: v1.user.openshift.io
274+
annotations:
275+
service.alpha.openshift.io/inject-cabundle: "true"
258276
spec:
259277
group: user.openshift.io
260278
version: v1
261279
service:
262280
namespace: openshift-apiserver
263281
name: api
264-
insecureSkipTLSVerify: true
265282
groupPriorityMinimum: 9900
266283
versionPriority: 15

‎install/openshift-service-cert-signer-operator/install-rbac.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: template.openshift.io/v1
2+
kind: Template
3+
parameters:
4+
- name: IMAGE
5+
value: openshift/origin-control-plane:latest
6+
- name: OPENSHIFT_PULL_POLICY
7+
value: Always
8+
- name: NAMESPACE
9+
value: openshift-core-operators
10+
- name: LOGLEVEL
11+
value: "0"
12+
13+
objects:
14+
15+
# When we have an orchestrating operator, it will do this
16+
- apiVersion: rbac.authorization.k8s.io/v1
17+
kind: ClusterRoleBinding
18+
metadata:
19+
name: system:openshift:operator:service-cert-signer
20+
roleRef:
21+
kind: ClusterRole
22+
name: cluster-admin
23+
subjects:
24+
- kind: ServiceAccount
25+
namespace: ${NAMESPACE}
26+
name: openshift-service-cert-signer-operator

‎install/openshift-service-cert-signer-operator/install.yaml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
apiVersion: template.openshift.io/v1
2+
kind: Template
3+
parameters:
4+
- name: IMAGE
5+
value: openshift/origin-service-serving-cert-signer:latest
6+
- name: OPENSHIFT_PULL_POLICY
7+
value: Always
8+
- name: NAMESPACE
9+
value: openshift-core-operators
10+
- name: LOGLEVEL
11+
value: "0"
12+
13+
objects:
14+
- apiVersion: v1
15+
kind: Namespace
16+
metadata:
17+
labels:
18+
openshift.io/run-level: "1"
19+
name: openshift-core-operators
20+
21+
- apiVersion: apiextensions.k8s.io/v1beta1
22+
kind: CustomResourceDefinition
23+
metadata:
24+
name: servicecertsigneroperatorconfigs.servicecertsigner.config.openshift.io
25+
spec:
26+
scope: Cluster
27+
group: servicecertsigner.config.openshift.io
28+
version: v1alpha1
29+
names:
30+
kind: ServiceCertSignerOperatorConfig
31+
plural: servicecertsigneroperatorconfigs
32+
singular: servicecertsigneroperatorconfig
33+
subresources:
34+
status: {}
35+
36+
- apiVersion: v1
37+
kind: ConfigMap
38+
metadata:
39+
namespace: ${NAMESPACE}
40+
name: openshift-service-cert-signer-operator-config
41+
data:
42+
operator-config.yaml: |
43+
apiVersion: operator.openshift.io/v1alpha1
44+
kind: GenericOperatorConfig
45+
46+
- apiVersion: apps/v1
47+
kind: Deployment
48+
metadata:
49+
namespace: ${NAMESPACE}
50+
name: openshift-service-cert-signer-operator
51+
labels:
52+
app: openshift-service-cert-signer-operator
53+
spec:
54+
replicas: 1
55+
selector:
56+
matchLabels:
57+
app: openshift-service-cert-signer-operator
58+
template:
59+
metadata:
60+
name: openshift-service-cert-signer-operator
61+
labels:
62+
app: openshift-service-cert-signer-operator
63+
spec:
64+
serviceAccountName: openshift-service-cert-signer-operator
65+
containers:
66+
- name: operator
67+
image: openshift/origin-service-serving-cert-signer:v3.11
68+
imagePullPolicy: ${OPENSHIFT_PULL_POLICY}
69+
command: ["service-serving-cert-signer", "operator"]
70+
args:
71+
- "--config=/var/run/configmaps/config/operator-config.yaml"
72+
- "-v=4"
73+
volumeMounts:
74+
- mountPath: /var/run/configmaps/config
75+
name: config
76+
volumes:
77+
- name: serving-cert
78+
secret:
79+
defaultMode: 400
80+
secretName: openshift-service-cert-signer-operator-serving-cert
81+
optional: true
82+
- name: config
83+
configMap:
84+
defaultMode: 440
85+
name: openshift-service-cert-signer-operator-config
86+
87+
- apiVersion: v1
88+
kind: ServiceAccount
89+
metadata:
90+
namespace: ${NAMESPACE}
91+
name: openshift-service-cert-signer-operator
92+
labels:
93+
app: openshift-service-cert-signer-operator
94+
95+
- apiVersion: servicecertsigner.config.openshift.io/v1alpha1
96+
kind: ServiceCertSignerOperatorConfig
97+
metadata:
98+
name: instance
99+
spec:
100+
managementState: Managed
101+
imagePullSpec: openshift/origin-service-serving-cert-signer:v3.11
102+
version: 3.10.0
103+
logging:
104+
level: 4
105+
replicas: 1

‎pkg/oc/clusterup/coreinstall/kubeapiserver/openshift_apiserver.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ func MakeOpenShiftAPIServerConfig(existingMasterConfig string, routingSuffix, ba
3636
// hardcode the route suffix to the old default. If anyone wants to change it, they can modify their config.
3737
masterconfig.RoutingConfig.Subdomain = routingSuffix
3838

39+
// use the generated service serving cert
40+
masterconfig.ServingInfo.ServerCert.CertFile = "/var/serving-cert/tls.crt"
41+
masterconfig.ServingInfo.ServerCert.KeyFile = "/var/serving-cert/tls.key"
42+
3943
// default openshift image policy admission
4044
if masterconfig.AdmissionConfig.PluginConfig == nil {
4145
masterconfig.AdmissionConfig.PluginConfig = map[string]*configapi.AdmissionPluginConfig{}

‎pkg/oc/clusterup/coreinstall/kubeapiserver/openshift_controller.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,12 @@ func MakeOpenShiftControllerConfig(existingMasterConfig string, basedir string)
3333
masterconfig := configObj.(*configapi.MasterConfig)
3434
masterconfig.ServingInfo.BindAddress = "0.0.0.0:8444"
3535

36+
// disable the service serving cert signer because that runs in a separate pod now
37+
masterconfig.ControllerConfig.Controllers = []string{
38+
"*",
39+
"-openshift.io/service-serving-cert",
40+
}
41+
3642
configBytes, err := configapilatest.WriteYAML(masterconfig)
3743
if err != nil {
3844
return "", err

0 commit comments

Comments
 (0)