cherry-pick: etcd-signer-server: allow server to serve TLS based on SNI #14
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The previous cert used to test signing metrics certs expired on Apr 19 :( ``` openssl genrsa -out myCA.key 2048 openssl req -x509 -new -nodes -key myCA.key -sha256 -days 3650 -out myCA.pem You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:US State or Province Name (full name) []:CA Locality Name (eg, city) [Default City]: Organization Name (eg, company) [Default Company Ltd]:fake-metrics-ca Organizational Unit Name (eg, section) []:fake-metrics-ca Common Name (eg, your name or your server's hostname) []: Email Address []: ``` The new one is valid for 10 years.
Currently the etcd-signer-server does not support serving TLS traffic based on SNI. Therefore, since openshift's kube-apiserver serves traffic on api.$cluster_domain and api-int.$cluster_domain [1] and because during bootstrapping when etcd-signer-server is mimic-ing the kube-apiserver to sign the etcd clients certificates it can only serve traffic on single domain, external clients trying to connect to `:6443` from api.$cluster_domain see errors like, ```console time="2019-04-24T13:25:11-07:00" level=debug msg="Still waiting for the Kubernetes API: Get https://api.adahiya-0.tt.testing:6443/version?timeout=32s: x509: certificate is valid for api-int.adahiya-0.tt.testing, not api.adahiya-0.tt.testing" ``` as the etcd-signer-server is using certs for `api-int.$cluster_domain` as internal clients ie etcd agent is contacting it on that domain, the external clients ie the installer hits the etcd-signer on `api.$cluster_domain` Allowing etcd-signer-server to accept multiple certs and serve TLS based on SNI allows it to correctly mimic the kube-apiserver's capability. [1]: openshift/installer#1633
openshift-ci-robot
added
approved
$ diff -u1 <(git show ccabab5) <(git show de9e5c8)
--- /dev/fd/63 2019-04-25 22:10:41.075006932 -0700
+++ /dev/fd/62 2019-04-25 22:10:41.075006932 -0700
@@ -1,2 +1,2 @@
-commit ccabab542d0584e9c806ace42def502b900c748d
+commit de9e5c8810b07d9631abae7168ce4b734d246883
Author: Abhinav Dahiya <abhinav.dahiya@redhat.com>
@@ -76,3 +76,3 @@
diff --git a/pkg/certsigner/signer.go b/pkg/certsigner/signer.go
-index ab45e22..2da6eb4 100644
+index 8f46dac..4a04fee 100644
--- a/pkg/certsigner/signer.go
@@ -109,3 +109,3 @@
// EtcdMetricCertDuration
-@@ -439,7 +443,22 @@ func StartSignerServer(c Config) error {
+@@ -440,7 +444,22 @@ func StartSignerServer(c Config) error {
if err != nil {
$ diff -u1 <(git show ccabab5^) <(git show de9e5c8^)
--- /dev/fd/63 2019-04-25 22:11:11.521296304 -0700
+++ /dev/fd/62 2019-04-25 22:11:11.522296313 -0700
@@ -1,2 +1,2 @@
-commit 94cc8fcd669be58be394c89e668d2e4611aa7c78
+commit a832ebcf3340e77368c0a187e2602f9673494324
Author: Abhinav Dahiya <abhinav.dahiya@redhat.com>/lgtm |
|
/retest |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: abhinavdahiya, hexfusion, wking The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR cherrypicks
added upstream via coreos#28
/cc @wking @abhinavdahiya