-
Notifications
You must be signed in to change notification settings - Fork 398
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add kubelet certificate mode in yurthub (#1625)
- Loading branch information
1 parent
fe46a9d
commit 4efa1bf
Showing
20 changed files
with
733 additions
and
315 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
119 changes: 119 additions & 0 deletions
119
pkg/yurthub/certificate/kubeletcertificate/kubelet_certificate.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,119 @@ | ||
| /* | ||
| Copyright 2023 The OpenYurt Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package kubeletcertificate | ||
|
|
||
| import ( | ||
| "crypto/tls" | ||
| "crypto/x509" | ||
| "errors" | ||
| "fmt" | ||
| "time" | ||
|
|
||
| "k8s.io/klog/v2" | ||
|
|
||
| "github.com/openyurtio/openyurt/pkg/yurthub/certificate" | ||
| "github.com/openyurtio/openyurt/pkg/yurthub/util" | ||
| ) | ||
|
|
||
| var ( | ||
| KubeConfNotExistErr = errors.New("/etc/kubernetes/kubelet.conf file doesn't exist") | ||
| KubeletCANotExistErr = errors.New("/etc/kubernetes/pki/ca.crt file doesn't exist") | ||
| KubeletPemNotExistErr = errors.New("/var/lib/kubelet/pki/kubelet-current.pem file doesn't exist") | ||
| ) | ||
|
|
||
| type kubeletCertManager struct { | ||
| kubeConfFile string | ||
| kubeletCAFile string | ||
| kubeletPemFile string | ||
| cert *tls.Certificate | ||
| } | ||
|
|
||
| func NewKubeletCertManager(kubeConfFile, kubeletCAFile, kubeletPemFile string) (certificate.YurtClientCertificateManager, error) { | ||
| if exist, _ := util.FileExists(kubeConfFile); !exist { | ||
| return nil, KubeConfNotExistErr | ||
| } | ||
|
|
||
| if exist, _ := util.FileExists(kubeletCAFile); !exist { | ||
| return nil, KubeletCANotExistErr | ||
| } | ||
|
|
||
| if exist, _ := util.FileExists(kubeletPemFile); !exist { | ||
| return nil, KubeletPemNotExistErr | ||
| } | ||
|
|
||
| cert, err := loadFile(kubeletPemFile) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return &kubeletCertManager{ | ||
| kubeConfFile: kubeConfFile, | ||
| kubeletCAFile: kubeletCAFile, | ||
| kubeletPemFile: kubeletPemFile, | ||
| cert: cert, | ||
| }, nil | ||
| } | ||
|
|
||
| func (kcm *kubeletCertManager) Start() { | ||
| // do nothing | ||
| } | ||
|
|
||
| func (kcm *kubeletCertManager) Stop() { | ||
| // do nothing | ||
| } | ||
|
|
||
| func (kcm *kubeletCertManager) UpdateBootstrapConf(_ string) error { | ||
| return nil | ||
| } | ||
|
|
||
| func (kcm *kubeletCertManager) GetHubConfFile() string { | ||
| return kcm.kubeConfFile | ||
| } | ||
|
|
||
| func (kcm *kubeletCertManager) GetCaFile() string { | ||
| return kcm.kubeletCAFile | ||
| } | ||
|
|
||
| func (kcm *kubeletCertManager) GetAPIServerClientCert() *tls.Certificate { | ||
| if kcm.cert != nil && kcm.cert.Leaf != nil && !time.Now().After(kcm.cert.Leaf.NotAfter) { | ||
| return kcm.cert | ||
| } | ||
|
|
||
| klog.Warningf("current certificate: %s is expired, reload it", kcm.kubeletPemFile) | ||
| cert, err := loadFile(kcm.kubeletPemFile) | ||
| if err != nil { | ||
| klog.Errorf("failed to load client certificate(%s), %v", kcm.kubeletPemFile, err) | ||
| return nil | ||
| } | ||
| kcm.cert = cert | ||
| return kcm.cert | ||
| } | ||
|
|
||
| func loadFile(pairFile string) (*tls.Certificate, error) { | ||
| // LoadX509KeyPair knows how to parse combined cert and private key from | ||
| // the same file. | ||
| cert, err := tls.LoadX509KeyPair(pairFile, pairFile) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("could not convert data from %q into cert/key pair: %v", pairFile, err) | ||
| } | ||
| certs, err := x509.ParseCertificates(cert.Certificate[0]) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("unable to parse certificate data: %v", err) | ||
| } | ||
| cert.Leaf = certs[0] | ||
| return &cert, nil | ||
| } |
59 changes: 59 additions & 0 deletions
59
pkg/yurthub/certificate/kubeletcertificate/kubelet_certificate_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| /* | ||
| Copyright 2023 The OpenYurt Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package kubeletcertificate | ||
|
|
||
| import "testing" | ||
|
|
||
| func TestNewKubeletCertManager(t *testing.T) { | ||
| testcases := map[string]struct { | ||
| kubeConfFile string | ||
| kubeletCAFile string | ||
| kubeletPemFile string | ||
| err error | ||
| }{ | ||
| "kubelet.conf doesn't exist": { | ||
| kubeConfFile: "invalid file", | ||
| err: KubeConfNotExistErr, | ||
| }, | ||
| "ca.crt file doesn't exist": { | ||
| kubeConfFile: "../testdata/kubelet.conf", | ||
| kubeletCAFile: "invalid file", | ||
| err: KubeletCANotExistErr, | ||
| }, | ||
| "kubelet.pem doesn't exist": { | ||
| kubeConfFile: "../testdata/kubelet.conf", | ||
| kubeletCAFile: "../testdata/ca.crt", | ||
| kubeletPemFile: "invalid file", | ||
| err: KubeletPemNotExistErr, | ||
| }, | ||
| "normal kubelet cert manager": { | ||
| kubeConfFile: "../testdata/kubelet.conf", | ||
| kubeletCAFile: "../testdata/ca.crt", | ||
| kubeletPemFile: "../testdata/kubelet.pem", | ||
| err: nil, | ||
| }, | ||
| } | ||
|
|
||
| for k, tc := range testcases { | ||
| t.Run(k, func(t *testing.T) { | ||
| _, err := NewKubeletCertManager(tc.kubeConfFile, tc.kubeletCAFile, tc.kubeletPemFile) | ||
| if err != tc.err { | ||
| t.Errorf("expect error is %v, but got %v", tc.err, err) | ||
| } | ||
| }) | ||
| } | ||
| } |
Oops, something went wrong.