Generate kubelet server cert with cluster CA

[stgleb]

/kind bug

Add kubelet-server phase to join and init commands.
Generate kubelet key and certificate signing request,
create, approve this certificate signing request and download
certificate.

Implements kubeadm design proposal
Fixes kubeadm issue

[k8s-ci-robot]

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

---

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
• If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
• If you have done the above and are still having issues with the CLA being reported as unsigned, please email the CNCF helpdesk: helpdesk@rt.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[k8s-ci-robot]

Hi @stgleb. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: stgleb
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: neolit123

If they are not already assigned, you can assign the PR to them by writing /assign @neolit123 in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubeadm/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[anarchistHH1983]

Sorry. I'm a newbie

…

On Mon, Feb 18, 2019, 12:06 PM Kubernetes Prow Robot < ***@***.*** wrote: Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). 📝 *Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement <https://git.k8s.io/community/CLA.md#the-contributor-license-agreement> to sign the CLA.* It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks. ------------------------------ - If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits <https://help.github.com/articles/setting-your-email-in-git/>. - If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized. - If you have done the above and are still having issues with the CLA being reported as unsigned, please email the CNCF helpdesk: ***@***.*** Instructions for interacting with me using PR comments are available here <https://git.k8s.io/community/contributors/guide/pull-requests.md>. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra <https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:> repository. I understand the commands that are listed here <https://go.k8s.io/bot-commands>. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#74216 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/Atif5VkFRFWb75saj7mY_7HUJQznjMYmks5vOt2ygaJpZM4bBSow> .

[anarchistHH1983]

/assign @neolit123

…

On Mon, Feb 18, 2019, 12:09 PM Kubernetes Prow Robot < ***@***.*** wrote: [APPROVALNOTIFIER] This PR is *NOT APPROVED* This pull-request has been approved by: *stgleb <#74216#>* To fully approve this pull request, please assign additional approvers. We suggest the following additional approver: *neolit123* If they are not already assigned, you can assign the PR to them by writing /assign @neolit123 in a comment when ready. The full list of commands accepted by this bot can be found here <https://go.k8s.io/bot-commands?repo=kubernetes%2Fkubernetes>. The pull request process is described here <https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process> Needs approval from an approver in each of these files: - *cmd/kubeadm/OWNERS <https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/OWNERS>* Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#74216 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/Atif5QHnvFW3ZmISRiwhy4n0RSfsgDfDks5vOt5bgaJpZM4bBSow> .

[neolit123]

/hold

@stgleb the kubeadm config is beta and we should batch multiple changes per release.
due to the kubeadm team being overbooked it was (mostly) decided to not bump v1beta1 to v1beta2 this cycle(?) this change is not batched with other changes and it might not make it in 1.14.

also:

• please add a release note instead of NONE
• and link to the original kubeadm issue - Fixes #1223 seems unrelated.

thanks.
@kubernetes/sig-cluster-lifecycle-pr-reviews
/assign @timothysc @detiber

[stgleb]

@neolit123 Thank you, I am not expecting this to be in 1.14

[anarchistHH1983]

Release

…

On Mon, Feb 18, 2019, 12:23 PM Lubomir I. Ivanov ***@***.*** wrote: ***@***.**** commented on this pull request. /hold @stgleb <https://github.com/stgleb> the kubeadm config is beta and we should batch multiple changes per release. due to the kubeadm team being overbooked this cycle it was (mostly) decided to not bump v1beta1 to v1beta2 this cycle(?) this change is not batched with other changes and it might not make it in 1.14. also: - please add a release note instead of NONE - and link to the original kubeadm issue - Fixes #1223 seems unrelated. thanks. @kubernetes/sig-cluster-lifecycle-pr-reviews <https://github.com/orgs/kubernetes/teams/sig-cluster-lifecycle-pr-reviews> /assign @timothysc <https://github.com/timothysc> @detiber <https://github.com/detiber> — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#74216 (review)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/Atif5Xpe3yrqoKFqFUHHol4UhZjKn3vQks5vOuF8gaJpZM4bBSow> .

[k8s-ci-robot]

@anarchistHH1983: Reiterating the mentions to trigger a notification:
@kubernetes/sig-cluster-lifecycle-pr-reviews

In response to this:

Release

On Mon, Feb 18, 2019, 12:23 PM Lubomir I. Ivanov <notifications@github.com
wrote:

@neolit123 commented on this pull request.

/hold

@stgleb https://github.com/stgleb the kubeadm config is beta and we
should batch multiple changes per release.
due to the kubeadm team being overbooked this cycle it was (mostly)
decided to not bump v1beta1 to v1beta2 this cycle(?) this change is not
batched with other changes and it might not make it in 1.14.

also:

• please add a release note instead of NONE
• and link to the original kubeadm issue - Fixes Proposal: don't return JSONBase in LIST responses #1223 seems unrelated.

thanks.
@kubernetes/sig-cluster-lifecycle-pr-reviews
https://github.com/orgs/kubernetes/teams/sig-cluster-lifecycle-pr-reviews
/assign @timothysc https://github.com/timothysc @detiber
https://github.com/detiber

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#74216 (review),
or mute the thread
https://github.com/notifications/unsubscribe-auth/Atif5Xpe3yrqoKFqFUHHol4UhZjKn3vQks5vOuF8gaJpZM4bBSow
.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mark-casey]

kfox1111
I kind of hit this issue the other day. Is there a reason it isn't rolled up in the bootstrap process? The client bootstrap already creates a signed client cert. why not create a server cert at the same time?

@liggitt just came across this and was recalling your comment from kubernetes/kubeadm#118 (comment). If I recall correctly the issue is during cert renewal, absent a recent bootstrap token, client certs would be self-authn/authz for renewal and serving certs are not?

Coming across this again though, I wonder for non-bootstrap scenarios could a kubelet just approve it's own new serving cert CSR by acting as a node/admin with its client cert? Just had the thought so may be half-baked, but it's all happening in the same process right and if the client cert isn't valid such that it couldn't approve the new serving CSR isn't the node in bad shape anyway?

[neolit123]

@stgleb
FYI the design proposal is not approved and also there is ongoing discussion in the kubeadm issue whether we should move away from the kubelet self-signed serving certificate and how.

it might be a good idea to hold on commits, because this PR can end up being rejected.
(also we cannot modify v1beta1 at this point as already mentioned).

[k8s-ci-robot]

@stgleb: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[stgleb]

@neolit123 May I keep it here as a possible solution? I am basically finished.

[neolit123]

@neolit123 May I keep it here as a possible solution? I am basically finished.

sure.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.