108 lines
3.7 KiB
Go
108 lines
3.7 KiB
Go
/*
|
|
Copyright 2016 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package csr
|
|
|
|
import (
|
|
"crypto/x509/pkix"
|
|
"fmt"
|
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
"k8s.io/apimachinery/pkg/watch"
|
|
"k8s.io/kubernetes/pkg/api/v1"
|
|
certificates "k8s.io/kubernetes/pkg/apis/certificates/v1alpha1"
|
|
unversionedcertificates "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/certificates/v1alpha1"
|
|
"k8s.io/kubernetes/pkg/fields"
|
|
certutil "k8s.io/kubernetes/pkg/util/cert"
|
|
)
|
|
|
|
// RequestNodeCertificate will create a certificate signing request and send it to API server,
|
|
// then it will watch the object's status, once approved by API server, it will return the API
|
|
// server's issued certificate (pem-encoded). If there is any errors, or the watch timeouts,
|
|
// it will return an error. This is intended for use on nodes (kubelet and kubeadm).
|
|
func RequestNodeCertificate(client unversionedcertificates.CertificateSigningRequestInterface, privateKeyData []byte, nodeName types.NodeName) (certData []byte, err error) {
|
|
subject := &pkix.Name{
|
|
Organization: []string{"system:nodes"},
|
|
CommonName: fmt.Sprintf("system:node:%s", nodeName),
|
|
}
|
|
|
|
privateKey, err := certutil.ParsePrivateKeyPEM(privateKeyData)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("invalid private key for certificate request: %v", err)
|
|
}
|
|
csr, err := certutil.MakeCSR(privateKey, subject, nil, nil)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to generate certificate request: %v", err)
|
|
}
|
|
|
|
req, err := client.Create(&certificates.CertificateSigningRequest{
|
|
// Username, UID, Groups will be injected by API server.
|
|
TypeMeta: metav1.TypeMeta{Kind: "CertificateSigningRequest"},
|
|
ObjectMeta: v1.ObjectMeta{GenerateName: "csr-"},
|
|
|
|
Spec: certificates.CertificateSigningRequestSpec{
|
|
Request: csr,
|
|
Usages: []certificates.KeyUsage{
|
|
certificates.UsageDigitalSignature,
|
|
certificates.UsageKeyEncipherment,
|
|
certificates.UsageClientAuth,
|
|
},
|
|
},
|
|
})
|
|
if err != nil {
|
|
return nil, fmt.Errorf("cannot create certificate signing request: %v", err)
|
|
|
|
}
|
|
|
|
// Make a default timeout = 3600s.
|
|
var defaultTimeoutSeconds int64 = 3600
|
|
resultCh, err := client.Watch(v1.ListOptions{
|
|
Watch: true,
|
|
TimeoutSeconds: &defaultTimeoutSeconds,
|
|
FieldSelector: fields.OneTermEqualSelector("metadata.name", req.Name).String(),
|
|
})
|
|
if err != nil {
|
|
return nil, fmt.Errorf("cannot watch on the certificate signing request: %v", err)
|
|
}
|
|
|
|
var status certificates.CertificateSigningRequestStatus
|
|
ch := resultCh.ResultChan()
|
|
|
|
for {
|
|
event, ok := <-ch
|
|
if !ok {
|
|
break
|
|
}
|
|
|
|
if event.Type == watch.Modified || event.Type == watch.Added {
|
|
if event.Object.(*certificates.CertificateSigningRequest).UID != req.UID {
|
|
continue
|
|
}
|
|
status = event.Object.(*certificates.CertificateSigningRequest).Status
|
|
for _, c := range status.Conditions {
|
|
if c.Type == certificates.CertificateDenied {
|
|
return nil, fmt.Errorf("certificate signing request is not approved, reason: %v, message: %v", c.Reason, c.Message)
|
|
}
|
|
if c.Type == certificates.CertificateApproved && status.Certificate != nil {
|
|
return status.Certificate, nil
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil, fmt.Errorf("watch channel closed")
|
|
}
|