[release-1.25] Backport user-provided CA cert and kubeadm bootstrap token support
#6929
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 1ec242d)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 0919ec6)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 58d4032)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 3c32433)
This command must be run on a server while the service is running. After this command completes, all the servers in the cluster should be restarted to load the new CA files. Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 215fb15)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit f13768c)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 9b6b729)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 8a6404f)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit be7f751)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 373df1c)
Allow bootstrapping with kubeadm bootstrap token strings or existing Kubelet certs. This allows agents to join the cluster using kubeadm bootstrap tokens, as created with the `k3s token create` command. When the token expires or is deleted, agents can successfully restart by authenticating with their kubelet certificate via node authentication. If the token is gone and the node is deleted from the cluster, node auth will fail and they will be prevented from rejoining the cluster until provided with a valid token. Servers still must be bootstrapped with the static cluster token, as they will need to know it to decrypt the bootstrap data. Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 992e649)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit 87f9c4a)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit c900089)
Signed-off-by: Brad Davidson <[email protected]> (cherry picked from commit b43dd77)
brandond
changed the title
kubeadm bootstrap token support
briandowns
approved these changes
Feb 10, 2023
Signed-off-by: Brad Davidson <[email protected]>
rbrtbnfgl
approved these changes
Feb 10, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed Changes
Backport features:
kubeadmstyle bootstrap token secret support #6663Types of Changes
new feature
Verification
See linked issue and original PRs
Testing
Linked Issues
kubeadmstyle bootstrap token secret support #6898User-Facing Change
Further Comments