-
Notifications
You must be signed in to change notification settings - Fork 917
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Redact sensitive information from the karmadactl init command output #5714
Conversation
Codecov ReportAttention: Patch coverage is
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## master #5714 +/- ##
==========================================
+ Coverage 46.18% 46.24% +0.05%
==========================================
Files 663 663
Lines 54592 54575 -17
==========================================
+ Hits 25215 25236 +21
+ Misses 27752 27717 -35
+ Partials 1625 1622 -3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
/assign @RainbowMango |
OK. Please rebase the code to make the new tests happy. |
79840e8
to
edd0fe6
Compare
Step 1: Create bootstrap tokens and get the full '%[2]s register' flag needed to register the member cluster using the token. | ||
(In karmada)~# %[2]s token create --print-register-command --kubeconfig %[1]s/karmada-apiserver.config | ||
%[2]s register [karmada-apiserver-endpoint] --token [token] --discovery-token-ca-cert-hash [ca-cert-hash] | ||
|
||
Step 2: Show members of karmada | ||
(In karmada)~# kubectl --kubeconfig %[1]s/karmada-apiserver.config get clusters | ||
Step 2: Use the output result from step 1 to register the cluster to Karmada control plane. "--cluster-name" is set to cluster of current-context by default. | ||
(In member cluster)~# %[2]s register [karmada-apiserver-endpoint] --token [token] --discovery-token-ca-cert-hash [ca-cert-hash] | ||
|
||
Step 3: Show members of karmada | ||
(In karmada)~# karmadactl --kubeconfig %[1]s/karmada-apiserver.config get clusters |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Something like:
Step 1: Create bootstrap token and generate the '%[2]s register' command which will be used later.
~# %[2]s token create --print-register-command --kubeconfig=<path-to-karmada-config>
This command will generate a registration command similar to:
%[2]s register 172.18.0.5:5443 --token t8xfio.640u9gp9obc72v5d --discovery-token-ca-cert-hash sha256:9cfa542ff48f43793d1816b1dd0a78ad574e349d8f6e005e6e32e8ab528e4244
Step 2: Use the output from Step 1 to register the cluster to the Karmada control plane.
You need to specify the target member cluster by flag '--kubeconfig'
~# %[2]s register 172.18.0.5:5443 --token t8xfio.640u9gp9obc72v5d --discovery-token-ca-cert-hash sha256:9cfa542ff48f43793d1816b1dd0a78ad574e349d8f6e005e6e32e8ab528e4244 --kubeconfig=<path-to-member-cluster-kubeconfig>
Step 3: Show members of Karmada
~# %[2]s --kubeconfig=<path-to-karmada-config> get clusters
The %[2]s register command has several optional parameters for setting the properties of the member cluster. For more details, run:
~# %[2]s register --help
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this is an example of karmadactl init
, path-to-karmada-config
is deterministic and can be referred to directly by %[1]s/karmada-apiserver.config
Signed-off-by: zhzhuang-zju <[email protected]>
edd0fe6
to
429f2d3
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
/approve
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: RainbowMango The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What type of PR is this?
/kind feature
What this PR does / why we need it:
The
karmadactl init
command, at the end of the initializtaion, writes some sensitive information in the stdout, like token, in itskarmadactl register
example. This will bring up two issues:data leak, for instance in CI/CD logs
The token's validity period is one day. Users may not join the pull mode member clusters immediately after installing Karmada, causing the secret to expire.
I hope the command output to be how to do rather than what to do. Users can follow the steps in the command output as needed.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Modified command output:
Does this PR introduce a user-facing change?: