Skip to content

Commit 517cb0d

Browse files
karmada-botkarmada-bot
authored
Merge pull request #5423 from chaosi-zju/secret-local
standardize the naming of karmada secrets in local up method
2 parents fdc47f8 + edb224d commit 517cb0d

16 files changed

+236
-171
lines changed

Diff for: ‎artifacts/deploy/karmada-aggregated-apiserver.yaml

+15-9
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,11 @@ spec:
3030
- --authentication-kubeconfig=/etc/karmada/config/karmada.config
3131
- --authorization-kubeconfig=/etc/karmada/config/karmada.config
3232
- --etcd-servers=https://etcd-client.karmada-system.svc.cluster.local:2379
33-
- --etcd-cafile=/etc/karmada/pki/etcd-ca.crt
34-
- --etcd-certfile=/etc/karmada/pki/etcd-client.crt
35-
- --etcd-keyfile=/etc/karmada/pki/etcd-client.key
36-
- --tls-cert-file=/etc/karmada/pki/karmada.crt
37-
- --tls-private-key-file=/etc/karmada/pki/karmada.key
33+
- --etcd-cafile=/etc/karmada/pki/etcd-client/ca.crt
34+
- --etcd-certfile=/etc/karmada/pki/etcd-client/tls.crt
35+
- --etcd-keyfile=/etc/karmada/pki/etcd-client/tls.key
36+
- --tls-cert-file=/etc/karmada/pki/server/tls.crt
37+
- --tls-private-key-file=/etc/karmada/pki//server/tls.key
3838
- --audit-log-path=-
3939
- --audit-log-maxage=0
4040
- --audit-log-maxbackup=0
@@ -61,16 +61,22 @@ spec:
6161
volumeMounts:
6262
- name: karmada-config
6363
mountPath: /etc/karmada/config
64-
- name: karmada-certs
65-
mountPath: /etc/karmada/pki
64+
- name: server-cert
65+
mountPath: /etc/karmada/pki/server
66+
readOnly: true
67+
- name: etcd-client-cert
68+
mountPath: /etc/karmada/pki/etcd-client
6669
readOnly: true
6770
volumes:
6871
- name: karmada-config
6972
secret:
7073
secretName: karmada-aggregated-apiserver-config
71-
- name: karmada-certs
74+
- name: server-cert
75+
secret:
76+
secretName: karmada-aggregated-apiserver-cert
77+
- name: etcd-client-cert
7278
secret:
73-
secretName: karmada-cert-secret
79+
secretName: karmada-aggregated-apiserver-etcd-client-cert
7480
---
7581
apiVersion: v1
7682
kind: Service

Diff for: ‎artifacts/deploy/karmada-apiserver.yaml

+35-17
Original file line numberDiff line numberDiff line change
@@ -36,29 +36,29 @@ spec:
3636
- kube-apiserver
3737
- --allow-privileged=true
3838
- --authorization-mode=Node,RBAC
39-
- --client-ca-file=/etc/karmada/pki/ca.crt
4039
- --enable-bootstrap-token-auth=true
41-
- --etcd-cafile=/etc/karmada/pki/etcd-ca.crt
42-
- --etcd-certfile=/etc/karmada/pki/etcd-client.crt
43-
- --etcd-keyfile=/etc/karmada/pki/etcd-client.key
40+
- --etcd-cafile=/etc/karmada/pki/etcd-client/ca.crt
41+
- --etcd-certfile=/etc/karmada/pki/etcd-client/tls.crt
42+
- --etcd-keyfile=/etc/karmada/pki/etcd-client/tls.key
4443
- --etcd-servers=https://etcd-client.karmada-system.svc.cluster.local:2379
4544
- --bind-address=0.0.0.0
4645
- --disable-admission-plugins=StorageObjectInUseProtection,ServiceAccount
4746
- --runtime-config=
4847
- --secure-port=5443
4948
- --service-account-issuer=https://kubernetes.default.svc.cluster.local
50-
- --service-account-key-file=/etc/karmada/pki/karmada.key
51-
- --service-account-signing-key-file=/etc/karmada/pki/karmada.key
49+
- --service-account-key-file=/etc/karmada/pki/service-account-key-pair/sa.pub
50+
- --service-account-signing-key-file=/etc/karmada/pki/service-account-key-pair/sa.key
5251
- --service-cluster-ip-range=10.96.0.0/12
53-
- --proxy-client-cert-file=/etc/karmada/pki/front-proxy-client.crt
54-
- --proxy-client-key-file=/etc/karmada/pki/front-proxy-client.key
52+
- --proxy-client-cert-file=/etc/karmada/pki/front-proxy-client/tls.crt
53+
- --proxy-client-key-file=/etc/karmada/pki/front-proxy-client/tls.key
54+
- --requestheader-client-ca-file=/etc/karmada/pki/front-proxy-client/ca.crt
5555
- --requestheader-allowed-names=front-proxy-client
56-
- --requestheader-client-ca-file=/etc/karmada/pki/front-proxy-ca.crt
5756
- --requestheader-extra-headers-prefix=X-Remote-Extra-
5857
- --requestheader-group-headers=X-Remote-Group
5958
- --requestheader-username-headers=X-Remote-User
60-
- --tls-cert-file=/etc/karmada/pki/apiserver.crt
61-
- --tls-private-key-file=/etc/karmada/pki/apiserver.key
59+
- --tls-cert-file=/etc/karmada/pki/server/tls.crt
60+
- --tls-private-key-file=/etc/karmada/pki/server/tls.key
61+
- --client-ca-file=/etc/karmada/pki/server/ca.crt
6262
- --tls-min-version=VersionTLS13
6363
name: karmada-apiserver
6464
image: registry.k8s.io/kube-apiserver:{{karmada_apiserver_version}}
@@ -88,9 +88,31 @@ spec:
8888
terminationMessagePath: /dev/termination-log
8989
terminationMessagePolicy: File
9090
volumeMounts:
91-
- mountPath: /etc/karmada/pki
92-
name: karmada-certs
91+
- name: server-cert
92+
mountPath: /etc/karmada/pki/server
9393
readOnly: true
94+
- name: etcd-client-cert
95+
mountPath: /etc/karmada/pki/etcd-client
96+
readOnly: true
97+
- name: front-proxy-client-cert
98+
mountPath: /etc/karmada/pki/front-proxy-client
99+
readOnly: true
100+
- name: service-account-key-pair
101+
mountPath: /etc/karmada/pki/service-account-key-pair
102+
readOnly: true
103+
volumes:
104+
- name: server-cert
105+
secret:
106+
secretName: karmada-apiserver-cert
107+
- name: etcd-client-cert
108+
secret:
109+
secretName: karmada-apiserver-etcd-client-cert
110+
- name: front-proxy-client-cert
111+
secret:
112+
secretName: karmada-apiserver-front-proxy-client-cert
113+
- name: service-account-key-pair
114+
secret:
115+
secretName: karmada-apiserver-service-account-key-pair
94116
dnsPolicy: ClusterFirstWithHostNet
95117
enableServiceLinks: true
96118
hostNetwork: true
@@ -104,10 +126,6 @@ spec:
104126
tolerations:
105127
- effect: NoExecute
106128
operator: Exists
107-
volumes:
108-
- name: karmada-certs
109-
secret:
110-
secretName: karmada-cert-secret
111129
---
112130
apiVersion: v1
113131
kind: Service

Diff for: ‎artifacts/deploy/karmada-webhook-cert-secret.yaml renamed to ‎artifacts/deploy/karmada-ca-cert-secret.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
apiVersion: v1
22
kind: Secret
33
metadata:
4-
name: webhook-cert
4+
name: ${component}-ca-cert
55
namespace: karmada-system
66
type: kubernetes.io/tls
77
data:
88
tls.crt: |
9-
{{server_certificate}}
9+
${ca_crt}
1010
tls.key: |
11-
{{server_key}}
11+
${ca_key}

Diff for: ‎artifacts/deploy/karmada-cert-secret.yaml

+7-29
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,13 @@
11
apiVersion: v1
22
kind: Secret
33
metadata:
4-
name: karmada-cert-secret
4+
name: ${name}-cert
55
namespace: karmada-system
6-
type: Opaque
6+
type: kubernetes.io/tls
77
data:
88
ca.crt: |
9-
{{ca_crt}}
10-
ca.key: |
11-
{{ca_key}}
12-
karmada.crt: |
13-
{{client_crt}}
14-
karmada.key: |
15-
{{client_key}}
16-
apiserver.crt: |
17-
{{apiserver_crt}}
18-
apiserver.key: |
19-
{{apiserver_key}}
20-
front-proxy-ca.crt: |
21-
{{front_proxy_ca_crt}}
22-
front-proxy-client.crt: |
23-
{{front_proxy_client_crt}}
24-
front-proxy-client.key: |
25-
{{front_proxy_client_key}}
26-
etcd-ca.crt: |
27-
{{etcd_ca_crt}}
28-
etcd-server.crt: |
29-
{{etcd_server_crt}}
30-
etcd-server.key: |
31-
{{etcd_server_key}}
32-
etcd-client.crt: |
33-
{{etcd_client_crt}}
34-
etcd-client.key: |
35-
{{etcd_client_key}}
9+
${ca_crt}
10+
tls.crt: |
11+
${tls_crt}
12+
tls.key: |
13+
${tls_key}

Diff for: ‎artifacts/deploy/karmada-descheduler.yaml

+7-7
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,9 @@ spec:
2828
- --kubeconfig=/etc/karmada/config/karmada.config
2929
- --metrics-bind-address=0.0.0.0:8080
3030
- --health-probe-bind-address=0.0.0.0:10358
31-
- --scheduler-estimator-ca-file=/etc/karmada/pki/ca.crt
32-
- --scheduler-estimator-cert-file=/etc/karmada/pki/karmada.crt
33-
- --scheduler-estimator-key-file=/etc/karmada/pki/karmada.key
31+
- --scheduler-estimator-ca-file=/etc/karmada/pki/scheduler-estimator-client/ca.crt
32+
- --scheduler-estimator-cert-file=/etc/karmada/pki/scheduler-estimator-client/tls.crt
33+
- --scheduler-estimator-key-file=/etc/karmada/pki/scheduler-estimator-client/tls.key
3434
- --v=4
3535
livenessProbe:
3636
httpGet:
@@ -48,13 +48,13 @@ spec:
4848
volumeMounts:
4949
- name: karmada-config
5050
mountPath: /etc/karmada/config
51-
- name: karmada-certs
52-
mountPath: /etc/karmada/pki
51+
- name: scheduler-estimator-client-cert
52+
mountPath: /etc/karmada/pki/scheduler-estimator-client
5353
readOnly: true
5454
volumes:
5555
- name: karmada-config
5656
secret:
5757
secretName: karmada-descheduler-config
58-
- name: karmada-certs
58+
- name: scheduler-estimator-client-cert
5959
secret:
60-
secretName: karmada-cert-secret
60+
secretName: karmada-descheduler-scheduler-estimator-client-cert

Diff for: ‎artifacts/deploy/karmada-etcd.yaml

+18-13
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ spec:
4040
command:
4141
- /bin/sh
4242
- -ec
43-
- 'etcdctl get /registry --prefix --keys-only --endpoints https://127.0.0.1:2379 --cacert /etc/karmada/pki/etcd-ca.crt --cert /etc/karmada/pki/etcd-server.crt --key /etc/karmada/pki/etcd-server.key'
43+
- 'etcdctl get /registry --prefix --keys-only --endpoints https://127.0.0.1:2379 --cacert /etc/karmada/pki/etcd-client/ca.crt --cert /etc/karmada/pki/etcd-client/tls.crt --key /etc/karmada/pki/etcd-client/tls.key'
4444
failureThreshold: 3
4545
initialDelaySeconds: 600
4646
periodSeconds: 60
@@ -53,11 +53,6 @@ spec:
5353
- containerPort: 2380
5454
name: server
5555
protocol: TCP
56-
volumeMounts:
57-
- mountPath: /var/lib/etcd
58-
name: etcd-data
59-
- mountPath: /etc/karmada/pki
60-
name: etcd-certs
6156
resources:
6257
requests:
6358
cpu: 100m
@@ -76,24 +71,34 @@ spec:
7671
- etcd0=http://etcd-0.etcd.karmada-system.svc.cluster.local:2380
7772
- --initial-cluster-state
7873
- new
79-
- --cert-file=/etc/karmada/pki/etcd-server.crt
8074
- --client-cert-auth=true
81-
- --key-file=/etc/karmada/pki/etcd-server.key
82-
- --trusted-ca-file=/etc/karmada/pki/etcd-ca.crt
75+
- --cert-file=/etc/karmada/pki/server/tls.crt
76+
- --key-file=/etc/karmada/pki/server/tls.key
77+
- --trusted-ca-file=/etc/karmada/pki/server/ca.crt
8378
- --data-dir=/var/lib/etcd
8479
- --snapshot-count=10000
8580
# Setting Golang's secure cipher suites as etcd's cipher suites.
8681
# They are obtained by the return value of the function CipherSuites() under the go/src/crypto/tls/cipher_suites.go package.
8782
# Consistent with the Preferred values of k8s’s default cipher suites.
8883
- --cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
84+
volumeMounts:
85+
- name: etcd-data
86+
mountPath: /var/lib/etcd
87+
- name: server-cert
88+
mountPath: /etc/karmada/pki/server
89+
- name: etcd-client-cert
90+
mountPath: /etc/karmada/pki/etcd-client
8991
volumes:
90-
- hostPath:
92+
- name: etcd-data
93+
hostPath:
9194
path: /var/lib/karmada-etcd
9295
type: DirectoryOrCreate
93-
name: etcd-data
94-
- name: etcd-certs
96+
- name: server-cert
97+
secret:
98+
secretName: etcd-cert
99+
- name: etcd-client-cert
95100
secret:
96-
secretName: karmada-cert-secret
101+
secretName: etcd-etcd-client-cert
97102
---
98103

99104
apiVersion: v1

Diff for: ‎artifacts/deploy/karmada-key-pair-secret.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: ${component}-service-account-key-pair
5+
namespace: karmada-system
6+
type: Opaque
7+
data:
8+
sa.pub: |
9+
${sa_pub}
10+
sa.key: |
11+
${sa_key}

Diff for: ‎artifacts/deploy/karmada-metrics-adapter.yaml

+7-7
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@ spec:
2929
- --kubeconfig=/etc/karmada/config/karmada.config
3030
- --authentication-kubeconfig=/etc/karmada/config/karmada.config
3131
- --authorization-kubeconfig=/etc/karmada/config/karmada.config
32-
- --client-ca-file=/etc/karmada/pki/ca.crt
33-
- --tls-cert-file=/etc/karmada/pki/karmada.crt
34-
- --tls-private-key-file=/etc/karmada/pki/karmada.key
32+
- --client-ca-file=/etc/karmada/pki/server/ca.crt
33+
- --tls-cert-file=/etc/karmada/pki/server/tls.crt
34+
- --tls-private-key-file=/etc/karmada/pki/server/tls.key
3535
- --audit-log-path=-
3636
- --audit-log-maxage=0
3737
- --audit-log-maxbackup=0
@@ -60,16 +60,16 @@ spec:
6060
volumeMounts:
6161
- name: karmada-config
6262
mountPath: /etc/karmada/config
63-
- name: karmada-certs
64-
mountPath: /etc/karmada/pki
63+
- name: server-cert
64+
mountPath: /etc/karmada/pki/server
6565
readOnly: true
6666
volumes:
6767
- name: karmada-config
6868
secret:
6969
secretName: karmada-metrics-adapter-config
70-
- name: karmada-certs
70+
- name: server-cert
7171
secret:
72-
secretName: karmada-cert-secret
72+
secretName: karmada-metrics-adapter-cert
7373
---
7474
apiVersion: v1
7575
kind: Service

Diff for: ‎artifacts/deploy/karmada-scheduler-estimator.yaml

+7-7
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@ spec:
2727
- /bin/karmada-scheduler-estimator
2828
- --kubeconfig=/etc/{{member_cluster_name}}-kubeconfig
2929
- --cluster-name={{member_cluster_name}}
30-
- --grpc-auth-cert-file=/etc/karmada/pki/karmada.crt
31-
- --grpc-auth-key-file=/etc/karmada/pki/karmada.key
32-
- --grpc-client-ca-file=/etc/karmada/pki/ca.crt
30+
- --grpc-auth-cert-file=/etc/karmada/pki/server/tls.crt
31+
- --grpc-auth-key-file=/etc/karmada/pki/server/tls.key
32+
- --grpc-client-ca-file=/etc/karmada/pki/server/ca.crt
3333
- --metrics-bind-address=0.0.0.0:8080
3434
- --health-probe-bind-address=0.0.0.0:10351
3535
livenessProbe:
@@ -46,16 +46,16 @@ spec:
4646
name: metrics
4747
protocol: TCP
4848
volumeMounts:
49-
- name: karmada-certs
50-
mountPath: /etc/karmada/pki
49+
- name: server-cert
50+
mountPath: /etc/karmada/pki/server
5151
readOnly: true
5252
- name: member-kubeconfig
5353
subPath: {{member_cluster_name}}-kubeconfig
5454
mountPath: /etc/{{member_cluster_name}}-kubeconfig
5555
volumes:
56-
- name: karmada-certs
56+
- name: server-cert
5757
secret:
58-
secretName: karmada-cert-secret
58+
secretName: karmada-metrics-adapter-cert
5959
- name: member-kubeconfig
6060
secret:
6161
secretName: {{member_cluster_name}}-kubeconfig

Diff for: ‎artifacts/deploy/karmada-scheduler.yaml

+7-7
Original file line numberDiff line numberDiff line change
@@ -42,20 +42,20 @@ spec:
4242
- --metrics-bind-address=0.0.0.0:8080
4343
- --health-probe-bind-address=0.0.0.0:10351
4444
- --enable-scheduler-estimator=true
45-
- --scheduler-estimator-ca-file=/etc/karmada/pki/ca.crt
46-
- --scheduler-estimator-cert-file=/etc/karmada/pki/karmada.crt
47-
- --scheduler-estimator-key-file=/etc/karmada/pki/karmada.key
45+
- --scheduler-estimator-ca-file=/etc/karmada/pki/scheduler-estimator-client/ca.crt
46+
- --scheduler-estimator-cert-file=/etc/karmada/pki/scheduler-estimator-client/tls.crt
47+
- --scheduler-estimator-key-file=/etc/karmada/pki/scheduler-estimator-client/tls.key
4848
- --v=4
4949
volumeMounts:
5050
- name: karmada-config
5151
mountPath: /etc/karmada/config
52-
- name: karmada-certs
53-
mountPath: /etc/karmada/pki
52+
- name: scheduler-estimator-client-cert
53+
mountPath: /etc/karmada/pki/scheduler-estimator-client
5454
readOnly: true
5555
volumes:
5656
- name: karmada-config
5757
secret:
5858
secretName: karmada-scheduler-config
59-
- name: karmada-certs
59+
- name: scheduler-estimator-client-cert
6060
secret:
61-
secretName: karmada-cert-secret
61+
secretName: karmada-scheduler-scheduler-estimator-client-cert

0 commit comments

Comments
 (0)