{"action":"closed","number":414,"pull_request":{"url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/pulls/414","id":110755657,"html_url":"https://github.com/kubernetes-incubator/kube-aws/pull/414","diff_url":"https://github.com/kubernetes-incubator/kube-aws/pull/414.diff","patch_url":"https://github.com/kubernetes-incubator/kube-aws/pull/414.patch","issue_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/issues/414","number":414,"state":"closed","locked":false,"title":"[wip] Kubelet TLS bootstrapping","user":{"login":"danielfm","id":29534,"avatar_url":"https://avatars1.githubusercontent.com/u/29534?v=3","gravatar_id":"","url":"https://api.github.com/users/danielfm","html_url":"https://github.com/danielfm","followers_url":"https://api.github.com/users/danielfm/followers","following_url":"https://api.github.com/users/danielfm/following{/other_user}","gists_url":"https://api.github.com/users/danielfm/gists{/gist_id}","starred_url":"https://api.github.com/users/danielfm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielfm/subscriptions","organizations_url":"https://api.github.com/users/danielfm/orgs","repos_url":"https://api.github.com/users/danielfm/repos","events_url":"https://api.github.com/users/danielfm/events{/privacy}","received_events_url":"https://api.github.com/users/danielfm/received_events","type":"User","site_admin":false},"body":"This PR introduces an experimental feature for provisioning TLS certificates for worker nodes via the also experimental [certificate signing requests](https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/) workflow. Since this workflow is used by kube-adm, I think we can rest assured it won't be dropped anytime soon.\r\n\r\nIf RBAC is enabled in `cluster.yaml`, I also made sure to set up the appropriate cluster role bindings so that the token used for sending the certificate signing requests can only make requests related to certificate provisioning, as instructed by the official documentation.\r\n\r\nThe work is not complete, though. For now, I hard-coded the access token used in the bootstrap process, so I need some pointers regarding how to implement this properly. I think we have two options here:\r\n\r\n1. Generate a token file, i.e. `./credentials/csr-token`, and handle it the same way we do with certificates, which is generating/encrypting when running `kube-aws render credentials` and `kube-aws up`, and handling the decryption in userdata templates\r\n2. Take a more generic approach by allowing the cluster administrator to specify a [CSV token file](https://kubernetes.io/docs/admin/authentication/#static-token-file), i.e. `./credentials/tokens.csv`, (we can even generate a minimal one in `kube-aws render credentials`) in which he/she could add as many entries as needed alongside the one needed by the TLS bootstrap...\r\n\r\n```csv\r\n<csr-token>,kubelet-bootstrap,10001,\"system:kubelet-bootstrap\"\r\n<some-token>,<username>,<id>,<groups>\r\n```\r\n\r\n...and have it encrypted/decrypted the usual way.\r\n\r\nThe first option is more to-the-point, but IMO the second option has the nice advantage of allowing the cluster administrator to manage other tokens for other purposes, perhaps even as the main authentication strategy for the cluster (e.g. by issuing tokens for other users and controlling who does what via RBAC).\r\n\r\nCould you guys share your opinions on this so I can proceed?\r\n\r\nCloses #406.","created_at":"2017-03-15T02:10:41Z","updated_at":"2017-03-23T17:10:42Z","closed_at":"2017-03-23T17:10:42Z","merged_at":null,"merge_commit_sha":"216bf7bc169bfd9e0de851e253a34adc7e83e494","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/pulls/414/commits","review_comments_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/pulls/414/comments","review_comment_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/issues/414/comments","statuses_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/statuses/bdae02017bd3d6081667fee0bfda87c805710f07","head":{"label":"danielfm:cluster-tls-bootstrap","ref":"cluster-tls-bootstrap","sha":"bdae02017bd3d6081667fee0bfda87c805710f07","user":{"login":"danielfm","id":29534,"avatar_url":"https://avatars1.githubusercontent.com/u/29534?v=3","gravatar_id":"","url":"https://api.github.com/users/danielfm","html_url":"https://github.com/danielfm","followers_url":"https://api.github.com/users/danielfm/followers","following_url":"https://api.github.com/users/danielfm/following{/other_user}","gists_url":"https://api.github.com/users/danielfm/gists{/gist_id}","starred_url":"https://api.github.com/users/danielfm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielfm/subscriptions","organizations_url":"https://api.github.com/users/danielfm/orgs","repos_url":"https://api.github.com/users/danielfm/repos","events_url":"https://api.github.com/users/danielfm/events{/privacy}","received_events_url":"https://api.github.com/users/danielfm/received_events","type":"User","site_admin":false},"repo":{"id":75734356,"name":"kube-aws","full_name":"danielfm/kube-aws","owner":{"login":"danielfm","id":29534,"avatar_url":"https://avatars1.githubusercontent.com/u/29534?v=3","gravatar_id":"","url":"https://api.github.com/users/danielfm","html_url":"https://github.com/danielfm","followers_url":"https://api.github.com/users/danielfm/followers","following_url":"https://api.github.com/users/danielfm/following{/other_user}","gists_url":"https://api.github.com/users/danielfm/gists{/gist_id}","starred_url":"https://api.github.com/users/danielfm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielfm/subscriptions","organizations_url":"https://api.github.com/users/danielfm/orgs","repos_url":"https://api.github.com/users/danielfm/repos","events_url":"https://api.github.com/users/danielfm/events{/privacy}","received_events_url":"https://api.github.com/users/danielfm/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/danielfm/kube-aws","description":"Kubernetes on AWS (kube-aws)","fork":true,"url":"https://api.github.com/repos/danielfm/kube-aws","forks_url":"https://api.github.com/repos/danielfm/kube-aws/forks","keys_url":"https://api.github.com/repos/danielfm/kube-aws/keys{/key_id}","collaborators_url":"https://api.github.com/repos/danielfm/kube-aws/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/danielfm/kube-aws/teams","hooks_url":"https://api.github.com/repos/danielfm/kube-aws/hooks","issue_events_url":"https://api.github.com/repos/danielfm/kube-aws/issues/events{/number}","events_url":"https://api.github.com/repos/danielfm/kube-aws/events","assignees_url":"https://api.github.com/repos/danielfm/kube-aws/assignees{/user}","branches_url":"https://api.github.com/repos/danielfm/kube-aws/branches{/branch}","tags_url":"https://api.github.com/repos/danielfm/kube-aws/tags","blobs_url":"https://api.github.com/repos/danielfm/kube-aws/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/danielfm/kube-aws/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/danielfm/kube-aws/git/refs{/sha}","trees_url":"https://api.github.com/repos/danielfm/kube-aws/git/trees{/sha}","statuses_url":"https://api.github.com/repos/danielfm/kube-aws/statuses/{sha}","languages_url":"https://api.github.com/repos/danielfm/kube-aws/languages","stargazers_url":"https://api.github.com/repos/danielfm/kube-aws/stargazers","contributors_url":"https://api.github.com/repos/danielfm/kube-aws/contributors","subscribers_url":"https://api.github.com/repos/danielfm/kube-aws/subscribers","subscription_url":"https://api.github.com/repos/danielfm/kube-aws/subscription","commits_url":"https://api.github.com/repos/danielfm/kube-aws/commits{/sha}","git_commits_url":"https://api.github.com/repos/danielfm/kube-aws/git/commits{/sha}","comments_url":"https://api.github.com/repos/danielfm/kube-aws/comments{/number}","issue_comment_url":"https://api.github.com/repos/danielfm/kube-aws/issues/comments{/number}","contents_url":"https://api.github.com/repos/danielfm/kube-aws/contents/{+path}","compare_url":"https://api.github.com/repos/danielfm/kube-aws/compare/{base}...{head}","merges_url":"https://api.github.com/repos/danielfm/kube-aws/merges","archive_url":"https://api.github.com/repos/danielfm/kube-aws/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/danielfm/kube-aws/downloads","issues_url":"https://api.github.com/repos/danielfm/kube-aws/issues{/number}","pulls_url":"https://api.github.com/repos/danielfm/kube-aws/pulls{/number}","milestones_url":"https://api.github.com/repos/danielfm/kube-aws/milestones{/number}","notifications_url":"https://api.github.com/repos/danielfm/kube-aws/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/danielfm/kube-aws/labels{/name}","releases_url":"https://api.github.com/repos/danielfm/kube-aws/releases{/id}","deployments_url":"https://api.github.com/repos/danielfm/kube-aws/deployments","created_at":"2016-12-06T13:34:56Z","updated_at":"2017-03-21T14:49:44Z","pushed_at":"2017-03-23T17:09:42Z","git_url":"git://github.com/danielfm/kube-aws.git","ssh_url":"git@github.com:danielfm/kube-aws.git","clone_url":"https://github.com/danielfm/kube-aws.git","svn_url":"https://github.com/danielfm/kube-aws","homepage":"","size":24390,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"coreos:master","ref":"master","sha":"cdf0ef7454bd0ebac2fe859a56f72126f7290758","user":{"login":"coreos","id":3730757,"avatar_url":"https://avatars0.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"repo":{"id":70860688,"name":"kube-aws","full_name":"kubernetes-incubator/kube-aws","owner":{"login":"kubernetes-incubator","id":20862812,"avatar_url":"https://avatars1.githubusercontent.com/u/20862812?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes-incubator","html_url":"https://github.com/kubernetes-incubator","followers_url":"https://api.github.com/users/kubernetes-incubator/followers","following_url":"https://api.github.com/users/kubernetes-incubator/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes-incubator/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes-incubator/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes-incubator/subscriptions","organizations_url":"https://api.github.com/users/kubernetes-incubator/orgs","repos_url":"https://api.github.com/users/kubernetes-incubator/repos","events_url":"https://api.github.com/users/kubernetes-incubator/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes-incubator/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes-incubator/kube-aws","description":"Kubernetes on AWS (kube-aws)","fork":false,"url":"https://api.github.com/repos/kubernetes-incubator/kube-aws","forks_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/forks","keys_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/teams","hooks_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/hooks","issue_events_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/events","assignees_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/tags","blobs_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/languages","stargazers_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/stargazers","contributors_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/contributors","subscribers_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/subscribers","subscription_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/subscription","commits_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/merges","archive_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/downloads","issues_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes-incubator/kube-aws/deployments","created_at":"2016-10-14T00:57:33Z","updated_at":"2017-03-23T10:19:06Z","pushed_at":"2017-03-23T15:44:53Z","git_url":"git://github.com/kubernetes-incubator/kube-aws.git","ssh_url":"git@github.com:kubernetes-incubator/kube-aws.git","clone_url":"https://github.com/kubernetes-incubator/kube-aws.git","svn_url":"https://github.com/kubernetes-incubator/kube-aws","homepage":"","size":24382,"stargazers_count":266,"watchers_count":266,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":82,"mirror_url":null,"open_issues_count":71,"forks":82,"open_issues":71,"watchers":266,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes-incubator/kube-aws/pulls/414"},"html":{"href":"https://github.com/kubernetes-incubator/kube-aws/pull/414"},"issue":{"href":"https://api.github.com/repos/kubernetes-incubator/kube-aws/issues/414"},"comments":{"href":"https://api.github.com/repos/kubernetes-incubator/kube-aws/issues/414/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes-incubator/kube-aws/pulls/414/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes-incubator/kube-aws/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes-incubator/kube-aws/pulls/414/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes-incubator/kube-aws/statuses/bdae02017bd3d6081667fee0bfda87c805710f07"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":11,"review_comments":0,"maintainer_can_modify":false,"commits":0,"additions":0,"deletions":0,"changed_files":0}}
{"actor":{"display_login":"danielfm"}}