public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #1 from srhb/k8s-nodeauth

Browse Source 
nixos/k8s: Enable Node authorizer and NodeRestriction by default
This commit is contained in:
Roman Kuznetsov 2018-02-05 13:14:58 +01:00 committed by GitHub
commit f44a81e19f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
nixos/modules/services/cluster/kubernetes/default.nix
View File

@ -301,8 +301,8 @@ in {
Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
<link xlink:href="http://kubernetes.io/docs/admin/authorization.html"/> <link xlink:href="http://kubernetes.io/docs/admin/authorization.html"/>
''; '';
default = ["RBAC"]; default = ["RBAC" "Node"];
type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC"]); type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC" "Node"]);
}; };
authorizationPolicy = mkOption { authorizationPolicy = mkOption {
@ -344,7 +344,7 @@ in {
Kubernetes admission control plugins to use. See Kubernetes admission control plugins to use. See
<link xlink:href="http://kubernetes.io/docs/admin/admission-controllers/"/> <link xlink:href="http://kubernetes.io/docs/admin/admission-controllers/"/>
''; '';
default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota" "DefaultStorageClass" "DefaultTolerationSeconds"]; default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota" "DefaultStorageClass" "DefaultTolerationSeconds" "NodeRestriction"];
example = [ example = [
"NamespaceLifecycle" "NamespaceExists" "LimitRanger" "NamespaceLifecycle" "NamespaceExists" "LimitRanger"
"SecurityContextDeny" "ServiceAccount" "ResourceQuota" "SecurityContextDeny" "ServiceAccount" "ResourceQuota"

2
nixos/tests/kubernetes/base.nix
View File

@ -8,7 +8,7 @@ let
mkKubernetesBaseTest = mkKubernetesBaseTest =
{ name, domain ? "my.zyx", test, machines { name, domain ? "my.zyx", test, machines
, pkgs ? import <nixpkgs> { inherit system; } , pkgs ? import <nixpkgs> { inherit system; }
, certs ? import ./certs.nix { inherit pkgs; externalDomain = domain; } , certs ? import ./certs.nix { inherit pkgs; externalDomain = domain; kubelets = attrNames machines; }
, extraConfiguration ? null }: , extraConfiguration ? null }:
let let
masterName = head (filter (machineName: any (role: role == "master") machines.${machineName}.roles) (attrNames machines)); masterName = head (filter (machineName: any (role: role == "master") machines.${machineName}.roles) (attrNames machines));

11
nixos/tests/kubernetes/certs.nix
View File

@ -2,7 +2,8 @@
pkgs ? import <nixpkgs> {}, pkgs ? import <nixpkgs> {},
internalDomain ? "cloud.yourdomain.net", internalDomain ? "cloud.yourdomain.net",
externalDomain ? "myawesomecluster.cluster.yourdomain.net", externalDomain ? "myawesomecluster.cluster.yourdomain.net",
serviceClusterIp ? "10.0.0.1" serviceClusterIp ? "10.0.0.1",
kubelets
}: }:
let let
runWithCFSSL = name: cmd: runWithCFSSL = name: cmd:
@ -123,9 +124,10 @@ let
}; };
apiserver-client = { apiserver-client = {
kubelet = createClientCertKey { kubelet = hostname: createClientCertKey {
inherit ca; inherit ca;
cn = "apiserver-client-kubelet"; name = "apiserver-client-kubelet-${hostname}";
cn = "system:node:${hostname}.${externalDomain}";
groups = ["system:nodes"]; groups = ["system:nodes"];
}; };
@ -175,10 +177,9 @@ in {
paths = [ paths = [
(writeCFSSL (noKey ca)) (writeCFSSL (noKey ca))
(writeCFSSL kubelet) (writeCFSSL kubelet)
(writeCFSSL apiserver-client.kubelet)
(writeCFSSL apiserver-client.kube-proxy) (writeCFSSL apiserver-client.kube-proxy)
(writeCFSSL etcd-client) (writeCFSSL etcd-client)
]; ] ++ map (hostname: writeCFSSL (apiserver-client.kubelet hostname)) kubelets;
}; };
admin = writeCFSSL apiserver-client.admin; admin = writeCFSSL apiserver-client.admin;

2
nixos/tests/kubernetes/dns.nix
View File

@ -3,7 +3,7 @@ with import ./base.nix { inherit system; };
let let
domain = "my.zyx"; domain = "my.zyx";
certs = import ./certs.nix { externalDomain = domain; }; certs = import ./certs.nix { externalDomain = domain; kubelets = [ "machine1" "machine2" ]; };
redisPod = pkgs.writeText "redis-pod.json" (builtins.toJSON { redisPod = pkgs.writeText "redis-pod.json" (builtins.toJSON {
kind = "Pod"; kind = "Pod";

4
nixos/tests/kubernetes/kubernetes-common.nix
View File

@ -29,8 +29,8 @@ let
tlsKeyFile = "${certs.worker}/kubelet-key.pem"; tlsKeyFile = "${certs.worker}/kubelet-key.pem";
hostname = "${config.networking.hostName}.${config.networking.domain}"; hostname = "${config.networking.hostName}.${config.networking.domain}";
kubeconfig = { kubeconfig = {
certFile = "${certs.worker}/apiserver-client-kubelet.pem"; certFile = "${certs.worker}/apiserver-client-kubelet-${config.networking.hostName}.pem";
keyFile = "${certs.worker}/apiserver-client-kubelet-key.pem"; keyFile = "${certs.worker}/apiserver-client-kubelet-${config.networking.hostName}-key.pem";
}; };
}; };
controllerManager = { controllerManager = {