Node Secrets

[gambol99]

As present a number of secrets are downloaded to the /src/kubernetes directory regardless of role (master, node). This limits the the node role to only donwload the ca.crt. The rest are for master nodes only

• removes basic_auth.csv, ca.key, known_tokens.csv, server.cert and server.key leaving only the ca.crt

core@ip-10-250-33-77 /srv/kubernetes $ ls
basic_auth.csv  ca.crt  ca.key  known_tokens.csv  server.cert  server.key

relates to #2832

[k8s-ci-robot]

Hi @gambol99. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[chrislovecnm]

/ok-to-test

Let's wait tulle 1.7.1 for this but LGTM

[gambol99]

/test pull-kops-e2e-kubernetes-aws

[gambol99]

hi @chrislovecnm ... the e2e are failed on using v1.8.0-alpha.2.901+04c863cb1d8939 image ... Can you give some points how to better debug this locally?

[chrislovecnm]

You need to do a full build and test this. Take a look at the upload target and then set you kops base URL.

There is a script under hack that has all of the env variables and commands. The script does have a bug, do not run make test before a build, has to be ran after.

[gambol99]

/test pull-kops-e2e-kubernetes-aws

[gambol99]

thanks @chrislovecnm ... i think i've fixed the issue .. it was my reduction of the code and i was using pulling certs rather key and saving server.key ... I'm thinking about along side this, albeit a different PR, changing the iam policy to limit on what the compute nodes are get as well ...

[chrislovecnm]

I already have a PR that reworks the IAM policies. It is sitting in flux because we will really mess up some peoples installs. I will probably refactor it and put it behind a feature flag.

Let me know if that PR meets your needs, or if you are referring to something else.

[justinsb]

/lgtm

Thanks @gambol99 - nice improvement, and will help us as we lock down these secrets to know they aren't used on the nodes.

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gambol99, justinsb

Associated issue: 2832

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• OWNERS [justinsb]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[k8s-github-robot]

Automatic merge from submit-queue