feat: add localhost and 127.0.0.1 to certificates #243
Conversation
Codecov Report
@@ Coverage Diff @@
## master #243 +/- ##
==========================================
- Coverage 53.21% 53.21% -0.01%
==========================================
Files 95 95
Lines 14248 14235 -13
==========================================
- Hits 7582 7575 -7
+ Misses 6001 5995 -6
Partials 665 665 |
|
@khenidak Curious for your thoughts on this one. Does this seem like a sane path we should allow? |
|
@tariq1890 you're right, I fixed that. |
sylr
force-pushed
the
cert-localhost
branch
2 times, most recently
from
344d226 to
7e39c68
Compare
|
@sylr We'll need to circle back a bit . You'll need to append "localhost " to this slice Once that is done. You can remove all of the append statements in |
pkg/helpers/pki.go
Outdated
| @@ -88,7 +88,11 @@ func CreatePki(extraFQDNs []string, extraIPs []net.IP, clusterDomain string, caP | |||
| } | |||
|
|
|||
| group.Go(func() (err error) { | |||
| apiServerCertificate, apiServerPrivateKey, err = createCertificate("apiserver", caCertificate, caPrivateKey, false, true, extraFQDNs, extraIPs, nil) | |||
| ip := net.ParseIP("127.0.0.1").To4() | |||
There was a problem hiding this comment.
Please refer to my latest PR comment. If that is done, we won't need to do these kind of appends
Signed-off-by: Sylvain Rabot <s.rabot@lectra.com>
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jackfrancis, sylr The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Signed-off-by: Sylvain Rabot <s.rabot@lectra.com>
Signed-off-by: Sylvain Rabot <s.rabot@lectra.com>
Reason for Change:
There are some cases where we have pods on master nodes who needs to communicate with the API server (e.g.: cluster-autoscaler) but it cannot use the
kubernetes.defaultservice cause it will intermittently fail due to the fact that, if the request is forwarded by the service to the apiserver on the same node as it originated from, the request will never come back due toMartian sourcenetwork error.The way around that is to use host network and send request to localhost:443 but localhost is currently not part of the default domains in the certificates generated.
Issue Fixed:
Requirements:
Notes: