Skip to content

Commit 0dbe7e4

Browse files
hasbro17hasbro17
committed
tls: add SignerKeyParams asset to decouple signer certs from InstallConfig
The TLS refactor for configurable PKI added InstallConfig as a dependency to 4 signer certificates that previously had none. This broke codepaths that generate signer certs without an install-config on disk, such as `agent create certificates` (used by set-node-zero.sh in UI-based agent installs) and `node-joiner add-nodes`. Introduce a SignerKeyParams WritableAsset that wraps the InstallConfig dependency. When no install-config is on disk, its Load() returns defaults (nil PKIConfig = RSA-2048), short-circuiting the asset store before it tries to generate InstallConfig interactively. When an install-config is present, Generate() reads the actual PKI config. Assisted-by: Claude Code (Opus 4.6)
1 parent 68341be commit 0dbe7e4

3 files changed

Lines changed: 78 additions & 18 deletions

File tree

‎pkg/asset/tls/adminkubeconfig.go‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@ import (
66
"crypto/x509/pkix"
77

88
"github.com/openshift/installer/pkg/asset"
9-
"github.com/openshift/installer/pkg/asset/installconfig"
10-
pkidefaults "github.com/openshift/installer/pkg/types/pki"
119
)
1210

1311
// AdminKubeConfigSignerCertKey is a key/cert pair that signs the admin kubeconfig client certs.
@@ -19,21 +17,21 @@ var _ asset.WritableAsset = (*AdminKubeConfigSignerCertKey)(nil)
1917

2018
// Dependencies returns the dependency of the root-ca, which is empty.
2119
func (c *AdminKubeConfigSignerCertKey) Dependencies() []asset.Asset {
22-
return []asset.Asset{&installconfig.InstallConfig{}}
20+
return []asset.Asset{&SignerKeyParams{}}
2321
}
2422

2523
// Generate generates the root-ca key and cert pair.
2624
func (c *AdminKubeConfigSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
27-
installConfig := &installconfig.InstallConfig{}
28-
parents.Get(installConfig)
25+
signerKeyParams := &SignerKeyParams{}
26+
parents.Get(signerKeyParams)
2927
cfg := &CertCfg{
3028
Subject: pkix.Name{CommonName: "admin-kubeconfig-signer", OrganizationalUnit: []string{"openshift"}},
3129
// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
3230
Validity: ValidityTenYears(),
3331
IsCA: true,
3432
}
3533

36-
return c.SelfSignedCertKey.Generate(ctx, cfg, "admin-kubeconfig-signer", pkidefaults.EffectiveSignerPKIConfig(installConfig.Config))
34+
return c.SelfSignedCertKey.Generate(ctx, cfg, "admin-kubeconfig-signer", signerKeyParams.PKIConfig)
3735
}
3836

3937
// Load reads the asset files from disk.

‎pkg/asset/tls/apiserver.go‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -119,21 +119,21 @@ var _ asset.WritableAsset = (*KubeAPIServerLocalhostSignerCertKey)(nil)
119119

120120
// Dependencies returns the dependency of the root-ca, which is empty.
121121
func (c *KubeAPIServerLocalhostSignerCertKey) Dependencies() []asset.Asset {
122-
return []asset.Asset{&installconfig.InstallConfig{}}
122+
return []asset.Asset{&SignerKeyParams{}}
123123
}
124124

125125
// Generate generates the root-ca key and cert pair.
126126
func (c *KubeAPIServerLocalhostSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
127-
installConfig := &installconfig.InstallConfig{}
128-
parents.Get(installConfig)
127+
signerKeyParams := &SignerKeyParams{}
128+
parents.Get(signerKeyParams)
129129
cfg := &CertCfg{
130130
Subject: pkix.Name{CommonName: "kube-apiserver-localhost-signer", OrganizationalUnit: []string{"openshift"}},
131131
// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
132132
Validity: ValidityTenYears(),
133133
IsCA: true,
134134
}
135135

136-
return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-localhost-signer", pkidefaults.EffectiveSignerPKIConfig(installConfig.Config))
136+
return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-localhost-signer", signerKeyParams.PKIConfig)
137137
}
138138

139139
// Load reads the asset files from disk.
@@ -225,21 +225,21 @@ var _ asset.WritableAsset = (*KubeAPIServerServiceNetworkSignerCertKey)(nil)
225225

226226
// Dependencies returns the dependency of the root-ca, which is empty.
227227
func (c *KubeAPIServerServiceNetworkSignerCertKey) Dependencies() []asset.Asset {
228-
return []asset.Asset{&installconfig.InstallConfig{}}
228+
return []asset.Asset{&SignerKeyParams{}}
229229
}
230230

231231
// Generate generates the root-ca key and cert pair.
232232
func (c *KubeAPIServerServiceNetworkSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
233-
installConfig := &installconfig.InstallConfig{}
234-
parents.Get(installConfig)
233+
signerKeyParams := &SignerKeyParams{}
234+
parents.Get(signerKeyParams)
235235
cfg := &CertCfg{
236236
Subject: pkix.Name{CommonName: "kube-apiserver-service-network-signer", OrganizationalUnit: []string{"openshift"}},
237237
// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
238238
Validity: ValidityTenYears(),
239239
IsCA: true,
240240
}
241241

242-
return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-service-network-signer", pkidefaults.EffectiveSignerPKIConfig(installConfig.Config))
242+
return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-service-network-signer", signerKeyParams.PKIConfig)
243243
}
244244

245245
// Load reads the asset files from disk.
@@ -340,21 +340,21 @@ var _ asset.WritableAsset = (*KubeAPIServerLBSignerCertKey)(nil)
340340

341341
// Dependencies returns the dependency of the root-ca, which is empty.
342342
func (c *KubeAPIServerLBSignerCertKey) Dependencies() []asset.Asset {
343-
return []asset.Asset{&installconfig.InstallConfig{}}
343+
return []asset.Asset{&SignerKeyParams{}}
344344
}
345345

346346
// Generate generates the root-ca key and cert pair.
347347
func (c *KubeAPIServerLBSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
348-
installConfig := &installconfig.InstallConfig{}
349-
parents.Get(installConfig)
348+
signerKeyParams := &SignerKeyParams{}
349+
parents.Get(signerKeyParams)
350350
cfg := &CertCfg{
351351
Subject: pkix.Name{CommonName: "kube-apiserver-lb-signer", OrganizationalUnit: []string{"openshift"}},
352352
// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
353353
Validity: ValidityTenYears(),
354354
IsCA: true,
355355
}
356356

357-
return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-lb-signer", pkidefaults.EffectiveSignerPKIConfig(installConfig.Config))
357+
return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-lb-signer", signerKeyParams.PKIConfig)
358358
}
359359

360360
// Load reads the asset files from disk.

‎pkg/asset/tls/signerkey_params.go‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
package tls
2+
3+
import (
4+
"context"
5+
"os"
6+
7+
"github.com/openshift/installer/pkg/asset"
8+
"github.com/openshift/installer/pkg/asset/installconfig"
9+
"github.com/openshift/installer/pkg/types"
10+
pkidefaults "github.com/openshift/installer/pkg/types/pki"
11+
)
12+
13+
// SignerKeyParams resolves the effective PKI configuration for signer
14+
// certificates. It wraps InstallConfig so that signer certs can be generated
15+
// without an install-config on disk (e.g. agent create certificates,
16+
// node-joiner add-nodes). When no install-config is present, Load returns
17+
// defaults (nil PKIConfig = RSA-2048).
18+
type SignerKeyParams struct {
19+
PKIConfig *types.PKIConfig
20+
}
21+
22+
var _ asset.WritableAsset = (*SignerKeyParams)(nil)
23+
24+
// Name returns a human-friendly name for the asset.
25+
func (*SignerKeyParams) Name() string {
26+
return "Signer Key Parameters"
27+
}
28+
29+
// Dependencies returns the dependency on InstallConfig.
30+
func (*SignerKeyParams) Dependencies() []asset.Asset {
31+
return []asset.Asset{
32+
&installconfig.InstallConfig{},
33+
}
34+
}
35+
36+
// Generate reads the PKI configuration from InstallConfig.
37+
func (s *SignerKeyParams) Generate(_ context.Context, parents asset.Parents) error {
38+
installConfig := &installconfig.InstallConfig{}
39+
parents.Get(installConfig)
40+
s.PKIConfig = pkidefaults.EffectiveSignerPKIConfig(installConfig.Config)
41+
return nil
42+
}
43+
44+
// Files returns nil — this asset has no on-disk representation.
45+
func (*SignerKeyParams) Files() []*asset.File {
46+
return nil
47+
}
48+
49+
// Load checks whether an install-config exists on disk. If it does, returns
50+
// false so that Generate runs and reads the actual PKI configuration. If no
51+
// install-config is present, returns true with nil PKIConfig (RSA-2048
52+
// defaults), which prevents the asset store from trying to generate
53+
// InstallConfig interactively.
54+
func (s *SignerKeyParams) Load(f asset.FileFetcher) (bool, error) {
55+
// Matches installConfigFilename in pkg/asset/installconfig/installconfig.go.
56+
if _, err := f.FetchByName("install-config.yaml"); err == nil {
57+
return false, nil
58+
} else if !os.IsNotExist(err) {
59+
return false, err
60+
}
61+
return true, nil
62+
}

0 commit comments

Comments
 (0)