Skip to content

Commit 0d996d1

Browse files
tiansuo114tiansuo114
committed
test
Signed-off-by: tiansuo <zhaoyi_114@outlook.com>
1 parent ba5ffba commit 0d996d1

File tree

1 file changed

+118
-21
lines changed

1 file changed

+118
-21
lines changed

‎hack/deploy-karmada.sh

+118-21
Original file line numberDiff line numberDiff line change
@@ -95,37 +95,45 @@ function generate_cert_related_secrets {
9595
TEMP_PATH=$(mktemp -d)
9696
echo ${TEMP_PATH}
9797

98-
# 1. generate secret with secret cert
99-
generate_cert_secret karmada-apiserver ${karmada_ca} ${SERVER_CRT} ${SERVER_KEY}
100-
generate_cert_secret karmada-aggregated-apiserver ${karmada_ca} ${SERVER_CRT} ${SERVER_KEY}
101-
generate_cert_secret karmada-metrics-adapter ${karmada_ca} ${SERVER_CRT} ${SERVER_KEY}
102-
generate_cert_secret karmada-search ${karmada_ca} ${SERVER_CRT} ${SERVER_KEY}
103-
generate_cert_secret karmada-webhook ${karmada_ca} ${SERVER_CRT} ${SERVER_KEY}
104-
generate_cert_secret karmada-interpreter-webhook-example ${karmada_ca} ${SERVER_CRT} ${SERVER_KEY}
105-
generate_cert_secret karmada-scheduler-estimator ${karmada_ca} ${SERVER_CRT} ${SERVER_KEY}
98+
# 1. generate secret with server cert for each component
99+
generate_cert_secret karmada-apiserver ${karmada_ca} ${KARMADA_APISERVER_SERVER_CRT} ${KARMADA_APISERVER_SERVER_KEY}
100+
generate_cert_secret karmada-aggregated-apiserver ${karmada_ca} ${KARMADA_AGGREGATED_APISERVER_SERVER_CRT} ${KARMADA_AGGREGATED_APISERVER_SERVER_KEY}
101+
generate_cert_secret karmada-webhook ${karmada_ca} ${KARMADA_WEBHOOK_SERVER_CRT} ${KARMADA_WEBHOOK_SERVER_KEY}
102+
generate_cert_secret karmada-search ${karmada_ca} ${KARMADA_SEARCH_SERVER_CRT} ${KARMADA_SEARCH_SERVER_KEY}
103+
generate_cert_secret karmada-metrics-adapter ${karmada_ca} ${KARMADA_METRICS_ADAPTER_SERVER_CRT} ${KARMADA_METRICS_ADAPTER_SERVER_KEY}
104+
generate_cert_secret karmada-scheduler-estimator ${karmada_ca} ${KARMADA_SCHEDULER_ESTIMATOR_SERVER_CRT} ${KARMADA_SCHEDULER_ESTIMATOR_SERVER_KEY}
106105
generate_cert_secret etcd ${karmada_ca} ${ETCD_SERVER_CRT} ${ETCD_SERVER_KEY}
107106

108107
# 2. generate secret with client cert
109-
generate_cert_secret karmada-apiserver-etcd-client ${karmada_ca} ${ETCD_CLIENT_CRT} ${ETCD_CLIENT_KEY}
108+
generate_cert_secret karmada-apiserver-etcd-client ${karmada_ca} ${KARMADA_APISERVER_ETCD_CLIENT_CRT} ${KARMADA_APISERVER_ETCD_CLIENT_KEY}
110109
generate_cert_secret karmada-apiserver-front-proxy-client ${karmada_ca} ${FRONT_PROXY_CLIENT_CRT} ${FRONT_PROXY_CLIENT_KEY}
111-
generate_cert_secret karmada-aggregated-apiserver-etcd-client ${karmada_ca} ${ETCD_CLIENT_CRT} ${ETCD_CLIENT_KEY}
112-
generate_cert_secret karmada-search-etcd-client ${karmada_ca} ${ETCD_CLIENT_CRT} ${ETCD_CLIENT_KEY}
110+
generate_cert_secret karmada-aggregated-apiserver-etcd-client ${karmada_ca} ${KARMADA_AGGREGATED_APISERVER_ETCD_CLIENT_CRT} ${KARMADA_AGGREGATED_APISERVER_ETCD_CLIENT_KEY}
111+
generate_cert_secret karmada-search-etcd-client ${karmada_ca} ${KARMADA_SEARCH_ETCD_CLIENT_CRT} ${KARMADA_SEARCH_ETCD_CLIENT_KEY}
113112
generate_cert_secret etcd-etcd-client ${karmada_ca} ${ETCD_CLIENT_CRT} ${ETCD_CLIENT_KEY}
114-
generate_cert_secret karmada-scheduler-scheduler-estimator-client ${karmada_ca} ${CLIENT_CRT} ${CLIENT_KEY}
115-
generate_cert_secret karmada-descheduler-scheduler-estimator-client ${karmada_ca} ${CLIENT_CRT} ${CLIENT_KEY}
113+
generate_cert_secret karmada-scheduler-scheduler-estimator-client ${karmada_ca} ${KARMADA_SCHEDULER_GRPC_CRT} ${KARMADA_SCHEDULER_GRPC_KEY}
114+
generate_cert_secret karmada-descheduler-scheduler-estimator-client ${karmada_ca} ${KARMADA_DESCHEDULER_GRPC_CRT} ${KARMADA_DESCHEDULER_GRPC_KEY}
116115

117116
# 3. generate secret with ca cert or sa key
118117
generate_ca_cert_secret kube-controller-manager ${karmada_ca} ${karmada_ca_key}
119118
generate_key_pair_secret kube-controller-manager ${SA_PUB} ${SA_KEY}
120119
generate_key_pair_secret karmada-apiserver ${SA_PUB} ${SA_KEY}
121120

122-
# 4. generate secret with karmada config
123-
components=(karmada-aggregated-apiserver karmada-controller-manager kube-controller-manager karmada-scheduler karmada-descheduler karmada-metrics-adapter karmada-search karmada-webhook karmada-interpreter-webhook-example)
121+
# 5. generate secret with karmada config for each component using their specific client certs
122+
generate_config_secret karmada-aggregated-apiserver ${karmada_ca} ${KARMADA_AGGREGATED_APISERVER_CLIENT_CRT} ${KARMADA_AGGREGATED_APISERVER_CLIENT_KEY}
123+
generate_config_secret karmada-controller-manager ${karmada_ca} ${KARMADA_CONTROLLER_MANAGER_CLIENT_CRT} ${KARMADA_CONTROLLER_MANAGER_CLIENT_KEY}
124+
generate_config_secret karmada-scheduler ${karmada_ca} ${KARMADA_SCHEDULER_CLIENT_CRT} ${KARMADA_SCHEDULER_CLIENT_KEY}
125+
generate_config_secret karmada-descheduler ${karmada_ca} ${KARMADA_DESCHEDULER_CLIENT_CRT} ${KARMADA_DESCHEDULER_CLIENT_KEY}
126+
generate_config_secret karmada-metrics-adapter ${karmada_ca} ${KARMADA_METRICS_ADAPTER_CLIENT_CRT} ${KARMADA_METRICS_ADAPTER_CLIENT_KEY}
127+
generate_config_secret karmada-search ${karmada_ca} ${KARMADA_SEARCH_CLIENT_CRT} ${KARMADA_SEARCH_CLIENT_KEY}
128+
generate_config_secret karmada-webhook ${karmada_ca} ${KARMADA_WEBHOOK_CLIENT_CRT} ${KARMADA_WEBHOOK_CLIENT_KEY}
129+
130+
components=(kube-controller-manager karmada-interpreter-webhook-example)
124131
for component in "${components[@]}"
125132
do
126133
generate_config_secret ${component} ${karmada_ca} ${CLIENT_CRT} ${CLIENT_KEY}
127134
done
128135

136+
129137
rm -rf "${TEMP_PATH}"
130138
}
131139

@@ -187,13 +195,53 @@ util::cmd_must_exist "openssl"
187195
util::cmd_must_exist_cfssl ${CFSSL_VERSION}
188196
# create CA signers
189197
util::create_signing_certkey "" "${CERT_DIR}" ca karmada '"client auth","server auth"'
190-
# signs a certificate
198+
199+
191200
karmadaAltNames=("*.karmada-system.svc.cluster.local" "*.karmada-system.svc" "localhost" "127.0.0.1" $(util::get_apiserver_ip_from_kubeconfig "${HOST_CLUSTER_NAME}") "${interpreter_webhook_example_service_external_ip_address}")
201+
# Define SAN names for each server component
202+
karmada_apiserver_alt_names=("karmada-apiserver.karmada-system.svc.cluster.local" "karmada-apiserver.karmada-system.svc" "localhost" "127.0.0.1" $(util::get_apiserver_ip_from_kubeconfig "${HOST_CLUSTER_NAME}"))
203+
karmada_aggregated_apiserver_alt_names=("karmada-aggregated-apiserver.karmada-system.svc.cluster.local" "karmada-aggregated-apiserver.karmada-system.svc" "localhost" "127.0.0.1")
204+
karmada_webhook_alt_names=("karmada-webhook.karmada-system.svc.cluster.local" "karmada-webhook.karmada-system.svc" "localhost" "127.0.0.1")
205+
karmada_search_alt_names=("karmada-search.karmada-system.svc.cluster.local" "karmada-search.karmada-system.svc" "localhost" "127.0.0.1")
206+
karmada_metrics_adapter_alt_names=("karmada-metrics-adapter.karmada-system.svc.cluster.local" "karmada-metrics-adapter.karmada-system.svc" "localhost" "127.0.0.1")
207+
etcd_server_alt_names=("etcd.karmada-system.svc.cluster.local" "etcd.karmada-system.svc" "etcd-client.karmada-system.svc.cluster.local" "etcd-client.karmada-system.svc" "localhost" "127.0.0.1")
208+
192209
util::create_certkey "" "${CERT_DIR}" "ca" server server "" "${karmadaAltNames[@]}"
193210
util::create_certkey "" "${CERT_DIR}" "ca" client system:admin system:masters "${karmadaAltNames[@]}"
194-
util::create_certkey "" "${CERT_DIR}" "ca" front-proxy-client front-proxy-client "" "${karmadaAltNames[@]}"
195-
util::create_certkey "" "${CERT_DIR}" "ca" etcd-server etcd-server "" "${karmadaAltNames[@]}"
196-
util::create_certkey "" "${CERT_DIR}" "ca" etcd-client etcd-client "" "${karmadaAltNames[@]}"
211+
# Generate server certificates for server components
212+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-apiserver "system:karmada:karmada-apiserver" "" "${karmada_apiserver_alt_names[@]}"
213+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-aggregated-apiserver "system:karmada:karmada-aggregated-apiserver" "" "${karmada_aggregated_apiserver_alt_names[@]}"
214+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-webhook "system:karmada:karmada-webhook" "" "${karmada_webhook_alt_names[@]}"
215+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-search "system:karmada:karmada-search" "" "${karmada_search_alt_names[@]}"
216+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-metrics-adapter "system:karmada:karmada-metrics-adapter" "" "${karmada_metrics_adapter_alt_names[@]}"
217+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-scheduler-estimator "system:karmada:karmada-scheduler-estimator" "" "${karmadaAltNames[@]}"
218+
util::create_certkey "" "${CERT_DIR}" "ca" etcd-server "system:karmada:etcd-server" "" "${etcd_server_alt_names[@]}"
219+
220+
# Generate client certificates for client components (without SAN)
221+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-apiserver-client "system:karmada:karmada-apiserver" "system:masters"
222+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-aggregated-apiserver-client "system:karmada:karmada-aggregated-apiserver" "system:masters"
223+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-webhook-client "system:karmada:karmada-webhook" "system:masters"
224+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-search-client "system:karmada:karmada-search" "system:masters"
225+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-metrics-adapter-client "system:karmada:karmada-metrics-adapter" "system:masters"
226+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-scheduler-estimator-client "system:karmada:karmada-scheduler-estimator" "system:masters"
227+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-controller-manager-client "system:karmada:karmada-controller-manager" "system:masters"
228+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-scheduler-client "system:karmada:karmada-scheduler" "system:masters"
229+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-descheduler-client "system:karmada:karmada-descheduler" "system:masters"
230+
231+
# ETCD client certificates
232+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-apiserver-etcd-client "system:karmada:karmada-apiserver-etcd-client" "system:masters"
233+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-aggregated-apiserver-etcd-client "system:karmada:karmada-aggregated-apiserver-etcd-client" "system:masters"
234+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-search-etcd-client "system:karmada:karmada-search-etcd-client" "system:masters"
235+
util::create_certkey "" "${CERT_DIR}" "ca" etcd-client "system:karmada:etcd-etcd-client" ""
236+
237+
# GRPC client certificates
238+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-scheduler-grpc "system:karmada:karmada-scheduler-grpc" "system:masters"
239+
util::create_certkey "" "${CERT_DIR}" "ca" karmada-descheduler-grpc "system:karmada:karmada-descheduler-grpc" "system:masters"
240+
241+
# Front proxy certificates
242+
util::create_certkey "" "${CERT_DIR}" "ca" front-proxy-client "front-proxy-client" ""
243+
244+
# Create service account key pair
197245
util::create_key_pair "" "${CERT_DIR}" "sa"
198246

199247
# create namespace for control plane components
@@ -203,14 +251,63 @@ SERVER_CRT=$(base64 < "${CERT_DIR}/server.crt" | tr -d '\r\n')
203251
SERVER_KEY=$(base64 < "${CERT_DIR}/server.key" | tr -d '\r\n')
204252
CLIENT_CRT=$(base64 < "${CERT_DIR}/client.crt" | tr -d '\r\n')
205253
CLIENT_KEY=$(base64 < "${CERT_DIR}/client.key" | tr -d '\r\n')
206-
FRONT_PROXY_CLIENT_CRT=$(base64 < "${CERT_DIR}/front-proxy-client.crt" | tr -d '\r\n')
207-
FRONT_PROXY_CLIENT_KEY=$(base64 < "${CERT_DIR}/front-proxy-client.key" | tr -d '\r\n')
254+
255+
KARMADA_APISERVER_SERVER_CRT=$(base64 < "${CERT_DIR}/karmada-apiserver.crt" | tr -d '\r\n')
256+
KARMADA_APISERVER_SERVER_KEY=$(base64 < "${CERT_DIR}/karmada-apiserver.key" | tr -d '\r\n')
257+
KARMADA_AGGREGATED_APISERVER_SERVER_CRT=$(base64 < "${CERT_DIR}/karmada-aggregated-apiserver.crt" | tr -d '\r\n')
258+
KARMADA_AGGREGATED_APISERVER_SERVER_KEY=$(base64 < "${CERT_DIR}/karmada-aggregated-apiserver.key" | tr -d '\r\n')
259+
KARMADA_WEBHOOK_SERVER_CRT=$(base64 < "${CERT_DIR}/karmada-webhook.crt" | tr -d '\r\n')
260+
KARMADA_WEBHOOK_SERVER_KEY=$(base64 < "${CERT_DIR}/karmada-webhook.key" | tr -d '\r\n')
261+
KARMADA_SEARCH_SERVER_CRT=$(base64 < "${CERT_DIR}/karmada-search.crt" | tr -d '\r\n')
262+
KARMADA_SEARCH_SERVER_KEY=$(base64 < "${CERT_DIR}/karmada-search.key" | tr -d '\r\n')
263+
KARMADA_METRICS_ADAPTER_SERVER_CRT=$(base64 < "${CERT_DIR}/karmada-metrics-adapter.crt" | tr -d '\r\n')
264+
KARMADA_METRICS_ADAPTER_SERVER_KEY=$(base64 < "${CERT_DIR}/karmada-metrics-adapter.key" | tr -d '\r\n')
265+
KARMADA_SCHEDULER_ESTIMATOR_SERVER_CRT=$(base64 < "${CERT_DIR}/karmada-scheduler-estimator.crt" | tr -d '\r\n')
266+
KARMADA_SCHEDULER_ESTIMATOR_SERVER_KEY=$(base64 < "${CERT_DIR}/karmada-scheduler-estimator.key" | tr -d '\r\n')
208267
ETCD_SERVER_CRT=$(base64 < "${CERT_DIR}/etcd-server.crt" | tr -d '\r\n')
209268
ETCD_SERVER_KEY=$(base64 < "${CERT_DIR}/etcd-server.key" | tr -d '\r\n')
210269
ETCD_CLIENT_CRT=$(base64 < "${CERT_DIR}/etcd-client.crt" | tr -d '\r\n')
211270
ETCD_CLIENT_KEY=$(base64 < "${CERT_DIR}/etcd-client.key" | tr -d '\r\n')
271+
272+
KARMADA_APISERVER_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-apiserver-client.crt" | tr -d '\r\n')
273+
KARMADA_APISERVER_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-apiserver-client.key" | tr -d '\r\n')
274+
KARMADA_AGGREGATED_APISERVER_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-aggregated-apiserver-client.crt" | tr -d '\r\n')
275+
KARMADA_AGGREGATED_APISERVER_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-aggregated-apiserver-client.key" | tr -d '\r\n')
276+
KARMADA_WEBHOOK_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-webhook-client.crt" | tr -d '\r\n')
277+
KARMADA_WEBHOOK_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-webhook-client.key" | tr -d '\r\n')
278+
KARMADA_SEARCH_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-search-client.crt" | tr -d '\r\n')
279+
KARMADA_SEARCH_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-search-client.key" | tr -d '\r\n')
280+
KARMADA_METRICS_ADAPTER_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-metrics-adapter-client.crt" | tr -d '\r\n')
281+
KARMADA_METRICS_ADAPTER_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-metrics-adapter-client.key" | tr -d '\r\n')
282+
KARMADA_SCHEDULER_ESTIMATOR_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-scheduler-estimator-client.crt" | tr -d '\r\n')
283+
KARMADA_SCHEDULER_ESTIMATOR_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-scheduler-estimator-client.key" | tr -d '\r\n')
284+
KARMADA_CONTROLLER_MANAGER_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-controller-manager-client.crt" | tr -d '\r\n')
285+
KARMADA_CONTROLLER_MANAGER_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-controller-manager-client.key" | tr -d '\r\n')
286+
KARMADA_SCHEDULER_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-scheduler-client.crt" | tr -d '\r\n')
287+
KARMADA_SCHEDULER_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-scheduler-client.key" | tr -d '\r\n')
288+
KARMADA_DESCHEDULER_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-descheduler-client.crt" | tr -d '\r\n')
289+
KARMADA_DESCHEDULER_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-descheduler-client.key" | tr -d '\r\n')
290+
291+
KARMADA_APISERVER_ETCD_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-apiserver-etcd-client.crt" | tr -d '\r\n')
292+
KARMADA_APISERVER_ETCD_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-apiserver-etcd-client.key" | tr -d '\r\n')
293+
KARMADA_AGGREGATED_APISERVER_ETCD_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-aggregated-apiserver-etcd-client.crt" | tr -d '\r\n')
294+
KARMADA_AGGREGATED_APISERVER_ETCD_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-aggregated-apiserver-etcd-client.key" | tr -d '\r\n')
295+
KARMADA_SEARCH_ETCD_CLIENT_CRT=$(base64 < "${CERT_DIR}/karmada-search-etcd-client.crt" | tr -d '\r\n')
296+
KARMADA_SEARCH_ETCD_CLIENT_KEY=$(base64 < "${CERT_DIR}/karmada-search-etcd-client.key" | tr -d '\r\n')
297+
298+
KARMADA_SCHEDULER_GRPC_CRT=$(base64 < "${CERT_DIR}/karmada-scheduler-grpc.crt" | tr -d '\r\n')
299+
KARMADA_SCHEDULER_GRPC_KEY=$(base64 < "${CERT_DIR}/karmada-scheduler-grpc.key" | tr -d '\r\n')
300+
KARMADA_DESCHEDULER_GRPC_CRT=$(base64 < "${CERT_DIR}/karmada-descheduler-grpc.crt" | tr -d '\r\n')
301+
KARMADA_DESCHEDULER_GRPC_KEY=$(base64 < "${CERT_DIR}/karmada-descheduler-grpc.key" | tr -d '\r\n')
302+
303+
FRONT_PROXY_CLIENT_CRT=$(base64 < "${CERT_DIR}/front-proxy-client.crt" | tr -d '\r\n')
304+
FRONT_PROXY_CLIENT_KEY=$(base64 < "${CERT_DIR}/front-proxy-client.key" | tr -d '\r\n')
305+
212306
SA_PUB=$(base64 < "${CERT_DIR}/sa.pub" | tr -d '\r\n')
213307
SA_KEY=$(base64 < "${CERT_DIR}/sa.key" | tr -d '\r\n')
308+
309+
310+
214311
generate_cert_related_secrets
215312

216313
# deploy karmada etcd

0 commit comments

Comments
 (0)