Support Configuring EncryptionAlgorithm in Kubeadm v1beta4 #11757
Conversation
k8s-ci-robot
added
release-note-none
k8s-ci-robot
added
the
size/S
ErikJiang
force-pushed
the
add_kube_encryption_algorithm
branch
from
2f2a242 to
af28739
Compare
ErikJiang
changed the title
|
/ok-to-test |
k8s-ci-robot
added
the
ok-to-test
Signed-off-by: bo.jiang <[email protected]>
ErikJiang
force-pushed
the
add_kube_encryption_algorithm
branch
from
af28739 to
02f6985
Compare
|
/test all |
|
@ErikJiang: The specified target(s) for
Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Thanks @ErikJiang |
k8s-ci-robot
added
the
lgtm
|
/release-note-edit |
k8s-ci-robot
added
release-note
|
Because #11751 has been reverted. Release note re-add this. |
| shell: set -o pipefail && openssl x509 -pubkey -in {{ kube_cert_dir }}/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //' | ||
| shell: | | ||
| set -o pipefail && openssl x509 -pubkey -in {{ kube_cert_dir }}/ca.crt | \ | ||
| openssl {% if 'RSA' in kube_asymmetric_encryption_algorithm %}rsa{% elif 'ECDSA' in kube_asymmetric_encryption_algorithm %}ec{% else %}rsa{% endif %} -pubin -outform der 2>/dev/null | \ | ||
| openssl dgst -sha256 -hex | sed 's/^.* //' |
There was a problem hiding this comment.
Ouch. We really need to switch to community.crypto at some point ^.
There was a problem hiding this comment.
😊 I tried to optimize this hash calculation logic. #11758
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ErikJiang, VannTen The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
…rnetes-sigs#11757) Signed-off-by: bo.jiang <[email protected]>
What type of PR is this?
/kind feature
What this PR does / why we need it:
add
ClusterConfiguration.encryptionAlgorithmto specify an asymmetric encryption algorithm for the cluster's certificates and keys.Which issue(s) this PR fixes:
Fixes #11749
Special notes for your reviewer:
Does this PR introduce a user-facing change?: