Documentation
¶
Overview ¶
Package bootstrap owns cluster-info transport for every consumer of the kube-public cluster-info ConfigMap, under two distinct trust models.
For INITIAL JOIN (the worker join and the HA control-plane join) the node holds no trust anchor yet, so DiscoverCA fetches without verifying the peer and authenticates the PAYLOAD instead — against the token's detached JWS and the token's CA hash — then writes the TLS-bootstrap kubeconfig.
For an ALREADY-JOINED node (package `certs`, during CA rotation) an anchor exists, so FetchClusterCAVerified verifies the PEER against that anchor and authenticates nothing about the payload; the caller validates it. That path is why no unverified fetch remains: an already-joined node never needed one.
It lives in a neutral leaf package so no command package has to import another.
The file is split along one line that matters: fetchClusterInfoData is TRANSPORT — it performs the request and decodes the ConfigMap's data map, and does nothing else. Everything that interprets those bytes lives in the clusterinfo subpackage behind clusterinfo.Authenticate, so the unauthenticated path below cannot reach the trust-bundle helper even by accident.
Index ¶
- func DiscoverCA(server, token, caHash string) ([]byte, error)
- func DiscoverJoin(server, token, caHash string) ([]byte, bool, error)
- func FetchClusterCAVerified(server string, roots []byte) ([]byte, []*x509.Certificate, error)
- func FetchKubeletClientCA(server string, roots []byte) (bundle []byte, found bool, err error)
- func WriteBootstrapKubeconfig(server, token string, ca []byte) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DiscoverCA ¶
DiscoverCA fetches the kube-public cluster-info ConfigMap (TLS-insecure, since we don't trust the server yet), authenticates it with the bootstrap token's detached JWS, verifies the CA against the token CA hash, and returns the authenticated trust bundle. For INITIAL join.
The JWS is what makes the insecure fetch safe: it authenticates the whole kubeconfig, where the CA-hash pin only ever attests one public key. Both run, and both must pass.
func DiscoverJoin ¶
DiscoverJoin returns both the pinned cluster root and the kubelet client-CA mode from the same token-authenticated cluster-info payload.
func FetchClusterCAVerified ¶
FetchClusterCAVerified fetches the cluster-info CA trust bundle over a TLS connection VERIFIED against roots (an already-joined node's on-disk trust bundle), and returns the fetched bundle together with the verified peer chain so the caller can check the bundle against the connection it arrived on.
Like DiscoverCA this sends no credential, and deliberately so — the two differ in what they authenticate, not in what they present. The cluster-info ConfigMap is granted to system:anonymous alone (token.ensureClusterInfo binds the stratum:cluster-info Role to exactly that one subject), and the apiserver runs --authorization-mode=Node,RBAC: presenting the kubelet's client certificate would authenticate the request as system:node:<host>, which has no grant on that ConfigMap and no Node-authorizer path to it, turning a request RBAC permits into a 403. Anonymous is both the working answer and the least privileged one for reading a ConfigMap published for anonymous read.
Dropping InsecureSkipVerify enables TWO checks, not one: chain validation and SAN/hostname validation. An endpoint outside the apiserver leaf's SANs fails closed on purpose — such a mismatch is a real misconfiguration, and this path rewrites the file that decides who is cluster-admin on the kubelet. classifyFetchError keeps that case distinguishable from a trust failure.
func FetchKubeletClientCA ¶
FetchKubeletClientCA anonymously fetches the kubelet client-CA bundle a split cluster publishes, over TLS verified against roots. found is false on a 404 or 403; the caller may treat that as legacy only when signed cluster-info says so.
func WriteBootstrapKubeconfig ¶
WriteBootstrapKubeconfig writes the token-auth kubeconfig kubelet uses for TLS bootstrap (and ha uses to download the shared certs) to version.BootstrapKubeconfig. It is rendered to bytes and written through the shared atomic writer: a kubeconfig cut in half stops the kubelet's TLS bootstrap from starting at all, and the file carries a token, so the 0600 mode is atomicfile's, not a chmod after a wider window.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package clusterinfo authenticates the kube-public cluster-info ConfigMap and turns the authenticated payload into a CA trust bundle.
|
Package clusterinfo authenticates the kube-public cluster-info ConfigMap and turns the authenticated payload into a CA trust bundle. |