Generate a node-bootstrap client cert for ease of setup

Author: smarterclayton

pkg/cmd/server/admin/create_mastercerts.go

@@ -191,6 +191,7 @@ func (o CreateMasterCertsOptions) CreateMasterCerts() error {
 		func() error { return o.createAPIClients(&getSignerCertOptions) },
 		func() error { return o.createEtcdClientCerts(&getSignerCertOptions) },
 		func() error { return o.createKubeletClientCerts(&getSignerCertOptions) },
+		func() error { return o.createNodeBootstrapClientCerts(&getSignerCertOptions) },
 		func() error { return o.createProxyClientCerts(&getSignerCertOptions) },
 		func() error { return o.createServiceAccountKeys() },
 		func() error { return o.createServiceSigningCA(&getSignerCertOptions) },
@@ -254,6 +255,15 @@ func (o CreateMasterCertsOptions) createKubeletClientCerts(getSignerCertOptions
 	return nil
 }
 
+func (o CreateMasterCertsOptions) createNodeBootstrapClientCerts(getSignerCertOptions *SignerCertOptions) error {
+	for _, clientCertInfo := range DefaultNodeBootstrapClientCerts(o.CertDir) {
+		if err := o.createClientCert(clientCertInfo, getSignerCertOptions); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (o CreateMasterCertsOptions) createClientCert(clientCertInfo ClientCertInfo, getSignerCertOptions *SignerCertOptions) error {
 	clientCertOptions := CreateClientCertOptions{
 		SignerCertOptions: getSignerCertOptions,

pkg/cmd/server/admin/default_certs.go

@@ -81,6 +81,23 @@ func DefaultMasterEtcdClientCertInfo(certDir string) ClientCertInfo {
 	}
 }
 
+func DefaultNodeBootstrapClientCerts(certDir string) []ClientCertInfo {
+	return []ClientCertInfo{
+		DefaultNodeBootstrapClientCertInfo(certDir),
+	}
+}
+func DefaultNodeBootstrapClientCertInfo(certDir string) ClientCertInfo {
+	return ClientCertInfo{
+		CertLocation: configapi.CertInfo{
+			CertFile: path.Join(certDir, "node-bootstrap.crt"),
+			KeyFile:  path.Join(certDir, "node-bootstrap.key"),
+		},
+		UnqualifiedUser: "node-bootstrap",
+		User:            "system:serviceaccount:openshift-infra:node-bootstrap",
+		Groups:          sets.NewString("system:serviceaccounts:openshift-infra"),
+	}
+}
+
 func DefaultProxyClientCerts(certDir string) []ClientCertInfo {
 	return []ClientCertInfo{
 		DefaultProxyClientCertInfo(certDir),
@@ -106,6 +123,7 @@ func DefaultAPIClientCerts(certDir string) []ClientCertInfo {
 		DefaultClusterAdminClientCertInfo(certDir),
 		DefaultRouterClientCertInfo(certDir),
 		DefaultRegistryClientCertInfo(certDir),
+		DefaultNodeBootstrapClientCertInfo(certDir),
 	}
 }