Skip to content

Commit ab7ef45

Browse files
liggittliggitt
committed
Enable TLS
Explicitly set scheme in node redirects Plumb ports to support TLS Generate self-signed certs, plumb in env vars to infrastructure pods Add docker loopback to master cert Make scheme and port configurable in e2e Change default to SSL Simplify bootstrapping Move crypto package, persist serial numbers between starts, make helper functions private Use generic crypto.PublicKey/PrivateKey interface Build assets Change OSC default scheme/port, generate .kubernetes_auth files Doc update to TLS Use .kubeconfig for cert config in tests Override default server host to https://localhost:8443 Use api object to write .kubeconfig
1 parent 8ced3d2 commit ab7ef45

28 files changed

+1252
-108
lines changed

‎Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,6 @@ RUN go get github.com/openshift/origin && \
2020
cp _output/local/go/bin/* /usr/bin/ && \
2121
mkdir -p /var/lib/openshift
2222

23-
EXPOSE 8080
23+
EXPOSE 8080 8443
2424
WORKDIR /var/lib/openshift
2525
ENTRYPOINT ["/usr/bin/openshift"]

‎README.md

+26-25
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ The simplest way to run OpenShift Origin is in a Docker container:
5757
Once the container is started, you can jump into a console inside the container and run the CLI.
5858

5959
$ docker exec -it openshift-origin bash
60+
$ ln -s /var/lib/openshift/openshift.local.certificates/admin/.kubernetes_auth $HOME/.kubernetes_auth
6061
$ osc --help
6162

6263

@@ -120,43 +121,43 @@ If you run into difficulties running OpenShift, start by reading through the [tr
120121
API
121122
---
122123

123-
The OpenShift APIs are exposed at `http://localhost:8080/osapi/v1beta1/*`.
124+
The OpenShift APIs are exposed at `https://localhost:8443/osapi/v1beta1/*`.
124125

125126
* Builds
126-
* `http://localhost:8080/osapi/v1beta1/builds`
127-
* `http://localhost:8080/osapi/v1beta1/buildConfigs`
128-
* `http://localhost:8080/osapi/v1beta1/buildLogs`
129-
* `http://localhost:8080/osapi/v1beta1/buildConfigHooks`
127+
* `https://localhost:8443/osapi/v1beta1/builds`
128+
* `https://localhost:8443/osapi/v1beta1/buildConfigs`
129+
* `https://localhost:8443/osapi/v1beta1/buildLogs`
130+
* `https://localhost:8443/osapi/v1beta1/buildConfigHooks`
130131
* Deployments
131-
* `http://localhost:8080/osapi/v1beta1/deployments`
132-
* `http://localhost:8080/osapi/v1beta1/deploymentConfigs`
132+
* `https://localhost:8443/osapi/v1beta1/deployments`
133+
* `https://localhost:8443/osapi/v1beta1/deploymentConfigs`
133134
* Images
134-
* `http://localhost:8080/osapi/v1beta1/images`
135-
* `http://localhost:8080/osapi/v1beta1/imageRepositories`
136-
* `http://localhost:8080/osapi/v1beta1/imageRepositoryMappings`
135+
* `https://localhost:8443/osapi/v1beta1/images`
136+
* `https://localhost:8443/osapi/v1beta1/imageRepositories`
137+
* `https://localhost:8443/osapi/v1beta1/imageRepositoryMappings`
137138
* Templates
138-
* `http://localhost:8080/osapi/v1beta1/templateConfigs`
139+
* `https://localhost:8443/osapi/v1beta1/templateConfigs`
139140
* Routes
140-
* `http://localhost:8080/osapi/v1beta1/routes`
141+
* `https://localhost:8443/osapi/v1beta1/routes`
141142
* Projects
142-
* `http://localhost:8080/osapi/v1beta1/projects`
143+
* `https://localhost:8443/osapi/v1beta1/projects`
143144
* Users
144-
* `http://localhost:8080/osapi/v1beta1/users`
145-
* `http://localhost:8080/osapi/v1beta1/userIdentityMappings`
145+
* `https://localhost:8443/osapi/v1beta1/users`
146+
* `https://localhost:8443/osapi/v1beta1/userIdentityMappings`
146147
* OAuth
147-
* `http://localhost:8080/osapi/v1beta1/accessTokens`
148-
* `http://localhost:8080/osapi/v1beta1/authorizeTokens`
149-
* `http://localhost:8080/osapi/v1beta1/clients`
150-
* `http://localhost:8080/osapi/v1beta1/clientAuthorizations`
148+
* `https://localhost:8443/osapi/v1beta1/accessTokens`
149+
* `https://localhost:8443/osapi/v1beta1/authorizeTokens`
150+
* `https://localhost:8443/osapi/v1beta1/clients`
151+
* `https://localhost:8443/osapi/v1beta1/clientAuthorizations`
151152

152-
The Kubernetes APIs are exposed at `http://localhost:8080/api/v1beta1/*`:
153+
The Kubernetes APIs are exposed at `https://localhost:8443/api/v1beta1/*`:
153154

154-
* `http://localhost:8080/api/v1beta1/pods`
155-
* `http://localhost:8080/api/v1beta1/services`
156-
* `http://localhost:8080/api/v1beta1/replicationControllers`
157-
* `http://localhost:8080/api/v1beta1/operations`
155+
* `https://localhost:8443/api/v1beta1/pods`
156+
* `https://localhost:8443/api/v1beta1/services`
157+
* `https://localhost:8443/api/v1beta1/replicationControllers`
158+
* `https://localhost:8443/api/v1beta1/operations`
158159

159-
OpenShift and Kubernetes integrate with the [Swagger 2.0 API framework](http://swagger.io) which aims to make it easier to document and write clients for RESTful APIs. When you start OpenShift, the Swagger API endpoint is exposed at `http://localhost:8080/swaggerapi`. The Swagger UI makes it easy to view your documentation - to view the docs for your local version of OpenShift start the server with CORS enabled:
160+
OpenShift and Kubernetes integrate with the [Swagger 2.0 API framework](http://swagger.io) which aims to make it easier to document and write clients for RESTful APIs. When you start OpenShift, the Swagger API endpoint is exposed at `https://localhost:8443/swaggerapi`. The Swagger UI makes it easy to view your documentation - to view the docs for your local version of OpenShift start the server with CORS enabled:
160161

161162
$ openshift start --cors-allowed-origins=.*
162163

‎Vagrantfile

+1
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
116116
# sudo ipfw add 100 fwd 127.0.0.1,1080 tcp from any to any 80 in
117117
config.vm.network "forwarded_port", guest: 80, host: 1080
118118
config.vm.network "forwarded_port", guest: 8080, host: 8080
119+
config.vm.network "forwarded_port", guest: 8443, host: 8443
119120
end
120121

121122
config.vm.provider "libvirt" do |libvirt, override|

‎assets/Gruntfile.js

+1
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ module.exports = function (grunt) {
7070
// The actual grunt server settings
7171
connect: {
7272
options: {
73+
protocol: grunt.option('scheme') || 'https',
7374
port: grunt.option('port') || 9000,
7475
// Change this to '0.0.0.0' to access the server from outside.
7576
hostname: grunt.option('hostname') || 'localhost',

‎assets/app/config.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
window.OPENSHIFT_CONFIG = {
55
api: {
66
openshift: {
7-
hostPort: "localhost:8080",
7+
hostPort: "localhost:8443",
88
prefix: "/osapi"
99
},
1010
k8s: {
11-
hostPort: "localhost:8080",
11+
hostPort: "localhost:8443",
1212
prefix: "/api"
1313
}
1414
}

‎assets/test/karma.conf.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ module.exports = function(config) {
5050
exclude: [],
5151

5252
// web server port
53-
port: 8080,
53+
port: 8443,
5454

5555
// Start these browsers, currently available:
5656
// - Chrome

‎examples/examples_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,7 @@ func TestExampleObjectSchemas(t *testing.T) {
151151
"../examples/sample-app": {
152152
"github-webhook-example": nil, // Skip.
153153
"docker-registry-config": &configapi.Config{},
154+
"docker-registry-template": &templateapi.Template{},
154155
"application-template-stibuild": &templateapi.Template{},
155156
"application-template-dockerbuild": &templateapi.Template{},
156157
"application-template-custombuild": &templateapi.Template{},

‎examples/jenkins/docker-registry-config.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"readOnly":false
6565
}
6666
],
67-
"command": ["sh", "-c", "REGISTRY_URL=${DOCKER_REGISTRY_SERVICE_HOST}:${DOCKER_REGISTRY_SERVICE_PORT} OPENSHIFT_URL=http://${KUBERNETES_SERVICE_HOST}:443/osapi/v1beta1 exec docker-registry"]
67+
"command": ["sh", "-c", "REGISTRY_URL=${DOCKER_REGISTRY_SERVICE_HOST}:${DOCKER_REGISTRY_SERVICE_PORT} OPENSHIFT_URL=https://${KUBERNETES_SERVICE_HOST}:443/osapi/v1beta1 OPENSHIFT_INSECURE=true exec docker-registry"]
6868
}
6969
],
7070
"version":"v1beta1",

‎examples/jenkins/job.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
<hudson.model.StringParameterDefinition>
1010
<name>OPENSHIFT_HOST</name>
1111
<description>host/port of openshift api server.</description>
12-
<defaultValue>http://172.17.42.1:8080</defaultValue>
12+
<defaultValue>https://172.17.42.1:8443</defaultValue>
1313
</hudson.model.StringParameterDefinition>
1414
</parameterDefinitions>
1515
</hudson.model.ParametersDefinitionProperty>

‎examples/sample-app/README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -112,14 +112,14 @@ All commands assume the `openshift` binary is in your path (normally located und
112112

113113
$ openshift cli create Project -f project.json
114114

115-
8. *Optional:* View the OpenShift web console in your browser by browsing to `http://[host machine ip]:8081`
115+
8. *Optional:* View the OpenShift web console in your browser by browsing to `https://<host>:8444`
116116
If you click the `Hello OpenShift` project and leave the tab open, you'll see the page update as you deploy objects into the project and run builds.
117117

118118
9. Fork the [ruby sample repository](https://github.com/openshift/ruby-hello-world)
119119

120120
10. *Optional:* Add the following webhook to your new github repository:
121121

122-
$ http://<host>:8080/osapi/v1beta1/buildConfigHooks/ruby-sample-build/secret101/github?namespace=test
122+
$ https://<host>:8443/osapi/v1beta1/buildConfigHooks/ruby-sample-build/secret101/github?namespace=test
123123
* Note: Using the webhook requires your OpenShift server be publicly accessible so github can reach it to invoke the hook.
124124

125125
11. Edit application-template-stibuild.json
@@ -136,7 +136,7 @@ All commands assume the `openshift` binary is in your path (normally located und
136136
* If you setup the github webhook in step 10, push a change to app.rb in your ruby sample repository from step 9.
137137
* Otherwise you can simulate the webhook invocation by running:
138138

139-
$ curl -X POST http://localhost:8080/osapi/v1beta1/buildConfigHooks/ruby-sample-build/secret101/generic?namespace=test
139+
$ curl -X POST https://localhost:8443/osapi/v1beta1/buildConfigHooks/ruby-sample-build/secret101/generic?namespace=test
140140

141141
14. Monitor the builds and wait for the status to go to "complete" (this can take a few mins):
142142

@@ -194,7 +194,7 @@ All commands assume the `openshift` binary is in your path (normally located und
194194

195195
* If you do not have the webhook enabled, you'll have to manually trigger another build:
196196

197-
$ curl -X POST http://localhost:8080/osapi/v1beta1/buildConfigHooks/ruby-sample-build/secret101/generic?namespace=test
197+
$ curl -X POST https://localhost:8443/osapi/v1beta1/buildConfigHooks/ruby-sample-build/secret101/generic?namespace=test
198198

199199

200200
19. Repeat step 14 (waiting for the build to complete). Once the build is complete, refreshing your browser should show your changes.

‎examples/sample-app/docker-registry-config.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,8 @@
6565
"readOnly":false
6666
}
6767
],
68-
"command": ["sh", "-c", "REGISTRY_URL=${DOCKER_REGISTRY_SERVICE_HOST}:${DOCKER_REGISTRY_SERVICE_PORT} OPENSHIFT_URL=http://${KUBERNETES_SERVICE_HOST}:443/osapi/v1beta1 exec docker-registry"],
69-
"privileged":true
68+
"command": ["sh", "-c", "REGISTRY_URL=${DOCKER_REGISTRY_SERVICE_HOST}:${DOCKER_REGISTRY_SERVICE_PORT} OPENSHIFT_URL=https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/osapi/v1beta1 OPENSHIFT_INSECURE=true exec docker-registry"],
69+
"privileged": true
7070
}
7171
],
7272
"version":"v1beta1",

‎examples/sample-app/docker-registry-template.json

+133
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
{
2+
"kind":"Template",
3+
"metadata": {
4+
"name": "docker-registry-template",
5+
"annotations": {
6+
"description": "Template for launching a docker-registry pod"
7+
}
8+
},
9+
"parameters": [
10+
{
11+
"name": "OPENSHIFT_MASTER",
12+
"description": "OpenShift master",
13+
"value": "http://localhost:8080"
14+
},
15+
{
16+
"name": "OPENSHIFT_CA_DATA",
17+
"description": "OpenShift root certificates",
18+
},
19+
{
20+
"name": "OPENSHIFT_CERT_DATA",
21+
"description": "OpenShift client certificate",
22+
},
23+
{
24+
"name": "OPENSHIFT_KEY_DATA",
25+
"description": "OpenShift client certificate key",
26+
}
27+
],
28+
"apiVersion":"v1beta1",
29+
"creationTimestamp":"2014-09-18T18:28:38-04:00",
30+
"items":[
31+
{
32+
"apiVersion":"v1beta2",
33+
"creationTimestamp":null,
34+
"id":"docker-registry",
35+
"kind":"Service",
36+
"portalIp": "172.30.17.3",
37+
"port":5001,
38+
"containerPort":5000,
39+
"selector":{
40+
"name":"registrypod"
41+
}
42+
},
43+
{
44+
"metadata":{
45+
"name":"docker-registry",
46+
},
47+
"kind":"DeploymentConfig",
48+
"apiVersion":"v1beta1",
49+
"triggers":[
50+
{
51+
"type":"ConfigChange",
52+
}
53+
],
54+
"template":{
55+
"strategy":{
56+
"type":"Recreate"
57+
},
58+
"controllerTemplate":{
59+
"replicas":1,
60+
"replicaSelector":{
61+
"name":"registrypod"
62+
},
63+
"podTemplate":{
64+
"desiredState":{
65+
"manifest":{
66+
"containers":[
67+
{
68+
"image":"openshift/docker-registry",
69+
"imagePullPolicy":"PullIfNotPresent",
70+
"name":"registry-container",
71+
"ports":[
72+
{
73+
"containerPort":5000,
74+
"protocol":"TCP"
75+
}
76+
],
77+
"env":[
78+
{
79+
"name":"STORAGE_PATH",
80+
"value":"/tmp/openshift.local.registry"
81+
},
82+
{
83+
"name": "OPENSHIFT_MASTER",
84+
"value": "${OPENSHIFT_MASTER}"
85+
},
86+
{
87+
"name": "OPENSHIFT_CA_DATA",
88+
"value": "${OPENSHIFT_CA_DATA}"
89+
},
90+
{
91+
"name": "OPENSHIFT_CERT_DATA",
92+
"value": "${OPENSHIFT_CERT_DATA}"
93+
},
94+
{
95+
"name": "OPENSHIFT_KEY_DATA",
96+
"value": "${OPENSHIFT_KEY_DATA}"
97+
}
98+
],
99+
"volumeMounts":[
100+
{
101+
"name":"registry-storage",
102+
"mountPath":"/tmp/openshift.local.registry",
103+
"readOnly":false
104+
}
105+
],
106+
"command": ["sh", "-c", "echo \"$OPENSHIFT_CA_DATA\" > $STORAGE_PATH/root.crt && REGISTRY_URL=${DOCKER_REGISTRY_SERVICE_HOST}:${DOCKER_REGISTRY_SERVICE_PORT} OPENSHIFT_URL=${OPENSHIFT_MASTER}/osapi/v1beta1 OPENSHIFT_CA_BUNDLE=$STORAGE_PATH/root.crt exec docker-registry"]
107+
}
108+
],
109+
"version":"v1beta1",
110+
"volumes":[
111+
{
112+
"name":"registry-storage",
113+
"source":{
114+
"hostDir":{
115+
"path":"/tmp/openshift.local.registry"
116+
}
117+
}
118+
}
119+
]
120+
},
121+
"restartpolicy":{
122+
123+
}
124+
},
125+
"labels":{
126+
"name":"registrypod"
127+
}
128+
}
129+
}
130+
}
131+
}
132+
]
133+
}

‎hack/serve-local-assets.sh

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@ set -e
55
OS_ROOT=$(dirname "${BASH_SOURCE}")/..
66
source "${OS_ROOT}/hack/common.sh"
77

8+
GRUNT_SCHEME=${GRUNT_SCHEME:-https}
89
GRUNT_PORT=${GRUNT_PORT:-9000}
910
GRUNT_HOSTNAME=${GRUNT_HOSTNAME:-localhost}
1011

1112
pushd "${OS_ROOT}/assets" > /dev/null
12-
grunt serve --port=$GRUNT_PORT --hostname=$GRUNT_HOSTNAME
13+
grunt serve --scheme=$GRUNT_SCHEME --port=$GRUNT_PORT --hostname=$GRUNT_HOSTNAME
1314
popd > /dev/null

‎hack/test-cmd.sh

+18-5
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,15 @@ USE_LOCAL_IMAGES=${USE_LOCAL_IMAGES:-true}
2929

3030
ETCD_HOST=${ETCD_HOST:-127.0.0.1}
3131
ETCD_PORT=${ETCD_PORT:-4001}
32-
API_PORT=${API_PORT:-8080}
32+
API_SCHEME=${API_SCHEME:-https}
33+
API_PORT=${API_PORT:-8443}
3334
API_HOST=${API_HOST:-127.0.0.1}
35+
KUBELET_SCHEME=${KUBELET_SCHEME:-http}
3436
KUBELET_PORT=${KUBELET_PORT:-10250}
3537

3638
ETCD_DATA_DIR=$(mktemp -d /tmp/openshift.local.etcd.XXXX)
3739
VOLUME_DIR=$(mktemp -d /tmp/openshift.local.volumes.XXXX)
40+
CERT_DIR=$(mktemp -d /tmp/openshift.local.certificates.XXXX)
3841

3942
# set path so OpenShift is available
4043
GO_OUT="${OS_ROOT}/_output/local/go/bin"
@@ -45,13 +48,23 @@ out=$(openshift version)
4548
echo openshift: $out
4649

4750
# Start openshift
48-
openshift start --master="${API_HOST}:${API_PORT}" --volume-dir="${VOLUME_DIR}" --etcd-dir="${ETCD_DATA_DIR}" 1>&2 &
51+
openshift start --master="${API_SCHEME}://${API_HOST}:${API_PORT}" --listen="${API_SCHEME}://0.0.0.0:${API_PORT}" --volume-dir="${VOLUME_DIR}" --etcd-dir="${ETCD_DATA_DIR}" --cert-dir="${CERT_DIR}" 1>&2 &
4952
OS_PID=$!
5053

51-
wait_for_url "http://localhost:${KUBELET_PORT}/healthz" "kubelet: " 1 30
52-
wait_for_url "http://${API_HOST}:${API_PORT}/healthz" "apiserver: "
54+
if [[ "$API_SCHEME" == "https" ]]; then
55+
export CURL_CA_BUNDLE="$CERT_DIR/admin/root.crt"
56+
fi
5357

54-
export KUBERNETES_MASTER="${API_HOST}:${API_PORT}"
58+
wait_for_url "${KUBELET_SCHEME}://${API_HOST}:${KUBELET_PORT}/healthz" "kubelet: " 1 30
59+
wait_for_url "${API_SCHEME}://${API_HOST}:${API_PORT}/healthz" "apiserver: "
60+
61+
# Set KUBERNETES_MASTER for osc
62+
export KUBERNETES_MASTER="${API_SCHEME}://${API_HOST}:${API_PORT}"
63+
if [[ "$API_SCHEME" == "https" ]]; then
64+
# Make osc use $CERT_DIR/admin/.kubeconfig, and ignore anything in the running user's $HOME dir
65+
export HOME=$CERT_DIR/admin
66+
export KUBECONFIG=$CERT_DIR/admin/.kubeconfig
67+
fi
5568

5669
#
5770
# Begin tests

0 commit comments

Comments
 (0)