PR: openshift/hypershift#9031 Bug: OCPBUGS-99014 Author: Hilliary Lipsig
The Konnectivity proxy-server previously accepted agent connections without validating client certificates because the --cluster-ca-cert flag was not configured on the agent listener. Any reachable client could connect to port 8091 without presenting a certificate signed by the hosted cluster's Konnectivity CA.
| # Please edit the object below. Lines beginning with a '#' will be ignored, | |
| # and an empty file will abort the edit. If an error occurs while saving this file will be | |
| # reopened with the relevant failures. | |
| # | |
| apiVersion: hypershift.openshift.io/v1alpha1 | |
| kind: HostedCluster | |
| metadata: | |
| creationTimestamp: "2021-07-15T19:15:12Z" | |
| finalizers: | |
| - hypershift.openshift.io/finalizer |
| t % oc get svc/kubernetes -o yaml -n default --kubeconfig=/tmp/kubeconfig ~hyper kas_endpoint_api thinkpad | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| creationTimestamp: "2021-07-14T20:05:36Z" | |
| labels: | |
| component: apiserver | |
| provider: kubernetes | |
| name: kubernetes | |
| namespace: default |
| apiVersion: hypershift.openshift.io/v1alpha1 | |
| kind: HostedCluster | |
| metadata: | |
| name: example | |
| spec: | |
| autoscaling: {} | |
| configs: {} | |
| dns: | |
| baseDomain: hypershift.example.com | |
| etcd: |
| apiVersion: hypershift.openshift.io/v1alpha1 | |
| kind: HostedCluster | |
| metadata: | |
| creationTimestamp: "2021-07-07T18:21:43Z" | |
| finalizers: | |
| - hypershift.openshift.io/finalizer | |
| generation: 6 | |
| labels: | |
| hypershift.openshift.io/auto-created-for-infra: cewong1-npzqm | |
| name: cewong1 |
| apiVersion: hypershift.openshift.io/v1alpha1 | |
| kind: HostedCluster | |
| metadata: | |
| name: example | |
| namespace: clusters | |
| spec: | |
| autoscaling: {} | |
| dns: {} | |
| infraID: example-b4tpl | |
| issuerURL: "" |
| { | |
| "keys": [ | |
| { | |
| "use": "sig", | |
| "kty": "RSA", | |
| "kid": "3KTayiRO4OfSE0ii1CA0NPLAiyIdiFOpCPYOBBGQZio", | |
| "alg": "RS256", | |
| "n": "z92EsZZrWMH_EJeJwd_Vxz0Pcr9k0ivlXA6dodVccMUzt0cLacvTEFPCsfxmUo6GxDCHt9P19FMcsYYDtliM-gunBRCln4kslUtvLHhQtdd-CgPU58l1NMUIDVcQxi8eEuroGv46A_YNXlacAUSXKMNmT0fGs58qHipIEz5sllvuKSCQY7rke_BDu8t6PGAmgr0M-BPuCELFMPMxrjzd3qDfDxyBI43UQacCuR-utN0Ke5U9ts6ErCVurtXxBoGGDh-rQYBAI47v19cQJldHtLotIZ2mUrHeJFkHk3YT2tQYxaLSqU9LMcD40ZE8me9qSLkDQ8rhlgR_LG96P1cDbrgxYQdbZQHP2425BcDpZc8YfNqMRaYqHzbwYgZGg_hDqSZORG-gSAzgoGiFno2OtSxbjsktbjcWfDCe_q3WX6YFqJnUH485a1elyDuxahK87WtpwPv60wP9bV0btM4-WO4uQwcqeG3fB9ivdGoqUM-JezLTpbUdERTy6Pn3QYpPwEUy-uh9abqYY_Bm1PiQlQu4Pt3by_6sWDUpRiDCtDVpFJbxRxj61Pn3zC_mDb68U0DrSLIaWe3qcYhhwDpIsmw76_lVZPJUUyYw0RZ3Pqp5IOQaWQczP0Sm2nuUS43PuLor6bez955QoWOFwXmXV1b4oZcpWwXVi6VU1asu0k0", | |
| "e": "AQAB" | |
| } |
| Cloning "https://github.com/openshift/ibm-roks-toolkit.git" ... | |
| Commit: 57d6aeed23aa18f1737f77ba98255a1284fa96b1 (Merge pull request #131 from openshift-cherrypick-robot/cherry-pick-127-to-rel..) | |
| Author: OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | |
| Date: Wed Jan 6 18:49:24 2021 -0500 | |
| Replaced Dockerfile FROM image quay.io/openshift/origin-base:latest | |
| Pulling image openshift/origin-release:golang-1.15 ... | |
| Pulling image quay.io/openshift/origin-base@sha256:19f7a5065ab1805b97755d484c949ae15861cc19dd17b060948b4f7bf1b00230 ... | |
| --> FROM openshift/origin-release:golang-1.15 as builder |
| kind: Pod | |
| apiVersion: v1 | |
| metadata: | |
| annotations: | |
| etcd.version: 3.2.13 | |
| k8s.v1.cni.cncf.io/network-status: |- | |
| [{ | |
| "name": "openshift-sdn", | |
| "interface": "eth0", | |
| "ips": [ |
| #!/bin/bash | |
| set -e | |
| oc registry login | |
| CI_PULL_SECRET="$(cat ~/.docker/config.json | jq -r '.auths["registry.svc.ci.openshift.org"].auth')" | |
| EXISTING="$(cat ~/.pull-secret)" | |
| NEW="$(echo "${EXISTING}" | jq --arg a "${CI_PULL_SECRET}" -c '.auths["registry.svc.ci.openshift.org"].auth = $a')" | |
| echo "${NEW}" > ~/.pull-secret |