A tool for automatically approving kubelet CSRs in OpenShift 4 clusters set up on user-provisioned infrastructure.
When installed on user-provisioned infrastructure, the OpenShift
machine-approver
does not automatically approve new kubelet CSRs.
On installer-provisioned infrastructure, the information from
Machine
resources is used to decide which CSRs to approve and which
to deny. On user-provisioned infrastructure, this information is not
available. Instead, this tool relies on information provided by the
user in form of a ConfigMap resource.
The tool is installed as a Kubernetes Cronjob
resource which starts
the CSR approval process every half hour.
We recommend to install this tool in an independent project/namespace. Installation in an existing, shared namespace is possible as well.
Create a project to deploy this tool in:
$ oc new-project csr-approver
When deploying in an existing project, switch to it:
$ oc project existing-project
Open the file deployment.yaml
in your preferred text editor. The
first resource in this file is a Config Map named
openshift-csr-approver
. In this CM, configure the file spec.yaml
as follows:
master-01: # Name of a node, as it appears in "oc get node"
# All DNS names expected to appear in the node's CSR
names: [ master-01, master-01.os.example.com ]
# All IP addresses expected to appear in the node's CSR
ips: [ "10.42.0.10", "2001:db8::10" ]
# Another node
worker-01:
names: [ worker-01, worker-01.os.example.com ]
ips: [ "10.42.0.20", "2001:db8::20" ]
# Add all allowed nodes to the file
# ...
In the file deployment.yaml
, you also need to set the ServiceAccount
namespace in the ClusterRoleBinding resource.
When you're done configuring the Node CSR Spec, create the resources with
$ oc apply -f deployment.yaml
This creates the following resource:
- The
ConfigMap
you configured earlier - A
ServiceAccount
used by the tool - A
Secret
for the service account - A
ClusterRole
with the permissions required for managing CSRs - A
ClusterRoleBinding
binding the service account to the role - A
CronJob
running the tool in a 30 minute interval
Since you're configuring a ClusterRole
and ClusterRoleBinding
,
corresponding administrative privileges are required for creating the
resources.
Whenever a node is removed from or added to the cluster, the
ConfigMap
should be adapted accordingly. To do this, first
switch to the project the tool is deployed in:
$ oc project csr-approver
Then edit the configmap with
$ oc edit cm openshift-csr-approver
and apply your changes.
Alternatively, edit the deployment.yaml
file and reapply it:
$ oc apply -f deployment.yaml