Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bootkube replacement: split k8s.secrets into multiple resources #3062

Closed
smira opened this issue Jan 29, 2021 · 0 comments · Fixed by #3180
Closed

bootkube replacement: split k8s.secrets into multiple resources #3062

smira opened this issue Jan 29, 2021 · 0 comments · Fixed by #3180
Assignees
@smira

Comments

@smira
Copy link
Member

smira commented Jan 29, 2021

Split into resources by usage:

  • etcd certs
  • root k8s CAs
  • generated k8s certs

Intermediate secret material config resource to prevent cert regeneration without any real changes
@smira smira self-assigned this Feb 17, 2021
smira added a commit to smira/talos that referenced this issue Feb 18, 2021
@smira
refactor: split kubernetes/etcd resource generation into subresources
4b67199 
Fixes siderolabs#3062

There's no user-visible change in this PR.

It carefully separates generated secrets (e.g. certs) from source
secrets from the config (e.g. CAs), so that certs are generated on
config changes which actually affect cert input.

And same way separates etcd and Kubernetes PKI, so if etcd CA got
changed, only etcd certs will be regenerated.

This should have noticeable impact with RSA-based PKI as it reduces
number of times PKI gets generated.

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
smira added a commit to smira/talos that referenced this issue Feb 18, 2021
@smira
refactor: split kubernetes/etcd resource generation into subresources
e06947c 
Fixes siderolabs#3062

There's no user-visible change in this PR.

It carefully separates generated secrets (e.g. certs) from source
secrets from the config (e.g. CAs), so that certs are generated on
config changes which actually affect cert input.

And same way separates etcd and Kubernetes PKI, so if etcd CA got
changed, only etcd certs will be regenerated.

This should have noticeable impact with RSA-based PKI as it reduces
number of times PKI gets generated.

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
@smira smira mentioned this issue Feb 18, 2021
Merged
talos-bot pushed a commit that referenced this issue Feb 19, 2021
@smira @talos-bot
refactor: split kubernetes/etcd resource generation into subresources
b914398 
Fixes #3062

There's no user-visible change in this PR.

It carefully separates generated secrets (e.g. certs) from source
secrets from the config (e.g. CAs), so that certs are generated on
config changes which actually affect cert input.

And same way separates etcd and Kubernetes PKI, so if etcd CA got
changed, only etcd certs will be regenerated.

This should have noticeable impact with RSA-based PKI as it reduces
number of times PKI gets generated.

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jun 27, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@smira smira

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

refactor: split kubernetes/etcd resource generation into subresources smira/talos
1 participant
@smira