edgelesssys · daniel-weisse · Feb 10, 2023 · Feb 1, 2023 · Feb 1, 2023 · Feb 2, 2023
diff --git a/.github/actions/constellation_create/action.yml b/.github/actions/constellation_create/action.yml
@@ -73,6 +73,8 @@ runs:
       run: |
         constellation config generate ${{ inputs.cloudProvider }}
 
+        yq eval -i "(.name) = \"e2e-test\"" constellation-conf.yaml
+
         yq eval -i \
           "(.provider | select(. | has(\"azure\")).azure.subscription) = \"${{ inputs.azureSubscription }}\" |
             (.provider | select(. | has(\"azure\")).azure.tenant) = \"${{ inputs.azureTenant }}\" |
@@ -158,7 +160,7 @@ runs:
         echo "Creating cluster using config:"
         cat constellation-conf.yaml
         sudo sh -c 'echo "127.0.0.1 license.confidential.cloud" >> /etc/hosts' || true
-        constellation create -c ${{ inputs.controlNodesCount }} -w ${{ inputs.workerNodesCount }} --name e2e-test -y --force
+        constellation create -c ${{ inputs.controlNodesCount }} -w ${{ inputs.workerNodesCount }} -y --force
 
     - name: Cdbg deploy
       if: inputs.isDebugImage == 'true'

@@ -21,7 +21,7 @@ type clusterFake struct{}
 
 // InitCluster fakes bootstrapping a new cluster with the current node being the master, returning the arguments required to join the cluster.
 func (c *clusterFake) InitCluster(
-	context.Context, string, string, []byte, []uint32, bool, bool,
+	context.Context, string, string, string, []byte, []uint32, bool, bool,
 	[]byte, bool, components.Components, *logger.Logger,
 ) ([]byte, error) {
 	return []byte{}, nil

@@ -25,6 +25,7 @@ message InitRequest {
   bool conformance_mode = 14;
   repeated KubernetesComponent kubernetes_components = 15;
   bytes init_secret = 16;
+  string cluster_name = 17;
 }
 
 message InitResponse {

@@ -161,9 +161,15 @@ func (s *Server) Init(ctx context.Context, req *initproto.InitRequest) (*initpro
 	// Check if we are running on a CVM
 	_, isCVM := s.issuer.(*snp.Issuer)
 
+	clusterName := req.ClusterName
+	if clusterName == "" {
+		clusterName = "constellation"
+	}
+
 	kubeconfig, err := s.initializer.InitCluster(ctx,
 		req.CloudServiceAccountUri,
 		req.KubernetesVersion,
+		clusterName,
 		measurementSalt,
 		req.EnforcedPcrs,
 		req.EnforceIdkeydigest,
@@ -237,6 +243,7 @@ type ClusterInitializer interface {
 		ctx context.Context,
 		cloudServiceAccountURI string,
 		k8sVersion string,
+		clusterName string,
 		measurementSalt []byte,
 		enforcedPcrs []uint32,
 		enforceIDKeyDigest bool,

@@ -314,7 +314,7 @@ type stubClusterInitializer struct {
 }
 
 func (i *stubClusterInitializer) InitCluster(
-	context.Context, string, string, []byte, []uint32, bool, bool,
+	context.Context, string, string, string, []byte, []uint32, bool, bool,
 	[]byte, bool, components.Components, *logger.Logger,
 ) ([]byte, error) {
 	return i.initClusterKubeconfig, i.initClusterErr

@@ -28,6 +28,7 @@ import (
 	"github.com/edgelesssys/constellation/v2/internal/role"
 	"github.com/edgelesssys/constellation/v2/internal/versions/components"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apiserver/pkg/authentication/user"
 	kubeconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 
 	"github.com/edgelesssys/constellation/v2/internal/crypto"
@@ -87,25 +88,26 @@ func (k *KubernetesUtil) InstallComponents(ctx context.Context, kubernetesCompon
 }
 
 // InitCluster instruments kubeadm to initialize the K8s cluster.
+// On success an admin kubeconfig file is returned.
 func (k *KubernetesUtil) InitCluster(
-	ctx context.Context, initConfig []byte, nodeName string, ips []net.IP, controlPlaneEndpoint string, conformanceMode bool, log *logger.Logger,
-) error {
+	ctx context.Context, initConfig []byte, nodeName, clusterName string, ips []net.IP, controlPlaneEndpoint string, conformanceMode bool, log *logger.Logger,
+) ([]byte, error) {
 	// TODO: audit policy should be user input
 	auditPolicy, err := resources.NewDefaultAuditPolicy().Marshal()
 	if err != nil {
-		return fmt.Errorf("generating default audit policy: %w", err)
+		return nil, fmt.Errorf("generating default audit policy: %w", err)
 	}
 	if err := os.WriteFile(auditPolicyPath, auditPolicy, 0o644); err != nil {
-		return fmt.Errorf("writing default audit policy: %w", err)
+		return nil, fmt.Errorf("writing default audit policy: %w", err)
 	}
 
 	initConfigFile, err := os.CreateTemp("", "kubeadm-init.*.yaml")
 	if err != nil {
-		return fmt.Errorf("creating init config file %v: %w", initConfigFile.Name(), err)
+		return nil, fmt.Errorf("creating init config file %v: %w", initConfigFile.Name(), err)
 	}
 
 	if _, err := initConfigFile.Write(initConfig); err != nil {
-		return fmt.Errorf("writing kubeadm init yaml config %v: %w", initConfigFile.Name(), err)
+		return nil, fmt.Errorf("writing kubeadm init yaml config %v: %w", initConfigFile.Name(), err)
 	}
 
 	// preflight
@@ -115,9 +117,9 @@ func (k *KubernetesUtil) InitCluster(
 	if err != nil {
 		var exitErr *exec.ExitError
 		if errors.As(err, &exitErr) {
-			return fmt.Errorf("kubeadm init phase preflight failed (code %v) with: %s", exitErr.ExitCode(), out)
+			return nil, fmt.Errorf("kubeadm init phase preflight failed (code %v) with: %s", exitErr.ExitCode(), out)
 		}
-		return fmt.Errorf("kubeadm init: %w", err)
+		return nil, fmt.Errorf("kubeadm init: %w", err)
 	}
 
 	// create CA certs
@@ -127,20 +129,20 @@ func (k *KubernetesUtil) InitCluster(
 	if err != nil {
 		var exitErr *exec.ExitError
 		if errors.As(err, &exitErr) {
-			return fmt.Errorf("kubeadm init phase certs all failed (code %v) with: %s", exitErr.ExitCode(), out)
+			return nil, fmt.Errorf("kubeadm init phase certs all failed (code %v) with: %s", exitErr.ExitCode(), out)
 		}
-		return fmt.Errorf("kubeadm init: %w", err)
+		return nil, fmt.Errorf("kubeadm init: %w", err)
 	}
 
 	// create kubelet key and CA signed certificate for the node
 	log.Infof("Creating signed kubelet certificate")
 	if err := k.createSignedKubeletCert(nodeName, ips); err != nil {
-		return err
+		return nil, fmt.Errorf("creating signed kubelete certificate: %w", err)
 	}
 
 	log.Infof("Preparing node for Konnectivity")
 	if err := k.prepareControlPlaneForKonnectivity(ctx, controlPlaneEndpoint); err != nil {
-		return fmt.Errorf("setup konnectivity: %w", err)
+		return nil, fmt.Errorf("setup konnectivity: %w", err)
 	}
 
 	// initialize the cluster
@@ -155,12 +157,29 @@ func (k *KubernetesUtil) InitCluster(
 	if err != nil {
 		var exitErr *exec.ExitError
 		if errors.As(err, &exitErr) {
-			return fmt.Errorf("kubeadm init failed (code %v) with: %s", exitErr.ExitCode(), out)
+			return nil, fmt.Errorf("kubeadm init failed (code %v) with: %s", exitErr.ExitCode(), out)
 		}
-		return fmt.Errorf("kubeadm init: %w", err)
+		return nil, fmt.Errorf("kubeadm init: %w", err)
 	}
 	log.With(zap.String("output", string(out))).Infof("kubeadm init succeeded")
-	return nil
+
+	userName := clusterName + "-admin"
+
+	log.With(zap.String("userName", userName)).Infof("Creating admin kubeconfig file")
+	cmd = exec.CommandContext(
+		ctx, constants.KubeadmPath, "kubeconfig", "user",
+		"--client-name", userName, "--config", initConfigFile.Name(), "--org", user.SystemPrivilegedGroup,
+	)
+	out, err = cmd.Output()
+	if err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			return nil, fmt.Errorf("kubeadm kubeconfig user failed (code %v) with: %s", exitErr.ExitCode(), out)
+		}
+		return nil, fmt.Errorf("kubeadm kubeconfig user: %w", err)
+	}
+	log.Infof("kubeadm kubeconfig user succeeded")
+	return out, nil
 }
 
 func (k *KubernetesUtil) prepareControlPlaneForKonnectivity(ctx context.Context, loadBalancerEndpoint string) error {

@@ -271,6 +271,12 @@ func (k *KubeadmInitYAML) SetNodeName(nodeName string) {
 	k.InitConfiguration.NodeRegistration.Name = nodeName
 }
 
+// SetClusterName sets the name of the Kubernetes cluster.
+// This name is reflected in the kubeconfig file and in the name of the default admin user.
+func (k *KubeadmInitYAML) SetClusterName(clusterName string) {
+	k.ClusterConfiguration.ClusterName = clusterName
+}
+
 // SetCertSANs sets the SANs for the certificate.
 func (k *KubeadmInitYAML) SetCertSANs(certSANs []string) {
 	for _, certSAN := range certSANs {

@@ -19,7 +19,7 @@ import (
 
 type clusterUtil interface {
 	InstallComponents(ctx cont
B925
ext.Context, kubernetesComponents components.Components) error
-	InitCluster(ctx context.Context, initConfig []byte, nodeName string, ips []net.IP, controlPlaneEndpoint string, conformanceMode bool, log *logger.Logger) error
+	InitCluster(ctx context.Context, initConfig []byte, nodeName, clusterName string, ips []net.IP, controlPlaneEndpoint string, conformanceMode bool, log *logger.Logger) ([]byte, error)
 	JoinCluster(ctx context.Context, joinConfig []byte, peerRole role.Role, controlPlaneEndpoint string, log *logger.Logger) error
 	FixCilium(log *logger.Logger)
 	StartKubelet() error