tree 96c6ec6648426bd51bbf82573b2fbe28f2044868
parent 73fc59541abfc457598cc5e62ae4d2c3b84065a1
author Serge Bazanski <serge@nexantic.com> 1594660668 +0200
committer Serge Bazanski <serge@nexantic.com> 1594660668 +0200

core/internal/cluster: implement multi-node clusters with 'golden ticket'.

As we have fully ripped out all traces of the node management service or
integrity checks, we implement a stopgap system that allows us to
continue developing multi-node clusters. This mechanism is enrolment
using 'golden tickets', which are protobuf messages that can be
generated via the debug service on an existing cluster, and set on a new
node's EnrolmentConfig to bring that enrol that node into the cluster.

As this is a stopgap measure (waiting for better cluster lifecycle
design), this is somewhat poorly implemented, with known issues:
 - odd enrolment flow that creates all certificates off-node and results
   in some code duplication in the cluster manager and node debug
   service
 - (more) assumptions that every node is both a kubernetes and etcd
   member.
 - absolutely no protection against consensus loss due to even quorum
   membership, repeated issuance of certificates
 - dependence on knowing the IP address of the new node ahead of time,
   which is not something that our test harness supports well (or that
   we want to rely on at all)

Test Plan: part of existing multi-node tests

X-Origin-Diff: phab/D591
GitOrigin-RevId: 8f099e6ef37f8d47fb2272a3a14b25ed480e377a