metropolis/node/kubernetes: fix mtls authentication to (controller-manager|scheduler)
Previously it wasn't possible to authenticate against the services
as they had no CA they trusted for the sent client certificate.
Change-Id: Ic7cd2419a9e3496680a9393424c7ca1780c4d38c
Reviewed-on: https://review.monogon.dev/c/monogon/+/1951
Tested-by: Jenkins CI
Reviewed-by: Serge Bazanski <serge@monogon.tech>
diff --git a/metropolis/node/kubernetes/controller-manager.go b/metropolis/node/kubernetes/controller-manager.go
index a6c424b..363571d 100644
--- a/metropolis/node/kubernetes/controller-manager.go
+++ b/metropolis/node/kubernetes/controller-manager.go
@@ -74,6 +74,8 @@
pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: config.serviceAccountPrivKey})),
args.FileOpt("--root-ca-file", "root-ca.pem",
pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: config.rootCA})),
+ args.FileOpt("--client-ca-file", "root-ca.pem",
+ pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: config.rootCA})),
"--use-service-account-credentials=true", // Enables things like PSP enforcement
fmt.Sprintf("--cluster-cidr=%v", config.clusterNet.String()),
args.FileOpt("--tls-cert-file", "server-cert.pem",