store CA in database for stateless masters

[matti]

Would be awesome to run k0s master(s) as fully stateless - the cluster CA needs to be stored in database like kine does, something like

spec:
  storage:
    type: ca
    kine:
      dataSource: mysql://root:kine@my-managed-database/ca
``

[matti]

OR better (?) accept a pre made CA from an ENV so that is is the same for every pod running the master regardless of the lifecycle

[jnummelin]

This does sound like a nice feature in general.

accept a pre made CA from an ENV

We do not have that sort of env currently, but you can already pre-dump the ca.{key,crt} files in /var/lib/k0s/pki and k0s will happily use them.

Note: In case for HA controllers, you must also have pre-defined sa.{key,pub} so that all controllers use same key for SA token creation/validation

[matti]

oh cool, can you explain this a bit more:

Note: In case for HA controllers, you must also have pre-defined sa.{key,pub} so that all controllers use same key for SA token creation/validation

[jnummelin]

So the controllers use the sa.key to sign the service account tokens. If there's multiple controller instances for HA we need to be sure each of them are using same keys. :)

[trawler]

This does sound like a nice feature in general.

accept a pre made CA from an ENV

We do not have that sort of env currently, but you can already pre-dump the ca.{key,crt} files in /var/lib/k0s/pki and k0s will happily use them.

Note: In case for HA controllers, you must also have pre-defined sa.{key,pub} so that all controllers use same key for SA token creation/validation

We can easily expose this option, by accepting a path from the user in the k0s.yaml file, and only generating a self-signed cert if there is none.

[jnummelin]

The issue is marked as stale since no activity has been recorded in 30 days

[matti]

häh

[mikhail-sakhnov]

with the io/fs package landed in 1.16 it should not be that hard. I think we already use it in the cert manager, so we can plug-in some io/fs implementation for example for s3 and it SHOULD work out of the box.

[github-actions[bot]]

The issue is marked as stale since no activity has been recorded in 30 days