Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ConfigConnector Webhook uses deprecated 'CommonName' field for certificates and cannot be installed in k8s 1.19.x #335

Closed
Tonyqu123 opened this issue Dec 7, 2020 · 6 comments
Closed

ConfigConnector Webhook uses deprecated 'CommonName' field for certificates and cannot be installed in k8s 1.19.x #335

Tonyqu123 opened this issue Dec 7, 2020 · 6 comments
Labels
bug Something isn't working

Comments

@Tonyqu123
Copy link

Describe the bug
After install the k8s-config-connector on our k8s cluster[version: 1.19.3]. I try to install an sql instance by following the sample yaml. Use the command kubectl create -f /path/to/sample-sql.yaml

Error from server (InternalError): error when creating "/Users/i519593/Code/cnrm/tmp/samples/sql.yaml": Internal error occurred: failed calling webhook "annotation-defaulter.cnrm.cloud.google.com": Post "https://cnrm-validating-webhook.cnrm-system.svc:443/annotation-defaulter?timeout=30s": x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0

ConfigConnector Version
1.16.0

To Reproduce
Install a k8s 1.19.x cluster. kubectl create -f /path/to/sample-sql.yaml

YAML snippets:
apiVersion: sql.cnrm.cloud.google.com/v1beta1
kind: SQLInstance
metadata:
name: sqlinstance-sample-mysql
spec:
databaseVersion: MYSQL_5_7
region: us-central1
settings:
tier: db-f1-micro%
@Tonyqu123 Tonyqu123 added the bug Something isn't working label Dec 7, 2020
@Tonyqu123
Copy link
Author

K8s 1.19.x is now built with golang 1.15.0-rc.1. As it says:
The deprecated, legacy behavior of treating the CommonName field on X.509 serving certificates as a host name when no Subject Alternative Names are present is now disabled by default. It can be temporarily re-enabled by adding the value x509ignoreCN=0 to the GODEBUG environment variable. (#93264, @justaugustus) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Release, Scalability, Storage and Testing]

@Tonyqu123
Copy link
Author

https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.19.md#v1194

@caieo
Copy link
Contributor

caieo commented Dec 8, 2020

Hi @Tonyqu123 , thank you for bringing this to our attention. Just to get more context, are you currently using a GKE cluster?

Given this breaking change of disabling the CommonName field for certificates, it looks like Config Connector cannot work with 1.19 and above Kubernetes Clusters until we update our webhook. Sorry for the inconvenience, but can you try using a lower versioned Kubernetes cluster until we fix this issue?

@Tonyqu123
Copy link
Author

Yes, we could use a lower version one. By the way, we are not using GKE, but gardener

@caieo
Copy link
Contributor

caieo commented Dec 10, 2020

Ah okay, thank you for the update & being flexible to use a lower versioned cluster. We'll update this thread when we fix the issue with k8s 1.19 compatibility.

@xiaobaitusi xiaobaitusi changed the title Webhook Err while Creating the the sample resource ConfigConnector Webhook uses deprecated 'CommonName' field for certificates and cannot be installed in k8s 1.19.x Jan 4, 2021
@maqiuyujoyce
Copy link
Collaborator

This bug should be fixed in Config Connector v1.37.0. Please let us know if you have any other questions.

@frealmyr frealmyr mentioned this issue Feb 22, 2021
Closed
@AndreLSnyk AndreLSnyk mentioned this issue Mar 7, 2021
Open
@Matthelonianxl Matthelonianxl mentioned this issue Mar 8, 2021
Open
@Bobgy Bobgy mentioned this issue Mar 25, 2021
Closed
@AndreLSnyk AndreLSnyk mentioned this issue Apr 30, 2023
Open
@AndreLSnyk AndreLSnyk mentioned this issue May 13, 2024
Open
@Matthelonianxl Matthelonianxl mentioned this issue May 14, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@caieo @Tonyqu123 @maqiuyujoyce