{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/21037","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/21037/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/21037/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/21037/events","html_url":"https://github.com/kubernetes/kubernetes/issues/21037","id":132881856,"number":21037,"title":"cluster/ubuntu/util.sh's use of make-ca-cert.sh fails in restricted deployment environment","user":{"login":"MikeSpreitzer","id":14296719,"avatar_url":"https://avatars.githubusercontent.com/u/14296719?v=3","gravatar_id":"","url":"https://api.github.com/users/MikeSpreitzer","html_url":"https://github.com/MikeSpreitzer","followers_url":"https://api.github.com/users/MikeSpreitzer/followers","following_url":"https://api.github.com/users/MikeSpreitzer/following{/other_user}","gists_url":"https://api.github.com/users/MikeSpreitzer/gists{/gist_id}","starred_url":"https://api.github.com/users/MikeSpreitzer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikeSpreitzer/subscriptions","organizations_url":"https://api.github.com/users/MikeSpreitzer/orgs","repos_url":"https://api.github.com/users/MikeSpreitzer/repos","events_url":"https://api.github.com/users/MikeSpreitzer/events{/privacy}","received_events_url":"https://api.github.com/users/MikeSpreitzer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-11T03:54:33Z","updated_at":"2016-02-11T07:47:25Z","closed_at":null,"body":"It is almost possible to run the cluster/ubuntu scripting on a non-cluster machine to deploy Kubernetes into a deployment environment that is restricted such that the cluster machines (master and workers (AKA \"minions\", \"nodes\")) can not open connections to arbitrary external locations.\r\n\r\nHowever, there is at least one sticking point.  The one I discovered is that `provision-master` and `provision-masterandnode` use `ssh` to ask the master machine to run the `make-ca-cert.sh` script, and that script fetches https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz .\r\n\r\n@dalanlan "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/182752452","html_url":"https://github.com/kubernetes/kubernetes/issues/21037#issuecomment-182752452","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/21037","id":182752452,"user":{"login":"roberthbailey","id":7751204,"avatar_url":"https://avatars.githubusercontent.com/u/7751204?v=3","gravatar_id":"","url":"https://api.github.com/users/roberthbailey","html_url":"https://github.com/roberthbailey","followers_url":"https://api.github.com/users/roberthbailey/followers","following_url":"https://api.github.com/users/roberthbailey/following{/other_user}","gists_url":"https://api.github.com/users/roberthbailey/gists{/gist_id}","starred_url":"https://api.github.com/users/roberthbailey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/roberthbailey/subscriptions","organizations_url":"https://api.github.com/users/roberthbailey/orgs","repos_url":"https://api.github.com/users/roberthbailey/repos","events_url":"https://api.github.com/users/roberthbailey/events{/privacy}","received_events_url":"https://api.github.com/users/roberthbailey/received_events","type":"User","site_admin":false},"created_at":"2016-02-11T07:47:25Z","updated_at":"2016-02-11T07:47:25Z","body":"Does ubuntu have openssl installed by default? You can also generate the certs using openssl commands which could replace the easyrsa cert generation for ubuntu. Alternatively, if you drop certs onto the master machine in the right location, salt will skip running the `make-ca-cert.sh` script because the certs will already exist (so there is no need to create them). This is what we do on GCE. "}}