{"action":"created","comment":{"url":"https://api.github.com/repos/coreos/tectonic-installer/pulls/comments/165989814","pull_request_review_id":94010542,"id":165989814,"diff_hunk":"@@ -0,0 +1,35 @@\n+# Kubernetes Aggregated API Server CA (resources/generated/tls/aggregator-ca.crt)\n+#\n+# TODO(diegs): this should be a sibling of the `--tls-ca-file` CA. However the\n+# self-signed CA ca.crt serves double-duty as the parent CA of other certs and \n+# as the `--tls-ca-file` CA. In the future that should be a separate CA as well.\n+resource \"tls_private_key\" \"aggregator_ca\" {\n+  algorithm = \"RSA\"\n+  rsa_bits  = \"2048\"\n+}\n+\n+resource \"tls_cert_request\" \"aggregator_ca\" {\n+  key_algorithm   = \"${tls_private_key.aggregator_ca.algorithm}\"\n+  private_key_pem = \"${tls_private_key.aggregator_ca.private_key_pem}\"\n+\n+  subject {\n+    common_name  = \"aggregator\"\n+    organization = \"bootkube\"\n+  }\n+}\n+\n+resource \"tls_locally_signed_cert\" \"aggregator_ca\" {\n+  cert_request_pem = \"${tls_cert_request.aggregator_ca.cert_request_pem}\"\n+\n+  is_ca_certificate     = true\n+  ca_key_algorithm      = \"${tls_self_signed_cert.kube_ca.key_algorithm}\"\n+  ca_private_key_pem    = \"${tls_private_key.kube_ca.private_key_pem}\"\n+  ca_cert_pem           = \"${tls_self_signed_cert.kube_ca.cert_pem}\"\n+  validity_period_hours = \"${var.validity_period}\"\n+\n+  allowed_uses = [\n+    \"key_encipherment\",\n+    \"digital_signature\",\n+    \"client_auth\",\n+  ]\n+}","path":"contrib/user-provided-certs/kube/self-signed/aggregator_ca.tf","position":35,"original_position":35,"commit_id":"5b9e32d3be43b9e1671adf45c42c2ce9eec46930","original_commit_id":"5b9e32d3be43b9e1671adf45c42c2ce9eec46930","user":{"login":"squat","id":20484159,"avatar_url":"https://avatars1.githubusercontent.com/u/20484159?v=4","gravatar_id":"","url":"https://api.github.com/users/squat","html_url":"https://github.com/squat","followers_url":"https://api.github.com/users/squat/followers","following_url":"https://api.github.com/users/squat/following{/other_user}","gists_url":"https://api.github.com/users/squat/gists{/gist_id}","starred_url":"https://api.github.com/users/squat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/squat/subscriptions","organizations_url":"https://api.github.com/users/squat/orgs","repos_url":"https://api.github.com/users/squat/repos","events_url":"https://api.github.com/users/squat/events{/privacy}","received_events_url":"https://api.github.com/users/squat/received_events","type":"User","site_admin":false},"body":"Should this module also create local files for the aggregated ca key and crt just like `modules/tls/kube/self-signed` does? i.e.:\r\n```hcl\r\nresource \"local_file\" \"aggregator_ca_key\" {\r\n...\r\n}\r\nresource \"local_file\" \"aggregator_ca_crt\" {\r\n...\r\n}\r\n```","created_at":"2018-02-05T14:40:23Z","updated_at":"2018-02-05T14:40:24Z","html_url":"https://github.com/coreos/tectonic-installer/pull/2850#discussion_r165989814","pull_request_url":"https://api.github.com/repos/coreos/tectonic-installer/pulls/2850","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/coreos/tectonic-installer/pulls/comments/165989814"},"html":{"href":"https://github.com/coreos/tectonic-installer/pull/2850#discussion_r165989814"},"pull_request":{"href":"https://api.github.com/repos/coreos/tectonic-installer/pulls/2850"}}},"pull_request":{"url":"https://api.github.com/repos/coreos/tectonic-installer/pulls/2850","id":165809245,"html_url":"https://github.com/coreos/tectonic-installer/pull/2850","diff_url":"https://github.com/coreos/tectonic-installer/pull/2850.diff","patch_url":"https://github.com/coreos/tectonic-installer/pull/2850.patch","issue_url":"https://api.github.com/repos/coreos/tectonic-installer/issues/2850","number":2850,"state":"open","locked":false,"title":"tls: add aggregated apiserver certs.","user":{"login":"diegs","id":74719,"avatar_url":"https://avatars3.githubusercontent.com/u/74719?v=4","gravatar_id":"","url":"https://api.github.com/users/diegs","html_url":"https://github.com/diegs","followers_url":"https://api.github.com/users/diegs/followers","following_url":"https://api.github.com/users/diegs/following{/other_user}","gists_url":"https://api.github.com/users/diegs/gists{/gist_id}","starred_url":"https://api.github.com/users/diegs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diegs/subscriptions","organizations_url":"https://api.github.com/users/diegs/orgs","repos_url":"https://api.github.com/users/diegs/repos","events_url":"https://api.github.com/users/diegs/events{/privacy}","received_events_url":"https://api.github.com/users/diegs/received_events","type":"User","site_admin":false},"body":"This adds a new CA and certificate pair to support running aggregated\r\napi-servers in the cluster. This is required for deploying\r\nmetrics-server (heapster replacement) and other aggregated api-server\r\ncomponents that will start to appear in 1.9+.\r\n\r\nIn the self-signed scenario these are derived from the kube_ca, which\r\nhappens to also be the apiserver serving ca. In practice the kube_ca\r\nshould be the parent of both this CA and the one that is used by the\r\n--tls-ca-file flag in the apiserver. I added a TODO to fix that when\r\nwe implement the \"single CA is the parent of all generated certs\" change\r\nfor track 2.","created_at":"2018-01-29T20:28:53Z","updated_at":"2018-02-05T14:40:24Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1e40ab7324797c6386b93715db3ba14d008eb0a2","assignee":{"login":"diegs","id":74719,"avatar_url":"https://avatars3.githubusercontent.com/u/74719?v=4","gravatar_id":"","url":"https://api.github.com/users/diegs","html_url":"https://github.com/diegs","followers_url":"https://api.github.com/users/diegs/followers","following_url":"https://api.github.com/users/diegs/following{/other_user}","gists_url":"https://api.github.com/users/diegs/gists{/gist_id}","starred_url":"https://api.github.com/users/diegs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diegs/subscriptions","organizations_url":"https://api.github.com/users/diegs/orgs","repos_url":"https://api.github.com/users/diegs/repos","events_url":"https://api.github.com/users/diegs/events{/privacy}","received_events_url":"https://api.github.com/users/diegs/received_events","type":"User","site_admin":false},"assignees":[{"login":"diegs","id":74719,"avatar_url":"https://avatars3.githubusercontent.com/u/74719?v=4","gravatar_id":"","url":"https://api.github.com/users/diegs","html_url":"https://github.com/diegs","followers_url":"https://api.github.com/users/diegs/followers","following_url":"https://api.github.com/users/diegs/following{/other_user}","gists_url":"https://api.github.com/users/diegs/gists{/gist_id}","starred_url":"https://api.github.com/users/diegs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diegs/subscriptions","organizations_url":"https://api.github.com/users/diegs/orgs","repos_url":"https://api.github.com/users/diegs/repos","events_url":"https://api.github.com/users/diegs/events{/privacy}","received_events_url":"https://api.github.com/users/diegs/received_events","type":"User","site_admin":false}],"requested_reviewers":[{"login":"sym3tri","id":224222,"avatar_url":"https://avatars0.githubusercontent.com/u/224222?v=4","gravatar_id":"","url":"https://api.github.com/users/sym3tri","html_url":"https://github.com/sym3tri","followers_url":"https://api.github.com/users/sym3tri/followers","following_url":"https://api.github.com/users/sym3tri/following{/other_user}","gists_url":"https://api.github.com/users/sym3tri/gists{/gist_id}","starred_url":"https://api.github.com/users/sym3tri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sym3tri/subscriptions","organizations_url":"https://api.github.com/users/sym3tri/orgs","repos_url":"https://api.github.com/users/sym3tri/repos","events_url":"https://api.github.com/users/sym3tri/events{/privacy}","received_events_url":"https://api.github.com/users/sym3tri/received_events","type":"User","site_admin":false}],"requested_teams":[],"milestone":null,"commits_url":"https://api.github.com/repos/coreos/tectonic-installer/pulls/2850/commits","review_comments_url":"https://api.github.com/repos/coreos/tectonic-installer/pulls/2850/comments","review_comment_url":"https://api.github.com/repos/coreos/tectonic-installer/pulls/comments{/number}","comments_url":"https://api.github.com/repos/coreos/tectonic-installer/issues/2850/comments","statuses_url":"https://api.github.com/repos/coreos/tectonic-installer/statuses/5b9e32d3be43b9e1671adf45c42c2ce9eec46930","head":{"label":"diegs:crt","ref":"crt","sha":"5b9e32d3be43b9e1671adf45c42c2ce9eec46930","user":{"login":"diegs","id":74719,"avatar_url":"https://avatars3.githubusercontent.com/u/74719?v=4","gravatar_id":"","url":"https://api.github.com/users/diegs","html_url":"https://github.com/diegs","followers_url":"https://api.github.com/users/diegs/followers","following_url":"https://api.github.com/users/diegs/following{/other_user}","gists_url":"https://api.github.com/users/diegs/gists{/gist_id}","starred_url":"https://api.github.com/users/diegs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diegs/subscriptions","organizations_url":"https://api.github.com/users/diegs/orgs","repos_url":"https://api.github.com/users/diegs/repos","events_url":"https://api.github.com/users/diegs/events{/privacy}","received_events_url":"https://api.github.com/users/diegs/received_events","type":"User","site_admin":false},"repo":{"id":92105079,"name":"tectonic-installer","full_name":"diegs/tectonic-installer","owner":{"login":"diegs","id":74719,"avatar_url":"https://avatars3.githubusercontent.com/u/74719?v=4","gravatar_id":"","url":"https://api.github.com/users/diegs","html_url":"https://github.com/diegs","followers_url":"https://api.github.com/users/diegs/followers","following_url":"https://api.github.com/users/diegs/following{/other_user}","gists_url":"https://api.github.com/users/diegs/gists{/gist_id}","starred_url":"https://api.github.com/users/diegs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diegs/subscriptions","organizations_url":"https://api.github.com/users/diegs/orgs","repos_url":"https://api.github.com/users/diegs/repos","events_url":"https://api.github.com/users/diegs/events{/privacy}","received_events_url":"https://api.github.com/users/diegs/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/diegs/tectonic-installer","description":"Install a Kubernetes cluster the CoreOS Tectonic Way: HA, self-hosted, RBAC, etcd Operator, and more","fork":true,"url":"https://api.github.com/repos/diegs/tectonic-installer","forks_url":"https://api.github.com/repos/diegs/tectonic-installer/forks","keys_url":"https://api.github.com/repos/diegs/tectonic-installer/keys{/key_id}","collaborators_url":"https://api.github.com/repos/diegs/tectonic-installer/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/diegs/tectonic-installer/teams","hooks_url":"https://api.github.com/repos/diegs/tectonic-installer/hooks","issue_events_url":"https://api.github.com/repos/diegs/tectonic-installer/issues/events{/number}","events_url":"https://api.github.com/repos/diegs/tectonic-installer/events","assignees_url":"https://api.github.com/repos/diegs/tectonic-installer/assignees{/user}","branches_url":"https://api.github.com/repos/diegs/tectonic-installer/branches{/branch}","tags_url":"https://api.github.com/repos/diegs/tectonic-installer/tags","blobs_url":"https://api.github.com/repos/diegs/tectonic-installer/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/diegs/tectonic-installer/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/diegs/tectonic-installer/git/refs{/sha}","trees_url":"https://api.github.com/repos/diegs/tectonic-installer/git/trees{/sha}","statuses_url":"https://api.github.com/repos/diegs/tectonic-installer/statuses/{sha}","languages_url":"https://api.github.com/repos/diegs/tectonic-installer/languages","stargazers_url":"https://api.github.com/repos/diegs/tectonic-installer/stargazers","contributors_url":"https://api.github.com/repos/diegs/tectonic-installer/contributors","subscribers_url":"https://api.github.com/repos/diegs/tectonic-installer/subscribers","subscription_url":"https://api.github.com/repos/diegs/tectonic-installer/subscription","commits_url":"https://api.github.com/repos/diegs/tectonic-installer/commits{/sha}","git_commits_url":"https://api.github.com/repos/diegs/tectonic-installer/git/commits{/sha}","comments_url":"https://api.github.com/repos/diegs/tectonic-installer/comments{/number}","issue_comment_url":"https://api.github.com/repos/diegs/tectonic-installer/issues/comments{/number}","contents_url":"https://api.github.com/repos/diegs/tectonic-installer/contents/{+path}","compare_url":"https://api.github.com/repos/diegs/tectonic-installer/compare/{base}...{head}","merges_url":"https://api.github.com/repos/diegs/tectonic-installer/merges","archive_url":"https://api.github.com/repos/diegs/tectonic-installer/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/diegs/tectonic-installer/downloads","issues_url":"https://api.github.com/repos/diegs/tectonic-installer/issues{/number}","pulls_url":"https://api.github.com/repos/diegs/tectonic-installer/pulls{/number}","milestones_url":"https://api.github.com/repos/diegs/tectonic-installer/milestones{/number}","notifications_url":"https://api.github.com/repos/diegs/tectonic-installer/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/diegs/tectonic-installer/labels{/name}","releases_url":"https://api.github.com/repos/diegs/tectonic-installer/releases{/id}","deployments_url":"https://api.github.com/repos/diegs/tectonic-installer/deployments","created_at":"2017-05-22T22:31:49Z","updated_at":"2017-12-07T20:53:42Z","pushed_at":"2018-02-02T18:32:17Z","git_url":"git://github.com/diegs/tectonic-installer.git","ssh_url":"git@github.com:diegs/tectonic-installer.git","clone_url":"https://github.com/diegs/tectonic-installer.git","svn_url":"https://github.com/diegs/tectonic-installer","homepage":"","size":32436,"stargazers_count":0,"watchers_count":0,"language":"HCL","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"coreos:master","ref":"master","sha":"0bcc34b274d385c81e95542ff4a9dc04e531b96f","user":{"login":"coreos","id":3730757,"avatar_url":"https://avatars3.githubusercontent.com/u/3730757?v=4","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"repo":{"id":81620471,"name":"tectonic-installer","full_name":"coreos/tectonic-installer","owner":{"login":"coreos","id":3730757,"avatar_url":"https://avatars3.githubusercontent.com/u/3730757?v=4","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/coreos/tectonic-installer","description":"Install a Kubernetes cluster the CoreOS Tectonic Way: HA, self-hosted, RBAC, etcd Operator, and more","fork":false,"url":"https://api.github.com/repos/coreos/tectonic-installer","forks_url":"https://api.github.com/repos/coreos/tectonic-installer/forks","keys_url":"https://api.github.com/repos/coreos/tectonic-installer/keys{/key_id}","collaborators_url":"https://api.github.com/repos/coreos/tectonic-installer/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/coreos/tectonic-installer/teams","hooks_url":"https://api.github.com/repos/coreos/tectonic-installer/hooks","issue_events_url":"https://api.github.com/repos/coreos/tectonic-installer/issues/events{/number}","events_url":"https://api.github.com/repos/coreos/tectonic-installer/events","assignees_url":"https://api.github.com/repos/coreos/tectonic-installer/assignees{/user}","branches_url":"https://api.github.com/repos/coreos/tectonic-installer/branches{/branch}","tags_url":"https://api.github.com/repos/coreos/tectonic-installer/tags","blobs_url":"https://api.github.com/repos/coreos/tectonic-installer/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/coreos/tectonic-installer/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/coreos/tectonic-installer/git/refs{/sha}","trees_url":"https://api.github.com/repos/coreos/tectonic-installer/git/trees{/sha}","statuses_url":"https://api.github.com/repos/coreos/tectonic-installer/statuses/{sha}","languages_url":"https://api.github.com/repos/coreos/tectonic-installer/languages","stargazers_url":"https://api.github.com/repos/coreos/tectonic-installer/stargazers","contributors_url":"https://api.github.com/repos/coreos/tectonic-installer/contributors","subscribers_url":"https://api.github.com/repos/coreos/tectonic-installer/subscribers","subscription_url":"https://api.github.com/repos/coreos/tectonic-installer/subscription","commits_url":"https://api.github.com/repos/coreos/tectonic-installer/commits{/sha}","git_commits_url":"https://api.github.com/repos/coreos/tectonic-installer/git/commits{/sha}","comments_url":"https://api.github.com/repos/coreos/tectonic-installer/comments{/number}","issue_comment_url":"https://api.github.com/repos/coreos/tectonic-installer/issues/comments{/number}","contents_url":"https://api.github.com/repos/coreos/tectonic-installer/contents/{+path}","compare_url":"https://api.github.com/repos/coreos/tectonic-installer/compare/{base}...{head}","merges_url":"https://api.github.com/repos/coreos/tectonic-installer/merges","archive_url":"https://api.github.com/repos/coreos/tectonic-installer/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/coreos/tectonic-installer/downloads","issues_url":"https://api.github.com/repos/coreos/tectonic-installer/issues{/number}","pulls_url":"https://api.github.com/repos/coreos/tectonic-installer/pulls{/number}","milestones_url":"https://api.github.com/repos/coreos/tectonic-installer/milestones{/number}","notifications_url":"https://api.github.com/repos/coreos/tectonic-installer/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/coreos/tectonic-installer/labels{/name}","releases_url":"https://api.github.com/repos/coreos/tectonic-installer/releases{/id}","deployments_url":"https://api.github.com/repos/coreos/tectonic-installer/deployments","created_at":"2017-02-11T00:52:23Z","updated_at":"2018-02-05T02:45:32Z","pushed_at":"2018-02-05T14:36:58Z","git_url":"git://github.com/coreos/tectonic-installer.git","ssh_url":"git@github.com:coreos/tectonic-installer.git","clone_url":"https://github.com/coreos/tectonic-installer.git","svn_url":"https://github.com/coreos/tectonic-installer","homepage":"","size":33300,"stargazers_count":424,"watchers_count":424,"language":"HCL","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":249,"mirror_url":null,"archived":false,"open_issues_count":169,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":249,"open_issues":169,"watchers":424,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/coreos/tectonic-installer/pulls/2850"},"html":{"href":"https://github.com/coreos/tectonic-installer/pull/2850"},"issue":{"href":"https://api.github.com/repos/coreos/tectonic-installer/issues/2850"},"comments":{"href":"https://api.github.com/repos/coreos/tectonic-installer/issues/2850/comments"},"review_comments":{"href":"https://api.github.com/repos/coreos/tectonic-installer/pulls/2850/comments"},"review_comment":{"href":"https://api.github.com/repos/coreos/tectonic-installer/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/coreos/tectonic-installer/pulls/2850/commits"},"statuses":{"href":"https://api.github.com/repos/coreos/tectonic-installer/statuses/5b9e32d3be43b9e1671adf45c42c2ce9eec46930"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"squat"}}