[EKS] [request]: Hostname Alias in Cluster CA
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
**Tell us about your request**
An optional parameter which can add a custom hostname in the cluster CA during the cluster creation.
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
This issue is slightly related to #221 as we are trying to make use of the private endpoints in a heavily routed, multi data center and cloud environment. Our idea is to place an inbound resolver endpoint to our VPC where we have a private DNS zone and set up the dns resolution in the corporate network to route name resolving of .example.com domain names through this resolver. Then we jsut would place a CNAME record to the api endpoint as api..example.com. Actually this works pretty well till we get to the real HTTPS requests.
We get:
```
Unable to connect to the server: x509: certificate is valid for ip-172-16-37-253.us-west-2.compute.internal, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, .us-west-2.eks.amazonaws.com, not api..example.com
```
It would be nice, that during the creation of the cluster an alias hostname could be added to the certificate.
**Are you currently working around this issue?**
We mark the cluster insecure using: ```insecure-skip-tls-verify: true``` in the kubeconfig
Contributor guide
Research direction
Start by reading this issue and the related #221, then investigate how EKS cluster creation produces the cluster CA and kubeconfig certificate names. Done means a user-supplied hostname alias is included in the cluster certificate so HTTPS requests through that alias validate without insecure-skip-tls-verify.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100