aws / aws/containers-roadmap

[EKS] [request]: Hostname Alias in Cluster CA

Open
#283 13 comments 125 reactions 0 assignees View on GitHub
EKS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

**Tell us about your request**
An optional parameter which can add a custom hostname in the cluster CA during the cluster creation.

**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
This issue is slightly related to #221 as we are trying to make use of the private endpoints in a heavily routed, multi data center and cloud environment. Our idea is to place an inbound resolver endpoint to our VPC where we have a private DNS zone and set up the dns resolution in the corporate network to route name resolving of .example.com domain names through this resolver. Then we jsut would place a CNAME record to the api endpoint as api..example.com. Actually this works pretty well till we get to the real HTTPS requests.

We get:
```
Unable to connect to the server: x509: certificate is valid for ip-172-16-37-253.us-west-2.compute.internal, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, .us-west-2.eks.amazonaws.com, not api..example.com
```

It would be nice, that during the creation of the cluster an alias hostname could be added to the certificate.

**Are you currently working around this issue?**
We mark the cluster insecure using: ```insecure-skip-tls-verify: true``` in the kubeconfig

Contributor guide

Open the contributing guide

Research direction

Start by reading this issue and the related #221, then investigate how EKS cluster creation produces the cluster CA and kubeconfig certificate names. Done means a user-supplied hostname alias is included in the cluster certificate so HTTPS requests through that alias validate without insecure-skip-tls-verify.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.