Don't generation self signed certs

cmd/kube-apiserver/app/server.go

@@ -22,7 +22,6 @@ package app
 import (
 	"fmt"
 	"io/ioutil"
-	"net"
 	"os"
 	"strings"
 	"time"
@@ -501,14 +500,11 @@ func Complete(s *options.ServerRunOptions) (completedServerRunOptions, error) {
 	if err := kubeoptions.DefaultAdvertiseAddress(s.GenericServerRunOptions, s.InsecureServing.DeprecatedInsecureServingOptions); err != nil {
 		return options, err
 	}
-	serviceIPRange, apiServerServiceIP, err := master.DefaultServiceIPRange(s.ServiceClusterIPRange)
+	serviceIPRange, _, err := master.DefaultServiceIPRange(s.ServiceClusterIPRange)
 	if err != nil {
 		return options, fmt.Errorf("error determining service IP ranges: %v", err)
 	}
 	s.ServiceClusterIPRange = serviceIPRange
-	if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts(s.GenericServerRunOptions.AdvertiseAddress.String(), []string{"kubernetes.default.svc", "kubernetes.default", "kubernetes"}, []net.IP{apiServerServiceIP}); err != nil {
-		return options, fmt.Errorf("error creating self-signed certificates: %v", err)
-	}
 
 	if len(s.GenericServerRunOptions.ExternalHost) == 0 {
 		if len(s.GenericServerRunOptions.AdvertiseAddress) > 0 {

cmd/kube-controller-manager/app/options/options.go

@@ -19,7 +19,6 @@ limitations under the License.
 package options
 
 import (
-	"fmt"
 	"net"
 
 	"k8s.io/api/core/v1"
@@ -392,10 +391,6 @@ func (s KubeControllerManagerOptions) Config(allControllers []string, disabledBy
 		return nil, err
 	}
 
-	if err := s.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", nil, []net.IP{net.ParseIP("127.0.0.1")}); err != nil {
-		return nil, fmt.Errorf("error creating self-signed certificates: %v", err)
-	}
-
 	kubeconfig, err := clientcmd.BuildConfigFromFlags(s.Master, s.Kubeconfig)
 	if err != nil {
 		return nil, err

staging/src/k8s.io/apiextensions-apiserver/pkg/cmd/server/options/options.go

@@ -17,9 +17,7 @@ limitations under the License.
 package options
 
 import (
-	"fmt"
 	"io"
-	"net"
 
 	"github.com/spf13/pflag"
 
@@ -77,11 +75,6 @@ func (o *CustomResourceDefinitionsServerOptions) Complete() error {
 
 // Config returns an apiextensions-apiserver configuration.
 func (o CustomResourceDefinitionsServerOptions) Config() (*apiserver.Config, error) {
-	// TODO have a "real" external address
-	if err := o.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", nil, []net.IP{net.ParseIP("127.0.0.1")}); err != nil {
-		return nil, fmt.Errorf("error creating self-signed certificates: %v", err)
-	}
-
 	serverConfig := genericapiserver.NewRecommendedConfig(apiserver.Codecs)
 	if err := o.RecommendedOptions.ApplyTo(serverConfig, apiserver.Scheme); err != nil {
 		return nil, err

staging/src/k8s.io/apiserver/pkg/server/options/serving.go

@@ -20,17 +20,14 @@ import (
 	"crypto/tls"
 	"fmt"
 	"net"
-	"path"
 	"strconv"
 	"strings"
 
-	"github.com/golang/glog"
 	"github.com/spf13/pflag"
 
 	utilnet "k8s.io/apimachinery/pkg/util/net"
 	"k8s.io/apiserver/pkg/server"
 	utilflag "k8s.io/apiserver/pkg/util/flag"
-	certutil "k8s.io/client-go/util/cert"
 )
 
 type SecureServingOptions struct {
@@ -259,48 +256,6 @@ func (s *SecureServingOptions) ApplyTo(config **server.SecureServingInfo) error
 	return nil
 }
 
-func (s *SecureServingOptions) MaybeDefaultWithSelfSignedCerts(publicAddress string, alternateDNS []string, alternateIPs []net.IP) error {
-	if s == nil || (s.BindPort == 0 && s.Listener == nil) {
-		return nil
-	}
-	keyCert := &s.ServerCert.CertKey
-	if len(keyCert.CertFile) != 0 || len(keyCert.KeyFile) != 0 {
-		return nil
-	}
-
-	keyCert.CertFile = path.Join(s.ServerCert.CertDirectory, s.ServerCert.PairName+".crt")
-	keyCert.KeyFile = path.Join(s.ServerCert.CertDirectory, s.ServerCert.PairName+".key")
-
-	canReadCertAndKey, err := certutil.CanReadCertAndKey(keyCert.CertFile, keyCert.KeyFile)
-	if err != nil {
-		return err
-	}
-	if !canReadCertAndKey {
-		// add either the bind address or localhost to the valid alternates
-		bindIP := s.BindAddress.String()
-		if bindIP == "0.0.0.0" {
-			alternateDNS = append(alternateDNS, "localhost")
-		} else {
-			alternateIPs = append(alternateIPs, s.BindAddress)
-		}
-
-		if cert, key, err := certutil.GenerateSelfSignedCertKeyWithFixtures(publicAddress, alternateIPs, alternateDNS, s.ServerCert.FixtureDirectory); err != nil {
-			return fmt.Errorf("unable to generate self signed cert: %v", err)
-		} else {
-			if err := certutil.WriteCert(keyCert.CertFile, cert); err != nil {
-				return err
-			}
-
-			if err := certutil.WriteKey(keyCert.KeyFile, key); err != nil {
-				return err
-			}
-			glog.Infof("Generated self-signed cert (%s, %s)", keyCert.CertFile, keyCert.KeyFile)
-		}
-	}
-
-	return nil
-}
-
 func CreateListener(network, addr string) (net.Listener, int, error) {
 	if len(network) == 0 {
 		network = "tcp"