Bumping k8s dependencies to 1.13

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/BUILD

@@ -8,7 +8,10 @@ load(
 
 go_test(
     name = "go_default_test",
-    srcs = ["certs_test.go"],
+    srcs = [
+        "certlist_test.go",
+        "certs_test.go",
+    ],
     embed = [":go_default_library"],
     deps = [
         "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
@@ -16,12 +19,14 @@ go_test(
         "//cmd/kubeadm/app/phases/certs/pkiutil:go_default_library",
         "//cmd/kubeadm/test:go_default_library",
         "//cmd/kubeadm/test/certs:go_default_library",
+        "//staging/src/k8s.io/client-go/util/cert:go_default_library",
     ],
 )
 
 go_library(
     name = "go_default_library",
     srcs = [
+        "certlist.go",
         "certs.go",
         "doc.go",
     ],
@@ -30,8 +35,8 @@ go_library(
         "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
         "//cmd/kubeadm/app/constants:go_default_library",
         "//cmd/kubeadm/app/phases/certs/pkiutil:go_default_library",
+        "//staging/src/k8s.io/client-go/util/cert:go_default_library",
         "//vendor/github.com/golang/glog:go_default_library",
-        "//vendor/k8s.io/client-go/util/cert:go_default_library",
     ],
 )
 
@@ -47,6 +52,7 @@ filegroup(
     srcs = [
         ":package-srcs",
         "//cmd/kubeadm/app/phases/certs/pkiutil:all-srcs",
+        "//cmd/kubeadm/app/phases/certs/renewal:all-srcs",
     ],
     tags = ["automanaged"],
 )

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/certlist.go

@@ -0,0 +1,377 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certs
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+	"fmt"
+
+	certutil "k8s.io/client-go/util/cert"
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil"
+)
+
+type configMutatorsFunc func(*kubeadmapi.InitConfiguration, *certutil.Config) error
+
+// KubeadmCert represents a certificate that Kubeadm will create to function properly.
+type KubeadmCert struct {
+	Name     string
+	LongName string
+	BaseName string
+	CAName   string
+	// Some attributes will depend on the InitConfiguration, only known at runtime.
+	// These functions will be run in series, passed both the InitConfiguration and a cert Config.
+	configMutators []configMutatorsFunc
+	config         certutil.Config
+}
+
+// GetConfig returns the definition for the given cert given the provided InitConfiguration
+func (k *KubeadmCert) GetConfig(ic *kubeadmapi.InitConfiguration) (*certutil.Config, error) {
+	for _, f := range k.configMutators {
+		if err := f(ic, &k.config); err != nil {
+			return nil, err
+		}
+	}
+
+	return &k.config, nil
+}
+
+// CreateFromCA makes and writes a certificate using the given CA cert and key.
+func (k *KubeadmCert) CreateFromCA(ic *kubeadmapi.InitConfiguration, caCert *x509.Certificate, caKey *rsa.PrivateKey) error {
+	cfg, err := k.GetConfig(ic)
+	if err != nil {
+		return fmt.Errorf("couldn't create %q certificate: %v", k.Name, err)
+	}
+	cert, key, err := pkiutil.NewCertAndKey(caCert, caKey, cfg)
+	if err != nil {
+		return err
+	}
+	err = writeCertificateFilesIfNotExist(
+		ic.CertificatesDir,
+		k.BaseName,
+		caCert,
+		cert,
+		key,
+	)
+
+	if err != nil {
+		return fmt.Errorf("failed to write certificate %q: %v", k.Name, err)
+	}
+
+	return nil
+}
+
+// CreateAsCA creates a certificate authority, writing the files to disk and also returning the created CA so it can be used to sign child certs.
+func (k *KubeadmCert) CreateAsCA(ic *kubeadmapi.InitConfiguration) (*x509.Certificate, *rsa.PrivateKey, error) {
+	cfg, err := k.GetConfig(ic)
+	if err != nil {
+		return nil, nil, fmt.Errorf("couldn't get configuration for %q CA certificate: %v", k.Name, err)
+	}
+	caCert, caKey, err := NewCACertAndKey(cfg)
+	if err != nil {
+		return nil, nil, fmt.Errorf("couldn't generate %q CA certificate: %v", k.Name, err)
+	}
+
+	err = writeCertificateAuthorithyFilesIfNotExist(
+		ic.CertificatesDir,
+		k.BaseName,
+		caCert,
+		caKey,
+	)
+	if err != nil {
+		return nil, nil, fmt.Errorf("couldn't write out %q CA certificate: %v", k.Name, err)
+	}
+
+	return caCert, caKey, nil
+}
+
+// CertificateTree is represents a one-level-deep tree, mapping a CA to the certs that depend on it.
+type CertificateTree map[*KubeadmCert]Certificates
+
+// CreateTree creates the CAs, certs signed by the CAs, and writes them all to disk.
+func (t CertificateTree) CreateTree(ic *kubeadmapi.InitConfiguration) error {
+	for ca, leaves := range t {
+		cfg, err := ca.GetConfig(ic)
+		if err != nil {
+			return err
+		}
+
+		var caKey *rsa.PrivateKey
+
+		caCert, err := pkiutil.TryLoadCertFromDisk(ic.CertificatesDir, ca.BaseName)
+		if err == nil {
+			// Cert exists already, make sure it's valid
+			if !caCert.IsCA {
+				return fmt.Errorf("certificate %q is not a CA", ca.Name)
+			}
+			// Try and load a CA Key
+			caKey, err = pkiutil.TryLoadKeyFromDisk(ic.CertificatesDir, ca.BaseName)
+			if err != nil {
+				// If there's no CA key, make sure every certificate exists.
+				for _, leaf := range leaves {
+					cl := certKeyLocation{
+						pkiDir:   ic.CertificatesDir,
+						baseName: leaf.BaseName,
+						uxName:   leaf.Name,
+					}
+					if err := validateSignedCertWithCA(cl, caCert); err != nil {
+						return fmt.Errorf("could not load expected certificate %q or validate the existence of key %q for it: %v", leaf.Name, ca.Name, err)
+					}
+				}
+				// CACert exists and all clients exist, continue to next CA.
+				continue
+			}
+			// CA key exists; just use that to create new certificates.
+		} else {
+			// CACert doesn't already exist, create a new cert and key.
+			caCert, caKey, err = NewCACertAndKey(cfg)
+			if err != nil {
+				return err
+			}
+
+			err = writeCertificateAuthorithyFilesIfNotExist(
+				ic.CertificatesDir,
+				ca.BaseName,
+				caCert,
+				caKey,
+			)
+			if err != nil {
+				return err
+			}
+		}
+
+		for _, leaf := range leaves {
+			if err := leaf.CreateFromCA(ic, caCert, caKey); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// CertificateMap is a flat map of certificates, keyed by Name.
+type CertificateMap map[string]*KubeadmCert
+
+// CertTree returns a one-level-deep tree, mapping a CA cert to an array of certificates that should be signed by it.
+func (m CertificateMap) CertTree() (CertificateTree, error) {
+	caMap := make(CertificateTree)
+
+	for _, cert := range m {
+		if cert.CAName == "" {
+			if _, ok := caMap[cert]; !ok {
+				caMap[cert] = []*KubeadmCert{}
+			}
+		} else {
+			ca, ok := m[cert.CAName]
+			if !ok {
+				return nil, fmt.Errorf("Certificate %q references unknown CA %q", cert.Name, cert.CAName)
+			}
+			caMap[ca] = append(caMap[ca], cert)
+		}
+	}
+
+	return caMap, nil
+}
+
+// Certificates is a list of Certificates that Kubeadm should create.
+type Certificates []*KubeadmCert
+
+// AsMap returns the list of certificates as a map, keyed by name.
+func (c Certificates) AsMap() CertificateMap {
+	certMap := make(map[string]*KubeadmCert)
+	for _, cert := range c {
+		certMap[cert.Name] = cert
+	}
+
+	return certMap
+}
+
+// GetDefaultCertList returns  all of the certificates kubeadm requires to function.
+func GetDefaultCertList() Certificates {
+	return Certificates{
+		&KubeadmCertRootCA,
+		&KubeadmCertAPIServer,
+		&KubeadmCertKubeletClient,
+		// Front Proxy certs
+		&KubeadmCertFrontProxyCA,
+		&KubeadmCertFrontProxyClient,
+		// etcd certs
+		&KubeadmCertEtcdCA,
+		&KubeadmCertEtcdServer,
+		&KubeadmCertEtcdPeer,
+		&KubeadmCertEtcdHealthcheck,
+		&KubeadmCertEtcdAPIClient,
+	}
+}
+
+// GetCertsWithoutEtcd returns all of the certificates kubeadm needs when etcd is hosted externally.
+func GetCertsWithoutEtcd() Certificates {
+	return Certificates{
+		&KubeadmCertRootCA,
+		&KubeadmCertAPIServer,
+		&KubeadmCertKubeletClient,
+		// Front Proxy certs
+		&KubeadmCertFrontProxyCA,
+		&KubeadmCertFrontProxyClient,
+	}
+}
+
+var (
+	// KubeadmCertRootCA is the definition of the Kubernetes Root CA for the API Server and kubelet.
+	KubeadmCertRootCA = KubeadmCert{
+		Name:     "ca",
+		LongName: "self-signed kubernetes CA to provision identities for other kuberenets components",
+		BaseName: kubeadmconstants.CACertAndKeyBaseName,
+		config: certutil.Config{
+			CommonName: "kubernetes",
+		},
+	}
+	// KubeadmCertAPIServer is the definition of the cert used to serve the kubernetes API.
+	KubeadmCertAPIServer = KubeadmCert{
+		Name:     "apiserver",
+		LongName: "certificate for serving the kubernetes API",
+		BaseName: kubeadmconstants.APIServerCertAndKeyBaseName,
+		CAName:   "ca",
+		config: certutil.Config{
+			CommonName: kubeadmconstants.APIServerCertCommonName,
+			Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		},
+		configMutators: []configMutatorsFunc{
+			makeAltNamesMutator(pkiutil.GetAPIServerAltNames),
+		},
+	}
+	// KubeadmCertKubeletClient is the definition of the cert used by the API server to access the kubelet.
+	KubeadmCertKubeletClient = KubeadmCert{
+		Name:     "apiserver-kubelet-client",
+		LongName: "Client certificate for the API server to connect to kubelet",
+		BaseName: kubeadmconstants.APIServerKubeletClientCertAndKeyBaseName,
+		CAName:   "ca",
+		config: certutil.Config{
+			CommonName:   kubeadmconstants.APIServerKubeletClientCertCommonName,
+			Organization: []string{kubeadmconstants.MastersGroup},
+			Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		},
+	}
+
+	// KubeadmCertFrontProxyCA is the definition of the CA used for the front end proxy.
+	KubeadmCertFrontProxyCA = KubeadmCert{
+		Name:     "front-proxy-ca",
+		LongName: "self-signed CA to provision identities for front proxy",
+		BaseName: kubeadmconstants.FrontProxyCACertAndKeyBaseName,
+		config: certutil.Config{
+			CommonName: "front-proxy-ca",
+		},
+	}
+
+	// KubeadmCertFrontProxyClient is the definition of the cert used by the API server to access the front proxy.
+	KubeadmCertFrontProxyClient = KubeadmCert{
+		Name:     "front-proxy-client",
+		BaseName: kubeadmconstants.FrontProxyClientCertAndKeyBaseName,
+		LongName: "client for the front proxy",
+		CAName:   "front-proxy-ca",
+		config: certutil.Config{
+			CommonName: kubeadmconstants.FrontProxyClientCertCommonName,
+			Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		},
+	}
+
+	// KubeadmCertEtcdCA is the definition of the root CA used by the hosted etcd server.
+	KubeadmCertEtcdCA = KubeadmCert{
+		Name:     "etcd-ca",
+		LongName: "self-signed CA to provision identities for etcd",
+		BaseName: kubeadmconstants.EtcdCACertAndKeyBaseName,
+		config: certutil.Config{
+			CommonName: "etcd-ca",
+		},
+	}
+	// KubeadmCertEtcdServer is the definition of the cert used to serve etcd to clients.
+	KubeadmCertEtcdServer = KubeadmCert{
+		Name:     "etcd-server",
+		LongName: "certificate for serving etcd",
+		BaseName: kubeadmconstants.EtcdServerCertAndKeyBaseName,
+		CAName:   "etcd-ca",
+		config: certutil.Config{
+			// TODO: etcd 3.2 introduced an undocumented requirement for ClientAuth usage on the
+			// server cert: https://github.com/coreos/etcd/issues/9785#issuecomment-396715692
+			// Once the upstream issue is resolved, this should be returned to only allowing
+			// ServerAuth usage.
+			Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+		},
+		configMutators: []configMutatorsFunc{
+			makeAltNamesMutator(pkiutil.GetEtcdAltNames),
+			setCommonNameToNodeName(),
+		},
+	}
+	// KubeadmCertEtcdPeer is the definition of the cert used by etcd peers to access each other.
+	KubeadmCertEtcdPeer = KubeadmCert{
+		Name:     "etcd-peer",
+		LongName: "credentials for etcd nodes to communicate with each other",
+		BaseName: kubeadmconstants.EtcdPeerCertAndKeyBaseName,
+		CAName:   "etcd-ca",
+		config: certutil.Config{
+			Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+		},
+		configMutators: []configMutatorsFunc{
+			makeAltNamesMutator(pkiutil.GetEtcdPeerAltNames),
+			setCommonNameToNodeName(),
+		},
+	}
+	// KubeadmCertEtcdHealthcheck is the definition of the cert used by Kubernetes to check the health of the etcd server.
+	KubeadmCertEtcdHealthcheck = KubeadmCert{
+		Name:     "etcd-healthcheck-client",
+		LongName: "client certificate for liveness probes to healtcheck etcd",
+		BaseName: kubeadmconstants.EtcdHealthcheckClientCertAndKeyBaseName,
+		CAName:   "etcd-ca",
+		config: certutil.Config{
+			CommonName:   kubeadmconstants.EtcdHealthcheckClientCertCommonName,
+			Organization: []string{kubeadmconstants.MastersGroup},
+			Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		},
+	}
+	// KubeadmCertEtcdAPIClient is the definition of the cert used by the API server to access etcd.
+	KubeadmCertEtcdAPIClient = KubeadmCert{
+		Name:     "apiserver-etcd-client",
+		LongName: "client apiserver uses to access etcd",
+		BaseName: kubeadmconstants.APIServerEtcdClientCertAndKeyBaseName,
+		CAName:   "etcd-ca",
+		config: certutil.Config{
+			CommonName:   kubeadmconstants.APIServerEtcdClientCertCommonName,
+			Organization: []string{kubeadmconstants.MastersGroup},
+			Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		},
+	}
+)
+
+func makeAltNamesMutator(f func(*kubeadmapi.InitConfiguration) (*certutil.AltNames, error)) configMutatorsFunc {
+	return func(mc *kubeadmapi.InitConfiguration, cc *certutil.Config) error {
+		altNames, err := f(mc)
+		if err != nil {
+			return err
+		}
+		cc.AltNames = *altNames
+		return nil
+	}
+}
+
+func setCommonNameToNodeName() configMutatorsFunc {
+	return func(mc *kubeadmapi.InitConfiguration, cc *certutil.Config) error {
+		cc.CommonName = mc.NodeRegistration.Name
+		return nil
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/certlist_test.go

@@ -0,0 +1,187 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certs
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"io/ioutil"
+	"os"
+	"path"
+	"testing"
+
+	certutil "k8s.io/client-go/util/cert"
+	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+)
+
+func TestCAPointersValid(t *testing.T) {
+	tests := []struct {
+		certs Certificates
+		name  string
+	}{
+		{
+			name:  "Default Certificate List",
+			certs: GetDefaultCertList(),
+		},
+		{
+			name:  "Cert list less etcd",
+			certs: GetCertsWithoutEtcd(),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+
+			certMap := test.certs.AsMap()
+
+			for _, cert := range test.certs {
+				if cert.CAName != "" && certMap[cert.CAName] == nil {
+					t.Errorf("Certificate %q references nonexistent CA %q", cert.Name, cert.CAName)
+				}
+			}
+		})
+	}
+}
+
+func TestMakeCertTree(t *testing.T) {
+	rootCert := &KubeadmCert{
+		Name: "root",
+	}
+	leaf0 := &KubeadmCert{
+		Name:   "leaf0",
+		CAName: "root",
+	}
+	leaf1 := &KubeadmCert{
+		Name:   "leaf1",
+		CAName: "root",
+	}
+	selfSigned := &KubeadmCert{
+		Name: "self-signed",
+	}
+
+	certMap := CertificateMap{
+		"root":        rootCert,
+		"leaf0":       leaf0,
+		"leaf1":       leaf1,
+		"self-signed": selfSigned,
+	}
+
+	orphanCertMap := CertificateMap{
+		"leaf0": leaf0,
+	}
+
+	if _, err := orphanCertMap.CertTree(); err == nil {
+		t.Error("expected orphan cert map to error, but got nil")
+	}
+
+	certTree, err := certMap.CertTree()
+	t.Logf("cert tree: %v", certTree)
+	if err != nil {
+		t.Errorf("expected no error, but got %v", err)
+	}
+
+	if len(certTree) != 2 {
+		t.Errorf("Expected tree to have 2 roots, got %d", len(certTree))
+	}
+
+	if len(certTree[rootCert]) != 2 {
+		t.Errorf("Expected root to have 2 leaves, got %d", len(certTree[rootCert]))
+	}
+
+	if _, ok := certTree[selfSigned]; !ok {
+		t.Error("Expected selfSigned to be present in tree, but missing")
+	}
+}
+
+func TestCreateCertificateChain(t *testing.T) {
+	dir, err := ioutil.TempDir("", t.Name())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
+
+	ic := &kubeadmapi.InitConfiguration{
+		NodeRegistration: kubeadmapi.NodeRegistrationOptions{
+			Name: "test-node",
+		},
+		ClusterConfiguration: kubeadmapi.ClusterConfiguration{
+			CertificatesDir: dir,
+		},
+	}
+
+	caCfg := Certificates{
+		{
+			config:   certutil.Config{},
+			Name:     "test-ca",
+			BaseName: "test-ca",
+		},
+		{
+			config: certutil.Config{
+				AltNames: certutil.AltNames{
+					DNSNames: []string{"test-domain.space"},
+				},
+				Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+			},
+			configMutators: []configMutatorsFunc{
+				setCommonNameToNodeName(),
+			},
+			CAName:   "test-ca",
+			Name:     "test-daughter",
+			BaseName: "test-daughter",
+		},
+	}
+
+	certTree, err := caCfg.AsMap().CertTree()
+	if err != nil {
+		t.Fatalf("unexpected error getting tree: %v", err)
+	}
+
+	if certTree.CreateTree(ic); err != nil {
+		t.Fatal(err)
+	}
+
+	caCert, _ := parseCertAndKey(path.Join(dir, "test-ca"), t)
+	daughterCert, _ := parseCertAndKey(path.Join(dir, "test-daughter"), t)
+
+	pool := x509.NewCertPool()
+	pool.AddCert(caCert)
+
+	_, err = daughterCert.Verify(x509.VerifyOptions{
+		DNSName:   "test-domain.space",
+		Roots:     pool,
+		KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	})
+	if err != nil {
+		t.Errorf("couldn't verify daughter cert: %v", err)
+	}
+
+}
+
+func parseCertAndKey(basePath string, t *testing.T) (*x509.Certificate, crypto.PrivateKey) {
+	certPair, err := tls.LoadX509KeyPair(basePath+".crt", basePath+".key")
+	if err != nil {
+		t.Fatalf("couldn't parse certificate and key: %v", err)
+	}
+
+	parsedCert, err := x509.ParseCertificate(certPair.Certificate[0])
+	if err != nil {
+		t.Fatalf("couldn't parse certificate: %v", err)
+	}
+
+	return parsedCert, certPair.PrivateKey
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/certs.go

@@ -33,223 +33,42 @@ import (
 
 // CreatePKIAssets will create and write to disk all PKI assets necessary to establish the control plane.
 // If the PKI assets already exists in the target folder, they are used only if evaluated equal; otherwise an error is returned.
-func CreatePKIAssets(cfg *kubeadmapi.MasterConfiguration) error {
+func CreatePKIAssets(cfg *kubeadmapi.InitConfiguration) error {
 	glog.V(1).Infoln("creating PKI assets")
-	certActions := []func(cfg *kubeadmapi.MasterConfiguration) error{
-		CreateCACertAndKeyFiles,
-		CreateAPIServerCertAndKeyFiles,
-		CreateAPIServerKubeletClientCertAndKeyFiles,
-		CreateServiceAccountKeyAndPublicKeyFiles,
-		CreateFrontProxyCACertAndKeyFiles,
-		CreateFrontProxyClientCertAndKeyFiles,
-	}
-	etcdCertActions := []func(cfg *kubeadmapi.MasterConfiguration) error{
-		CreateEtcdCACertAndKeyFiles,
-		CreateEtcdServerCertAndKeyFiles,
-		CreateEtcdPeerCertAndKeyFiles,
-		CreateEtcdHealthcheckClientCertAndKeyFiles,
-		CreateAPIServerEtcdClientCertAndKeyFiles,
+
+	// This structure cannot handle multilevel CA hierarchies.
+	// This isn't a problem right now, but may become one in the future.
+
+	var certList Certificates
+
+	if cfg.Etcd.Local == nil {
+		certList = GetCertsWithoutEtcd()
+	} else {
+		certList = GetDefaultCertList()
 	}
 
-	if cfg.Etcd.Local != nil {
-		certActions = append(certActions, etcdCertActions...)
+	certTree, err := certList.AsMap().CertTree()
+	if err != nil {
+		return err
 	}
 
-	for _, action := range certActions {
-		err := action(cfg)
-		if err != nil {
-			return err
-		}
+	if err := certTree.CreateTree(cfg); err != nil {
+		return fmt.Errorf("Error creating PKI assets: %v", err)
 	}
 
 	fmt.Printf("[certificates] valid certificates and keys now exist in %q\n", cfg.CertificatesDir)
 
+	// Service accounts are not x509 certs, so handled separately
+	if err := CreateServiceAccountKeyAndPublicKeyFiles(cfg); err != nil {
+		return err
+	}
+
 	return nil
 }
 
-// CreateCACertAndKeyFiles create a new self signed cluster CA certificate and key files.
-// If the CA certificate and key files already exists in the target folder, they are used only if evaluated equal; otherwise an error is returned.
-func CreateCACertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-	glog.V(1).Infoln("create a new self signed cluster CA certificate and key files")
-	caCert, caKey, err := NewCACertAndKey()
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateAuthorithyFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.CACertAndKeyBaseName,
-		caCert,
-		caKey,
-	)
-}
-
-// CreateAPIServerCertAndKeyFiles create a new certificate and key files for the apiserver.
-// If the apiserver certificate and key files already exists in the target folder, they are used only if evaluated equal; otherwise an error is returned.
-// It assumes the cluster CA certificate and key files exist in the CertificatesDir.
-func CreateAPIServerCertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-	glog.V(1).Infoln("creating a new certificate and key files for the apiserver")
-	caCert, caKey, err := loadCertificateAuthority(cfg.CertificatesDir, kubeadmconstants.CACertAndKeyBaseName)
-	if err != nil {
-		return err
-	}
-
-	apiCert, apiKey, err := NewAPIServerCertAndKey(cfg, caCert, caKey)
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.APIServerCertAndKeyBaseName,
-		caCert,
-		apiCert,
-		apiKey,
-	)
-}
-
-// CreateAPIServerKubeletClientCertAndKeyFiles create a new certificate for kubelets calling apiserver.
-// If the apiserver-kubelet-client certificate and key files already exists in the target folder, they are used only if evaluated equals; otherwise an error is returned.
-// It assumes the cluster CA certificate and key files exist in the CertificatesDir.
-func CreateAPIServerKubeletClientCertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-	glog.V(1).Infoln("creating a new certificate for kubelets calling apiserver")
-	caCert, caKey, err := loadCertificateAuthority(cfg.CertificatesDir, kubeadmconstants.CACertAndKeyBaseName)
-	if err != nil {
-		return err
-	}
-
-	apiKubeletClientCert, apiKubeletClientKey, err := NewAPIServerKubeletClientCertAndKey(caCert, caKey)
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.APIServerKubeletClientCertAndKeyBaseName,
-		caCert,
-		apiKubeletClientCert,
-		apiKubeletClientKey,
-	)
-}
-
-// CreateEtcdCACertAndKeyFiles create a self signed etcd CA certificate and key files.
-// The etcd CA and client certs are used to secure communication between etcd peers and connections to etcd from the API server.
-// This is a separate CA, so that kubernetes client identities cannot connect to etcd directly or peer with the etcd cluster.
-// If the etcd CA certificate and key files already exists in the target folder, they are used only if evaluated equals; otherwise an error is returned.
-func CreateEtcdCACertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-	glog.V(1).Infoln("creating a self signed etcd CA certificate and key files")
-	etcdCACert, etcdCAKey, err := NewEtcdCACertAndKey()
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateAuthorithyFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.EtcdCACertAndKeyBaseName,
-		etcdCACert,
-		etcdCAKey,
-	)
-}
-
-// CreateEtcdServerCertAndKeyFiles create a new certificate and key file for etcd.
-// If the etcd serving certificate and key file already exist in the target folder, they are used only if evaluated equal; otherwise an error is returned.
-// It assumes the etcd CA certificate and key file exist in the CertificatesDir
-func CreateEtcdServerCertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-	glog.V(1).Infoln("creating a new server certificate and key files for etcd")
-	etcdCACert, etcdCAKey, err := loadCertificateAuthority(cfg.CertificatesDir, kubeadmconstants.EtcdCACertAndKeyBaseName)
-	if err != nil {
-		return err
-	}
-
-	etcdServerCert, etcdServerKey, err := NewEtcdServerCertAndKey(cfg, etcdCACert, etcdCAKey)
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.EtcdServerCertAndKeyBaseName,
-		etcdCACert,
-		etcdServerCert,
-		etcdServerKey,
-	)
-}
-
-// CreateEtcdPeerCertAndKeyFiles create a new certificate and key file for etcd peering.
-// If the etcd peer certificate and key file already exist in the target folder, they are used only if evaluated equal; otherwise an error is returned.
-// It assumes the etcd CA certificate and key file exist in the CertificatesDir
-func CreateEtcdPeerCertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-	glog.V(1).Infoln("creating a new certificate and key files for etcd peering")
-	etcdCACert, etcdCAKey, err := loadCertificateAuthority(cfg.CertificatesDir, kubeadmconstants.EtcdCACertAndKeyBaseName)
-	if err != nil {
-		return err
-	}
-
-	etcdPeerCert, etcdPeerKey, err := NewEtcdPeerCertAndKey(cfg, etcdCACert, etcdCAKey)
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.EtcdPeerCertAndKeyBaseName,
-		etcdCACert,
-		etcdPeerCert,
-		etcdPeerKey,
-	)
-}
-
-// CreateEtcdHealthcheckClientCertAndKeyFiles create a new client certificate for liveness probes to healthcheck etcd
-// If the etcd-healthcheck-client certificate and key file already exist in the target folder, they are used only if evaluated equal; otherwise an error is returned.
-// It assumes the etcd CA certificate and key file exist in the CertificatesDir
-func CreateEtcdHealthcheckClientCertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-
-	etcdCACert, etcdCAKey, err := loadCertificateAuthority(cfg.CertificatesDir, kubeadmconstants.EtcdCACertAndKeyBaseName)
-	if err != nil {
-		return err
-	}
-
-	etcdHealthcheckClientCert, etcdHealthcheckClientKey, err := NewEtcdHealthcheckClientCertAndKey(etcdCACert, etcdCAKey)
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.EtcdHealthcheckClientCertAndKeyBaseName,
-		etcdCACert,
-		etcdHealthcheckClientCert,
-		etcdHealthcheckClientKey,
-	)
-}
-
-// CreateAPIServerEtcdClientCertAndKeyFiles create a new client certificate for the apiserver calling etcd
-// If the apiserver-etcd-client certificate and key file already exist in the target folder, they are used only if evaluated equal; otherwise an error is returned.
-// It assumes the etcd CA certificate and key file exist in the CertificatesDir
-func CreateAPIServerEtcdClientCertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-	glog.V(1).Infoln("creating a new client certificate for the apiserver calling etcd")
-	etcdCACert, etcdCAKey, err := loadCertificateAuthority(cfg.CertificatesDir, kubeadmconstants.EtcdCACertAndKeyBaseName)
-	if err != nil {
-		return err
-	}
-
-	apiEtcdClientCert, apiEtcdClientKey, err := NewAPIServerEtcdClientCertAndKey(etcdCACert, etcdCAKey)
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.APIServerEtcdClientCertAndKeyBaseName,
-		etcdCACert,
-		apiEtcdClientCert,
-		apiEtcdClientKey,
-	)
-}
-
 // CreateServiceAccountKeyAndPublicKeyFiles create a new public/private key files for signing service account users.
 // If the sa public/private key files already exists in the target folder, they are used only if evaluated equals; otherwise an error is returned.
-func CreateServiceAccountKeyAndPublicKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
+func CreateServiceAccountKeyAndPublicKeyFiles(cfg *kubeadmapi.InitConfiguration) error {
 	glog.V(1).Infoln("creating a new public/private key files for signing service account users")
 	saSigningKey, err := NewServiceAccountSigningKey()
 	if err != nil {
@@ -263,186 +82,8 @@ func CreateServiceAccountKeyAndPublicKeyFiles(cfg *kubeadmapi.MasterConfiguratio
 	)
 }
 
-// CreateFrontProxyCACertAndKeyFiles create a self signed front proxy CA certificate and key files.
-// Front proxy CA and client certs are used to secure a front proxy authenticator which is used to assert identity
-// without the client cert; This is a separate CA, so that front proxy identities cannot hit the API and normal client certs cannot be used
-// as front proxies.
-// If the front proxy CA certificate and key files already exists in the target folder, they are used only if evaluated equals; otherwise an error is returned.
-func CreateFrontProxyCACertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-	glog.V(1).Infoln("creating a self signed front proxy CA certificate and key files")
-	frontProxyCACert, frontProxyCAKey, err := NewFrontProxyCACertAndKey()
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateAuthorithyFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.FrontProxyCACertAndKeyBaseName,
-		frontProxyCACert,
-		frontProxyCAKey,
-	)
-}
-
-// CreateFrontProxyClientCertAndKeyFiles create a new certificate for proxy server client.
-// If the front-proxy-client certificate and key files already exists in the target folder, they are used only if evaluated equals; otherwise an error is returned.
-// It assumes the front proxy CA certificate and key files exist in the CertificatesDir.
-func CreateFrontProxyClientCertAndKeyFiles(cfg *kubeadmapi.MasterConfiguration) error {
-	glog.V(1).Infoln("creating a new certificate for proxy server client")
-	frontProxyCACert, frontProxyCAKey, err := loadCertificateAuthority(cfg.CertificatesDir, kubeadmconstants.FrontProxyCACertAndKeyBaseName)
-	if err != nil {
-		return err
-	}
-
-	frontProxyClientCert, frontProxyClientKey, err := NewFrontProxyClientCertAndKey(frontProxyCACert, frontProxyCAKey)
-	if err != nil {
-		return err
-	}
-
-	return writeCertificateFilesIfNotExist(
-		cfg.CertificatesDir,
-		kubeadmconstants.FrontProxyClientCertAndKeyBaseName,
-		frontProxyCACert,
-		frontProxyClientCert,
-		frontProxyClientKey,
-	)
-}
-
-// NewCACertAndKey will generate a self signed CA.
-func NewCACertAndKey() (*x509.Certificate, *rsa.PrivateKey, error) {
-
-	caCert, caKey, err := pkiutil.NewCertificateAuthority()
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while generating CA certificate and key: %v", err)
-	}
-
-	return caCert, caKey, nil
-}
-
-// NewAPIServerCertAndKey generate certificate for apiserver, signed by the given CA.
-func NewAPIServerCertAndKey(cfg *kubeadmapi.MasterConfiguration, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
-
-	altNames, err := pkiutil.GetAPIServerAltNames(cfg)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while composing altnames for API server: %v", err)
-	}
-
-	config := certutil.Config{
-		CommonName: kubeadmconstants.APIServerCertCommonName,
-		AltNames:   *altNames,
-		Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-	}
-	apiCert, apiKey, err := pkiutil.NewCertAndKey(caCert, caKey, config)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while creating API server key and certificate: %v", err)
-	}
-
-	return apiCert, apiKey, nil
-}
-
-// NewAPIServerKubeletClientCertAndKey generate certificate for the apiservers to connect to the kubelets securely, signed by the given CA.
-func NewAPIServerKubeletClientCertAndKey(caCert *x509.Certificate, caKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
-
-	config := certutil.Config{
-		CommonName:   kubeadmconstants.APIServerKubeletClientCertCommonName,
-		Organization: []string{kubeadmconstants.MastersGroup},
-		Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
-	}
-	apiClientCert, apiClientKey, err := pkiutil.NewCertAndKey(caCert, caKey, config)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while creating API server kubelet client key and certificate: %v", err)
-	}
-
-	return apiClientCert, apiClientKey, nil
-}
-
-// NewEtcdCACertAndKey generate a self signed etcd CA.
-func NewEtcdCACertAndKey() (*x509.Certificate, *rsa.PrivateKey, error) {
-
-	etcdCACert, etcdCAKey, err := pkiutil.NewCertificateAuthority()
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while generating etcd CA certificate and key: %v", err)
-	}
-
-	return etcdCACert, etcdCAKey, nil
-}
-
-// NewEtcdServerCertAndKey generate certificate for etcd, signed by the given CA.
-func NewEtcdServerCertAndKey(cfg *kubeadmapi.MasterConfiguration, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
-
-	altNames, err := pkiutil.GetEtcdAltNames(cfg)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while composing altnames for etcd: %v", err)
-	}
-
-	config := certutil.Config{
-		CommonName: cfg.NodeRegistration.Name,
-		AltNames:   *altNames,
-		Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
-	}
-	etcdServerCert, etcdServerKey, err := pkiutil.NewCertAndKey(caCert, caKey, config)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while creating etcd key and certificate: %v", err)
-	}
-
-	return etcdServerCert, etcdServerKey, nil
-}
-
-// NewEtcdPeerCertAndKey generate certificate for etcd peering, signed by the given CA.
-func NewEtcdPeerCertAndKey(cfg *kubeadmapi.MasterConfiguration, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
-
-	altNames, err := pkiutil.GetEtcdPeerAltNames(cfg)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while composing altnames for etcd peering: %v", err)
-	}
-
-	config := certutil.Config{
-		CommonName: cfg.NodeRegistration.Name,
-		AltNames:   *altNames,
-		Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
-	}
-	etcdPeerCert, etcdPeerKey, err := pkiutil.NewCertAndKey(caCert, caKey, config)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while creating etcd peer key and certificate: %v", err)
-	}
-
-	return etcdPeerCert, etcdPeerKey, nil
-}
-
-// NewEtcdHealthcheckClientCertAndKey generate certificate for liveness probes to healthcheck etcd, signed by the given CA.
-func NewEtcdHealthcheckClientCertAndKey(caCert *x509.Certificate, caKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
-
-	config := certutil.Config{
-		CommonName:   kubeadmconstants.EtcdHealthcheckClientCertCommonName,
-		Organization: []string{kubeadmconstants.MastersGroup},
-		Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
-	}
-	etcdHealcheckClientCert, etcdHealcheckClientKey, err := pkiutil.NewCertAndKey(caCert, caKey, config)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while creating etcd healthcheck client key and certificate: %v", err)
-	}
-
-	return etcdHealcheckClientCert, etcdHealcheckClientKey, nil
-}
-
-// NewAPIServerEtcdClientCertAndKey generate certificate for the apiservers to connect to etcd securely, signed by the given CA.
-func NewAPIServerEtcdClientCertAndKey(caCert *x509.Certificate, caKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
-
-	config := certutil.Config{
-		CommonName:   kubeadmconstants.APIServerEtcdClientCertCommonName,
-		Organization: []string{kubeadmconstants.MastersGroup},
-		Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
-	}
-	apiClientCert, apiClientKey, err := pkiutil.NewCertAndKey(caCert, caKey, config)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failure while creating API server etcd client key and certificate: %v", err)
-	}
-
-	return apiClientCert, apiClientKey, nil
-}
-
 // NewServiceAccountSigningKey generate public/private key pairs for signing service account tokens.
 func NewServiceAccountSigningKey() (*rsa.PrivateKey, error) {
-
 	// The key does NOT exist, let's generate it now
 	saSigningKey, err := certutil.NewPrivateKey()
 	if err != nil {
@@ -452,34 +93,73 @@ func NewServiceAccountSigningKey() (*rsa.PrivateKey, error) {
 	return saSigningKey, nil
 }
 
-// NewFrontProxyCACertAndKey generate a self signed front proxy CA.
-func NewFrontProxyCACertAndKey() (*x509.Certificate, *rsa.PrivateKey, error) {
+// NewCACertAndKey will generate a self signed CA.
+func NewCACertAndKey(certSpec *certutil.Config) (*x509.Certificate, *rsa.PrivateKey, error) {
 
-	frontProxyCACert, frontProxyCAKey, err := pkiutil.NewCertificateAuthority()
+	caCert, caKey, err := pkiutil.NewCertificateAuthority(certSpec)
 	if err != nil {
-		return nil, nil, fmt.Errorf("failure while generating front-proxy CA certificate and key: %v", err)
+		return nil, nil, fmt.Errorf("failure while generating CA certificate and key: %v", err)
 	}
 
-	return frontProxyCACert, frontProxyCAKey, nil
+	return caCert, caKey, nil
 }
 
-// NewFrontProxyClientCertAndKey generate certificate for proxy server client, signed by the given front proxy CA.
-func NewFrontProxyClientCertAndKey(frontProxyCACert *x509.Certificate, frontProxyCAKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
-
-	config := certutil.Config{
-		CommonName: kubeadmconstants.FrontProxyClientCertCommonName,
-		Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+// CreateCACertAndKeyFiles generates and writes out a given certificate authority.
+// The certSpec should be one of the variables from this package.
+func CreateCACertAndKeyFiles(certSpec *KubeadmCert, cfg *kubeadmapi.InitConfiguration) error {
+	if certSpec.CAName != "" {
+		return fmt.Errorf("This function should only be used for CAs, but cert %s has CA %s", certSpec.Name, certSpec.CAName)
 	}
-	frontProxyClientCert, frontProxyClientKey, err := pkiutil.NewCertAndKey(frontProxyCACert, frontProxyCAKey, config)
+	glog.V(1).Infoln("creating a new certificate authority for %s", certSpec.Name)
+
+	certConfig, err := certSpec.GetConfig(cfg)
 	if err != nil {
-		return nil, nil, fmt.Errorf("failure while creating front-proxy client key and certificate: %v", err)
+		return err
 	}
 
-	return frontProxyClientCert, frontProxyClientKey, nil
+	caCert, caKey, err := NewCACertAndKey(certConfig)
+	if err != nil {
+		return err
+	}
+
+	return writeCertificateAuthorithyFilesIfNotExist(
+		cfg.CertificatesDir,
+		certSpec.BaseName,
+		caCert,
+		caKey,
+	)
 }
 
-// loadCertificateAuthority loads certificate authority
-func loadCertificateAuthority(pkiDir string, baseName string) (*x509.Certificate, *rsa.PrivateKey, error) {
+// CreateCertAndKeyFilesWithCA loads the given certificate authority from disk, then generates and writes out the given certificate and key.
+// The certSpec and caCertSpec should both be one of the variables from this package.
+func CreateCertAndKeyFilesWithCA(certSpec *KubeadmCert, caCertSpec *KubeadmCert, cfg *kubeadmapi.InitConfiguration) error {
+	if certSpec.CAName != caCertSpec.Name {
+		return fmt.Errorf("Expected CAname for %s to be %q, but was %s", certSpec.Name, certSpec.CAName, caCertSpec.Name)
+	}
+
+	caCert, caKey, err := LoadCertificateAuthority(cfg.CertificatesDir, caCertSpec.BaseName)
+	if err != nil {
+		return fmt.Errorf("Couldn't load CA certificate %s: %v", caCertSpec.Name, err)
+	}
+
+	return certSpec.CreateFromCA(cfg, caCert, caKey)
+}
+
+func newCertAndKeyFromSpec(certSpec *KubeadmCert, cfg *kubeadmapi.InitConfiguration, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
+	certConfig, err := certSpec.GetConfig(cfg)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failure while creating certificate %s: %v", certSpec.Name, err)
+	}
+	cert, key, err := pkiutil.NewCertAndKey(caCert, caKey, certConfig)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failure while creating %s key and certificate: %v", certSpec.Name, err)
+	}
+
+	return cert, key, err
+}
+
+// LoadCertificateAuthority tries to load a CA in the given directory with the given name.
+func LoadCertificateAuthority(pkiDir string, baseName string) (*x509.Certificate, *rsa.PrivateKey, error) {
 	// Checks if certificate authority exists in the PKI directory
 	if !pkiutil.CertOrKeyExist(pkiDir, baseName) {
 		return nil, nil, fmt.Errorf("couldn't load %s certificate authority from %s", baseName, pkiDir)
@@ -501,7 +181,7 @@ func loadCertificateAuthority(pkiDir string, baseName string) (*x509.Certificate
 
 // writeCertificateAuthorithyFilesIfNotExist write a new certificate Authority to the given path.
 // If there already is a certificate file at the given path; kubeadm tries to load it and check if the values in the
-// existing and the expected certificate equals. If they do; kubeadm will just skip writing the file as it's up-to-date,
+// existing and the eexpected certificate equals. If they do; kubeadm will just skip writing the file as it's up-to-date,
 // otherwise this function returns an error.
 func writeCertificateAuthorithyFilesIfNotExist(pkiDir string, baseName string, caCert *x509.Certificate, caKey *rsa.PrivateKey) error {
 
@@ -617,10 +297,29 @@ type certKeyLocation struct {
 	uxName     string
 }
 
+// SharedCertificateExists verifies if the shared certificates - the certificates that must be
+// equal across masters: ca.key, ca.crt, sa.key, sa.pub
+func SharedCertificateExists(cfg *kubeadmapi.InitConfiguration) (bool, error) {
+
+	if err := validateCACertAndKey(certKeyLocation{cfg.CertificatesDir, kubeadmconstants.CACertAndKeyBaseName, "", "CA"}); err != nil {
+		return false, err
+	}
+
+	if err := validatePrivatePublicKey(certKeyLocation{cfg.CertificatesDir, "", kubeadmconstants.ServiceAccountKeyBaseName, "service account"}); err != nil {
+		return false, err
+	}
+
+	if err := validateCACertAndKey(certKeyLocation{cfg.CertificatesDir, kubeadmconstants.FrontProxyCACertAndKeyBaseName, "", "front-proxy CA"}); err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
+
 // UsingExternalCA determines whether the user is relying on an external CA.  We currently implicitly determine this is the case
 // when both the CA Cert and the front proxy CA Cert are present but the CA Key and front proxy CA Key are not.
 // This allows us to, e.g., skip generating certs or not start the csr signing controller.
-func UsingExternalCA(cfg *kubeadmapi.MasterConfiguration) (bool, error) {
+func UsingExternalCA(cfg *kubeadmapi.InitConfiguration) (bool, error) {
 
 	if err := validateCACert(certKeyLocation{cfg.CertificatesDir, kubeadmconstants.CACertAndKeyBaseName, "", "CA"}); err != nil {
 		return false, err
@@ -697,6 +396,11 @@ func validateSignedCert(l certKeyLocation) error {
 		return fmt.Errorf("failure loading certificate authority for %s: %v", l.uxName, err)
 	}
 
+	return validateSignedCertWithCA(l, caCert)
+}
+
+// validateSignedCertWithCA tries to load a certificate and validate it with the given caCert
+func validateSignedCertWithCA(l certKeyLocation, caCert *x509.Certificate) error {
 	// Try to load key and signed certificate
 	signedCert, _, err := pkiutil.TryLoadCertAndKeyFromDisk(l.pkiDir, l.baseName)
 	if err != nil {

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/certs_test.go

@@ -20,11 +20,12 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"fmt"
-	"net"
 	"os"
+	"path"
 	"path/filepath"
 	"testing"
 
+	certutil "k8s.io/client-go/util/cert"
 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil"
@@ -32,10 +33,30 @@ import (
 	certstestutil "k8s.io/kubernetes/cmd/kubeadm/test/certs"
 )
 
-func TestWriteCertificateAuthorithyFilesIfNotExist(t *testing.T) {
+func createCACert(t *testing.T) (*x509.Certificate, *rsa.PrivateKey) {
+	certCfg := &certutil.Config{CommonName: "kubernetes"}
+	cert, key, err := NewCACertAndKey(certCfg)
+	if err != nil {
+		t.Fatalf("couldn't create CA: %v", err)
+	}
+	return cert, key
+}
 
-	setupCert, setupKey, _ := NewCACertAndKey()
-	caCert, caKey, _ := NewCACertAndKey()
+func createTestCert(t *testing.T, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey) {
+	cert, key, err := pkiutil.NewCertAndKey(caCert, caKey,
+		&certutil.Config{
+			CommonName: "testCert",
+			Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
+		})
+	if err != nil {
+		t.Fatalf("couldn't create test cert: %v", err)
+	}
+	return cert, key
+}
+
+func TestWriteCertificateAuthorithyFilesIfNotExist(t *testing.T) {
+	setupCert, setupKey := createCACert(t)
+	caCert, caKey := createCACert(t)
 
 	var tests = []struct {
 		setupFunc     func(pkiDir string) error
@@ -60,7 +81,7 @@ func TestWriteCertificateAuthorithyFilesIfNotExist(t *testing.T) {
 		},
 		{ // cert exists, but it is not a ca > err
 			setupFunc: func(pkiDir string) error {
-				cert, key, _ := NewFrontProxyClientCertAndKey(setupCert, setupKey)
+				cert, key := createTestCert(t, setupCert, setupKey)
 				return writeCertificateFilesIfNotExist(pkiDir, "dummy", setupCert, cert, key)
 			},
 			expectedError: true,
@@ -110,9 +131,9 @@ func TestWriteCertificateAuthorithyFilesIfNotExist(t *testing.T) {
 
 func TestWriteCertificateFilesIfNotExist(t *testing.T) {
 
-	caCert, caKey, _ := NewFrontProxyCACertAndKey()
-	setupCert, setupKey, _ := NewFrontProxyClientCertAndKey(caCert, caKey)
-	cert, key, _ := NewFrontProxyClientCertAndKey(caCert, caKey)
+	caCert, caKey := createCACert(t)
+	setupCert, setupKey := createTestCert(t, caCert, caKey)
+	cert, key := createTestCert(t, caCert, caKey)
 
 	var tests = []struct {
 		setupFunc     func(pkiDir string) error
@@ -137,8 +158,8 @@ func TestWriteCertificateFilesIfNotExist(t *testing.T) {
 		},
 		{ // cert exists, is signed by another ca > err
 			setupFunc: func(pkiDir string) error {
-				anotherCaCert, anotherCaKey, _ := NewFrontProxyCACertAndKey()
-				anotherCert, anotherKey, _ := NewFrontProxyClientCertAndKey(anotherCaCert, anotherCaKey)
+				anotherCaCert, anotherCaKey := createCACert(t)
+				anotherCert, anotherKey := createTestCert(t, anotherCaCert, anotherCaKey)
 
 				return writeCertificateFilesIfNotExist(pkiDir, "dummy", anotherCaCert, anotherCert, anotherKey)
 			},
@@ -259,7 +280,8 @@ func TestWriteKeyFilesIfNotExist(t *testing.T) {
 }
 
 func TestNewCACertAndKey(t *testing.T) {
-	caCert, _, err := NewCACertAndKey()
+	certCfg := &certutil.Config{CommonName: "kubernetes"}
+	caCert, _, err := NewCACertAndKey(certCfg)
 	if err != nil {
 		t.Fatalf("failed call NewCACertAndKey: %v", err)
 	}
@@ -267,210 +289,187 @@ func TestNewCACertAndKey(t *testing.T) {
 	certstestutil.AssertCertificateIsCa(t, caCert)
 }
 
-func TestNewAPIServerCertAndKey(t *testing.T) {
-	hostname := "valid-hostname"
+func TestSharedCertificateExists(t *testing.T) {
+	caCert, caKey := createCACert(t)
+	_, key := createTestCert(t, caCert, caKey)
+	publicKey := &key.PublicKey
 
-	advertiseAddresses := []string{"1.2.3.4", "1:2:3::4"}
-	for _, addr := range advertiseAddresses {
-		cfg := &kubeadmapi.MasterConfiguration{
-			API:              kubeadmapi.API{AdvertiseAddress: addr},
-			Networking:       kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
-			NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: hostname},
-		}
-		caCert, caKey, err := NewCACertAndKey()
-		if err != nil {
-			t.Fatalf("failed creation of ca cert and key: %v", err)
-		}
-
-		apiServerCert, _, err := NewAPIServerCertAndKey(cfg, caCert, caKey)
-		if err != nil {
-			t.Fatalf("failed creation of cert and key: %v", err)
-		}
-
-		certstestutil.AssertCertificateIsSignedByCa(t, apiServerCert, caCert)
-		certstestutil.AssertCertificateHasServerAuthUsage(t, apiServerCert)
-		certstestutil.AssertCertificateHasDNSNames(t, apiServerCert, hostname, "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster.local")
-		certstestutil.AssertCertificateHasIPAddresses(t, apiServerCert, net.ParseIP("10.96.0.1"), net.ParseIP(addr))
-	}
-}
-
-func TestNewAPIServerKubeletClientCertAndKey(t *testing.T) {
-	caCert, caKey, err := NewCACertAndKey()
-	if err != nil {
-		t.Fatalf("failed creation of ca cert and key: %v", err)
-	}
-
-	apiKubeletClientCert, _, err := NewAPIServerKubeletClientCertAndKey(caCert, caKey)
-	if err != nil {
-		t.Fatalf("failed creation of cert and key: %v", err)
-	}
-
-	certstestutil.AssertCertificateIsSignedByCa(t, apiKubeletClientCert, caCert)
-	certstestutil.AssertCertificateHasClientAuthUsage(t, apiKubeletClientCert)
-	certstestutil.AssertCertificateHasOrganizations(t, apiKubeletClientCert, kubeadmconstants.MastersGroup)
-}
-
-func TestNewEtcdCACertAndKey(t *testing.T) {
-	etcdCACert, _, err := NewEtcdCACertAndKey()
-	if err != nil {
-		t.Fatalf("failed creation of cert and key: %v", err)
-	}
-
-	certstestutil.AssertCertificateIsCa(t, etcdCACert)
-}
-
-func TestNewEtcdServerCertAndKey(t *testing.T) {
-	proxy := "user-etcd-proxy"
-	proxyIP := "10.10.10.100"
-
-	cfg := &kubeadmapi.MasterConfiguration{
-		NodeRegistration: kubeadmapi.NodeRegistrationOptions{
-			Name: "etcd-server-cert",
-		},
-		Etcd: kubeadmapi.Etcd{
-			Local: &kubeadmapi.LocalEtcd{
-				ServerCertSANs: []string{
-					proxy,
-					proxyIP,
-				},
+	var tests = []struct {
+		name          string
+		files         pkiFiles
+		expectedError bool
+	}{
+		{
+			name: "success",
+			files: pkiFiles{
+				"ca.crt":             caCert,
+				"ca.key":             caKey,
+				"front-proxy-ca.crt": caCert,
+				"front-proxy-ca.key": caKey,
+				"sa.pub":             publicKey,
+				"sa.key":             key,
 			},
 		},
-	}
-	caCert, caKey, err := NewCACertAndKey()
-	if err != nil {
-		t.Fatalf("failed creation of ca cert and key: %v", err)
-	}
-
-	etcdServerCert, _, err := NewEtcdServerCertAndKey(cfg, caCert, caKey)
-	if err != nil {
-		t.Fatalf("failed creation of cert and key: %v", err)
-	}
-
-	certstestutil.AssertCertificateIsSignedByCa(t, etcdServerCert, caCert)
-	certstestutil.AssertCertificateHasServerAuthUsage(t, etcdServerCert)
-	certstestutil.AssertCertificateHasDNSNames(t, etcdServerCert, "localhost", proxy)
-	certstestutil.AssertCertificateHasIPAddresses(t, etcdServerCert, net.ParseIP("127.0.0.1"), net.ParseIP(proxyIP))
-}
-
-func TestNewEtcdPeerCertAndKey(t *testing.T) {
-	hostname := "valid-hostname"
-	proxy := "user-etcd-proxy"
-	proxyIP := "10.10.10.100"
-
-	advertiseAddresses := []string{"1.2.3.4", "1:2:3::4"}
-	for _, addr := range advertiseAddresses {
-		cfg := &kubeadmapi.MasterConfiguration{
-			API:              kubeadmapi.API{AdvertiseAddress: addr},
-			NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: hostname},
-			Etcd: kubeadmapi.Etcd{
-				Local: &kubeadmapi.LocalEtcd{
-					PeerCertSANs: []string{
-						proxy,
-						proxyIP,
-					},
-				},
+		{
+			name: "missing ca.crt",
+			files: pkiFiles{
+				"ca.key":             caKey,
+				"front-proxy-ca.crt": caCert,
+				"front-proxy-ca.key": caKey,
+				"sa.pub":             publicKey,
+				"sa.key":             key,
 			},
-		}
-		caCert, caKey, err := NewCACertAndKey()
-		if err != nil {
-			t.Fatalf("failed creation of ca cert and key: %v", err)
-		}
+			expectedError: true,
+		},
+		{
+			name: "missing sa.key",
+			files: pkiFiles{
+				"ca.crt":             caCert,
+				"ca.key":             caKey,
+				"front-proxy-ca.crt": caCert,
+				"front-proxy-ca.key": caKey,
+				"sa.pub":             publicKey,
+			},
+			expectedError: true,
+		},
+		{
+			name: "expected front-proxy.crt missing",
+			files: pkiFiles{
+				"ca.crt":             caCert,
+				"ca.key":             caKey,
+				"front-proxy-ca.key": caKey,
+				"sa.pub":             publicKey,
+				"sa.key":             key,
+			},
+			expectedError: true,
+		},
+	}
 
-		etcdPeerCert, _, err := NewEtcdPeerCertAndKey(cfg, caCert, caKey)
-		if err != nil {
-			t.Fatalf("failed creation of cert and key: %v", err)
-		}
+	for _, test := range tests {
+		t.Run("", func(t *testing.T) {
+			tmpdir := testutil.SetupTempDir(t)
+			defer os.RemoveAll(tmpdir)
 
-		certstestutil.AssertCertificateIsSignedByCa(t, etcdPeerCert, caCert)
-		certstestutil.AssertCertificateHasServerAuthUsage(t, etcdPeerCert)
-		certstestutil.AssertCertificateHasClientAuthUsage(t, etcdPeerCert)
-		certstestutil.AssertCertificateHasDNSNames(t, etcdPeerCert, hostname, proxy)
-		certstestutil.AssertCertificateHasIPAddresses(t, etcdPeerCert, net.ParseIP(addr), net.ParseIP(proxyIP))
+			cfg := &kubeadmapi.InitConfiguration{
+				ClusterConfiguration: kubeadmapi.ClusterConfiguration{
+					CertificatesDir: tmpdir,
+				},
+			}
+
+			// created expected keys
+			writePKIFiles(t, tmpdir, test.files)
+
+			// executes create func
+			ret, err := SharedCertificateExists(cfg)
+
+			switch {
+			case !test.expectedError && err != nil:
+				t.Errorf("error SharedCertificateExists failed when not expected to fail: %v", err)
+			case test.expectedError && err == nil:
+				t.Errorf("error SharedCertificateExists didn't failed when expected")
+			case ret != (err == nil):
+				t.Errorf("error SharedCertificateExists returned %v when expected to return %v", ret, err == nil)
+			}
+		})
 	}
 }
 
-func TestNewEtcdHealthcheckClientCertAndKey(t *testing.T) {
-	caCert, caKey, err := NewCACertAndKey()
-	if err != nil {
-		t.Fatalf("failed creation of ca cert and key: %v", err)
+func TestCreatePKIAssetsWithSparseCerts(t *testing.T) {
+	caCert, caKey := createCACert(t)
+	fpCACert, fpCAKey := createCACert(t)
+	etcdCACert, etcdCAKey := createCACert(t)
+
+	fpCert, fpKey := createTestCert(t, fpCACert, fpCAKey)
+
+	tests := []struct {
+		name        string
+		files       pkiFiles
+		expectError bool
+	}{
+		{
+			name: "nothing present",
+		},
+		{
+			name: "CAs already exist",
+			files: pkiFiles{
+				"ca.crt":             caCert,
+				"ca.key":             caKey,
+				"front-proxy-ca.crt": fpCACert,
+				"front-proxy-ca.key": fpCAKey,
+				"etcd/ca.crt":        etcdCACert,
+				"etcd/ca.key":        etcdCAKey,
+			},
+		},
+		{
+			name: "CA certs only",
+			files: pkiFiles{
+				"ca.crt":             caCert,
+				"front-proxy-ca.crt": fpCACert,
+				"etcd/ca.crt":        etcdCACert,
+			},
+			expectError: true,
+		},
+		{
+			name: "FrontProxyCA with certs",
+			files: pkiFiles{
+				"ca.crt":                 caCert,
+				"ca.key":                 caKey,
+				"front-proxy-ca.crt":     fpCACert,
+				"front-proxy-client.crt": fpCert,
+				"front-proxy-client.key": fpKey,
+				"etcd/ca.crt":            etcdCACert,
+				"etcd/ca.key":            etcdCAKey,
+			},
+		},
+		{
+			name: "FrontProxy certs missing CA",
+			files: pkiFiles{
+				"front-proxy-client.crt": fpCert,
+				"front-proxy-client.key": fpKey,
+			},
+			expectError: true,
+		},
 	}
 
-	etcdHealthcheckClientCert, _, err := NewEtcdHealthcheckClientCertAndKey(caCert, caKey)
-	if err != nil {
-		t.Fatalf("failed creation of cert and key: %v", err)
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			tmpdir := testutil.SetupTempDir(t)
+			defer os.RemoveAll(tmpdir)
+
+			cfg := testutil.GetDefaultInternalConfig(t)
+			cfg.ClusterConfiguration.CertificatesDir = tmpdir
+
+			writePKIFiles(t, tmpdir, test.files)
+
+			err := CreatePKIAssets(cfg)
+			if err != nil {
+				if test.expectError {
+					return
+				}
+				t.Fatalf("Unexpected error: %v", err)
+			}
+			if test.expectError {
+				t.Fatal("Expected error from CreatePKIAssets, got none")
+			}
+			assertCertsExist(t, tmpdir)
+		})
 	}
 
-	certstestutil.AssertCertificateIsSignedByCa(t, etcdHealthcheckClientCert, caCert)
-	certstestutil.AssertCertificateHasClientAuthUsage(t, etcdHealthcheckClientCert)
-	certstestutil.AssertCertificateHasOrganizations(t, etcdHealthcheckClientCert, kubeadmconstants.MastersGroup)
-}
-
-func TestNewAPIServerEtcdClientCertAndKey(t *testing.T) {
-	caCert, caKey, err := NewCACertAndKey()
-	if err != nil {
-		t.Fatalf("failed creation of ca cert and key: %v", err)
-	}
-
-	apiEtcdClientCert, _, err := NewAPIServerEtcdClientCertAndKey(caCert, caKey)
-	if err != nil {
-		t.Fatalf("failed creation of cert and key: %v", err)
-	}
-
-	certstestutil.AssertCertificateIsSignedByCa(t, apiEtcdClientCert, caCert)
-	certstestutil.AssertCertificateHasClientAuthUsage(t, apiEtcdClientCert)
-	certstestutil.AssertCertificateHasOrganizations(t, apiEtcdClientCert, kubeadmconstants.MastersGroup)
-}
-
-func TestNewNewServiceAccountSigningKey(t *testing.T) {
-
-	key, err := NewServiceAccountSigningKey()
-	if err != nil {
-		t.Fatalf("failed creation of key: %v", err)
-	}
-
-	if key.N.BitLen() < 2048 {
-		t.Error("Service account signing key has less than 2048 bits size")
-	}
-}
-
-func TestNewFrontProxyCACertAndKey(t *testing.T) {
-	frontProxyCACert, _, err := NewFrontProxyCACertAndKey()
-	if err != nil {
-		t.Fatalf("failed creation of cert and key: %v", err)
-	}
-
-	certstestutil.AssertCertificateIsCa(t, frontProxyCACert)
-}
-
-func TestNewFrontProxyClientCertAndKey(t *testing.T) {
-	frontProxyCACert, frontProxyCAKey, err := NewFrontProxyCACertAndKey()
-	if err != nil {
-		t.Fatalf("failed creation of ca cert and key: %v", err)
-	}
-
-	frontProxyClientCert, _, err := NewFrontProxyClientCertAndKey(frontProxyCACert, frontProxyCAKey)
-	if err != nil {
-		t.Fatalf("failed creation of cert and key: %v", err)
-	}
-
-	certstestutil.AssertCertificateIsSignedByCa(t, frontProxyClientCert, frontProxyCACert)
-	certstestutil.AssertCertificateHasClientAuthUsage(t, frontProxyClientCert)
 }
 
 func TestUsingExternalCA(t *testing.T) {
-
 	tests := []struct {
-		setupFuncs []func(cfg *kubeadmapi.MasterConfiguration) error
+		setupFuncs []func(cfg *kubeadmapi.InitConfiguration) error
 		expected   bool
 	}{
 		{
-			setupFuncs: []func(cfg *kubeadmapi.MasterConfiguration) error{
+			setupFuncs: []func(cfg *kubeadmapi.InitConfiguration) error{
 				CreatePKIAssets,
 			},
 			expected: false,
 		},
 		{
-			setupFuncs: []func(cfg *kubeadmapi.MasterConfiguration) error{
+			setupFuncs: []func(cfg *kubeadmapi.InitConfiguration) error{
 				CreatePKIAssets,
 				deleteCAKey,
 				deleteFrontProxyCAKey,
@@ -483,11 +482,13 @@ func TestUsingExternalCA(t *testing.T) {
 		dir := testutil.SetupTempDir(t)
 		defer os.RemoveAll(dir)
 
-		cfg := &kubeadmapi.MasterConfiguration{
-			API:              kubeadmapi.API{AdvertiseAddress: "1.2.3.4"},
-			Networking:       kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
+		cfg := &kubeadmapi.InitConfiguration{
+			APIEndpoint: kubeadmapi.APIEndpoint{AdvertiseAddress: "1.2.3.4"},
+			ClusterConfiguration: kubeadmapi.ClusterConfiguration{
+				Networking:      kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
+				CertificatesDir: dir,
+			},
 			NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: "valid-hostname"},
-			CertificatesDir:  dir,
 		}
 
 		for _, f := range test.setupFuncs {
@@ -504,17 +505,20 @@ func TestUsingExternalCA(t *testing.T) {
 
 func TestValidateMethods(t *testing.T) {
 
+	caCert, caKey := createCACert(t)
+	cert, key := createTestCert(t, caCert, caKey)
+
 	tests := []struct {
 		name            string
-		setupFuncs      []func(cfg *kubeadmapi.MasterConfiguration) error
+		files           pkiFiles
 		validateFunc    func(l certKeyLocation) error
 		loc             certKeyLocation
 		expectedSuccess bool
 	}{
 		{
 			name: "validateCACert",
-			setupFuncs: []func(cfg *kubeadmapi.MasterConfiguration) error{
-				CreateCACertAndKeyFiles,
+			files: pkiFiles{
+				"ca.crt": caCert,
 			},
 			validateFunc:    validateCACert,
 			loc:             certKeyLocation{caBaseName: "ca", baseName: "", uxName: "CA"},
@@ -522,28 +526,30 @@ func TestValidateMethods(t *testing.T) {
 		},
 		{
 			name: "validateCACertAndKey (files present)",
-			setupFuncs: []func(cfg *kubeadmapi.MasterConfiguration) error{
-				CreateCACertAndKeyFiles,
+			files: pkiFiles{
+				"ca.crt": caCert,
+				"ca.key": caKey,
 			},
 			validateFunc:    validateCACertAndKey,
 			loc:             certKeyLocation{caBaseName: "ca", baseName: "", uxName: "CA"},
 			expectedSuccess: true,
 		},
 		{
-			name: "validateCACertAndKey (key missing)",
-			setupFuncs: []func(cfg *kubeadmapi.MasterConfiguration) error{
-				CreatePKIAssets,
-				deleteCAKey,
+			files: pkiFiles{
+				"ca.crt": caCert,
 			},
+			name:            "validateCACertAndKey (key missing)",
 			validateFunc:    validateCACertAndKey,
 			loc:             certKeyLocation{caBaseName: "ca", baseName: "", uxName: "CA"},
 			expectedSuccess: false,
 		},
 		{
 			name: "validateSignedCert",
-			setupFuncs: []func(cfg *kubeadmapi.MasterConfiguration) error{
-				CreateCACertAndKeyFiles,
-				CreateAPIServerCertAndKeyFiles,
+			files: pkiFiles{
+				"ca.crt":        caCert,
+				"ca.key":        caKey,
+				"apiserver.crt": cert,
+				"apiserver.key": key,
 			},
 			validateFunc:    validateSignedCert,
 			loc:             certKeyLocation{caBaseName: "ca", baseName: "apiserver", uxName: "apiserver"},
@@ -551,8 +557,9 @@ func TestValidateMethods(t *testing.T) {
 		},
 		{
 			name: "validatePrivatePublicKey",
-			setupFuncs: []func(cfg *kubeadmapi.MasterConfiguration) error{
-				CreateServiceAccountKeyAndPublicKeyFiles,
+			files: pkiFiles{
+				"sa.pub": &key.PublicKey,
+				"sa.key": key,
 			},
 			validateFunc:    validatePrivatePublicKey,
 			loc:             certKeyLocation{baseName: "sa", uxName: "service account"},
@@ -561,25 +568,11 @@ func TestValidateMethods(t *testing.T) {
 	}
 
 	for _, test := range tests {
-
 		dir := testutil.SetupTempDir(t)
 		defer os.RemoveAll(dir)
 		test.loc.pkiDir = dir
 
-		cfg := &kubeadmapi.MasterConfiguration{
-			API:              kubeadmapi.API{AdvertiseAddress: "1.2.3.4"},
-			Networking:       kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
-			NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: "valid-hostname"},
-			CertificatesDir:  dir,
-		}
-
-		fmt.Println("Testing", test.name)
-
-		for _, f := range test.setupFuncs {
-			if err := f(cfg); err != nil {
-				t.Errorf("error executing setup function: %v", err)
-			}
-		}
+		writePKIFiles(t, dir, test.files)
 
 		err := test.validateFunc(test.loc)
 		if test.expectedSuccess && err != nil {
@@ -590,25 +583,36 @@ func TestValidateMethods(t *testing.T) {
 	}
 }
 
-func deleteCAKey(cfg *kubeadmapi.MasterConfiguration) error {
-	if err := os.Remove(filepath.Join(cfg.CertificatesDir, kubeadmconstants.CAKeyName)); err != nil {
-		return fmt.Errorf("failed removing %s: %v", kubeadmconstants.CAKeyName, err)
-	}
-	return nil
-}
+type pkiFiles map[string]interface{}
 
-func deleteFrontProxyCAKey(cfg *kubeadmapi.MasterConfiguration) error {
-	if err := os.Remove(filepath.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyCAKeyName)); err != nil {
-		return fmt.Errorf("failed removing %s: %v", kubeadmconstants.FrontProxyCAKeyName, err)
+func writePKIFiles(t *testing.T, dir string, files pkiFiles) {
+	for filename, body := range files {
+		switch body := body.(type) {
+		case *x509.Certificate:
+			if err := certutil.WriteCert(path.Join(dir, filename), certutil.EncodeCertPEM(body)); err != nil {
+				t.Errorf("unable to write certificate to file %q: [%v]", dir, err)
+			}
+		case *rsa.PublicKey:
+			publicKeyBytes, err := certutil.EncodePublicKeyPEM(body)
+			if err != nil {
+				t.Errorf("unable to write public key to file %q: [%v]", filename, err)
+			}
+			if err := certutil.WriteKey(path.Join(dir, filename), publicKeyBytes); err != nil {
+				t.Errorf("unable to write public key to file %q: [%v]", filename, err)
+			}
+		case *rsa.PrivateKey:
+			if err := certutil.WriteKey(path.Join(dir, filename), certutil.EncodePrivateKeyPEM(body)); err != nil {
+				t.Errorf("unable to write private key to file %q: [%v]", filename, err)
+			}
+		}
 	}
-	return nil
 }
 
 func TestCreateCertificateFilesMethods(t *testing.T) {
 
 	var tests = []struct {
-		setupFunc     func(cfg *kubeadmapi.MasterConfiguration) error
-		createFunc    func(cfg *kubeadmapi.MasterConfiguration) error
+		setupFunc     func(cfg *kubeadmapi.InitConfiguration) error
+		createFunc    func(cfg *kubeadmapi.InitConfiguration) error
 		expectedFiles []string
 		externalEtcd  bool
 	}{
@@ -640,57 +644,6 @@ func TestCreateCertificateFilesMethods(t *testing.T) {
 				kubeadmconstants.FrontProxyClientCertName, kubeadmconstants.FrontProxyClientKeyName,
 			},
 		},
-		{
-			createFunc:    CreateCACertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.CACertName, kubeadmconstants.CAKeyName},
-		},
-		{
-			setupFunc:     CreateCACertAndKeyFiles,
-			createFunc:    CreateAPIServerCertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.APIServerCertName, kubeadmconstants.APIServerKeyName},
-		},
-		{
-			setupFunc:     CreateCACertAndKeyFiles,
-			createFunc:    CreateAPIServerKubeletClientCertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.APIServerKubeletClientCertName, kubeadmconstants.APIServerKubeletClientKeyName},
-		},
-		{
-			createFunc:    CreateEtcdCACertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.EtcdCACertName, kubeadmconstants.EtcdCAKeyName},
-		},
-		{
-			setupFunc:     CreateEtcdCACertAndKeyFiles,
-			createFunc:    CreateEtcdServerCertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.EtcdServerCertName, kubeadmconstants.EtcdServerKeyName},
-		},
-		{
-			setupFunc:     CreateEtcdCACertAndKeyFiles,
-			createFunc:    CreateEtcdPeerCertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.EtcdPeerCertName, kubeadmconstants.EtcdPeerKeyName},
-		},
-		{
-			setupFunc:     CreateEtcdCACertAndKeyFiles,
-			createFunc:    CreateEtcdHealthcheckClientCertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.EtcdHealthcheckClientCertName, kubeadmconstants.EtcdHealthcheckClientKeyName},
-		},
-		{
-			setupFunc:     CreateEtcdCACertAndKeyFiles,
-			createFunc:    CreateAPIServerEtcdClientCertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.APIServerEtcdClientCertName, kubeadmconstants.APIServerEtcdClientKeyName},
-		},
-		{
-			createFunc:    CreateServiceAccountKeyAndPublicKeyFiles,
-			expectedFiles: []string{kubeadmconstants.ServiceAccountPrivateKeyName, kubeadmconstants.ServiceAccountPublicKeyName},
-		},
-		{
-			createFunc:    CreateFrontProxyCACertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.FrontProxyCACertName, kubeadmconstants.FrontProxyCAKeyName},
-		},
-		{
-			setupFunc:     CreateFrontProxyCACertAndKeyFiles,
-			createFunc:    CreateFrontProxyClientCertAndKeyFiles,
-			expectedFiles: []string{kubeadmconstants.FrontProxyCACertName, kubeadmconstants.FrontProxyCAKeyName},
-		},
 	}
 
 	for _, test := range tests {
@@ -698,12 +651,14 @@ func TestCreateCertificateFilesMethods(t *testing.T) {
 		tmpdir := testutil.SetupTempDir(t)
 		defer os.RemoveAll(tmpdir)
 
-		cfg := &kubeadmapi.MasterConfiguration{
-			API:              kubeadmapi.API{AdvertiseAddress: "1.2.3.4"},
-			Etcd:             kubeadmapi.Etcd{Local: &kubeadmapi.LocalEtcd{}},
-			Networking:       kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
+		cfg := &kubeadmapi.InitConfiguration{
+			APIEndpoint: kubeadmapi.APIEndpoint{AdvertiseAddress: "1.2.3.4"},
+			ClusterConfiguration: kubeadmapi.ClusterConfiguration{
+				Etcd:            kubeadmapi.Etcd{Local: &kubeadmapi.LocalEtcd{}},
+				Networking:      kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
+				CertificatesDir: tmpdir,
+			},
 			NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: "valid-hostname"},
-			CertificatesDir:  tmpdir,
 		}
 
 		if test.externalEtcd {
@@ -714,14 +669,6 @@ func TestCreateCertificateFilesMethods(t *testing.T) {
 			cfg.Etcd.External.Endpoints = []string{"192.168.1.1:2379"}
 		}
 
-		// executes setup func (if necessary)
-		if test.setupFunc != nil {
-			if err := test.setupFunc(cfg); err != nil {
-				t.Errorf("error executing setupFunc: %v", err)
-				continue
-			}
-		}
-
 		// executes create func
 		if err := test.createFunc(cfg); err != nil {
 			t.Errorf("error executing createFunc: %v", err)
@@ -732,3 +679,38 @@ func TestCreateCertificateFilesMethods(t *testing.T) {
 		testutil.AssertFileExists(t, tmpdir, test.expectedFiles...)
 	}
 }
+
+func deleteCAKey(cfg *kubeadmapi.InitConfiguration) error {
+	if err := os.Remove(filepath.Join(cfg.CertificatesDir, kubeadmconstants.CAKeyName)); err != nil {
+		return fmt.Errorf("failed removing %s: %v", kubeadmconstants.CAKeyName, err)
+	}
+	return nil
+}
+
+func deleteFrontProxyCAKey(cfg *kubeadmapi.InitConfiguration) error {
+	if err := os.Remove(filepath.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyCAKeyName)); err != nil {
+		return fmt.Errorf("failed removing %s: %v", kubeadmconstants.FrontProxyCAKeyName, err)
+	}
+	return nil
+}
+
+func assertCertsExist(t *testing.T, dir string) {
+	tree, err := GetDefaultCertList().AsMap().CertTree()
+	if err != nil {
+		t.Fatalf("unexpected error getting certificates: %v", err)
+	}
+
+	for caCert, certs := range tree {
+		if err := validateCACert(certKeyLocation{dir, caCert.BaseName, "", caCert.Name}); err != nil {
+			t.Errorf("couldn't validate CA certificate %v: %v", caCert.Name, err)
+			// Don't bother validating child certs, but do try the other CAs
+			continue
+		}
+
+		for _, cert := range certs {
+			if err := validateSignedCert(certKeyLocation{dir, caCert.BaseName, cert.BaseName, cert.Name}); err != nil {
+				t.Errorf("couldn't validate certificate %v: %v", cert.Name, err)
+			}
+		}
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/doc.go

@@ -21,7 +21,7 @@ package certs
 	PHASE: CERTIFICATES
 
 	INPUTS:
-		From MasterConfiguration
+		From InitConfiguration
 			.API.AdvertiseAddress is an optional parameter that can be passed for an extra addition to the SAN IPs
 			.APIServerCertSANs is an optional parameter for adding DNS names and IPs to the API Server serving cert SAN
 			.Etcd.Local.ServerCertSANs is an optional parameter for adding DNS names and IPs to the etcd serving cert SAN

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil/BUILD

@@ -12,7 +12,7 @@ go_test(
     embed = [":go_default_library"],
     deps = [
         "//cmd/kubeadm/app/apis/kubeadm:go_default_library",
-        "//vendor/k8s.io/client-go/util/cert:go_default_library",
+        "//staging/src/k8s.io/client-go/util/cert:go_default_library",
     ],
 )
 
@@ -25,8 +25,8 @@ go_library(
         "//cmd/kubeadm/app/constants:go_default_library",
         "//cmd/kubeadm/app/util:go_default_library",
         "//pkg/registry/core/service/ipallocator:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/validation:go_default_library",
-        "//vendor/k8s.io/client-go/util/cert:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/validation:go_default_library",
+        "//staging/src/k8s.io/client-go/util/cert:go_default_library",
     ],
 )
 

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil/pki_helpers.go

@@ -34,16 +34,13 @@ import (
 )
 
 // NewCertificateAuthority creates new certificate and private key for the certificate authority
-func NewCertificateAuthority() (*x509.Certificate, *rsa.PrivateKey, error) {
+func NewCertificateAuthority(config *certutil.Config) (*x509.Certificate, *rsa.PrivateKey, error) {
 	key, err := certutil.NewPrivateKey()
 	if err != nil {
 		return nil, nil, fmt.Errorf("unable to create private key [%v]", err)
 	}
 
-	config := certutil.Config{
-		CommonName: "kubernetes",
-	}
-	cert, err := certutil.NewSelfSignedCACert(config, key)
+	cert, err := certutil.NewSelfSignedCACert(*config, key)
 	if err != nil {
 		return nil, nil, fmt.Errorf("unable to create self-signed certificate [%v]", err)
 	}
@@ -52,13 +49,13 @@ func NewCertificateAuthority() (*x509.Certificate, *rsa.PrivateKey, error) {
 }
 
 // NewCertAndKey creates new certificate and key by passing the certificate authority certificate and key
-func NewCertAndKey(caCert *x509.Certificate, caKey *rsa.PrivateKey, config certutil.Config) (*x509.Certificate, *rsa.PrivateKey, error) {
+func NewCertAndKey(caCert *x509.Certificate, caKey *rsa.PrivateKey, config *certutil.Config) (*x509.Certificate, *rsa.PrivateKey, error) {
 	key, err := certutil.NewPrivateKey()
 	if err != nil {
 		return nil, nil, fmt.Errorf("unable to create private key [%v]", err)
 	}
 
-	cert, err := certutil.NewSignedCert(config, key, caCert, caKey)
+	cert, err := certutil.NewSignedCert(*config, key, caCert, caKey)
 	if err != nil {
 		return nil, nil, fmt.Errorf("unable to sign certificate [%v]", err)
 	}
@@ -133,7 +130,7 @@ func WritePublicKey(pkiPath, name string, key *rsa.PublicKey) error {
 
 // CertOrKeyExist returns a boolean whether the cert or the key exists
 func CertOrKeyExist(pkiPath, name string) bool {
-	certificatePath, privateKeyPath := pathsForCertAndKey(pkiPath, name)
+	certificatePath, privateKeyPath := PathsForCertAndKey(pkiPath, name)
 
 	_, certErr := os.Stat(certificatePath)
 	_, keyErr := os.Stat(privateKeyPath)
@@ -237,7 +234,8 @@ func TryLoadPrivatePublicKeyFromDisk(pkiPath, name string) (*rsa.PrivateKey, *rs
 	return k, p, nil
 }
 
-func pathsForCertAndKey(pkiPath, name string) (string, string) {
+// PathsForCertAndKey returns the paths for the certificate and key given the path and basename.
+func PathsForCertAndKey(pkiPath, name string) (string, string) {
 	return pathForCert(pkiPath, name), pathForKey(pkiPath, name)
 }
 
@@ -254,11 +252,11 @@ func pathForPublicKey(pkiPath, name string) string {
 }
 
 // GetAPIServerAltNames builds an AltNames object for to be used when generating apiserver certificate
-func GetAPIServerAltNames(cfg *kubeadmapi.MasterConfiguration) (*certutil.AltNames, error) {
+func GetAPIServerAltNames(cfg *kubeadmapi.InitConfiguration) (*certutil.AltNames, error) {
 	// advertise address
-	advertiseAddress := net.ParseIP(cfg.API.AdvertiseAddress)
+	advertiseAddress := net.ParseIP(cfg.APIEndpoint.AdvertiseAddress)
 	if advertiseAddress == nil {
-		return nil, fmt.Errorf("error parsing API AdvertiseAddress %v: is not a valid textual representation of an IP address", cfg.API.AdvertiseAddress)
+		return nil, fmt.Errorf("error parsing APIEndpoint AdvertiseAddress %v: is not a valid textual representation of an IP address", cfg.APIEndpoint.AdvertiseAddress)
 	}
 
 	// internal IP address for the API server
@@ -287,16 +285,16 @@ func GetAPIServerAltNames(cfg *kubeadmapi.MasterConfiguration) (*certutil.AltNam
 		},
 	}
 
-	// add api server controlPlaneEndpoint if present (dns or ip)
-	if len(cfg.API.ControlPlaneEndpoint) > 0 {
-		if host, _, err := kubeadmutil.ParseHostPort(cfg.API.ControlPlaneEndpoint); err == nil {
+	// add cluster controlPlaneEndpoint if present (dns or ip)
+	if len(cfg.ControlPlaneEndpoint) > 0 {
+		if host, _, err := kubeadmutil.ParseHostPort(cfg.ControlPlaneEndpoint); err == nil {
 			if ip := net.ParseIP(host); ip != nil {
 				altNames.IPs = append(altNames.IPs, ip)
 			} else {
 				altNames.DNSNames = append(altNames.DNSNames, host)
 			}
 		} else {
-			return nil, fmt.Errorf("error parsing API api.controlPlaneEndpoint %q: %s", cfg.API.ControlPlaneEndpoint, err)
+			return nil, fmt.Errorf("error parsing cluster controlPlaneEndpoint %q: %s", cfg.ControlPlaneEndpoint, err)
 		}
 	}
 
@@ -309,7 +307,7 @@ func GetAPIServerAltNames(cfg *kubeadmapi.MasterConfiguration) (*certutil.AltNam
 // `localhost` is included in the SAN since this is the interface the etcd static pod listens on.
 // Hostname and `API.AdvertiseAddress` are excluded since etcd does not listen on this interface by default.
 // The user can override the listen address with `Etcd.ExtraArgs` and add SANs with `Etcd.ServerCertSANs`.
-func GetEtcdAltNames(cfg *kubeadmapi.MasterConfiguration) (*certutil.AltNames, error) {
+func GetEtcdAltNames(cfg *kubeadmapi.InitConfiguration) (*certutil.AltNames, error) {
 	// create AltNames with defaults DNSNames/IPs
 	altNames := &certutil.AltNames{
 		DNSNames: []string{cfg.NodeRegistration.Name, "localhost"},
@@ -327,11 +325,11 @@ func GetEtcdAltNames(cfg *kubeadmapi.MasterConfiguration) (*certutil.AltNames, e
 // `localhost` is excluded from the SAN since etcd will not refer to itself as a peer.
 // Hostname and `API.AdvertiseAddress` are included if the user chooses to promote the single node etcd cluster into a multi-node one.
 // The user can override the listen address with `Etcd.ExtraArgs` and add SANs with `Etcd.PeerCertSANs`.
-func GetEtcdPeerAltNames(cfg *kubeadmapi.MasterConfiguration) (*certutil.AltNames, error) {
+func GetEtcdPeerAltNames(cfg *kubeadmapi.InitConfiguration) (*certutil.AltNames, error) {
 	// advertise address
-	advertiseAddress := net.ParseIP(cfg.API.AdvertiseAddress)
+	advertiseAddress := net.ParseIP(cfg.APIEndpoint.AdvertiseAddress)
 	if advertiseAddress == nil {
-		return nil, fmt.Errorf("error parsing API AdvertiseAddress %v: is not a valid textual representation of an IP address", cfg.API.AdvertiseAddress)
+		return nil, fmt.Errorf("error parsing APIEndpoint AdvertiseAddress %v: is not a valid textual representation of an IP address", cfg.APIEndpoint.AdvertiseAddress)
 	}
 
 	// create AltNames with defaults DNSNames/IPs

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil/pki_helpers_test.go

@@ -30,7 +30,7 @@ import (
 )
 
 func TestNewCertificateAuthority(t *testing.T) {
-	cert, key, err := NewCertificateAuthority()
+	cert, key, err := NewCertificateAuthority(&certutil.Config{CommonName: "kubernetes"})
 
 	if cert == nil {
 		t.Errorf(
@@ -73,7 +73,7 @@ func TestNewCertAndKey(t *testing.T) {
 			t.Fatalf("Couldn't create rsa Private Key")
 		}
 		caCert := &x509.Certificate{}
-		config := certutil.Config{
+		config := &certutil.Config{
 			CommonName:   "test",
 			Organization: []string{"test"},
 			Usages:       []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
@@ -90,7 +90,7 @@ func TestNewCertAndKey(t *testing.T) {
 }
 
 func TestHasServerAuth(t *testing.T) {
-	caCert, caKey, _ := NewCertificateAuthority()
+	caCert, caKey, _ := NewCertificateAuthority(&certutil.Config{CommonName: "kubernetes"})
 
 	var tests = []struct {
 		config   certutil.Config
@@ -113,7 +113,7 @@ func TestHasServerAuth(t *testing.T) {
 	}
 
 	for _, rt := range tests {
-		cert, _, err := NewCertAndKey(caCert, caKey, rt.config)
+		cert, _, err := NewCertAndKey(caCert, caKey, &rt.config)
 		if err != nil {
 			t.Fatalf("Couldn't create cert: %v", err)
 		}
@@ -261,7 +261,7 @@ func TestTryLoadCertAndKeyFromDisk(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 
-	caCert, caKey, err := NewCertificateAuthority()
+	caCert, caKey, err := NewCertificateAuthority(&certutil.Config{CommonName: "kubernetes"})
 	if err != nil {
 		t.Errorf(
 			"failed to create cert and key with an error: %v",
@@ -311,7 +311,7 @@ func TestTryLoadCertFromDisk(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 
-	caCert, _, err := NewCertificateAuthority()
+	caCert, _, err := NewCertificateAuthority(&certutil.Config{CommonName: "kubernetes"})
 	if err != nil {
 		t.Errorf(
 			"failed to create cert and key with an error: %v",
@@ -361,7 +361,7 @@ func TestTryLoadKeyFromDisk(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 
-	_, caKey, err := NewCertificateAuthority()
+	_, caKey, err := NewCertificateAuthority(&certutil.Config{CommonName: "kubernetes"})
 	if err != nil {
 		t.Errorf(
 			"failed to create cert and key with an error: %v",
@@ -405,7 +405,7 @@ func TestTryLoadKeyFromDisk(t *testing.T) {
 }
 
 func TestPathsForCertAndKey(t *testing.T) {
-	crtPath, keyPath := pathsForCertAndKey("/foo", "bar")
+	crtPath, keyPath := PathsForCertAndKey("/foo", "bar")
 	if crtPath != "/foo/bar.crt" {
 		t.Errorf("unexpected certificate path: %s", crtPath)
 	}
@@ -439,28 +439,34 @@ func TestGetAPIServerAltNames(t *testing.T) {
 
 	var tests = []struct {
 		name                string
-		cfg                 *kubeadmapi.MasterConfiguration
+		cfg                 *kubeadmapi.InitConfiguration
 		expectedDNSNames    []string
 		expectedIPAddresses []string
 	}{
 		{
 			name: "ControlPlaneEndpoint DNS",
-			cfg: &kubeadmapi.MasterConfiguration{
-				API:               kubeadmapi.API{AdvertiseAddress: "1.2.3.4", ControlPlaneEndpoint: "api.k8s.io:6443"},
-				Networking:        kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
-				NodeRegistration:  kubeadmapi.NodeRegistrationOptions{Name: "valid-hostname"},
-				APIServerCertSANs: []string{"10.1.245.94", "10.1.245.95", "1.2.3.L", "invalid,commas,in,DNS"},
+			cfg: &kubeadmapi.InitConfiguration{
+				APIEndpoint: kubeadmapi.APIEndpoint{AdvertiseAddress: "1.2.3.4"},
+				ClusterConfiguration: kubeadmapi.ClusterConfiguration{
+					ControlPlaneEndpoint: "api.k8s.io:6443",
+					Networking:           kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
+					APIServerCertSANs:    []string{"10.1.245.94", "10.1.245.95", "1.2.3.L", "invalid,commas,in,DNS"},
+				},
+				NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: "valid-hostname"},
 			},
 			expectedDNSNames:    []string{"valid-hostname", "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster.local", "api.k8s.io"},
 			expectedIPAddresses: []string{"10.96.0.1", "1.2.3.4", "10.1.245.94", "10.1.245.95"},
 		},
 		{
 			name: "ControlPlaneEndpoint IP",
-			cfg: &kubeadmapi.MasterConfiguration{
-				API:               kubeadmapi.API{AdvertiseAddress: "1.2.3.4", ControlPlaneEndpoint: "4.5.6.7:6443"},
-				Networking:        kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
-				NodeRegistration:  kubeadmapi.NodeRegistrationOptions{Name: "valid-hostname"},
-				APIServerCertSANs: []string{"10.1.245.94", "10.1.245.95", "1.2.3.L", "invalid,commas,in,DNS"},
+			cfg: &kubeadmapi.InitConfiguration{
+				APIEndpoint: kubeadmapi.APIEndpoint{AdvertiseAddress: "1.2.3.4"},
+				ClusterConfiguration: kubeadmapi.ClusterConfiguration{
+					ControlPlaneEndpoint: "4.5.6.7:6443",
+					Networking:           kubeadmapi.Networking{ServiceSubnet: "10.96.0.0/12", DNSDomain: "cluster.local"},
+					APIServerCertSANs:    []string{"10.1.245.94", "10.1.245.95", "1.2.3.L", "invalid,commas,in,DNS"},
+				},
+				NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: "valid-hostname"},
 			},
 			expectedDNSNames:    []string{"valid-hostname", "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster.local"},
 			expectedIPAddresses: []string{"10.96.0.1", "1.2.3.4", "10.1.245.94", "10.1.245.95", "4.5.6.7"},
@@ -506,14 +512,16 @@ func TestGetAPIServerAltNames(t *testing.T) {
 func TestGetEtcdAltNames(t *testing.T) {
 	proxy := "user-etcd-proxy"
 	proxyIP := "10.10.10.100"
-	cfg := &kubeadmapi.MasterConfiguration{
-		Etcd: kubeadmapi.Etcd{
-			Local: &kubeadmapi.LocalEtcd{
-				ServerCertSANs: []string{
-					proxy,
-					proxyIP,
-					"1.2.3.L",
-					"invalid,commas,in,DNS",
+	cfg := &kubeadmapi.InitConfiguration{
+		ClusterConfiguration: kubeadmapi.ClusterConfiguration{
+			Etcd: kubeadmapi.Etcd{
+				Local: &kubeadmapi.LocalEtcd{
+					ServerCertSANs: []string{
+						proxy,
+						proxyIP,
+						"1.2.3.L",
+						"invalid,commas,in,DNS",
+					},
 				},
 			},
 		},
@@ -560,19 +568,21 @@ func TestGetEtcdPeerAltNames(t *testing.T) {
 	proxy := "user-etcd-proxy"
 	proxyIP := "10.10.10.100"
 	advertiseIP := "1.2.3.4"
-	cfg := &kubeadmapi.MasterConfiguration{
-		API:              kubeadmapi.API{AdvertiseAddress: advertiseIP},
-		NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: hostname},
-		Etcd: kubeadmapi.Etcd{
-			Local: &kubeadmapi.LocalEtcd{
-				PeerCertSANs: []string{
-					proxy,
-					proxyIP,
-					"1.2.3.L",
-					"invalid,commas,in,DNS",
+	cfg := &kubeadmapi.InitConfiguration{
+		APIEndpoint: kubeadmapi.APIEndpoint{AdvertiseAddress: advertiseIP},
+		ClusterConfiguration: kubeadmapi.ClusterConfiguration{
+			Etcd: kubeadmapi.Etcd{
+				Local: &kubeadmapi.LocalEtcd{
+					PeerCertSANs: []string{
+						proxy,
+						proxyIP,
+						"1.2.3.L",
+						"invalid,commas,in,DNS",
+					},
 				},
 			},
 		},
+		NodeRegistration: kubeadmapi.NodeRegistrationOptions{Name: hostname},
 	}
 
 	altNames, err := GetEtcdPeerAltNames(cfg)

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/renewal/BUILD

@@ -0,0 +1,60 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "certsapi.go",
+        "filerenewal.go",
+        "interface.go",
+        "renewal.go",
+    ],
+    importpath = "k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/renewal",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//cmd/kubeadm/app/phases/certs/pkiutil:go_default_library",
+        "//staging/src/k8s.io/api/certificates/v1beta1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/fields:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/watch:go_default_library",
+        "//staging/src/k8s.io/client-go/kubernetes:go_default_library",
+        "//staging/src/k8s.io/client-go/kubernetes/typed/certificates/v1beta1:go_default_library",
+        "//staging/src/k8s.io/client-go/util/cert:go_default_library",
+        "//vendor/github.com/pkg/errors:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "filerenewal_test.go",
+        "renewal_test.go",
+    ],
+    embed = [":go_default_library"],
+    deps = [
+        "//cmd/kubeadm/app/phases/certs:go_default_library",
+        "//cmd/kubeadm/app/phases/certs/pkiutil:go_default_library",
+        "//cmd/kubeadm/test:go_default_library",
+        "//cmd/kubeadm/test/certs:go_default_library",
+        "//staging/src/k8s.io/api/certificates/v1beta1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/watch:go_default_library",
+        "//staging/src/k8s.io/client-go/kubernetes/typed/certificates/v1beta1/fake:go_default_library",
+        "//staging/src/k8s.io/client-go/testing:go_default_library",
+        "//staging/src/k8s.io/client-go/util/cert:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/renewal/certsapi.go

@@ -0,0 +1,152 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package renewal
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+
+	certsapi "k8s.io/api/certificates/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/kubernetes"
+	certstype "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
+	certutil "k8s.io/client-go/util/cert"
+)
+
+const (
+	certAPIPrefixName = "kubeadm-cert"
+)
+
+var (
+	watchTimeout = 5 * time.Minute
+)
+
+// CertsAPIRenewal creates new certificates using the certs API
+type CertsAPIRenewal struct {
+	client certstype.CertificatesV1beta1Interface
+}
+
+// NewCertsAPIRenawal takes a Kubernetes interface and returns a renewal Interface.
+func NewCertsAPIRenawal(client kubernetes.Interface) Interface {
+	return &CertsAPIRenewal{
+		client: client.CertificatesV1beta1(),
+	}
+}
+
+// Renew takes a certificate using the cert and key.
+func (r *CertsAPIRenewal) Renew(cfg *certutil.Config) (*x509.Certificate, *rsa.PrivateKey, error) {
+	reqTmp := &x509.CertificateRequest{
+		Subject: pkix.Name{
+			CommonName:   cfg.CommonName,
+			Organization: cfg.Organization,
+		},
+		DNSNames:    cfg.AltNames.DNSNames,
+		IPAddresses: cfg.AltNames.IPs,
+	}
+
+	key, err := certutil.NewPrivateKey()
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "couldn't create new private key")
+	}
+
+	csr, err := x509.CreateCertificateRequest(rand.Reader, reqTmp, key)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "couldn't create certificate signing request")
+	}
+
+	usages := make([]certsapi.KeyUsage, len(cfg.Usages))
+	for i, usage := range cfg.Usages {
+		certsAPIUsage, ok := usageMap[usage]
+		if !ok {
+			return nil, nil, fmt.Errorf("unknown key usage: %v", usage)
+		}
+		usages[i] = certsAPIUsage
+	}
+
+	k8sCSR := &certsapi.CertificateSigningRequest{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: certAPIPrefixName,
+		},
+		Spec: certsapi.CertificateSigningRequestSpec{
+			Request: csr,
+			Usages:  usages,
+		},
+	}
+
+	req, err := r.client.CertificateSigningRequests().Create(k8sCSR)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "couldn't create certificate signing request")
+	}
+
+	watcher, err := r.client.CertificateSigningRequests().Watch(metav1.ListOptions{
+		Watch:         true,
+		FieldSelector: fields.Set{"metadata.name": req.Name}.String(),
+	})
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "couldn't watch for certificate creation")
+	}
+	defer watcher.Stop()
+
+	select {
+	case ev := <-watcher.ResultChan():
+		if ev.Type != watch.Modified {
+			return nil, nil, fmt.Errorf("unexpected event received: %q", ev.Type)
+		}
+	case <-time.After(watchTimeout):
+		return nil, nil, errors.New("timeout trying to sign certificate")
+	}
+
+	req, err = r.client.CertificateSigningRequests().Get(req.Name, metav1.GetOptions{})
+	if len(req.Status.Conditions) < 1 {
+		return nil, nil, errors.New("certificate signing request has no statuses")
+	}
+
+	// TODO: under what circumstances are there more than one?
+	if status := req.Status.Conditions[0].Type; status != certsapi.CertificateApproved {
+		return nil, nil, fmt.Errorf("unexpected certificate status: %v", status)
+	}
+
+	cert, err := x509.ParseCertificate(req.Status.Certificate)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "couldn't parse issued certificate")
+	}
+
+	return cert, key, nil
+}
+
+var usageMap = map[x509.ExtKeyUsage]certsapi.KeyUsage{
+	x509.ExtKeyUsageAny:                        certsapi.UsageAny,
+	x509.ExtKeyUsageServerAuth:                 certsapi.UsageServerAuth,
+	x509.ExtKeyUsageClientAuth:                 certsapi.UsageClientAuth,
+	x509.ExtKeyUsageCodeSigning:                certsapi.UsageCodeSigning,
+	x509.ExtKeyUsageEmailProtection:            certsapi.UsageEmailProtection,
+	x509.ExtKeyUsageIPSECEndSystem:             certsapi.UsageIPsecEndSystem,
+	x509.ExtKeyUsageIPSECTunnel:                certsapi.UsageIPsecTunnel,
+	x509.ExtKeyUsageIPSECUser:                  certsapi.UsageIPsecUser,
+	x509.ExtKeyUsageTimeStamping:               certsapi.UsageTimestamping,
+	x509.ExtKeyUsageOCSPSigning:                certsapi.UsageOCSPSigning,
+	x509.ExtKeyUsageMicrosoftServerGatedCrypto: certsapi.UsageMicrosoftSGC,
+	x509.ExtKeyUsageNetscapeServerGatedCrypto:  certsapi.UsageNetscapSGC,
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/renewal/filerenewal.go

@@ -0,0 +1,44 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package renewal
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+
+	certutil "k8s.io/client-go/util/cert"
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil"
+)
+
+// FileRenewal renews a certificate using local certs
+type FileRenewal struct {
+	caCert *x509.Certificate
+	caKey  *rsa.PrivateKey
+}
+
+// NewFileRenewal takes a certificate pair to construct the Interface.
+func NewFileRenewal(caCert *x509.Certificate, caKey *rsa.PrivateKey) Interface {
+	return &FileRenewal{
+		caCert: caCert,
+		caKey:  caKey,
+	}
+}
+
+// Renew takes a certificate using the cert and key
+func (r *FileRenewal) Renew(cfg *certutil.Config) (*x509.Certificate, *rsa.PrivateKey, error) {
+	return pkiutil.NewCertAndKey(r.caCert, r.caKey, cfg)
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/renewal/filerenewal_test.go

@@ -0,0 +1,61 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package renewal
+
+import (
+	"crypto/x509"
+	"testing"
+
+	certutil "k8s.io/client-go/util/cert"
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs"
+)
+
+func TestFileRenew(t *testing.T) {
+	caCertCfg := &certutil.Config{CommonName: "kubernetes"}
+	caCert, caKey, err := certs.NewCACertAndKey(caCertCfg)
+	if err != nil {
+		t.Fatalf("couldn't create CA: %v", err)
+	}
+
+	fr := NewFileRenewal(caCert, caKey)
+
+	certCfg := &certutil.Config{
+		CommonName: "test-certs",
+		AltNames: certutil.AltNames{
+			DNSNames: []string{"test-domain.space"},
+		},
+		Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	}
+
+	cert, _, err := fr.Renew(certCfg)
+	if err != nil {
+		t.Fatalf("unexpected error renewing cert: %v", err)
+	}
+
+	pool := x509.NewCertPool()
+	pool.AddCert(caCert)
+
+	_, err = cert.Verify(x509.VerifyOptions{
+		DNSName:   "test-domain.space",
+		Roots:     pool,
+		KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	})
+	if err != nil {
+		t.Errorf("couldn't verify new cert: %v", err)
+	}
+
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/renewal/interface.go

@@ -0,0 +1,29 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package renewal
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+
+	certutil "k8s.io/client-go/util/cert"
+)
+
+// Interface represents a standard way to renew a certificate.
+type Interface interface {
+	Renew(*certutil.Config) (*x509.Certificate, *rsa.PrivateKey, error)
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/renewal/renewal.go

@@ -0,0 +1,63 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package renewal
+
+import (
+	"crypto/x509"
+	"fmt"
+
+	"github.com/pkg/errors"
+	certutil "k8s.io/client-go/util/cert"
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil"
+)
+
+// RenewExistingCert loads a certificate file, uses the renew interface to renew it,
+// and saves the resulting certificate and key over the old one.
+func RenewExistingCert(certsDir, baseName string, impl Interface) error {
+	certificatePath, _ := pkiutil.PathsForCertAndKey(certsDir, baseName)
+	certs, err := certutil.CertsFromFile(certificatePath)
+	if err != nil {
+		return fmt.Errorf("failed to load existing certificate %s: %v", baseName, err)
+	}
+
+	if len(certs) != 1 {
+		return fmt.Errorf("wanted exactly one certificate, got %d", len(certs))
+	}
+
+	cfg := certToConfig(certs[0])
+	newCert, newKey, err := impl.Renew(cfg)
+	if err != nil {
+		return errors.Wrapf(err, "failed to renew certificate %s", baseName)
+	}
+
+	if err := pkiutil.WriteCertAndKey(certsDir, baseName, newCert, newKey); err != nil {
+		return errors.Wrapf(err, "failed to write new certificate %s", baseName)
+	}
+	return nil
+}
+
+func certToConfig(cert *x509.Certificate) *certutil.Config {
+	return &certutil.Config{
+		CommonName:   cert.Subject.CommonName,
+		Organization: cert.Subject.Organization,
+		AltNames: certutil.AltNames{
+			IPs:      cert.IPAddresses,
+			DNSNames: cert.DNSNames,
+		},
+		Usages: cert.ExtKeyUsage,
+	}
+}

vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/renewal/renewal_test.go

@@ -0,0 +1,235 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package renewal
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"net"
+	"os"
+	"testing"
+	"time"
+
+	certsapi "k8s.io/api/certificates/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	fakecerts "k8s.io/client-go/kubernetes/typed/certificates/v1beta1/fake"
+	k8stesting "k8s.io/client-go/testing"
+	certutil "k8s.io/client-go/util/cert"
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs"
+	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/pkiutil"
+	testutil "k8s.io/kubernetes/cmd/kubeadm/test"
+	certtestutil "k8s.io/kubernetes/cmd/kubeadm/test/certs"
+)
+
+func TestRenewImplementations(t *testing.T) {
+	caCertCfg := &certutil.Config{CommonName: "kubernetes"}
+	caCert, caKey, err := certs.NewCACertAndKey(caCertCfg)
+	if err != nil {
+		t.Fatalf("couldn't create CA: %v", err)
+	}
+
+	client := &fakecerts.FakeCertificatesV1beta1{
+		Fake: &k8stesting.Fake{},
+	}
+	certReq := getCertReq(t, caCert, caKey)
+	client.AddReactor("get", "certificatesigningrequests", defaultReactionFunc(certReq))
+	watcher := watch.NewFakeWithChanSize(1, false)
+	watcher.Modify(certReq)
+	client.AddWatchReactor("certificatesigningrequests", k8stesting.DefaultWatchReactor(watcher, nil))
+
+	// override the timeout so tests are faster
+	watchTimeout = time.Second
+
+	tests := []struct {
+		name string
+		impl Interface
+	}{
+		{
+			name: "filerenewal",
+			impl: NewFileRenewal(caCert, caKey),
+		},
+		{
+			name: "certs api",
+			impl: &CertsAPIRenewal{
+				client: client,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+
+			certCfg := &certutil.Config{
+				CommonName: "test-certs",
+				AltNames: certutil.AltNames{
+					DNSNames: []string{"test-domain.space"},
+				},
+				Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+			}
+
+			cert, _, err := test.impl.Renew(certCfg)
+			if err != nil {
+				t.Fatalf("unexpected error renewing cert: %v", err)
+			}
+
+			pool := x509.NewCertPool()
+			pool.AddCert(caCert)
+
+			_, err = cert.Verify(x509.VerifyOptions{
+				DNSName:   "test-domain.space",
+				Roots:     pool,
+				KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+			})
+			if err != nil {
+				t.Errorf("couldn't verify new cert: %v", err)
+			}
+		})
+	}
+}
+
+func defaultReactionFunc(obj runtime.Object) k8stesting.ReactionFunc {
+	return func(act k8stesting.Action) (bool, runtime.Object, error) {
+		return true, obj, nil
+	}
+}
+
+func getCertReq(t *testing.T, caCert *x509.Certificate, caKey *rsa.PrivateKey) *certsapi.CertificateSigningRequest {
+	cert, _, err := pkiutil.NewCertAndKey(caCert, caKey, &certutil.Config{
+		CommonName: "testcert",
+		AltNames: certutil.AltNames{
+			DNSNames: []string{"test-domain.space"},
+		},
+		Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	})
+	if err != nil {
+		t.Fatalf("couldn't generate cert: %v", err)
+	}
+
+	return &certsapi.CertificateSigningRequest{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "testcert",
+		},
+		Status: certsapi.CertificateSigningRequestStatus{
+			Conditions: []certsapi.CertificateSigningRequestCondition{
+				{
+					Type: certsapi.CertificateApproved,
+				},
+			},
+			Certificate: cert.Raw,
+		},
+	}
+}
+
+func TestCertToConfig(t *testing.T) {
+	expectedConfig := &certutil.Config{
+		CommonName:   "test-common-name",
+		Organization: []string{"sig-cluster-lifecycle"},
+		AltNames: certutil.AltNames{
+			IPs:      []net.IP{net.ParseIP("10.100.0.1")},
+			DNSNames: []string{"test-domain.space"},
+		},
+		Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	}
+
+	cert := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName:   "test-common-name",
+			Organization: []string{"sig-cluster-lifecycle"},
+		},
+		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		DNSNames:    []string{"test-domain.space"},
+		IPAddresses: []net.IP{net.ParseIP("10.100.0.1")},
+	}
+
+	cfg := certToConfig(cert)
+
+	if cfg.CommonName != expectedConfig.CommonName {
+		t.Errorf("expected common name %q, got %q", expectedConfig.CommonName, cfg.CommonName)
+	}
+
+	if len(cfg.Organization) != 1 || cfg.Organization[0] != expectedConfig.Organization[0] {
+		t.Errorf("expected organization %v, got %v", expectedConfig.Organization, cfg.Organization)
+
+	}
+
+	if len(cfg.Usages) != 1 || cfg.Usages[0] != expectedConfig.Usages[0] {
+		t.Errorf("expected ext key usage %v, got %v", expectedConfig.Usages, cfg.Usages)
+	}
+
+	if len(cfg.AltNames.IPs) != 1 || cfg.AltNames.IPs[0].String() != expectedConfig.AltNames.IPs[0].String() {
+		t.Errorf("expected SAN IPs %v, got %v", expectedConfig.AltNames.IPs, cfg.AltNames.IPs)
+	}
+
+	if len(cfg.AltNames.DNSNames) != 1 || cfg.AltNames.DNSNames[0] != expectedConfig.AltNames.DNSNames[0] {
+		t.Errorf("expected SAN DNSNames %v, got %v", expectedConfig.AltNames.DNSNames, cfg.AltNames.DNSNames)
+	}
+}
+
+func TestRenewExistingCert(t *testing.T) {
+	cfg := &certutil.Config{
+		CommonName:   "test-common-name",
+		Organization: []string{"sig-cluster-lifecycle"},
+		AltNames: certutil.AltNames{
+			IPs:      []net.IP{net.ParseIP("10.100.0.1")},
+			DNSNames: []string{"test-domain.space"},
+		},
+		Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	}
+
+	caCertCfg := &certutil.Config{CommonName: "kubernetes"}
+	caCert, caKey, err := certs.NewCACertAndKey(caCertCfg)
+	if err != nil {
+		t.Fatalf("couldn't create CA: %v", err)
+	}
+
+	cert, key, err := pkiutil.NewCertAndKey(caCert, caKey, cfg)
+	if err != nil {
+		t.Fatalf("couldn't generate certificate: %v", err)
+	}
+
+	dir := testutil.SetupTempDir(t)
+	defer os.RemoveAll(dir)
+
+	if err := pkiutil.WriteCertAndKey(dir, "server", cert, key); err != nil {
+		t.Fatalf("couldn't write out certificate")
+	}
+
+	renewer := NewFileRenewal(caCert, caKey)
+
+	if err := RenewExistingCert(dir, "server", renewer); err != nil {
+		t.Fatalf("couldn't renew certificate: %v", err)
+	}
+
+	newCert, err := pkiutil.TryLoadCertFromDisk(dir, "server")
+	if err != nil {
+		t.Fatalf("couldn't load created certificate: %v", err)
+	}
+
+	if newCert.SerialNumber.Cmp(cert.SerialNumber) == 0 {
+		t.Fatal("expected new certificate, but renewed certificate has same serial number")
+	}
+
+	certtestutil.AssertCertificateIsSignedByCa(t, newCert, caCert)
+	certtestutil.AssertCertificateHasClientAuthUsage(t, newCert)
+	certtestutil.AssertCertificateHasOrganizations(t, newCert, cfg.Organization...)
+	certtestutil.AssertCertificateHasCommonName(t, newCert, cfg.CommonName)
+	certtestutil.AssertCertificateHasDNSNames(t, newCert, cfg.AltNames.DNSNames...)
+	certtestutil.AssertCertificateHasIPAddresses(t, newCert, cfg.AltNames.IPs...)
+}