migrations: Add migration for kubelet private key path

This adds a migration to update the `kubelet-server.key` file location
used for Kubernetes PKI. This was moved from the common location with
the public key to a separate private location so users would still be
able to read the public key if needed.

Signed-off-by: Sean McGinnis <stmcg@amazon.com>

Release.toml

@@ -171,4 +171,6 @@ version = "1.12.0"
     "migrate_v1.11.0_public-control-container-v0-6-4.lz4",
 ]
 "(1.11.0, 1.11.1)" = []
-"(1.11.1, 1.12.0)" = []
+"(1.11.1, 1.12.0)" = [
+    "migrate_v1.12.0_k8s-private-pki-path.lz4",
+]

sources/Cargo.toml

@@ -25,7 +25,8 @@ members = [
     "api/prairiedog",
 
     # "api/migration/migrations/vX.Y.Z/..."
-    # (all migrations currently archived; replace this line with new ones)
+    # (all previous migrations archived; add new ones after this line)
+    "api/migration/migrations/v1.12.0/k8s-private-pki-path",
 
     "bottlerocket-release",
 

sources/api/migration/migrations/v1.12.0/k8s-private-pki-path/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "k8s-private-pki-path"
+version = "0.1.0"
+authors = ["Sean McGinnis <stmcg@amazon.com>"]
+license = "Apache-2.0 OR MIT"
+edition = "2018"
+publish = false
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers = { path = "../../../migration-helpers", version = "0.1.0"}
+serde_json = "1.0"

sources/api/migration/migrations/v1.12.0/k8s-private-pki-path/src/main.rs

@@ -0,0 +1,81 @@
+#![deny(rust_2018_idioms)]
+
+use migration_helpers::{migrate, Migration, MigrationData, Result};
+use std::process;
+
+const SETTING: &'static str = "configuration-files.kubelet-server-key.path";
+const OLD_VALUE: &'static str = "/etc/kubernetes/pki/kubelet-server.key";
+const NEW_VALUE: &'static str = "/etc/kubernetes/pki/private/kubelet-server.key";
+
+/// We moved the render output location for the kubelet PKI private key to be in a restricted
+/// subdirectory. We need to update this output path in the stored configuration so updated nodes
+/// pick up the change.
+fn run() -> Result<()> {
+    migrate(KubeletServerKey {})
+}
+
+pub struct KubeletServerKey {}
+
+impl KubeletServerKey {
+    fn migrate(&mut self, mut input: MigrationData, action: &'static str) -> Result<MigrationData> {
+        let old_value;
+        let new_value;
+        if action == "upgrade" {
+            old_value = OLD_VALUE;
+            new_value = NEW_VALUE;
+        } else {
+            // Downgrade: everything old is new again
+            old_value = NEW_VALUE;
+            new_value = OLD_VALUE;
+        }
+
+        if let Some(data) = input.data.get_mut(SETTING) {
+            match data {
+                serde_json::Value::String(current_value) => {
+                    if current_value == old_value {
+                        *data = new_value.into();
+                        println!(
+                            "Changed '{}' from {:?} to {:?} on {}",
+                            SETTING, old_value, new_value, action
+                        );
+                    } else {
+                        println!(
+                            "'{}' is already set to {:?}, leaving alone",
+                            SETTING, new_value
+                        );
+                    }
+                }
+                _ => {
+                    println!(
+                        "'{}' is set to non-string value '{}'; KubeletServerKey only handles strings",
+                        SETTING, data
+                    );
+                }
+            }
+        } else {
+            println!("Found no setting '{}'", SETTING);
+        }
+
+        Ok(input)
+    }
+}
+
+impl Migration for KubeletServerKey {
+    fn forward(&mut self, input: MigrationData) -> Result<MigrationData> {
+        self.migrate(input, "upgrade")
+    }
+
+    fn backward(&mut self, input: MigrationData) -> Result<MigrationData> {
+        self.migrate(input, "downgrade")
+    }
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{}", e);
+        process::exit(1);
+    }
+}