From 63950491764535a8635cb2c4810db59a9a1fad25 Mon Sep 17 00:00:00 2001 From: "Dr. Stefan Schimanski" Date: Sun, 24 Sep 2023 11:50:38 +0200 Subject: [PATCH] controlplane: make option structs uniformly optional Signed-off-by: Dr. Stefan Schimanski --- pkg/controlplane/apiserver/config.go | 7 +++++-- pkg/controlplane/apiserver/options/options.go | 2 ++ pkg/kubeapiserver/options/admission.go | 3 +++ pkg/kubeapiserver/options/authentication.go | 15 ++++++++++++++- pkg/kubeapiserver/options/authorization.go | 14 +++++++++++--- .../pkg/server/options/api_enablement.go | 4 +++- .../src/k8s.io/component-base/metrics/options.go | 4 ++++ 7 files changed, 42 insertions(+), 7 deletions(-) diff --git a/pkg/controlplane/apiserver/config.go b/pkg/controlplane/apiserver/config.go index 2ee85df6e53..c0c720dd44b 100644 --- a/pkg/controlplane/apiserver/config.go +++ b/pkg/controlplane/apiserver/config.go @@ -152,7 +152,7 @@ func BuildGenericConfig( lastErr = fmt.Errorf("invalid authorization config: %v", err) return } - if !sets.NewString(s.Authorization.Modes...).Has(modes.ModeRBAC) { + if s.Authorization != nil && !sets.NewString(s.Authorization.Modes...).Has(modes.ModeRBAC) { genericConfig.DisabledPostStartHooks.Insert(rbacrest.PostStartHookName) } @@ -172,12 +172,15 @@ func BuildGenericConfig( return } -// BuildAuthorizer constructs the authorizer +// BuildAuthorizer constructs the authorizer. If authorization is not set in s, it returns nil, nil, nil func BuildAuthorizer(s controlplaneapiserver.CompletedOptions, EgressSelector *egressselector.EgressSelector, versionedInformers clientgoinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver, error) { authorizationConfig, err := s.Authorization.ToAuthorizationConfig(versionedInformers) if err != nil { return nil, nil, err } + if authorizationConfig == nil { + return nil, nil, nil + } if EgressSelector != nil { egressDialer, err := EgressSelector.Lookup(egressselector.ControlPlane.AsNetworkContext()) diff --git a/pkg/controlplane/apiserver/options/options.go b/pkg/controlplane/apiserver/options/options.go index d3e19ddce9c..a3a7b03442d 100644 --- a/pkg/controlplane/apiserver/options/options.go +++ b/pkg/controlplane/apiserver/options/options.go @@ -42,6 +42,8 @@ import ( "k8s.io/kubernetes/pkg/serviceaccount" ) +// Options define the flags and validation for a generic controlplane. If the +// structs are nil, the options are not added to the command line and not validated. type Options struct { GenericServerRunOptions *genericoptions.ServerRunOptions Etcd *genericoptions.EtcdOptions diff --git a/pkg/kubeapiserver/options/admission.go b/pkg/kubeapiserver/options/admission.go index 68b31cc58de..c58c2e9080a 100644 --- a/pkg/kubeapiserver/options/admission.go +++ b/pkg/kubeapiserver/options/admission.go @@ -67,6 +67,9 @@ func NewAdmissionOptions() *AdmissionOptions { // AddFlags adds flags related to admission for kube-apiserver to the specified FlagSet func (a *AdmissionOptions) AddFlags(fs *pflag.FlagSet) { + if a == nil { + return + } fs.StringSliceVar(&a.PluginNames, "admission-control", a.PluginNames, ""+ "Admission is divided into two phases. "+ "In the first phase, only mutating admission plugins run. "+ diff --git a/pkg/kubeapiserver/options/authentication.go b/pkg/kubeapiserver/options/authentication.go index fe7753ab0d1..c2582282669 100644 --- a/pkg/kubeapiserver/options/authentication.go +++ b/pkg/kubeapiserver/options/authentication.go @@ -210,6 +210,10 @@ func (o *BuiltInAuthenticationOptions) WithWebHook() *BuiltInAuthenticationOptio // Validate checks invalid config combination func (o *BuiltInAuthenticationOptions) Validate() []error { + if o == nil { + return nil + } + var allErrors []error allErrors = append(allErrors, o.validateOIDCOptions()...) @@ -270,6 +274,10 @@ func (o *BuiltInAuthenticationOptions) Validate() []error { // AddFlags returns flags of authentication for a API Server func (o *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) { + if o == nil { + return + } + fs.StringSliceVar(&o.APIAudiences, "api-audiences", o.APIAudiences, ""+ "Identifiers of the API. The service account token authenticator will validate that "+ "tokens used against the API are bound to at least one of these audiences. If the "+ @@ -416,8 +424,13 @@ func (o *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) { } } -// ToAuthenticationConfig convert BuiltInAuthenticationOptions to kubeauthenticator.Config +// ToAuthenticationConfig convert BuiltInAuthenticationOptions to kubeauthenticator.Config. Returns +// an empty config if o is nil. func (o *BuiltInAuthenticationOptions) ToAuthenticationConfig() (kubeauthenticator.Config, error) { + if o == nil { + return kubeauthenticator.Config{}, nil + } + ret := kubeauthenticator.Config{ TokenSuccessCacheTTL: o.TokenSuccessCacheTTL, TokenFailureCacheTTL: o.TokenFailureCacheTTL, diff --git a/pkg/kubeapiserver/options/authorization.go b/pkg/kubeapiserver/options/authorization.go index b9491809754..fc371cf1ae6 100644 --- a/pkg/kubeapiserver/options/authorization.go +++ b/pkg/kubeapiserver/options/authorization.go @@ -29,6 +29,7 @@ import ( authzconfig "k8s.io/apiserver/pkg/apis/apiserver" genericoptions "k8s.io/apiserver/pkg/server/options" versionedinformers "k8s.io/client-go/informers" + "k8s.io/kubernetes/pkg/kubeapiserver/authorizer" authzmodes "k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes" ) @@ -106,6 +107,10 @@ func (o *BuiltInAuthorizationOptions) Validate() []error { // AddFlags returns flags of authorization for a API Server func (o *BuiltInAuthorizationOptions) AddFlags(fs *pflag.FlagSet) { + if o == nil { + return + } + fs.StringSliceVar(&o.Modes, "authorization-mode", o.Modes, ""+ "Ordered list of plug-ins to do authorization on secure port. Comma-delimited list of: "+ strings.Join(authzmodes.AuthorizationModeChoices, ",")+".") @@ -130,14 +135,17 @@ func (o *BuiltInAuthorizationOptions) AddFlags(fs *pflag.FlagSet) { } // ToAuthorizationConfig convert BuiltInAuthorizationOptions to authorizer.Config -func (o *BuiltInAuthorizationOptions) ToAuthorizationConfig(versionedInformerFactory versionedinformers.SharedInformerFactory) (authorizer.Config, error) { +func (o *BuiltInAuthorizationOptions) ToAuthorizationConfig(versionedInformerFactory versionedinformers.SharedInformerFactory) (*authorizer.Config, error) { + if o == nil { + return nil, nil + } authzConfiguration, err := o.buildAuthorizationConfiguration() if err != nil { - return authorizer.Config{}, fmt.Errorf("failed to build authorization config: %s", err) + return nil, fmt.Errorf("failed to build authorization config: %s", err) } - return authorizer.Config{ + return &authorizer.Config{ PolicyFile: o.PolicyFile, VersionedInformerFactory: versionedInformerFactory, WebhookRetryBackoff: o.WebhookRetryBackoff, diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/api_enablement.go b/staging/src/k8s.io/apiserver/pkg/server/options/api_enablement.go index 13968b4e7d9..6ab58bab249 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/options/api_enablement.go +++ b/staging/src/k8s.io/apiserver/pkg/server/options/api_enablement.go @@ -42,6 +42,9 @@ func NewAPIEnablementOptions() *APIEnablementOptions { // AddFlags adds flags for a specific APIServer to the specified FlagSet func (s *APIEnablementOptions) AddFlags(fs *pflag.FlagSet) { + if s == nil { + return + } fs.Var(&s.RuntimeConfig, "runtime-config", ""+ "A set of key=value pairs that enable or disable built-in APIs. Supported options are:\n"+ "v1=true|false for the core API group\n"+ @@ -87,7 +90,6 @@ func (s *APIEnablementOptions) Validate(registries ...GroupRegistry) []error { // ApplyTo override MergedResourceConfig with defaults and registry func (s *APIEnablementOptions) ApplyTo(c *server.Config, defaultResourceConfig *serverstore.ResourceConfig, registry resourceconfig.GroupVersionRegistry) error { - if s == nil { return nil } diff --git a/staging/src/k8s.io/component-base/metrics/options.go b/staging/src/k8s.io/component-base/metrics/options.go index 7a59b7ba169..45aadfb99a8 100644 --- a/staging/src/k8s.io/component-base/metrics/options.go +++ b/staging/src/k8s.io/component-base/metrics/options.go @@ -40,6 +40,10 @@ func NewOptions() *Options { // Validate validates metrics flags options. func (o *Options) Validate() []error { + if o == nil { + return nil + } + var errs []error err := validateShowHiddenMetricsVersion(parseVersion(version.Get()), o.ShowHiddenMetricsForVersion) if err != nil {