github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 21:47:07 +00:00
Code Issues Projects Releases Wiki Activity

Set connrotation dialer via restclient.Config.Dialer

Browse Source 
Instead of Transport. This fixes ExecPlugin, which fails if
restclient.Config.Transport is set.
This commit is contained in:
Andrew Lytvynov 2018-07-25 16:22:32 -07:00
parent afcc156806
commit 3357b5ecf4
2 changed files with 66 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
pkg/kubelet/certificate/transport.go
View File

@ -65,15 +65,26 @@ func updateTransport(stopCh <-chan struct{}, period time.Duration, clientConfig
d := connrotation.NewDialer((&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext) d := connrotation.NewDialer((&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext)
if clientCertificateManager != nil {
if err := addCertRotation(stopCh, period, clientConfig, clientCertificateManager, exitAfter, d); err != nil {
return nil, err
}
} else {
clientConfig.Dial = d.DialContext
}
return d.CloseAll, nil
}
func addCertRotation(stopCh <-chan struct{}, period time.Duration, clientConfig *restclient.Config, clientCertificateManager certificate.Manager, exitAfter time.Duration, d *connrotation.Dialer) error {
tlsConfig, err := restclient.TLSConfigFor(clientConfig) tlsConfig, err := restclient.TLSConfigFor(clientConfig)
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to configure TLS for the rest client: %v", err) return fmt.Errorf("unable to configure TLS for the rest client: %v", err)
} }
if tlsConfig == nil { if tlsConfig == nil {
tlsConfig = &tls.Config{} tlsConfig = &tls.Config{}
} }
if clientCertificateManager != nil {
tlsConfig.Certificates = nil tlsConfig.Certificates = nil
tlsConfig.GetClientCertificate = func(requestInfo *tls.CertificateRequestInfo) (*tls.Certificate, error) { tlsConfig.GetClientCertificate = func(requestInfo *tls.CertificateRequestInfo) (*tls.Certificate, error) {
cert := clientCertificateManager.Current() cert := clientCertificateManager.Current()
@ -125,14 +136,13 @@ func updateTransport(stopCh <-chan struct{}, period time.Duration, clientConfig
// See: https://github.com/kubernetes-incubator/bootkube/pull/663#issuecomment-318506493 // See: https://github.com/kubernetes-incubator/bootkube/pull/663#issuecomment-318506493
d.CloseAll() d.CloseAll()
}, period, stopCh) }, period, stopCh)
}
clientConfig.Transport = utilnet.SetTransportDefaults(&http.Transport{ clientConfig.Transport = utilnet.SetTransportDefaults(&http.Transport{
Proxy: http.ProxyFromEnvironment, Proxy: http.ProxyFromEnvironment,
TLSHandshakeTimeout: 10 * time.Second, TLSHandshakeTimeout: 10 * time.Second,
TLSClientConfig: tlsConfig, TLSClientConfig: tlsConfig,
MaxIdleConnsPerHost: 25, MaxIdleConnsPerHost: 25,
DialContext: d.DialContext, // Use custom dialer. DialContext: d.DialContext,
}) })
// Zero out all existing TLS options since our new transport enforces them. // Zero out all existing TLS options since our new transport enforces them.
@ -144,5 +154,5 @@ func updateTransport(stopCh <-chan struct{}, period time.Duration, clientConfig
clientConfig.CAFile = "" clientConfig.CAFile = ""
clientConfig.Insecure = false clientConfig.Insecure = false
return d.CloseAll, nil return nil
} }

18
staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go
View File

@ -20,6 +20,7 @@ import (
"bytes" "bytes"
"context" "context"
"crypto/tls" "crypto/tls"
"errors"
"fmt" "fmt"
"io" "io"
"net" "net"
@ -179,21 +180,10 @@ func (a *Authenticator) UpdateTransportConfig(c *transport.Config) error {
return &roundTripper{a, rt} return &roundTripper{a, rt}
} }
getCert := c.TLS.GetCert if c.TLS.GetCert != nil {
c.TLS.GetCert = func() (*tls.Certificate, error) { return errors.New("can't add TLS certificate callback: transport.Config.TLS.GetCert already set")
// If previous GetCert is present and returns a valid non-nil
// certificate, use that. Otherwise use cert from exec plugin.
if getCert != nil {
cert, err := getCert()
if err != nil {
return nil, err
}
if cert != nil {
return cert, nil
}
}
return a.cert()
} }
c.TLS.GetCert = a.cert
var dial func(ctx context.Context, network, addr string) (net.Conn, error) var dial func(ctx context.Context, network, addr string) (net.Conn, error)
if c.Dial != nil { if c.Dial != nil {