github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-26 13:07:07 +00:00
Code Issues Projects Releases Wiki Activity

Switched ANP w/ grpc to not use destHost strategy.

Browse Source 
Factored in feedback from caesarxuchao
This commit is contained in:
Walter Fender 2021-09-16 09:32:52 -07:00
parent f7185b0be1
commit 35737ff810
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
cluster/gce/gci/configure-helper.sh
View File

@ -737,9 +737,6 @@ function create-master-pki {
if [[ -n "${KONNECTIVITY_SERVER_CA_CERT:-}" ]]; then
mkdir -p "${pki_dir}"/konnectivity-server
#KONNECTIVITY_SERVER_CA_KEY_PATH="${pki_dir}/konnectivity-server/ca.key"
#write-pki-data "${KONNECTIVITY_SERVER_CA_KEY}" "${KONNECTIVITY_SERVER_CA_KEY_PATH}"
KONNECTIVITY_SERVER_CA_CERT_PATH="${pki_dir}/konnectivity-server/ca.crt"
write-pki-data "${KONNECTIVITY_SERVER_CA_CERT}" "${KONNECTIVITY_SERVER_CA_CERT_PATH}"
@ -1996,6 +1993,8 @@ function prepare-konnectivity-server-manifest {
if [[ "${KONNECTIVITY_SERVICE_PROXY_PROTOCOL_MODE:-grpc}" == 'grpc' ]]; then
params+=("--uds-name=/etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket")
elif [[ "${KONNECTIVITY_SERVICE_PROXY_PROTOCOL_MODE:-grpc}" == 'http-connect' ]]; then
# HTTP-CONNECT can work with either UDS or mTLS.
# Linking them here to make sure we get good coverage with two test configurations.
params+=("--server-ca-cert=${KONNECTIVITY_SERVER_CA_CERT_PATH}")
params+=("--server-cert=${KONNECTIVITY_SERVER_CERT_PATH}")
params+=("--server-key=${KONNECTIVITY_SERVER_KEY_PATH}")
@ -2010,7 +2009,9 @@ function prepare-konnectivity-server-manifest {
params+=("--agent-service-account=konnectivity-agent")
params+=("--authentication-audience=system:konnectivity-server")
params+=("--kubeconfig=/etc/srv/kubernetes/konnectivity-server/kubeconfig")
params+=("--proxy-strategies=default")
elif [[ "${KONNECTIVITY_SERVICE_PROXY_PROTOCOL_MODE:-grpc}" == 'http-connect' ]]; then
# GRPC can work with either UDS or mTLS.
params+=("--mode=http-connect")
params+=("--server-port=8131")
params+=("--agent-namespace=")
@ -2018,6 +2019,7 @@ function prepare-konnectivity-server-manifest {
params+=("--authentication-audience=")
# Need to fix ANP code to allow kubeconfig to be set with mtls.
params+=("--kubeconfig=")
params+=("--proxy-strategies=destHost,default")
else
echo "KONNECTIVITY_SERVICE_PROXY_PROTOCOL_MODE must be set to either grpc or http-connect"
exit 1
@ -2030,7 +2032,6 @@ function prepare-konnectivity-server-manifest {
params+=("--kubeconfig-burst=150")
params+=("--keepalive-time=60s")
params+=("--frontend-keepalive-time=60s")
params+=("--proxy-strategies=destHost,default")
konnectivity_args=""
for param in "${params[@]}"; do
konnectivity_args+=", \"${param}\""