github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-10-22 06:59:03 +00:00
Code Issues Projects Releases Wiki Activity

promote --service-account-api-audiences to top level kube-apiserver config

Browse Source 
The service account authenticator isn't the only authenticator that
should respect API audience. The authentication config structure should
reflect that.
This commit is contained in:
Mike Danese
2018-10-22 18:01:40 -07:00
parent 1af393d58e
commit 371b1e7fed
6 changed files with 24 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/master/master.go
View File

@@ -169,9 +169,10 @@ type ExtraConfig struct {
EndpointReconcilerType reconcilers.Type
ServiceAccountIssuer serviceaccount.TokenGenerator
ServiceAccountAPIAudiences []string
ServiceAccountMaxExpiration time.Duration
APIAudiences []string
VersionedInformers informers.SharedInformerFactory
InternalInformers internalinformers.SharedInformerFactory
}
@@ -334,8 +335,8 @@ func (c completedConfig) New(delegationTarget genericapiserver.DelegationTarget)
ServiceNodePortRange: c.ExtraConfig.ServiceNodePortRange,
LoopbackClientConfig: c.GenericConfig.LoopbackClientConfig,
ServiceAccountIssuer: c.ExtraConfig.ServiceAccountIssuer,
ServiceAccountAPIAudiences: c.ExtraConfig.ServiceAccountAPIAudiences,
ServiceAccountMaxExpiration: c.ExtraConfig.ServiceAccountMaxExpiration,
APIAudiences: c.ExtraConfig.APIAudiences,
}
m.InstallLegacyAPI(&c, c.GenericConfig.RESTOptionsGetter, legacyRESTStorageProvider)
}