From 3d7aeb480c22edae8d89159af1af0d034de75f1e Mon Sep 17 00:00:00 2001 From: Mike Danese Date: Fri, 3 Feb 2017 13:15:25 -0800 Subject: [PATCH] only use a kubelet client cert auth if it's available TODO(mikedanese): revert this commit --- cluster/gce/gci/configure-helper.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/cluster/gce/gci/configure-helper.sh b/cluster/gce/gci/configure-helper.sh index 82bcfd5f424..3bd19735dc2 100644 --- a/cluster/gce/gci/configure-helper.sh +++ b/cluster/gce/gci/configure-helper.sh @@ -821,8 +821,10 @@ function start-kube-apiserver { params+=" --secure-port=443" params+=" --tls-cert-file=/etc/srv/kubernetes/server.cert" params+=" --tls-private-key-file=/etc/srv/kubernetes/server.key" - params+=" --kubelet-client-certificate=/etc/srv/kubernetes/kubeapiserver.cert" - params+=" --kubelet-client-key=/etc/srv/kubernetes/kubeapiserver.key" + if [[ -e /etc/srv/kubernetes/kubeapiserver.cert ]] && [[ -e /etc/srv/kubernetes/kubeapiserver.key ]]; then + params+=" --kubelet-client-certificate=/etc/srv/kubernetes/kubeapiserver.cert" + params+=" --kubelet-client-key=/etc/srv/kubernetes/kubeapiserver.key" + fi params+=" --token-auth-file=/etc/srv/kubernetes/known_tokens.csv" if [[ -n "${KUBE_PASSWORD:-}" && -n "${KUBE_USER:-}" ]]; then params+=" --basic-auth-file=/etc/srv/kubernetes/basic_auth.csv"