From db828a44406efe09e2db91e6dc88d1292c9a29e1 Mon Sep 17 00:00:00 2001 From: Tripathi Date: Wed, 18 Jul 2018 15:07:09 -0700 Subject: [PATCH] Support pulling requestheader CA from extension-apiserver-authentication ConfigMap without client CA This commit prevents extension API server from erroring out during bootstrap when the core API server doesn't support certificate based authentication for it's clients i.e. client-ca isn't present in extension-apiserver-authentication ConfigMap in kube-system. This can happen in cluster setups where core API server uses Webhook token authentication. Fixes: https://github.com/kubernetes/kubernetes/issues/65724 --- .../pkg/server/options/authentication.go | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/authentication.go b/staging/src/k8s.io/apiserver/pkg/server/options/authentication.go index ea795ba5a08..2dd8cda3893 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/options/authentication.go +++ b/staging/src/k8s.io/apiserver/pkg/server/options/authentication.go @@ -160,7 +160,11 @@ func (s *DelegatingAuthenticationOptions) ApplyTo(c *server.AuthenticationInfo, clientCA, err := s.getClientCA() if err != nil { - return err + if _, ignorable := err.(ignorableError); !ignorable { + return err + } else { + glog.Warning(err) + } } if err = c.ApplyClientCert(clientCA.ClientCA, servingInfo); err != nil { return fmt.Errorf("unable to load client CA file: %v", err) @@ -200,7 +204,11 @@ func (s *DelegatingAuthenticationOptions) ToAuthenticationConfig() (authenticato clientCA, err := s.getClientCA() if err != nil { - return authenticatorfactory.DelegatingAuthenticatorConfig{}, err + if _, ignorable := err.(ignorableError); !ignorable { + return authenticatorfactory.DelegatingAuthenticatorConfig{}, err + } else { + glog.Warning(err) + } } requestHeader, err := s.getRequestHeader() if err != nil { @@ -240,7 +248,7 @@ func (s *DelegatingAuthenticationOptions) getClientCA() (*ClientCertAuthenticati return nil, err } if incluster == nil { - return nil, fmt.Errorf("cluster doesn't provide client-ca-file") + return &s.ClientCert, ignorableError{fmt.Errorf("cluster doesn't provide client-ca-file in configmap/%s in %s, so client certificate authentication to extension api-server won't work.", authenticationConfigMapName, authenticationConfigMapNamespace)} } return incluster, nil } @@ -394,3 +402,5 @@ func (s *DelegatingAuthenticationOptions) newTokenAccessReview() (authentication return client.TokenReviews(), nil } + +type ignorableError struct{ error }