From 5b74f3d8adb14d199ec4b5d258a899dec545ebb7 Mon Sep 17 00:00:00 2001 From: SataQiu Date: Wed, 24 Apr 2019 22:05:10 +0800 Subject: [PATCH] fix kubelet config bug for kubeadm init phase --- cmd/kubeadm/app/componentconfigs/defaults.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cmd/kubeadm/app/componentconfigs/defaults.go b/cmd/kubeadm/app/componentconfigs/defaults.go index 7920ab66a9a..320f7bdd20f 100644 --- a/cmd/kubeadm/app/componentconfigs/defaults.go +++ b/cmd/kubeadm/app/componentconfigs/defaults.go @@ -17,6 +17,8 @@ limitations under the License. package componentconfigs import ( + "path/filepath" + kubeproxyconfigv1alpha1 "k8s.io/kube-proxy/config/v1alpha1" kubeletconfigv1beta1 "k8s.io/kubelet/config/v1beta1" kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm" @@ -88,7 +90,7 @@ func DefaultKubeletConfiguration(internalcfg *kubeadmapi.ClusterConfiguration) { // Enforce security-related kubelet options // Require all clients to the kubelet API to have client certs signed by the cluster CA - externalkubeletcfg.Authentication.X509.ClientCAFile = kubeadmapiv1beta1.DefaultCACertPath + externalkubeletcfg.Authentication.X509.ClientCAFile = filepath.Join(internalcfg.CertificatesDir, constants.CACertName) externalkubeletcfg.Authentication.Anonymous.Enabled = utilpointer.BoolPtr(false) // On every client request to the kubelet API, execute a webhook (SubjectAccessReview request) to the API server