github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-29 13:24:42 +00:00
Code Issues Projects Releases Wiki Activity

Pass the CA root cert into the apiserver so that the apiserver will

Browse Source 
perform client cert checks for authorization. Only enable on GCE where
the apiserver is terminating SSL connections from end users.
This commit is contained in:
Robert Bailey 2015-04-24 13:06:16 -07:00
parent c3ce410cb0
commit 846ffcff83
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest
View File

@ -43,10 +43,12 @@
{% set cert_file = "--tls_cert_file=/srv/kubernetes/server.cert" -%} {% set cert_file = "--tls_cert_file=/srv/kubernetes/server.cert" -%}
{% set key_file = "--tls_private_key_file=/srv/kubernetes/server.key" -%} {% set key_file = "--tls_private_key_file=/srv/kubernetes/server.key" -%}
{% set client_ca_file = "--client_ca_file=/dev/null" -%}
{% set secure_port = "6443" -%} {% set secure_port = "6443" -%}
{% if grains['cloud'] is defined and grains['cloud'] == 'gce' %} {% if grains['cloud'] is defined and grains['cloud'] == 'gce' %}
{% set secure_port = "443" -%} {% set secure_port = "443" -%}
{% set client_ca_file = "--client_ca_file=/srv/kubernetes/ca.crt" -%}
{% endif -%} {% endif -%}
{% set token_auth_file = "--token_auth_file=/dev/null" -%} {% set token_auth_file = "--token_auth_file=/dev/null" -%}
@ -92,6 +94,7 @@
"{{key_file}}", "{{key_file}}",
"--secure_port={{secure_port}}", "--secure_port={{secure_port}}",
"{{token_auth_file}}", "{{token_auth_file}}",
"{{client_ca_file}}",
"{{publicAddressOverride}}", "{{publicAddressOverride}}",
"{{pillar['log_level']}}" "{{pillar['log_level']}}"
], ],