From a5021a4ddfdfdbe86063727bcbe812ff09aa7145 Mon Sep 17 00:00:00 2001 From: Shihang Zhang Date: Mon, 26 Oct 2020 22:23:10 -0700 Subject: [PATCH] make flags of TokenRequest required --- cmd/kube-apiserver/app/options/validation.go | 2 +- pkg/kubeapiserver/options/authentication.go | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/cmd/kube-apiserver/app/options/validation.go b/cmd/kube-apiserver/app/options/validation.go index cdeb43b37f2..396a40ad3be 100644 --- a/cmd/kube-apiserver/app/options/validation.go +++ b/cmd/kube-apiserver/app/options/validation.go @@ -120,7 +120,7 @@ func validateTokenRequest(options *ServerRunOptions) []error { enableSucceeded := options.ServiceAccountIssuer != nil - if !enableAttempted && utilfeature.DefaultFeatureGate.Enabled(features.BoundServiceAccountTokenVolume) { + if !enableAttempted { errs = append(errs, errors.New("--service-account-signing-key-file and --service-account-issuer are required flags")) } diff --git a/pkg/kubeapiserver/options/authentication.go b/pkg/kubeapiserver/options/authentication.go index 910ae817493..6e05aaba7a3 100644 --- a/pkg/kubeapiserver/options/authentication.go +++ b/pkg/kubeapiserver/options/authentication.go @@ -198,19 +198,21 @@ func (o *BuiltInAuthenticationOptions) Validate() []error { allErrors = append(allErrors, fmt.Errorf("service-account-issuer contained a ':' but was not a valid URL: %v", err)) } } + if o.ServiceAccounts != nil && utilfeature.DefaultFeatureGate.Enabled(features.BoundServiceAccountTokenVolume) { if !utilfeature.DefaultFeatureGate.Enabled(features.RootCAConfigMap) { allErrors = append(allErrors, errors.New("BoundServiceAccountTokenVolume feature depends on RootCAConfigMap feature, but RootCAConfigMap features is not enabled")) } - if len(o.ServiceAccounts.Issuer) == 0 { - allErrors = append(allErrors, errors.New("service-account-issuer is a required flag when BoundServiceAccountTokenVolume is enabled")) - } - if len(o.ServiceAccounts.KeyFiles) == 0 { - allErrors = append(allErrors, errors.New("service-account-key-file is a required flag when BoundServiceAccountTokenVolume is enabled")) - } } if o.ServiceAccounts != nil { + if len(o.ServiceAccounts.Issuer) == 0 { + allErrors = append(allErrors, errors.New("service-account-issuer is a required flag")) + } + if len(o.ServiceAccounts.KeyFiles) == 0 { + allErrors = append(allErrors, errors.New("service-account-key-file is a required flag")) + } + if utilfeature.DefaultFeatureGate.Enabled(features.ServiceAccountIssuerDiscovery) { // Validate the JWKS URI when it is explicitly set. // When unset, it is later derived from ExternalHost.