From 6686d8b846546f682d1a449cc9cd0e3c0de977b4 Mon Sep 17 00:00:00 2001 From: Monis Khan Date: Tue, 9 Mar 2021 22:53:04 -0500 Subject: [PATCH] delegated authn: allow client CA override based on non-empty opts Signed-off-by: Monis Khan --- .../k8s.io/apiserver/pkg/server/options/authentication.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/authentication.go b/staging/src/k8s.io/apiserver/pkg/server/options/authentication.go index 46130aad4e9..47476422b20 100644 --- a/staging/src/k8s.io/apiserver/pkg/server/options/authentication.go +++ b/staging/src/k8s.io/apiserver/pkg/server/options/authentication.go @@ -290,16 +290,16 @@ func (s *DelegatingAuthenticationOptions) ApplyTo(authenticationInfo *server.Aut } // get the clientCA information - clientCAFileSpecified := len(s.ClientCert.ClientCA) > 0 + clientCASpecified := s.ClientCert != ClientCertAuthenticationOptions{} var clientCAProvider dynamiccertificates.CAContentProvider - if clientCAFileSpecified { + if clientCASpecified { clientCAProvider, err = s.ClientCert.GetClientCAContentProvider() if err != nil { - return fmt.Errorf("unable to load client CA file %q: %v", s.ClientCert.ClientCA, err) + return fmt.Errorf("unable to load client CA provider: %v", err) } cfg.ClientCertificateCAContentProvider = clientCAProvider if err = authenticationInfo.ApplyClientCert(cfg.ClientCertificateCAContentProvider, servingInfo); err != nil { - return fmt.Errorf("unable to assign client CA file: %v", err) + return fmt.Errorf("unable to assign client CA provider: %v", err) } } else if !s.SkipInClusterLookup {