mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-23 11:50:44 +00:00
Resolve uncompatibility from update: etcd CAFile -> TrustedCAFIle
This commit is contained in:
parent
3b274fad2a
commit
9ead9373f3
@ -149,7 +149,7 @@ func TestAddFlags(t *testing.T) {
|
||||
Transport: storagebackend.TransportConfig{
|
||||
ServerList: nil,
|
||||
KeyFile: "/var/run/kubernetes/etcd.key",
|
||||
CAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
CertFile: "/var/run/kubernetes/etcdce.crt",
|
||||
},
|
||||
Paging: true,
|
||||
|
@ -28,8 +28,8 @@ import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"go.etcd.io/etcd/pkg/transport"
|
||||
"github.com/pkg/errors"
|
||||
"go.etcd.io/etcd/pkg/transport"
|
||||
|
||||
"k8s.io/client-go/tools/clientcmd"
|
||||
certutil "k8s.io/client-go/util/cert"
|
||||
|
@ -26,9 +26,9 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
"go.etcd.io/etcd/clientv3"
|
||||
"go.etcd.io/etcd/pkg/transport"
|
||||
"github.com/pkg/errors"
|
||||
"google.golang.org/grpc"
|
||||
"k8s.io/apimachinery/pkg/util/wait"
|
||||
clientset "k8s.io/client-go/kubernetes"
|
||||
|
@ -142,7 +142,7 @@ func TestInvalidObjectMetaInStorage(t *testing.T) {
|
||||
tlsInfo := transport.TLSInfo{
|
||||
CertFile: restOptions.StorageConfig.Transport.CertFile,
|
||||
KeyFile: restOptions.StorageConfig.Transport.KeyFile,
|
||||
CAFile: restOptions.StorageConfig.Transport.CAFile,
|
||||
TrustedCAFile: restOptions.StorageConfig.Transport.TrustedCAFile,
|
||||
}
|
||||
tlsConfig, err := tlsInfo.ClientConfig()
|
||||
if err != nil {
|
||||
|
@ -326,7 +326,7 @@ func TestPruningFromStorage(t *testing.T) {
|
||||
tlsInfo := transport.TLSInfo{
|
||||
CertFile: restOptions.StorageConfig.Transport.CertFile,
|
||||
KeyFile: restOptions.StorageConfig.Transport.KeyFile,
|
||||
CAFile: restOptions.StorageConfig.Transport.CAFile,
|
||||
TrustedCAFile: restOptions.StorageConfig.Transport.TrustedCAFile,
|
||||
}
|
||||
tlsConfig, err := tlsInfo.ClientConfig()
|
||||
if err != nil {
|
||||
|
@ -104,7 +104,7 @@ func GetEtcdClients(config storagebackend.TransportConfig) (*clientv3.Client, cl
|
||||
tlsInfo := transport.TLSInfo{
|
||||
CertFile: config.CertFile,
|
||||
KeyFile: config.KeyFile,
|
||||
CAFile: config.CAFile,
|
||||
TrustedCAFile: config.TrustedCAFile,
|
||||
}
|
||||
|
||||
tlsConfig, err := tlsInfo.ClientConfig()
|
||||
|
@ -161,7 +161,7 @@ func (s *EtcdOptions) AddFlags(fs *pflag.FlagSet) {
|
||||
fs.StringVar(&s.StorageConfig.Transport.CertFile, "etcd-certfile", s.StorageConfig.Transport.CertFile,
|
||||
"SSL certification file used to secure etcd communication.")
|
||||
|
||||
fs.StringVar(&s.StorageConfig.Transport.CAFile, "etcd-cafile", s.StorageConfig.Transport.CAFile,
|
||||
fs.StringVar(&s.StorageConfig.Transport.TrustedCAFile, "etcd-cafile", s.StorageConfig.Transport.TrustedCAFile,
|
||||
"SSL Certificate Authority file used to secure etcd communication.")
|
||||
|
||||
fs.StringVar(&s.EncryptionProviderConfigFilepath, "experimental-encryption-provider-config", s.EncryptionProviderConfigFilepath,
|
||||
|
@ -42,7 +42,7 @@ func TestEtcdOptionsValidate(t *testing.T) {
|
||||
Transport: storagebackend.TransportConfig{
|
||||
ServerList: nil,
|
||||
KeyFile: "/var/run/kubernetes/etcd.key",
|
||||
CAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
CertFile: "/var/run/kubernetes/etcdce.crt",
|
||||
},
|
||||
CompactionInterval: storagebackend.DefaultCompactInterval,
|
||||
@ -66,7 +66,7 @@ func TestEtcdOptionsValidate(t *testing.T) {
|
||||
Transport: storagebackend.TransportConfig{
|
||||
ServerList: []string{"http://127.0.0.1"},
|
||||
KeyFile: "/var/run/kubernetes/etcd.key",
|
||||
CAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
CertFile: "/var/run/kubernetes/etcdce.crt",
|
||||
},
|
||||
CompactionInterval: storagebackend.DefaultCompactInterval,
|
||||
@ -89,7 +89,7 @@ func TestEtcdOptionsValidate(t *testing.T) {
|
||||
Transport: storagebackend.TransportConfig{
|
||||
ServerList: []string{"http://127.0.0.1"},
|
||||
KeyFile: "/var/run/kubernetes/etcd.key",
|
||||
CAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
CertFile: "/var/run/kubernetes/etcdce.crt",
|
||||
},
|
||||
Prefix: "/registry",
|
||||
@ -114,7 +114,7 @@ func TestEtcdOptionsValidate(t *testing.T) {
|
||||
Transport: storagebackend.TransportConfig{
|
||||
ServerList: []string{"http://127.0.0.1"},
|
||||
KeyFile: "/var/run/kubernetes/etcd.key",
|
||||
CAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
|
||||
CertFile: "/var/run/kubernetes/etcdce.crt",
|
||||
},
|
||||
CompactionInterval: storagebackend.DefaultCompactInterval,
|
||||
|
@ -307,8 +307,8 @@ func (s *DefaultStorageFactory) Backends() []Backend {
|
||||
tlsConfig.Certificates = []tls.Certificate{cert}
|
||||
}
|
||||
}
|
||||
if len(s.StorageConfig.Transport.CAFile) > 0 {
|
||||
if caCert, err := ioutil.ReadFile(s.StorageConfig.Transport.CAFile); err != nil {
|
||||
if len(s.StorageConfig.Transport.TrustedCAFile) > 0 {
|
||||
if caCert, err := ioutil.ReadFile(s.StorageConfig.Transport.TrustedCAFile); err != nil {
|
||||
klog.Errorf("failed to read ca file while getting backends: %s", err)
|
||||
} else {
|
||||
caPool := x509.NewCertPool()
|
||||
|
@ -17,10 +17,10 @@ limitations under the License.
|
||||
package etcd3
|
||||
|
||||
import (
|
||||
"go.etcd.io/etcd/clientv3"
|
||||
"go.etcd.io/etcd/mvcc/mvccpb"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.etcd.io/etcd/clientv3"
|
||||
"go.etcd.io/etcd/mvcc/mvccpb"
|
||||
"testing"
|
||||
)
|
||||
|
||||
|
@ -29,9 +29,9 @@ import (
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/coreos/pkg/capnslog"
|
||||
"go.etcd.io/etcd/clientv3"
|
||||
"go.etcd.io/etcd/integration"
|
||||
"github.com/coreos/pkg/capnslog"
|
||||
apitesting "k8s.io/apimachinery/pkg/api/apitesting"
|
||||
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
|
@ -26,6 +26,7 @@ go_library(
|
||||
"//vendor/github.com/coreos/etcd/pkg/testutil:go_default_library",
|
||||
"//vendor/github.com/coreos/etcd/pkg/transport:go_default_library",
|
||||
"//vendor/github.com/coreos/etcd/pkg/types:go_default_library",
|
||||
"//vendor/go.uber.org/zap:go_default_library",
|
||||
"//vendor/k8s.io/klog:go_default_library",
|
||||
],
|
||||
)
|
||||
|
@ -42,6 +42,7 @@ import (
|
||||
"go.etcd.io/etcd/pkg/testutil"
|
||||
"go.etcd.io/etcd/pkg/transport"
|
||||
"go.etcd.io/etcd/pkg/types"
|
||||
"go.uber.org/zap"
|
||||
"k8s.io/klog"
|
||||
)
|
||||
|
||||
@ -87,7 +88,7 @@ func newSecuredLocalListener(t *testing.T, certFile, keyFile, caFile string) net
|
||||
tlsInfo := transport.TLSInfo{
|
||||
CertFile: certFile,
|
||||
KeyFile: keyFile,
|
||||
CAFile: caFile,
|
||||
TrustedCAFile: caFile,
|
||||
}
|
||||
tlscfg, err := tlsInfo.ServerConfig()
|
||||
if err != nil {
|
||||
@ -105,7 +106,7 @@ func newHTTPTransport(t *testing.T, certFile, keyFile, caFile string) etcd.Cance
|
||||
tlsInfo := transport.TLSInfo{
|
||||
CertFile: certFile,
|
||||
KeyFile: keyFile,
|
||||
CAFile: caFile,
|
||||
TrustedCAFile: caFile,
|
||||
}
|
||||
tr, err := transport.NewTransport(tlsInfo, time.Second)
|
||||
if err != nil {
|
||||
@ -194,7 +195,7 @@ func (m *EtcdTestServer) launch(t *testing.T) error {
|
||||
}
|
||||
m.s.SyncTicker = time.NewTicker(500 * time.Millisecond)
|
||||
m.s.Start()
|
||||
m.raftHandler = &testutil.PauseableHandler{Next: etcdhttp.NewPeerHandler(m.s)}
|
||||
m.raftHandler = &testutil.PauseableHandler{Next: etcdhttp.NewPeerHandler(zap.NewExample(), m.s)}
|
||||
for _, ln := range m.PeerListeners {
|
||||
hs := &httptest.Server{
|
||||
Listener: ln,
|
||||
@ -206,7 +207,7 @@ func (m *EtcdTestServer) launch(t *testing.T) error {
|
||||
for _, ln := range m.ClientListeners {
|
||||
hs := &httptest.Server{
|
||||
Listener: ln,
|
||||
Config: &http.Server{Handler: v2http.NewClientHandler(m.s, m.ServerConfig.ReqTimeout())},
|
||||
Config: &http.Server{Handler: v2http.NewClientHandler(zap.NewExample(), m.s, m.ServerConfig.ReqTimeout())},
|
||||
}
|
||||
hs.Start()
|
||||
m.hss = append(m.hss, hs)
|
||||
|
@ -38,7 +38,7 @@ type TransportConfig struct {
|
||||
// TLS credentials
|
||||
KeyFile string
|
||||
CertFile string
|
||||
CAFile string
|
||||
TrustedCAFile string
|
||||
// function to determine the egress dialer. (i.e. konnectivity server dialer)
|
||||
EgressLookup egressselector.Lookup
|
||||
}
|
||||
|
@ -26,9 +26,9 @@ import (
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
grpcprom "github.com/grpc-ecosystem/go-grpc-prometheus"
|
||||
"go.etcd.io/etcd/clientv3"
|
||||
"go.etcd.io/etcd/pkg/transport"
|
||||
grpcprom "github.com/grpc-ecosystem/go-grpc-prometheus"
|
||||
"google.golang.org/grpc"
|
||||
|
||||
utilnet "k8s.io/apimachinery/pkg/util/net"
|
||||
@ -99,7 +99,7 @@ func newETCD3Client(c storagebackend.TransportConfig) (*clientv3.Client, error)
|
||||
tlsInfo := transport.TLSInfo{
|
||||
CertFile: c.CertFile,
|
||||
KeyFile: c.KeyFile,
|
||||
CAFile: c.CAFile,
|
||||
TrustedCAFile: c.TrustedCAFile,
|
||||
}
|
||||
tlsConfig, err := tlsInfo.ClientConfig()
|
||||
if err != nil {
|
||||
@ -107,7 +107,7 @@ func newETCD3Client(c storagebackend.TransportConfig) (*clientv3.Client, error)
|
||||
}
|
||||
// NOTE: Client relies on nil tlsConfig
|
||||
// for non-secure connections, update the implicit variable
|
||||
if len(c.CertFile) == 0 && len(c.KeyFile) == 0 && len(c.CAFile) == 0 {
|
||||
if len(c.CertFile) == 0 && len(c.KeyFile) == 0 && len(c.TrustedCAFile) == 0 {
|
||||
tlsConfig = nil
|
||||
}
|
||||
networkContext := egressselector.Etcd.AsNetworkContext()
|
||||
|
@ -56,7 +56,7 @@ func TestTLSConnection(t *testing.T) {
|
||||
tlsInfo := &transport.TLSInfo{
|
||||
CertFile: certFile,
|
||||
KeyFile: keyFile,
|
||||
CAFile: caFile,
|
||||
TrustedCAFile: caFile,
|
||||
}
|
||||
|
||||
cluster := integration.NewClusterV3(t, &integration.ClusterConfig{
|
||||
@ -71,7 +71,7 @@ func TestTLSConnection(t *testing.T) {
|
||||
ServerList: []string{cluster.Members[0].GRPCAddr()},
|
||||
CertFile: certFile,
|
||||
KeyFile: keyFile,
|
||||
CAFile: caFile,
|
||||
TrustedCAFile: caFile,
|
||||
},
|
||||
Codec: codec,
|
||||
}
|
||||
|
@ -43,7 +43,7 @@ func init() {
|
||||
// Deprecated: Please note the issues described in the doc comment of
|
||||
// InstrumentHandler. You might want to consider using promhttp.Handler instead.
|
||||
func Handler() http.Handler {
|
||||
return prometheus.InstrumentHandler("prometheus", promhttp.HandlerFor(defaultRegistry, promhttp.HandlerOpts{}))
|
||||
return promhttp.InstrumentMetricHandler(prometheus.DefaultRegisterer, promhttp.HandlerFor(defaultRegistry, promhttp.HandlerOpts{}))
|
||||
}
|
||||
|
||||
// Register registers a collectable metric but uses the global registry
|
||||
|
@ -22,8 +22,8 @@ import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
_ "go.etcd.io/etcd/etcdserver/api/v3rpc" // Force package logger init.
|
||||
"github.com/coreos/pkg/capnslog"
|
||||
_ "go.etcd.io/etcd/etcdserver/api/v3rpc" // Force package logger init.
|
||||
|
||||
appsv1 "k8s.io/api/apps/v1"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
|
@ -74,7 +74,7 @@ func GetEtcdClients(config storagebackend.TransportConfig) (*clientv3.Client, cl
|
||||
tlsInfo := transport.TLSInfo{
|
||||
CertFile: config.CertFile,
|
||||
KeyFile: config.KeyFile,
|
||||
CAFile: config.CAFile,
|
||||
TrustedCAFile: config.TrustedCAFile,
|
||||
}
|
||||
|
||||
tlsConfig, err := tlsInfo.ClientConfig()
|
||||
|
Loading…
Reference in New Issue
Block a user