github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 05:27:21 +00:00
Code Issues Projects Releases Wiki Activity

fix delegated authn client cert presentation

Browse Source
This commit is contained in:
deads2k 2016-12-09 12:23:14 -05:00
parent 79a956c197
commit bae26c2030
2 changed files with 32 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hack/local-up-discovery.sh
View File

@ -99,7 +99,7 @@ function start_discovery {
sleep 1 sleep 1
# create the "normal" api services for the core API server # create the "normal" api services for the core API server
${kubectl} --kubeconfig="${CERT_DIR}/admin-discovery.kubeconfig" create -f "${KUBE_ROOT}/cmd/kubernetes-discovery/artifacts/core-apiservices" --token="foo/system:masters" ${kubectl} --kubeconfig="${CERT_DIR}/admin-discovery.kubeconfig" create -f "${KUBE_ROOT}/cmd/kubernetes-discovery/artifacts/core-apiservices"
} }
kube::util::test_openssl_installed kube::util::test_openssl_installed

46
pkg/genericapiserver/config.go
View File

@ -312,9 +312,28 @@ func (c *Config) ApplyAuthenticationOptions(o *options.BuiltInAuthenticationOpti
return c, nil return c, nil
} }
var err error
if o.ClientCert != nil {
c, err = c.applyClientCert(o.ClientCert.ClientCA)
if err != nil {
return nil, fmt.Errorf("unable to load client CA file: %v", err)
}
}
if o.RequestHeader != nil {
c, err = c.applyClientCert(o.RequestHeader.ClientCAFile)
if err != nil {
return nil, fmt.Errorf("unable to load client CA file: %v", err)
}
}
c.SupportsBasicAuth = len(o.PasswordFile.BasicAuthFile) > 0
return c, nil
}
func (c *Config) applyClientCert(clientCAFile string) (*Config, error) {
if c.SecureServingInfo != nil { if c.SecureServingInfo != nil {
if o.ClientCert != nil && len(o.ClientCert.ClientCA) > 0 { if len(clientCAFile) > 0 {
clientCAs, err := certutil.CertsFromFile(o.ClientCert.ClientCA) clientCAs, err := certutil.CertsFromFile(clientCAFile)
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to load client CA file: %v", err) return nil, fmt.Errorf("unable to load client CA file: %v", err)
} }
@ -325,21 +344,8 @@ func (c *Config) ApplyAuthenticationOptions(o *options.BuiltInAuthenticationOpti
c.SecureServingInfo.ClientCA.AddCert(cert) c.SecureServingInfo.ClientCA.AddCert(cert)
} }
} }
if o.RequestHeader != nil && len(o.RequestHeader.ClientCAFile) > 0 {
clientCAs, err := certutil.CertsFromFile(o.RequestHeader.ClientCAFile)
if err != nil {
return nil, fmt.Errorf("unable to load requestheader client CA file: %v", err)
}
if c.SecureServingInfo.ClientCA == nil {
c.SecureServingInfo.ClientCA = x509.NewCertPool()
}
for _, cert := range clientCAs {
c.SecureServingInfo.ClientCA.AddCert(cert)
}
}
} }
c.SupportsBasicAuth = len(o.PasswordFile.BasicAuthFile) > 0
return c, nil return c, nil
} }
@ -348,6 +354,16 @@ func (c *Config) ApplyDelegatingAuthenticationOptions(o *options.DelegatingAuthe
return c, nil return c, nil
} }
var err error
c, err = c.applyClientCert(o.ClientCert.ClientCA)
if err != nil {
return nil, fmt.Errorf("unable to load client CA file: %v", err)
}
c, err = c.applyClientCert(o.RequestHeader.ClientCAFile)
if err != nil {
return nil, fmt.Errorf("unable to load client CA file: %v", err)
}
cfg, err := o.ToAuthenticationConfig() cfg, err := o.ToAuthenticationConfig()
if err != nil { if err != nil {
return nil, err return nil, err