github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-22 11:21:47 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #84744 from immutableT/isolate-etcd-config

Browse Source 
Isolate configuration of etcd related parameters into a separate function.
This commit is contained in:
Kubernetes Prow Robot 2019-11-05 15:31:29 -08:00 committed by GitHub
commit c7869131dd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 172 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

138
cluster/gce/gci/apiserver_etcd_test.go
View File

@ -22,17 +22,132 @@ import (
)
type kubeAPIServeETCDEnv struct {
KubeHome string
ETCDServers string
CAKey string
CACert string
CACertPath string
APIServerKey string
APIServerCert string
APIServerCertPath string
APIServerKeyPath string
ETCDKey string
ETCDCert string
KubeHome string
ETCDServers string
ETCDServersOverride string
CAKey string
CACert string
CACertPath string
APIServerKey string
APIServerCert string
APIServerCertPath string
APIServerKeyPath string
ETCDKey string
ETCDCert string
StorageBackend string
StorageMediaType string
CompactionInterval string
}
func TestServerOverride(t *testing.T) {
testCases := []struct {
desc string
env kubeAPIServeETCDEnv
want []string
}{
{
desc: "ETCD-SERVERS is not set - default override",
want: []string{
"--etcd-servers-overrides=/events#http://127.0.0.1:4002",
},
},
{
desc: "ETCD-SERVERS and ETCD_SERVERS_OVERRIDES iare set",
env: kubeAPIServeETCDEnv{
ETCDServers: "ETCDServers",
ETCDServersOverride: "ETCDServersOverrides",
},
want: []string{
"--etcd-servers-overrides=ETCDServersOverrides",
},
},
}
for _, tc := range testCases {
t.Run(tc.desc, func(t *testing.T) {
c := newManifestTestCase(t, kubeAPIServerManifestFileName, kubeAPIServerStartFuncName, nil)
defer c.tearDown()
tc.env.KubeHome = c.kubeHome
c.mustInvokeFunc(
tc.env,
kubeAPIServerConfigScriptName,
"etcd.template",
"testdata/kube-apiserver/base.template",
"testdata/kube-apiserver/etcd.template",
)
c.mustLoadPodFromManifest()
execArgs := c.pod.Spec.Containers[0].Command[2]
for _, f := range tc.want {
if !strings.Contains(execArgs, f) {
t.Fatalf("Got %q, want it to contain %q", execArgs, f)
}
}
})
}
}
func TestStorageOptions(t *testing.T) {
testCases := []struct {
desc string
env kubeAPIServeETCDEnv
want []string
dontWant []string
}{
{
desc: "storage options are supplied",
env: kubeAPIServeETCDEnv{
StorageBackend: "StorageBackend",
StorageMediaType: "StorageMediaType",
CompactionInterval: "1s",
},
want: []string{
"--storage-backend=StorageBackend",
"--storage-media-type=StorageMediaType",
"--etcd-compaction-interval=1s",
},
},
{
desc: "storage options not not supplied",
env: kubeAPIServeETCDEnv{},
dontWant: []string{
"--storage-backend",
"--storage-media-type",
"--etcd-compaction-interval",
},
},
}
for _, tc := range testCases {
t.Run(tc.desc, func(t *testing.T) {
c := newManifestTestCase(t, kubeAPIServerManifestFileName, kubeAPIServerStartFuncName, nil)
defer c.tearDown()
tc.env.KubeHome = c.kubeHome
c.mustInvokeFunc(
tc.env,
kubeAPIServerConfigScriptName,
"etcd.template",
"testdata/kube-apiserver/base.template",
"testdata/kube-apiserver/etcd.template",
)
c.mustLoadPodFromManifest()
execArgs := c.pod.Spec.Containers[0].Command[2]
for _, f := range tc.want {
if !strings.Contains(execArgs, f) {
t.Fatalf("Got %q, want it to contain %q", execArgs, f)
}
}
for _, f := range tc.dontWant {
if strings.Contains(execArgs, f) {
t.Fatalf("Got %q, but it was not expected it to contain %q", execArgs, f)
}
}
})
}
}
func TestTLSFlags(t *testing.T) {
@ -89,7 +204,6 @@ func TestTLSFlags(t *testing.T) {
t.Fatalf("Got %q, want it to contain %q", execArgs, f)
}
}
})
}
}

69
cluster/gce/gci/configure-kubeapiserver.sh
View File

@ -13,6 +13,43 @@
# See the License for the specific language governing permissions and
# limitations under the License.
# Configures etcd related flags of kube-apiserver.
function configure-etcd-params {
local -n params_ref=$1
if [[ -n "${ETCD_APISERVER_CA_KEY:-}" && -n "${ETCD_APISERVER_CA_CERT:-}" && -n "${ETCD_APISERVER_SERVER_KEY:-}" && -n "${ETCD_APISERVER_SERVER_CERT:-}" && -n "${ETCD_APISERVER_CLIENT_KEY:-}" && -n "${ETCD_APISERVER_CLIENT_CERT:-}" ]]; then
params_ref+=" --etcd-servers=${ETCD_SERVERS:-https://127.0.0.1:2379}"
params_ref+=" --etcd-cafile=${ETCD_APISERVER_CA_CERT_PATH}"
params_ref+=" --etcd-certfile=${ETCD_APISERVER_CLIENT_CERT_PATH}"
params_ref+=" --etcd-keyfile=${ETCD_APISERVER_CLIENT_KEY_PATH}"
elif [[ -z "${ETCD_APISERVER_CA_KEY:-}" && -z "${ETCD_APISERVER_CA_CERT:-}" && -z "${ETCD_APISERVER_SERVER_KEY:-}" && -z "${ETCD_APISERVER_SERVER_CERT:-}" && -z "${ETCD_APISERVER_CLIENT_KEY:-}" && -z "${ETCD_APISERVER_CLIENT_CERT:-}" ]]; then
params_ref+=" --etcd-servers=${ETCD_SERVERS:-http://127.0.0.1:2379}"
echo "WARNING: ALL of ETCD_APISERVER_CA_KEY, ETCD_APISERVER_CA_CERT, ETCD_APISERVER_SERVER_KEY, ETCD_APISERVER_SERVER_CERT, ETCD_APISERVER_CLIENT_KEY and ETCD_APISERVER_CLIENT_CERT are missing, mTLS between etcd server and kube-apiserver is not enabled."
else
echo "ERROR: Some of ETCD_APISERVER_CA_KEY, ETCD_APISERVER_CA_CERT, ETCD_APISERVER_SERVER_KEY, ETCD_APISERVER_SERVER_CERT, ETCD_APISERVER_CLIENT_KEY and ETCD_APISERVER_CLIENT_CERT are missing, mTLS between etcd server and kube-apiserver cannot be enabled. Please provide all mTLS credential."
exit 1
fi
if [[ -z "${ETCD_SERVERS:-}" ]]; then
params_ref+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-/events#http://127.0.0.1:4002}"
elif [[ -n "${ETCD_SERVERS_OVERRIDES:-}" ]]; then
params_ref+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-}"
fi
if [[ -n "${STORAGE_BACKEND:-}" ]]; then
params_ref+=" --storage-backend=${STORAGE_BACKEND}"
fi
if [[ -n "${STORAGE_MEDIA_TYPE:-}" ]]; then
params_ref+=" --storage-media-type=${STORAGE_MEDIA_TYPE}"
fi
if [[ -n "${ETCD_COMPACTION_INTERVAL_SEC:-}" ]]; then
params_ref+=" --etcd-compaction-interval=${ETCD_COMPACTION_INTERVAL_SEC}s"
fi
}
# Starts kubernetes apiserver.
# It prepares the log file, loads the docker image, calculates variables, sets them
# in the manifest file, and then copies the manifest file to /etc/kubernetes/manifests.
@ -34,23 +71,10 @@ function start-kube-apiserver {
params+=" --allow-privileged=true"
params+=" --cloud-provider=gce"
params+=" --client-ca-file=${CA_CERT_BUNDLE_PATH}"
if [[ -n "${ETCD_APISERVER_CA_KEY:-}" && -n "${ETCD_APISERVER_CA_CERT:-}" && -n "${ETCD_APISERVER_SERVER_KEY:-}" && -n "${ETCD_APISERVER_SERVER_CERT:-}" && -n "${ETCD_APISERVER_CLIENT_KEY:-}" && -n "${ETCD_APISERVER_CLIENT_CERT:-}" ]]; then
params+=" --etcd-servers=${ETCD_SERVERS:-https://127.0.0.1:2379}"
params+=" --etcd-cafile=${ETCD_APISERVER_CA_CERT_PATH}"
params+=" --etcd-certfile=${ETCD_APISERVER_CLIENT_CERT_PATH}"
params+=" --etcd-keyfile=${ETCD_APISERVER_CLIENT_KEY_PATH}"
elif [[ -z "${ETCD_APISERVER_CA_KEY:-}" && -z "${ETCD_APISERVER_CA_CERT:-}" && -z "${ETCD_APISERVER_SERVER_KEY:-}" && -z "${ETCD_APISERVER_SERVER_CERT:-}" && -z "${ETCD_APISERVER_CLIENT_KEY:-}" && -z "${ETCD_APISERVER_CLIENT_CERT:-}" ]]; then
params+=" --etcd-servers=${ETCD_SERVERS:-http://127.0.0.1:2379}"
echo "WARNING: ALL of ETCD_APISERVER_CA_KEY, ETCD_APISERVER_CA_CERT, ETCD_APISERVER_SERVER_KEY, ETCD_APISERVER_SERVER_CERT, ETCD_APISERVER_CLIENT_KEY and ETCD_APISERVER_CLIENT_CERT are missing, mTLS between etcd server and kube-apiserver is not enabled."
else
echo "ERROR: Some of ETCD_APISERVER_CA_KEY, ETCD_APISERVER_CA_CERT, ETCD_APISERVER_SERVER_KEY, ETCD_APISERVER_SERVER_CERT, ETCD_APISERVER_CLIENT_KEY and ETCD_APISERVER_CLIENT_CERT are missing, mTLS between etcd server and kube-apiserver cannot be enabled. Please provide all mTLS credential."
exit 1
fi
if [[ -z "${ETCD_SERVERS:-}" ]]; then
params+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-/events#http://127.0.0.1:4002}"
elif [[ -n "${ETCD_SERVERS_OVERRIDES:-}" ]]; then
params+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-}"
fi
# params is passed by reference, so no "$"
configure-etcd-params params
params+=" --secure-port=443"
if [[ "${ENABLE_APISERVER_INSECURE_PORT:-false}" != "true" ]]; then
# Default is :8080
@ -80,15 +104,7 @@ function start-kube-apiserver {
if [[ -n "${KUBE_PASSWORD:-}" && -n "${KUBE_USER:-}" ]]; then
params+=" --basic-auth-file=/etc/srv/kubernetes/basic_auth.csv"
fi
if [[ -n "${STORAGE_BACKEND:-}" ]]; then
params+=" --storage-backend=${STORAGE_BACKEND}"
fi
if [[ -n "${STORAGE_MEDIA_TYPE:-}" ]]; then
params+=" --storage-media-type=${STORAGE_MEDIA_TYPE}"
fi
if [[ -n "${ETCD_COMPACTION_INTERVAL_SEC:-}" ]]; then
params+=" --etcd-compaction-interval=${ETCD_COMPACTION_INTERVAL_SEC}s"
fi
if [[ -n "${KUBE_APISERVER_REQUEST_TIMEOUT_SEC:-}" ]]; then
params+=" --request-timeout=${KUBE_APISERVER_REQUEST_TIMEOUT_SEC}s"
fi
@ -268,7 +284,6 @@ function start-kube-apiserver {
fi
fi
local authorization_mode="RBAC"
local -r src_dir="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty"

4
cluster/gce/gci/testdata/kube-apiserver/etcd.template vendored
View File

@ -9,3 +9,7 @@ readonly ETCD_SERVERS={{.ETCDServers}}
readonly ETCD_APISERVER_CA_CERT_PATH={{.CACertPath}}
readonly ETCD_APISERVER_CLIENT_CERT_PATH={{.APIServerCertPath}}
readonly ETCD_APISERVER_CLIENT_KEY_PATH={{.APIServerKeyPath}}
readonly ETCD_SERVERS_OVERRIDES={{.ETCDServersOverride}}
readonly STORAGE_BACKEND={{.StorageBackend}}
readonly STORAGE_MEDIA_TYPE={{.StorageMediaType}}
readonly ETCD_COMPACTION_INTERVAL_SEC={{.CompactionInterval}}