github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-20 10:20:51 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #98773 from mtaufen/said-fqdn

Browse Source 
Use FQDN for SERVICEACCOUNT_ISSUER in tests
This commit is contained in:
Kubernetes Prow Robot 2021-02-05 05:40:52 -08:00 committed by GitHub
commit ce1ee6461a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
cluster/gce/config-test.sh
View File

@ -556,9 +556,14 @@ ROTATE_CERTIFICATES=${ROTATE_CERTIFICATES:-}
# into kube-controller-manager via `--concurrent-service-syncs`
CONCURRENT_SERVICE_SYNCS=${CONCURRENT_SERVICE_SYNCS:-}
# The value kubernetes.default.svc is only usable in Pods and should only be
# set for tests. DO NOT COPY THIS VALUE FOR PRODUCTION CLUSTERS.
export SERVICEACCOUNT_ISSUER='https://kubernetes.default.svc'
# The value kubernetes.default.svc.cluster.local is only usable for full
# OIDC discovery flows in Pods in the same cluster. For some providers
# with configurations that support non-traditional KSA authentication methods,
# this value may make sense, but if the expectation is traditional OIDC, don't
# use this value in production. If you do use it, the FQDN is preferred to
# kubernetes.default.svc, to avoid something outside the cluster attempting
# to resolve the partially qualified name.
export SERVICEACCOUNT_ISSUER='https://kubernetes.default.svc.cluster.local'
# Optional: Enable Node termination Handler for Preemptible and GPU VMs.
# https://github.com/GoogleCloudPlatform/k8s-node-termination-handler
@ -596,6 +601,6 @@ export ETCD_PROGRESS_NOTIFY_INTERVAL="${ETCD_PROGRESS_NOTIFY_INTERVAL:-10m}"
# unzipping the image layers to disk.
export WINDOWS_ENABLE_PIGZ="${WINDOWS_ENABLE_PIGZ:-true}"
# TLS_CIPHER_SUITES defines cipher suites allowed to be used by kube-apiserver.
# TLS_CIPHER_SUITES defines cipher suites allowed to be used by kube-apiserver.
# If this variable is unset or empty, kube-apiserver will allow its default set of cipher suites.
export TLS_CIPHER_SUITES=""