github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-21 02:41:25 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #98773 from mtaufen/said-fqdn

Browse Source 
Use FQDN for SERVICEACCOUNT_ISSUER in tests
This commit is contained in:
Kubernetes Prow Robot 2021-02-05 05:40:52 -08:00 committed by GitHub
commit ce1ee6461a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
cluster/gce/config-test.sh
View File

@ -556,9 +556,14 @@ ROTATE_CERTIFICATES=${ROTATE_CERTIFICATES:-}
# into kube-controller-manager via `--concurrent-service-syncs`
CONCURRENT_SERVICE_SYNCS=${CONCURRENT_SERVICE_SYNCS:-}
# The value kubernetes.default.svc is only usable in Pods and should only be
# set for tests. DO NOT COPY THIS VALUE FOR PRODUCTION CLUSTERS.
export SERVICEACCOUNT_ISSUER='https://kubernetes.default.svc'
# The value kubernetes.default.svc.cluster.local is only usable for full
# OIDC discovery flows in Pods in the same cluster. For some providers
# with configurations that support non-traditional KSA authentication methods,
# this value may make sense, but if the expectation is traditional OIDC, don't
# use this value in production. If you do use it, the FQDN is preferred to
# kubernetes.default.svc, to avoid something outside the cluster attempting
# to resolve the partially qualified name.
export SERVICEACCOUNT_ISSUER='https://kubernetes.default.svc.cluster.local'
# Optional: Enable Node termination Handler for Preemptible and GPU VMs.
# https://github.com/GoogleCloudPlatform/k8s-node-termination-handler