github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-11 14:11:14 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #98325 from deads2k/update-default-authorizer

Browse Source 
Update delegated authorization options default to eliminate unnecessary SARs
This commit is contained in:
Kubernetes Prow Robot
2021-02-02 11:38:28 -08:00
committed by GitHub
parent 2dc0176dff 62230d3c46
commit d2659101bf
7 changed files with 21 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
cmd/kube-controller-manager/app/options/options.go
View File

@@ -193,7 +193,6 @@ func NewKubeControllerManagerOptions() (*KubeControllerManagerOptions, error) {
s.Authentication.RemoteKubeConfigFileOptional = true
s.Authorization.RemoteKubeConfigFileOptional = true
s.Authorization.AlwaysAllowPaths = []string{"/healthz"}
// Set the PairName but leave certificate directory blank to generate in-memory by default
s.SecureServing.ServerCert.CertDirectory = ""

3
cmd/kube-controller-manager/app/options/options_test.go
View File

@@ -428,7 +428,8 @@ func TestAddFlags(t *testing.T) {
ClientTimeout: 10 * time.Second,
WebhookRetryBackoff: apiserveroptions.DefaultAuthWebhookRetryBackoff(),
RemoteKubeConfigFileOptional: true,
AlwaysAllowPaths: []string{"/healthz"}, // note: this does not match /healthz/ or /healthz/*
AlwaysAllowPaths: []string{"/healthz", "/readyz", "/livez"}, // note: this does not match /healthz/ or /healthz/*
AlwaysAllowGroups: []string{"system:masters"},
},
Kubeconfig: "/kubeconfig",
Master: "192.168.4.20",