github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-20 01:23:48 +00:00
Code Issues Projects Releases Wiki Activity

separate RootCAConfigMap from BoundServiceAccountTokenVolume

Browse Source
This commit is contained in:
Shihang Zhang
2020-11-03 14:35:19 -08:00
parent f75316e294
commit d40f0c43c4
12 changed files with 135 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/kubeapiserver/options/authentication.go
View File

@@ -199,6 +199,9 @@ func (o *BuiltInAuthenticationOptions) Validate() []error {
}
}
if o.ServiceAccounts != nil && utilfeature.DefaultFeatureGate.Enabled(features.BoundServiceAccountTokenVolume) {
if !utilfeature.DefaultFeatureGate.Enabled(features.RootCAConfigMap) {
allErrors = append(allErrors, errors.New("BoundServiceAccountTokenVolume feature depends on RootCAConfigMap feature, but RootCAConfigMap features is not enabled"))
}
if len(o.ServiceAccounts.Issuer) == 0 {
allErrors = append(allErrors, errors.New("service-account-issuer is a required flag when BoundServiceAccountTokenVolume is enabled"))
}