From d8be13fee85075abfc087632b3dbc586a10897ad Mon Sep 17 00:00:00 2001 From: deads2k Date: Mon, 27 Mar 2017 13:31:31 -0400 Subject: [PATCH] add proxy client-certs to kube-apiserver to allow it to proxy aggregated api servers --- cmd/kubeadm/app/master/manifests.go | 3 +++ cmd/kubeadm/app/master/manifests_test.go | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/cmd/kubeadm/app/master/manifests.go b/cmd/kubeadm/app/master/manifests.go index 0af22fa345c..e00e5994cb0 100644 --- a/cmd/kubeadm/app/master/manifests.go +++ b/cmd/kubeadm/app/master/manifests.go @@ -323,6 +323,9 @@ func getAPIServerCommand(cfg *kubeadmapi.MasterConfiguration, selfHosted bool) [ "requestheader-extra-headers-prefix": "X-Remote-Extra-", "requestheader-client-ca-file": path.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyCACertName), "requestheader-allowed-names": "front-proxy-client", + // add options which allow the kube-apiserver to act as a front-proxy to aggregated API servers + "proxy-client-cert-file": path.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyClientCertName), + "proxy-client-key-file": path.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyClientKeyName), } command = getComponentBaseCommand(apiServer) diff --git a/cmd/kubeadm/app/master/manifests_test.go b/cmd/kubeadm/app/master/manifests_test.go index 16b7da0352c..f9fb8ac23d1 100644 --- a/cmd/kubeadm/app/master/manifests_test.go +++ b/cmd/kubeadm/app/master/manifests_test.go @@ -453,6 +453,8 @@ func TestGetAPIServerCommand(t *testing.T) { "--storage-backend=etcd3", "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname", "--experimental-bootstrap-token-auth=true", + "--proxy-client-cert-file=/var/lib/certs/front-proxy-client.crt", + "--proxy-client-key-file=/var/lib/certs/front-proxy-client.key", "--requestheader-username-headers=X-Remote-User", "--requestheader-group-headers=X-Remote-Group", "--requestheader-extra-headers-prefix=X-Remote-Extra-", @@ -485,6 +487,8 @@ func TestGetAPIServerCommand(t *testing.T) { "--storage-backend=etcd3", "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname", "--experimental-bootstrap-token-auth=true", + "--proxy-client-cert-file=/var/lib/certs/front-proxy-client.crt", + "--proxy-client-key-file=/var/lib/certs/front-proxy-client.key", "--requestheader-username-headers=X-Remote-User", "--requestheader-group-headers=X-Remote-Group", "--requestheader-extra-headers-prefix=X-Remote-Extra-", @@ -518,6 +522,8 @@ func TestGetAPIServerCommand(t *testing.T) { "--storage-backend=etcd3", "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname", "--experimental-bootstrap-token-auth=true", + "--proxy-client-cert-file=/var/lib/certs/front-proxy-client.crt", + "--proxy-client-key-file=/var/lib/certs/front-proxy-client.key", "--requestheader-username-headers=X-Remote-User", "--requestheader-group-headers=X-Remote-Group", "--requestheader-extra-headers-prefix=X-Remote-Extra-",