github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-26 21:17:23 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #47603 from jcbsmpsn/add-files-as-cert-key-source

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 38751, 44282, 46382, 47603, 47606)

Add files specified in the kube config as a potential source of cert/…

Fixes #47208

Add files specified in the kube config as a potential source of cert/key data.

Without this change, the kubelet won't use certificates that are specified using file paths in the kubeconfig file. This specifically affects GCE clusters started with kube-up.sh with the RotateKubelet*Certificate feature gate flags enabled, but may affect other configurations.

This change only affects feature gated alpha code.
This commit is contained in:
Kubernetes Submit Queue 2017-06-16 18:05:53 -07:00 committed by GitHub
commit edc61f528e
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cmd/kubelet/app/server.go
View File

@ -457,7 +457,7 @@ func run(s *options.KubeletServer, kubeDeps *kubelet.KubeletDeps) (err error) {
if err != nil { if err != nil {
return err return err
} }
clientCertificateManager, err = initializeClientCertificateManager(s.CertDirectory, nodeName, clientConfig.CertData, clientConfig.KeyData) clientCertificateManager, err = initializeClientCertificateManager(s.CertDirectory, nodeName, clientConfig.CertData, clientConfig.KeyData, clientConfig.CertFile, clientConfig.KeyFile)
if err != nil { if err != nil {
return err return err
} }
@ -664,13 +664,13 @@ func updateTransport(clientConfig *restclient.Config, clientCertificateManager c
// client that can be used to sign new certificates (or rotate). It answers with // client that can be used to sign new certificates (or rotate). It answers with
// whatever certificate it is initialized with. If a CSR client is set later, it // whatever certificate it is initialized with. If a CSR client is set later, it
// may begin rotating/renewing the client cert // may begin rotating/renewing the client cert
func initializeClientCertificateManager(certDirectory string, nodeName types.NodeName, certData []byte, keyData []byte) (certificate.Manager, error) { func initializeClientCertificateManager(certDirectory string, nodeName types.NodeName, certData []byte, keyData []byte, certFile string, keyFile string) (certificate.Manager, error) {
certificateStore, err := certificate.NewFileStore( certificateStore, err := certificate.NewFileStore(
"kubelet-client", "kubelet-client",
certDirectory, certDirectory,
certDirectory, certDirectory,
"", certFile,
"") keyFile)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to initialize certificate store: %v", err) return nil, fmt.Errorf("failed to initialize certificate store: %v", err)
} }