mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-24 20:24:09 +00:00
Merge pull request #47603 from jcbsmpsn/add-files-as-cert-key-source
Automatic merge from submit-queue (batch tested with PRs 38751, 44282, 46382, 47603, 47606) Add files specified in the kube config as a potential source of cert/… Fixes #47208 Add files specified in the kube config as a potential source of cert/key data. Without this change, the kubelet won't use certificates that are specified using file paths in the kubeconfig file. This specifically affects GCE clusters started with kube-up.sh with the RotateKubelet*Certificate feature gate flags enabled, but may affect other configurations. This change only affects feature gated alpha code.
This commit is contained in:
commit
edc61f528e
@ -457,7 +457,7 @@ func run(s *options.KubeletServer, kubeDeps *kubelet.KubeletDeps) (err error) {
|
|||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
clientCertificateManager, err = initializeClientCertificateManager(s.CertDirectory, nodeName, clientConfig.CertData, clientConfig.KeyData)
|
clientCertificateManager, err = initializeClientCertificateManager(s.CertDirectory, nodeName, clientConfig.CertData, clientConfig.KeyData, clientConfig.CertFile, clientConfig.KeyFile)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
@ -664,13 +664,13 @@ func updateTransport(clientConfig *restclient.Config, clientCertificateManager c
|
|||||||
// client that can be used to sign new certificates (or rotate). It answers with
|
// client that can be used to sign new certificates (or rotate). It answers with
|
||||||
// whatever certificate it is initialized with. If a CSR client is set later, it
|
// whatever certificate it is initialized with. If a CSR client is set later, it
|
||||||
// may begin rotating/renewing the client cert
|
// may begin rotating/renewing the client cert
|
||||||
func initializeClientCertificateManager(certDirectory string, nodeName types.NodeName, certData []byte, keyData []byte) (certificate.Manager, error) {
|
func initializeClientCertificateManager(certDirectory string, nodeName types.NodeName, certData []byte, keyData []byte, certFile string, keyFile string) (certificate.Manager, error) {
|
||||||
certificateStore, err := certificate.NewFileStore(
|
certificateStore, err := certificate.NewFileStore(
|
||||||
"kubelet-client",
|
"kubelet-client",
|
||||||
certDirectory,
|
certDirectory,
|
||||||
certDirectory,
|
certDirectory,
|
||||||
"",
|
certFile,
|
||||||
"")
|
keyFile)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("failed to initialize certificate store: %v", err)
|
return nil, fmt.Errorf("failed to initialize certificate store: %v", err)
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user