github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 05:27:21 +00:00
Code Issues Projects Releases Wiki Activity

kubeadm: add --port=0 for kube-controller-manager and kube-scheduler

Browse Source 
Kubeadm setup of kube-controller-manager and kube-scheduler is
lacking the --port=0 option which caused the component to enable
the insecure port by default and serve insecurely on the default
node interface.

Add --port=0 by default to both components. Users are still allowed
the explicitly set the flag (via extraArgs), which allows them
to override this default kubeadm behavior and enable the insecure port.

NOTE: the flag is deprecated and should be removed from kubeadm manifests
once it's removed from core.
This commit is contained in:
Lubomir I. Ivanov 2020-07-01 22:17:46 +03:00
parent da54185c9e
commit f66513d98a
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/kubeadm/app/phases/controlplane/manifests.go
View File

@ -322,6 +322,7 @@ func getControllerManagerCommand(cfg *kubeadmapi.ClusterConfiguration) []string
caFile := filepath.Join(cfg.CertificatesDir, kubeadmconstants.CACertName) caFile := filepath.Join(cfg.CertificatesDir, kubeadmconstants.CACertName)
defaultArguments := map[string]string{ defaultArguments := map[string]string{
"port": "0",
"bind-address": "127.0.0.1", "bind-address": "127.0.0.1",
"leader-elect": "true", "leader-elect": "true",
"kubeconfig": kubeconfigFile, "kubeconfig": kubeconfigFile,
@ -392,6 +393,7 @@ func getControllerManagerCommand(cfg *kubeadmapi.ClusterConfiguration) []string
func getSchedulerCommand(cfg *kubeadmapi.ClusterConfiguration) []string { func getSchedulerCommand(cfg *kubeadmapi.ClusterConfiguration) []string {
kubeconfigFile := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.SchedulerKubeConfigFileName) kubeconfigFile := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.SchedulerKubeConfigFileName)
defaultArguments := map[string]string{ defaultArguments := map[string]string{
"port": "0",
"bind-address": "127.0.0.1", "bind-address": "127.0.0.1",
"leader-elect": "true", "leader-elect": "true",
"kubeconfig": kubeconfigFile, "kubeconfig": kubeconfigFile,

11
cmd/kubeadm/app/phases/controlplane/manifests_test.go
View File

@ -588,6 +588,7 @@ func TestGetControllerManagerCommand(t *testing.T) {
}, },
expected: []string{ expected: []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -612,6 +613,7 @@ func TestGetControllerManagerCommand(t *testing.T) {
}, },
expected: []string{ expected: []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -636,6 +638,7 @@ func TestGetControllerManagerCommand(t *testing.T) {
}, },
expected: []string{ expected: []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -665,6 +668,7 @@ func TestGetControllerManagerCommand(t *testing.T) {
}, },
expected: []string{ expected: []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -696,6 +700,7 @@ func TestGetControllerManagerCommand(t *testing.T) {
}, },
expected: []string{ expected: []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -726,6 +731,7 @@ func TestGetControllerManagerCommand(t *testing.T) {
}, },
expected: []string{ expected: []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -758,6 +764,7 @@ func TestGetControllerManagerCommand(t *testing.T) {
}, },
expected: []string{ expected: []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -792,6 +799,7 @@ func TestGetControllerManagerCommand(t *testing.T) {
}, },
expected: []string{ expected: []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -941,6 +949,7 @@ func TestGetControllerManagerCommandExternalCA(t *testing.T) {
expectedArgFunc: func(tmpdir string) []string { expectedArgFunc: func(tmpdir string) []string {
return []string{ return []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -970,6 +979,7 @@ func TestGetControllerManagerCommandExternalCA(t *testing.T) {
expectedArgFunc: func(tmpdir string) []string { expectedArgFunc: func(tmpdir string) []string {
return []string{ return []string{
"kube-controller-manager", "kube-controller-manager",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/controller-manager.conf",
@ -1031,6 +1041,7 @@ func TestGetSchedulerCommand(t *testing.T) {
cfg: &kubeadmapi.ClusterConfiguration{}, cfg: &kubeadmapi.ClusterConfiguration{},
expected: []string{ expected: []string{
"kube-scheduler", "kube-scheduler",
"--port=0",
"--bind-address=127.0.0.1", "--bind-address=127.0.0.1",
"--leader-elect=true", "--leader-elect=true",
"--kubeconfig=" + kubeadmconstants.KubernetesDir + "/scheduler.conf", "--kubeconfig=" + kubeadmconstants.KubernetesDir + "/scheduler.conf",