mirror of
https://github.com/k3s-io/kubernetes.git
synced 2026-07-22 09:40:07 +00:00
2ba1b66b57
Currently, we set TLSConfig.Config.GetCertificate, but then also pass certificate and key paths to http.Server.ListenAndServeTLS. ListenAndServeTLS uses these paths to populate the TLS config Certificate property. Then, when accepting connections, a non-nil Certificate is preferred over GetCertificate if the ServerName is not set in ClientHelloInfo. Finally, the Go TLS client doesn't set ServerName when connecting by IP. As a result, when connecting to the kubelet by IP (e.g. to fetch pod logs), stale certificates are served. This patch passes empty certFile and keyFile arguments, to force the TLS server to use the GetCertificate function. This is done by clearing key/cert file config when setting GetCertificate as suggested in PR review. This way, all downstream users of kubeDeps.TLSConfig will do the right thing automatically.