Skip to content

K
k3s
Commit 08bd9c77 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #44071 from liggitt/service-account-lookup

Automatic merge from submit-queue (batch tested with PRs 44406, 41543, 44071, 44374, 44299) Enable service account token lookup by default Fixes #24167 ```release-note kube-apiserver: --service-account-lookup now defaults to true, requiring the Secret API object containing the token to exist in order for a service account token to be valid. This enables service account tokens to be revoked by deleting the Secret object containing the token. ```
parents 4653a9b2 0d2e5a0d
Hide whitespace changes
Inline Side-by-side
Showing with 5 additions and 5 deletions
cluster/libvirt-coreos/util.sh
View file @ 08bd9c77
...@@ -26,7 +26,7 @@ source "$ROOT/${KUBE_CONFIG_FILE:-"config-default.sh"}" ...@@ -26,7 +26,7 @@ source "$ROOT/${KUBE_CONFIG_FILE:-"config-default.sh"}"
source "$KUBE_ROOT/cluster/common.sh" source "$KUBE_ROOT/cluster/common.sh"
export LIBVIRT_DEFAULT_URI=qemu:///system export LIBVIRT_DEFAULT_URI=qemu:///system
export SERVICE_ACCOUNT_LOOKUP=${SERVICE_ACCOUNT_LOOKUP:-false} export SERVICE_ACCOUNT_LOOKUP=${SERVICE_ACCOUNT_LOOKUP:-true}
export ADMISSION_CONTROL=${ADMISSION_CONTROL:-NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota} export ADMISSION_CONTROL=${ADMISSION_CONTROL:-NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota}
readonly POOL=kubernetes readonly POOL=kubernetes
readonly POOL_PATH=/var/lib/libvirt/images/kubernetes readonly POOL_PATH=/var/lib/libvirt/images/kubernetes
......
cluster/rackspace/cloud-config/master-cloud-config.yaml
View file @ 08bd9c77
...@@ -135,7 +135,7 @@ coreos: ...@@ -135,7 +135,7 @@ coreos:
--token-auth-file=/var/lib/kube-apiserver/known_tokens.csv \ --token-auth-file=/var/lib/kube-apiserver/known_tokens.csv \
--v=2 \ --v=2 \
--service-account-key-file=/var/run/kubernetes/kube-serviceaccount.key \ --service-account-key-file=/var/run/kubernetes/kube-serviceaccount.key \
--service-account-lookup=false \ --service-account-lookup=true \
--admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,DefaultTolerationSeconds,ResourceQuota --admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,DefaultTolerationSeconds,ResourceQuota
Restart=always Restart=always
RestartSec=5 RestartSec=5
......
hack/local-up-cluster.sh
View file @ 08bd9c77
...@@ -364,7 +364,7 @@ function start_etcd { ...@@ -364,7 +364,7 @@ function start_etcd {
} }
function set_service_accounts { function set_service_accounts {
SERVICE_ACCOUNT_LOOKUP=${SERVICE_ACCOUNT_LOOKUP:-false} SERVICE_ACCOUNT_LOOKUP=${SERVICE_ACCOUNT_LOOKUP:-true}
SERVICE_ACCOUNT_KEY=${SERVICE_ACCOUNT_KEY:-/tmp/kube-serviceaccount.key} SERVICE_ACCOUNT_KEY=${SERVICE_ACCOUNT_KEY:-/tmp/kube-serviceaccount.key}
# Generate ServiceAccount key if needed # Generate ServiceAccount key if needed
if [[ ! -f "${SERVICE_ACCOUNT_KEY}" ]]; then if [[ ! -f "${SERVICE_ACCOUNT_KEY}" ]]; then
......
pkg/kubeapiserver/options/authentication.go
View file @ 08bd9c77
...@@ -147,7 +147,7 @@ func (s *BuiltInAuthenticationOptions) WithRequestHeader() *BuiltInAuthenticatio ...@@ -147,7 +147,7 @@ func (s *BuiltInAuthenticationOptions) WithRequestHeader() *BuiltInAuthenticatio
} }
func (s *BuiltInAuthenticationOptions) WithServiceAccounts() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithServiceAccounts() *BuiltInAuthenticationOptions {
s.ServiceAccounts = &ServiceAccountAuthenticationOptions{} s.ServiceAccounts = &ServiceAccountAuthenticationOptions{Lookup: true}
return s return s
} }
......
test/fixtures/doc-yaml/getting-started-guides/coreos/cloud-configs/master.yaml
View file @ 08bd9c77
...@@ -90,7 +90,7 @@ coreos: ...@@ -90,7 +90,7 @@ coreos:
ExecStartPre=/opt/bin/wupiao 127.0.0.1:2379/v2/machines ExecStartPre=/opt/bin/wupiao 127.0.0.1:2379/v2/machines
ExecStart=/opt/bin/kube-apiserver \ ExecStart=/opt/bin/kube-apiserver \
--service-account-key-file=/opt/bin/kube-serviceaccount.key \ --service-account-key-file=/opt/bin/kube-serviceaccount.key \
--service-account-lookup=false \ --service-account-lookup=true \
--admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \ --admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \
--runtime-config=api/v1 \ --runtime-config=api/v1 \
--allow-privileged=true \ --allow-privileged=true \
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment