Skip to content

K
k3s
Unverified Commit 2c933695 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #68273 from sttts/sttts-non-fatal-in-cluster-config

Automatic merge from submit-queue (batch tested with PRs 68265, 68273). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md. apiserver: make InClusterConfig errs for delegated authn/z non-fatal Fixes https://github.com/kubernetes/kubernetes/issues/68246: Background: In gci e2e tests the kube-controller-manager is started as static pod. When it first starts, there is no kubernetes service and the KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT env vars are not set inside the container. When the kube-controller-manager is restarted, the KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT env vars are set, but the static pod has no service account, i.e. /var/run/secrets/kubernetes.io/serviceaccount/token does not exist. We made the later fatal in rest.InClusterConfig and its use to setup delegated authn/z.
parents 79b3d3e7 04e793e6
Hide whitespace changes
Inline Side-by-side
Showing with 14 additions and 8 deletions
staging/src/k8s.io/apiserver/pkg/server/options/authentication.go
View file @ 2c933695
...@@ -230,10 +230,10 @@ func (s *DelegatingAuthenticationOptions) lookupMissingConfigInCluster(client ku ...@@ -230,10 +230,10 @@ func (s *DelegatingAuthenticationOptions) lookupMissingConfigInCluster(client ku
} }
if client == nil { if client == nil {
if len(s.ClientCert.ClientCA) == 0 { if len(s.ClientCert.ClientCA) == 0 {
glog.Warningf("No authentication-kubeconfig provided in order to lookup client-ca-file in configmap/%s in %s, so client certificate authentication to extension api-server won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) glog.Warningf("No authentication-kubeconfig provided in order to lookup client-ca-file in configmap/%s in %s, so client certificate authentication won't work.", authenticationConfigMapName, authenticationConfigMapNamespace)
} }
if len(s.RequestHeader.ClientCAFile) == 0 { if len(s.RequestHeader.ClientCAFile) == 0 {
glog.Warningf("No authentication-kubeconfig provided in order to lookup requestheader-client-ca-file in configmap/%s in %s, so request-header client certificate authentication to extension api-server won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) glog.Warningf("No authentication-kubeconfig provided in order to lookup requestheader-client-ca-file in configmap/%s in %s, so request-header client certificate authentication won't work.", authenticationConfigMapName, authenticationConfigMapNamespace)
} }
return nil return nil
} }
...@@ -262,7 +262,7 @@ func (s *DelegatingAuthenticationOptions) lookupMissingConfigInCluster(client ku ...@@ -262,7 +262,7 @@ func (s *DelegatingAuthenticationOptions) lookupMissingConfigInCluster(client ku
} }
} }
if len(s.ClientCert.ClientCA) == 0 { if len(s.ClientCert.ClientCA) == 0 {
glog.Warningf("Cluster doesn't provide client-ca-file in configmap/%s in %s, so client certificate authentication to extension api-server won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) glog.Warningf("Cluster doesn't provide client-ca-file in configmap/%s in %s, so client certificate authentication won't work.", authenticationConfigMapName, authenticationConfigMapNamespace)
} }
} }
...@@ -277,7 +277,7 @@ func (s *DelegatingAuthenticationOptions) lookupMissingConfigInCluster(client ku ...@@ -277,7 +277,7 @@ func (s *DelegatingAuthenticationOptions) lookupMissingConfigInCluster(client ku
} }
} }
if len(s.RequestHeader.ClientCAFile) == 0 { if len(s.RequestHeader.ClientCAFile) == 0 {
glog.Warningf("Cluster doesn't provide requestheader-client-ca-file in configmap/%s in %s, so request-header client certificate authentication to extension api-server won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) glog.Warningf("Cluster doesn't provide requestheader-client-ca-file in configmap/%s in %s, so request-header client certificate authentication won't work.", authenticationConfigMapName, authenticationConfigMapNamespace)
} }
} }
...@@ -364,9 +364,12 @@ func (s *DelegatingAuthenticationOptions) getClient() (kubernetes.Interface, err ...@@ -364,9 +364,12 @@ func (s *DelegatingAuthenticationOptions) getClient() (kubernetes.Interface, err
clientConfig, err = loader.ClientConfig() clientConfig, err = loader.ClientConfig()
} else { } else {
// without the remote kubeconfig file, try to use the in-cluster config. Most addon API servers will // without the remote kubeconfig file, try to use the in-cluster config. Most addon API servers will
// use this path // use this path. If it is optional, ignore errors.
clientConfig, err = rest.InClusterConfig() clientConfig, err = rest.InClusterConfig()
if err == rest.ErrNotInCluster && s.RemoteKubeConfigFileOptional { if err != nil && s.RemoteKubeConfigFileOptional {
if err != rest.ErrNotInCluster {
glog.Warningf("failed to read in-cluster kubeconfig for delegated authentication: %v", err)
}
return nil, nil return nil, nil
} }
} }
......
staging/src/k8s.io/apiserver/pkg/server/options/authorization.go
View file @ 2c933695
...@@ -151,9 +151,12 @@ func (s *DelegatingAuthorizationOptions) getClient() (kubernetes.Interface, erro ...@@ -151,9 +151,12 @@ func (s *DelegatingAuthorizationOptions) getClient() (kubernetes.Interface, erro
clientConfig, err = loader.ClientConfig() clientConfig, err = loader.ClientConfig()
} else { } else {
// without the remote kubeconfig file, try to use the in-cluster config. Most addon API servers will // without the remote kubeconfig file, try to use the in-cluster config. Most addon API servers will
// use this path // use this path. If it is optional, ignore errors.
clientConfig, err = rest.InClusterConfig() clientConfig, err = rest.InClusterConfig()
if err == rest.ErrNotInCluster && s.RemoteKubeConfigFileOptional { if err != nil && s.RemoteKubeConfigFileOptional {
if err != rest.ErrNotInCluster {
glog.Warningf("failed to read in-cluster kubeconfig for delegated authorization: %v", err)
}
return nil, nil return nil, nil
} }
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment