Skip to content

K
k3s
Commit 5efab5a1 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #52497 from jcbsmpsn/add-signing-duration-configuration-flag

Automatic merge from submit-queue (batch tested with PRs 48970, 52497, 51367, 52549, 52541). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.. Add configuration support for signing duration. Fixes https://github.com/kubernetes/kubernetes/issues/52286 Fixes https://github.com/kubernetes/kubernetes/issues/52282 Reverses revert (with fixes) https://github.com/kubernetes/kubernetes/pull/52299 ```release-note Add CLUSTER_SIGNING_DURATION environment variable to cluster configuration scripts to allow configuration of signing duration of certificates issued via the Certificate Signing Request API. ```
parents f80999f4 ca48fca1
Hide whitespace changes
Inline Side-by-side
Showing with 15 additions and 0 deletions
cluster/common.sh
View file @ 5efab5a1
...@@ -883,6 +883,11 @@ EOF ...@@ -883,6 +883,11 @@ EOF
ETCD_QUORUM_READ: $(yaml-quote ${ETCD_QUORUM_READ}) ETCD_QUORUM_READ: $(yaml-quote ${ETCD_QUORUM_READ})
EOF EOF
fi fi
if [ -n "${CLUSTER_SIGNING_DURATION:-}" ]; then
cat >>$file <<EOF
CLUSTER_SIGNING_DURATION: $(yaml-quote ${CLUSTER_SIGNING_DURATION})
EOF
fi
else else
# Node-only env vars. # Node-only env vars.
......
cluster/gce/config-default.sh
View file @ 5efab5a1
...@@ -323,6 +323,9 @@ ENABLE_PROMETHEUS_TO_SD="${ENABLE_PROMETHEUS_TO_SD:-false}" ...@@ -323,6 +323,9 @@ ENABLE_PROMETHEUS_TO_SD="${ENABLE_PROMETHEUS_TO_SD:-false}"
# Optional: [Experiment Only] Run kube-proxy as a DaemonSet if set to true, run as static pods otherwise. # Optional: [Experiment Only] Run kube-proxy as a DaemonSet if set to true, run as static pods otherwise.
KUBE_PROXY_DAEMONSET="${KUBE_PROXY_DAEMONSET:-false}" # true, false KUBE_PROXY_DAEMONSET="${KUBE_PROXY_DAEMONSET:-false}" # true, false
# Optional: duration of cluster signed certificates.
CLUSTER_SIGNING_DURATION="${CLUSTER_SIGNING_DURATION:-}"
# Optional: enable pod priority # Optional: enable pod priority
ENABLE_POD_PRIORITY="${ENABLE_POD_PRIORITY:-}" ENABLE_POD_PRIORITY="${ENABLE_POD_PRIORITY:-}"
if [[ "${ENABLE_POD_PRIORITY}" == "true" ]]; then if [[ "${ENABLE_POD_PRIORITY}" == "true" ]]; then
......
cluster/gce/config-test.sh
View file @ 5efab5a1
...@@ -377,6 +377,9 @@ ENABLE_PROMETHEUS_TO_SD="${ENABLE_PROMETHEUS_TO_SD:-true}" ...@@ -377,6 +377,9 @@ ENABLE_PROMETHEUS_TO_SD="${ENABLE_PROMETHEUS_TO_SD:-true}"
# Optional: [Experiment Only] Run kube-proxy as a DaemonSet if set to true, run as static pods otherwise. # Optional: [Experiment Only] Run kube-proxy as a DaemonSet if set to true, run as static pods otherwise.
KUBE_PROXY_DAEMONSET="${KUBE_PROXY_DAEMONSET:-false}" # true, false KUBE_PROXY_DAEMONSET="${KUBE_PROXY_DAEMONSET:-false}" # true, false
# Optional: duration of cluster signed certificates.
CLUSTER_SIGNING_DURATION="${CLUSTER_SIGNING_DURATION:-}"
# Optional: enable pod priority # Optional: enable pod priority
ENABLE_POD_PRIORITY="${ENABLE_POD_PRIORITY:-}" ENABLE_POD_PRIORITY="${ENABLE_POD_PRIORITY:-}"
if [[ "${ENABLE_POD_PRIORITY}" == "true" ]]; then if [[ "${ENABLE_POD_PRIORITY}" == "true" ]]; then
......
cluster/gce/gci/configure-helper.sh
View file @ 5efab5a1
...@@ -1562,6 +1562,10 @@ function start-kube-controller-manager { ...@@ -1562,6 +1562,10 @@ function start-kube-controller-manager {
if [[ -n "${VOLUME_PLUGIN_DIR:-}" ]]; then if [[ -n "${VOLUME_PLUGIN_DIR:-}" ]]; then
params+=" --flex-volume-plugin-dir=${VOLUME_PLUGIN_DIR}" params+=" --flex-volume-plugin-dir=${VOLUME_PLUGIN_DIR}"
fi fi
if [[ -n "${CLUSTER_SIGNING_DURATION:-}" ]]; then
params+=" --experimental-cluster-signing-duration=$CLUSTER_SIGNING_DURATION"
fi
local -r kube_rc_docker_tag=$(cat /home/kubernetes/kube-docker-files/kube-controller-manager.docker_tag) local -r kube_rc_docker_tag=$(cat /home/kubernetes/kube-docker-files/kube-controller-manager.docker_tag)
local container_env="" local container_env=""
if [[ -n "${ENABLE_CACHE_MUTATION_DETECTOR:-}" ]]; then if [[ -n "${ENABLE_CACHE_MUTATION_DETECTOR:-}" ]]; then
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment