Skip to content

K
k3s
Commit 9a218d40 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #41309 from kars7e/add-cafile-openstack

Automatic merge from submit-queue (batch tested with PRs 40932, 41896, 41815, 41309, 41628) Add custom CA file to openstack cloud provider config **What this PR does / why we need it**: Adds ability to specify custom CA bundle file to verify OpenStack endpoint against. Useful in tests and PoC deployments. Similar to what https://github.com/kubernetes/kubernetes/pull/35488 did for authentication. **Which issue this PR fixes**: None **Special notes for your reviewer**: Based on https://github.com/kubernetes/kubernetes/pull/35488 which added support for custom CA file for authentication. **Release note**:
parents 77ba346f e3c8a0ce
Hide whitespace changes
Inline Side-by-side
Showing with 16 additions and 0 deletions
pkg/cloudprovider/providers/openstack/BUILD
View file @ 9a218d40
...@@ -54,6 +54,8 @@ go_library( ...@@ -54,6 +54,8 @@ go_library(
"//vendor:gopkg.in/gcfg.v1", "//vendor:gopkg.in/gcfg.v1",
"//vendor:k8s.io/apimachinery/pkg/api/resource", "//vendor:k8s.io/apimachinery/pkg/api/resource",
"//vendor:k8s.io/apimachinery/pkg/types", "//vendor:k8s.io/apimachinery/pkg/types",
"//vendor:k8s.io/apimachinery/pkg/util/net",
"//vendor:k8s.io/client-go/util/cert",
], ],
) )
......
pkg/cloudprovider/providers/openstack/openstack.go
View file @ 9a218d40
...@@ -17,6 +17,7 @@ limitations under the License. ...@@ -17,6 +17,7 @@ limitations under the License.
package openstack package openstack
import ( import (
"crypto/tls"
"errors" "errors"
"fmt" "fmt"
"io" "io"
...@@ -37,6 +38,8 @@ import ( ...@@ -37,6 +38,8 @@ import (
"github.com/golang/glog" "github.com/golang/glog"
"k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/types"
netutil "k8s.io/apimachinery/pkg/util/net"
certutil "k8s.io/client-go/util/cert"
"k8s.io/kubernetes/pkg/api/v1" "k8s.io/kubernetes/pkg/api/v1"
"k8s.io/kubernetes/pkg/cloudprovider" "k8s.io/kubernetes/pkg/cloudprovider"
) )
...@@ -116,6 +119,7 @@ type Config struct { ...@@ -116,6 +119,7 @@ type Config struct {
DomainId string `gcfg:"domain-id"` DomainId string `gcfg:"domain-id"`
DomainName string `gcfg:"domain-name"` DomainName string `gcfg:"domain-name"`
Region string Region string
CAFile string `gcfg:"ca-file"`
} }
LoadBalancer LoadBalancerOpts LoadBalancer LoadBalancerOpts
BlockStorage BlockStorageOpts BlockStorage BlockStorageOpts
...@@ -214,6 +218,16 @@ func newOpenStack(cfg Config) (*OpenStack, error) { ...@@ -214,6 +218,16 @@ func newOpenStack(cfg Config) (*OpenStack, error) {
if err != nil { if err != nil {
return nil, err return nil, err
} }
if cfg.Global.CAFile != "" {
roots, err := certutil.NewPool(cfg.Global.CAFile)
if err != nil {
return nil, err
}
config := &tls.Config{}
config.RootCAs = roots
provider.HTTPClient.Transport = netutil.SetOldTransportDefaults(&http.Transport{TLSClientConfig: config})
}
if cfg.Global.TrustId != "" { if cfg.Global.TrustId != "" {
opts := cfg.toAuth3Options() opts := cfg.toAuth3Options()
authOptsExt := trusts.AuthOptsExt{ authOptsExt := trusts.AuthOptsExt{
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment