Skip to content

K
k3s
Unverified Commit c59393e9 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #63266 from awly/exec-plugin-kubeconfig

Automatic merge from submit-queue (batch tested with PRs 63340, 63266). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. gcp: allow non-bootstrap kubeconfig **What this PR does / why we need it**: Needed for https://github.com/kubernetes/community/pull/2022 This change lets us generate a non-bootstrap kubeconfig with exec plugin for authn. The plugin does TLS bootstrapping internally. **Special notes for your reviewer**: Defaults when no new env vars are set will behave same as before this change. `KUBELET_AUTH_TYPE` should never be `tls-auth` in practice, but leaving it there just in case. **Release note**: ```release-note NONE ```
parents 861d20bf 77c13d6d
Hide whitespace changes
Inline Side-by-side
Showing with 26 additions and 5 deletions
cluster/gce/gci/configure-helper.sh
View file @ c59393e9
...@@ -892,8 +892,9 @@ function create-kubelet-kubeconfig() { ...@@ -892,8 +892,9 @@ function create-kubelet-kubeconfig() {
echo "Must provide API server address to create Kubelet kubeconfig file!" echo "Must provide API server address to create Kubelet kubeconfig file!"
exit 1 exit 1
fi fi
echo "Creating kubelet kubeconfig file" if [[ "${CREATE_BOOTSTRAP_KUBECONFIG:-true}" == "true" ]]; then
cat <<EOF >/var/lib/kubelet/bootstrap-kubeconfig echo "Creating kubelet bootstrap-kubeconfig file"
cat <<EOF >/var/lib/kubelet/bootstrap-kubeconfig
apiVersion: v1 apiVersion: v1
kind: Config kind: Config
users: users:
...@@ -913,6 +914,13 @@ contexts: ...@@ -913,6 +914,13 @@ contexts:
name: service-account-context name: service-account-context
current-context: service-account-context current-context: service-account-context
EOF EOF
elif [[ "${FETCH_BOOTSTRAP_KUBECONFIG:-false}" == "true" ]]; then
echo "Fetching kubelet bootstrap-kubeconfig file from metadata"
get-metadata-value "instance/attributes/bootstrap-kubeconfig" >/var/lib/kubelet/bootstrap-kubeconfig
else
echo "Fetching kubelet kubeconfig file from metadata"
get-metadata-value "instance/attributes/kubeconfig" >/var/lib/kubelet/kubeconfig
fi
} }
# Uses KUBELET_CA_CERT (falling back to CA_CERT), KUBELET_CERT, and KUBELET_KEY # Uses KUBELET_CA_CERT (falling back to CA_CERT), KUBELET_CERT, and KUBELET_KEY
...@@ -1612,7 +1620,7 @@ function start-kube-apiserver { ...@@ -1612,7 +1620,7 @@ function start-kube-apiserver {
params+=" --feature-gates=${FEATURE_GATES}" params+=" --feature-gates=${FEATURE_GATES}"
fi fi
if [[ -n "${PROJECT_ID:-}" && -n "${TOKEN_URL:-}" && -n "${TOKEN_BODY:-}" && -n "${NODE_NETWORK:-}" ]]; then if [[ -n "${PROJECT_ID:-}" && -n "${TOKEN_URL:-}" && -n "${TOKEN_BODY:-}" && -n "${NODE_NETWORK:-}" ]]; then
local -r vm_external_ip=$(curl --retry 5 --retry-delay 3 ${CURL_RETRY_CONNREFUSED} --fail --silent -H 'Metadata-Flavor: Google' "http://metadata/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip") local -r vm_external_ip=$(get-metadata-value "instance/network-interfaces/0/access-configs/0/external-ip")
if [[ -n "${PROXY_SSH_USER:-}" ]]; then if [[ -n "${PROXY_SSH_USER:-}" ]]; then
params+=" --advertise-address=${vm_external_ip}" params+=" --advertise-address=${vm_external_ip}"
params+=" --ssh-user=${PROXY_SSH_USER}" params+=" --ssh-user=${PROXY_SSH_USER}"
...@@ -2008,6 +2016,20 @@ function download-extra-addons { ...@@ -2008,6 +2016,20 @@ function download-extra-addons {
"${curl_cmd[@]}" "${curl_cmd[@]}"
} }
# A function that fetches a GCE metadata value and echoes it out.
#
# $1: URL path after /computeMetadata/v1/ (without heading slash).
function get-metadata-value {
curl \
--retry 5 \
--retry-delay 3 \
${CURL_RETRY_CONNREFUSED} \
--fail \
--silent \
-H 'Metadata-Flavor: Google' \
"http://metadata/computeMetadata/v1/${1}"
}
# A helper function for copying manifests and setting dir/files # A helper function for copying manifests and setting dir/files
# permissions. # permissions.
# #
...@@ -2590,4 +2612,4 @@ if [[ "$#" -eq 1 && "${1}" == "--source-only" ]]; then ...@@ -2590,4 +2612,4 @@ if [[ "$#" -eq 1 && "${1}" == "--source-only" ]]; then
: :
else else
main "${@}" main "${@}"
fi fi
\ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment