Skip to content

K
k3s
Commit d8be13fe authored by deads2k's avatar deads2k
Browse files
Options

add proxy client-certs to kube-apiserver to allow it to proxy aggregated api servers

parent d6c5f059
Hide whitespace changes
Inline Side-by-side
Showing with 9 additions and 0 deletions
cmd/kubeadm/app/master/manifests.go
View file @ d8be13fe
......@@ -323,6 +323,9 @@ func getAPIServerCommand(cfg *kubeadmapi.MasterConfiguration, selfHosted bool) [
"requestheader-extra-headers-prefix": "X-Remote-Extra-",
"requestheader-client-ca-file": path.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyCACertName),
"requestheader-allowed-names": "front-proxy-client",
// add options which allow the kube-apiserver to act as a front-proxy to aggregated API servers
"proxy-client-cert-file": path.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyClientCertName),
"proxy-client-key-file": path.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyClientKeyName),
}
command = getComponentBaseCommand(apiServer)
......
cmd/kubeadm/app/master/manifests_test.go
View file @ d8be13fe
......@@ -453,6 +453,8 @@ func TestGetAPIServerCommand(t *testing.T) {
"--storage-backend=etcd3",
"--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname",
"--experimental-bootstrap-token-auth=true",
"--proxy-client-cert-file=/var/lib/certs/front-proxy-client.crt",
"--proxy-client-key-file=/var/lib/certs/front-proxy-client.key",
"--requestheader-username-headers=X-Remote-User",
"--requestheader-group-headers=X-Remote-Group",
"--requestheader-extra-headers-prefix=X-Remote-Extra-",
......@@ -485,6 +487,8 @@ func TestGetAPIServerCommand(t *testing.T) {
"--storage-backend=etcd3",
"--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname",
"--experimental-bootstrap-token-auth=true",
"--proxy-client-cert-file=/var/lib/certs/front-proxy-client.crt",
"--proxy-client-key-file=/var/lib/certs/front-proxy-client.key",
"--requestheader-username-headers=X-Remote-User",
"--requestheader-group-headers=X-Remote-Group",
"--requestheader-extra-headers-prefix=X-Remote-Extra-",
......@@ -518,6 +522,8 @@ func TestGetAPIServerCommand(t *testing.T) {
"--storage-backend=etcd3",
"--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname",
"--experimental-bootstrap-token-auth=true",
"--proxy-client-cert-file=/var/lib/certs/front-proxy-client.crt",
"--proxy-client-key-file=/var/lib/certs/front-proxy-client.key",
"--requestheader-username-headers=X-Remote-User",
"--requestheader-group-headers=X-Remote-Group",
"--requestheader-extra-headers-prefix=X-Remote-Extra-",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment