Skip to content

K
k3s
Commit e3c8a0ce authored by Karol Stepniewski's avatar Karol Stepniewski Committed by Karol Stepniewski
Browse files
Options

Add custom CA file to openstack cloud provider config

In cases where insecure OpenStack endpoint is to be used (e.g., when testing), gophercloud will fail to connect to such endpoints. This patch adds support for custom CA file configuration option, which, when provided, will make gophercloud validate OpenStack endpoint against certificate(s) read from file specified in that option.
parent d46dc10b
Hide whitespace changes
Inline Side-by-side
Showing with 16 additions and 0 deletions
pkg/cloudprovider/providers/openstack/BUILD
View file @ e3c8a0ce
...@@ -54,6 +54,8 @@ go_library( ...@@ -54,6 +54,8 @@ go_library(
"//vendor:gopkg.in/gcfg.v1", "//vendor:gopkg.in/gcfg.v1",
"//vendor:k8s.io/apimachinery/pkg/api/resource", "//vendor:k8s.io/apimachinery/pkg/api/resource",
"//vendor:k8s.io/apimachinery/pkg/types", "//vendor:k8s.io/apimachinery/pkg/types",
"//vendor:k8s.io/apimachinery/pkg/util/net",
"//vendor:k8s.io/client-go/util/cert",
], ],
) )
......
pkg/cloudprovider/providers/openstack/openstack.go
View file @ e3c8a0ce
...@@ -17,6 +17,7 @@ limitations under the License. ...@@ -17,6 +17,7 @@ limitations under the License.
package openstack package openstack
import ( import (
"crypto/tls"
"errors" "errors"
"fmt" "fmt"
"io" "io"
...@@ -37,6 +38,8 @@ import ( ...@@ -37,6 +38,8 @@ import (
"github.com/golang/glog" "github.com/golang/glog"
"k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/types"
netutil "k8s.io/apimachinery/pkg/util/net"
certutil "k8s.io/client-go/util/cert"
"k8s.io/kubernetes/pkg/api/v1" "k8s.io/kubernetes/pkg/api/v1"
"k8s.io/kubernetes/pkg/cloudprovider" "k8s.io/kubernetes/pkg/cloudprovider"
) )
...@@ -118,6 +121,7 @@ type Config struct { ...@@ -118,6 +121,7 @@ type Config struct {
DomainId string `gcfg:"domain-id"` DomainId string `gcfg:"domain-id"`
DomainName string `gcfg:"domain-name"` DomainName string `gcfg:"domain-name"`
Region string Region string
CAFile string `gcfg:"ca-file"`
} }
LoadBalancer LoadBalancerOpts LoadBalancer LoadBalancerOpts
BlockStorage BlockStorageOpts BlockStorage BlockStorageOpts
...@@ -205,6 +209,16 @@ func newOpenStack(cfg Config) (*OpenStack, error) { ...@@ -205,6 +209,16 @@ func newOpenStack(cfg Config) (*OpenStack, error) {
if err != nil { if err != nil {
return nil, err return nil, err
} }
if cfg.Global.CAFile != "" {
roots, err := certutil.NewPool(cfg.Global.CAFile)
if err != nil {
return nil, err
}
config := &tls.Config{}
config.RootCAs = roots
provider.HTTPClient.Transport = netutil.SetOldTransportDefaults(&http.Transport{TLSClientConfig: config})
}
if cfg.Global.TrustId != "" { if cfg.Global.TrustId != "" {
authOptionsExt := trust.AuthOptionsExt{ authOptionsExt := trust.AuthOptionsExt{
TrustID: cfg.Global.TrustId, TrustID: cfg.Global.TrustId,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment