From 61a21e903f96671d57443fe1e56a3ca1a83933c0 Mon Sep 17 00:00:00 2001 From: CJ Cullen Date: Fri, 23 Feb 2018 10:58:37 -0800 Subject: [PATCH] Allow TTLs to be plumbed through to webhook authn/authz in gce scripts. --- cluster/gce/gci/configure-helper.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/cluster/gce/gci/configure-helper.sh b/cluster/gce/gci/configure-helper.sh index 5c200490d6..e3affc5669 100644 --- a/cluster/gce/gci/configure-helper.sh +++ b/cluster/gce/gci/configure-helper.sh @@ -1690,6 +1690,9 @@ function start-kube-apiserver { params+=" --authentication-token-webhook-config-file=/etc/gcp_authn.config" webhook_authn_config_mount="{\"name\": \"webhookauthnconfigmount\",\"mountPath\": \"/etc/gcp_authn.config\", \"readOnly\": false}," webhook_authn_config_volume="{\"name\": \"webhookauthnconfigmount\",\"hostPath\": {\"path\": \"/etc/gcp_authn.config\", \"type\": \"FileOrCreate\"}}," + if [[ -n "${GCP_AUTHN_CACHE_TTL:-}" ]]; then + params+=" --authentication-token-webhook-cache-ttl=${GCP_AUTHN_CACHE_TTL}" + fi fi @@ -1721,6 +1724,12 @@ function start-kube-apiserver { params+=" --authorization-webhook-config-file=/etc/gcp_authz.config" webhook_config_mount="{\"name\": \"webhookconfigmount\",\"mountPath\": \"/etc/gcp_authz.config\", \"readOnly\": false}," webhook_config_volume="{\"name\": \"webhookconfigmount\",\"hostPath\": {\"path\": \"/etc/gcp_authz.config\", \"type\": \"FileOrCreate\"}}," + if [[ -n "${GCP_AUTHZ_CACHE_AUTHORIZED_TTL:-}" ]]; then + params+=" --authorization-webhook-cache-authorized-ttl=${GCP_AUTHZ_CACHE_AUTHORIZED_TTL}" + fi + if [[ -n "${GCP_AUTHZ_CACHE_UNAUTHORIZED_TTL:-}" ]]; then + params+=" --authorization-webhook-cache-unauthorized-ttl=${GCP_AUTHZ_CACHE_UNAUTHORIZED_TTL}" + fi fi authorization_mode="Node,${authorization_mode}" params+=" --authorization-mode=${authorization_mode}"