github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #75425 from liggitt/kubeadm-insecure-port 

Kubeadm insecure port
pull/564/head
Kubernetes Prow Robot 2019-03-16 17:24:55 -07:00 committed by GitHub
parent 1a24040447 d4591ea324
commit fe8b1e24ee
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cmd/kubeadm/app/phases/controlplane/manifests.go
View File

@ -137,6 +137,7 @@ func CreateStaticPodFiles(manifestDir string, cfg *kubeadmapi.ClusterConfigurati
func getAPIServerCommand(cfg *kubeadmapi.ClusterConfiguration, localAPIEndpoint *kubeadmapi.APIEndpoint) []string { func getAPIServerCommand(cfg *kubeadmapi.ClusterConfiguration, localAPIEndpoint *kubeadmapi.APIEndpoint) []string {
defaultArguments := map[string]string{ defaultArguments := map[string]string{
"advertise-address": localAPIEndpoint.AdvertiseAddress, "advertise-address": localAPIEndpoint.AdvertiseAddress,
"insecure-port": "0",
"enable-admission-plugins": "NodeRestriction", "enable-admission-plugins": "NodeRestriction",
"service-cluster-ip-range": cfg.Networking.ServiceSubnet, "service-cluster-ip-range": cfg.Networking.ServiceSubnet,
"service-account-key-file": filepath.Join(cfg.CertificatesDir, kubeadmconstants.ServiceAccountPublicKeyName), "service-account-key-file": filepath.Join(cfg.CertificatesDir, kubeadmconstants.ServiceAccountPublicKeyName),

12
cmd/kubeadm/app/phases/controlplane/manifests_test.go
View File

@ -148,6 +148,7 @@ func TestGetAPIServerCommand(t *testing.T) {
endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"}, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"},
expected: []string{ expected: []string{
"kube-apiserver", "kube-apiserver",
"--insecure-port=0",
"--enable-admission-plugins=NodeRestriction", "--enable-admission-plugins=NodeRestriction",
"--service-cluster-ip-range=bar", "--service-cluster-ip-range=bar",
"--service-account-key-file=" + testCertsDir + "/sa.pub", "--service-account-key-file=" + testCertsDir + "/sa.pub",
@ -184,6 +185,7 @@ func TestGetAPIServerCommand(t *testing.T) {
endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "2001:db8::1"}, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "2001:db8::1"},
expected: []string{ expected: []string{
"kube-apiserver", "kube-apiserver",
"--insecure-port=0",
"--enable-admission-plugins=NodeRestriction", "--enable-admission-plugins=NodeRestriction",
"--service-cluster-ip-range=bar", "--service-cluster-ip-range=bar",
"--service-account-key-file=" + testCertsDir + "/sa.pub", "--service-account-key-file=" + testCertsDir + "/sa.pub",
@ -228,6 +230,7 @@ func TestGetAPIServerCommand(t *testing.T) {
endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "2001:db8::1"}, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "2001:db8::1"},
expected: []string{ expected: []string{
"kube-apiserver", "kube-apiserver",
"--insecure-port=0",
"--enable-admission-plugins=NodeRestriction", "--enable-admission-plugins=NodeRestriction",
"--service-cluster-ip-range=bar", "--service-cluster-ip-range=bar",
"--service-account-key-file=" + testCertsDir + "/sa.pub", "--service-account-key-file=" + testCertsDir + "/sa.pub",
@ -269,6 +272,7 @@ func TestGetAPIServerCommand(t *testing.T) {
endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "2001:db8::1"}, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "2001:db8::1"},
expected: []string{ expected: []string{
"kube-apiserver", "kube-apiserver",
"--insecure-port=0",
"--enable-admission-plugins=NodeRestriction", "--enable-admission-plugins=NodeRestriction",
"--service-cluster-ip-range=bar", "--service-cluster-ip-range=bar",
"--service-account-key-file=" + testCertsDir + "/sa.pub", "--service-account-key-file=" + testCertsDir + "/sa.pub",
@ -312,6 +316,7 @@ func TestGetAPIServerCommand(t *testing.T) {
endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"}, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"},
expected: []string{ expected: []string{
"kube-apiserver", "kube-apiserver",
"--insecure-port=0",
"--enable-admission-plugins=NodeRestriction", "--enable-admission-plugins=NodeRestriction",
"--service-cluster-ip-range=baz", "--service-cluster-ip-range=baz",
"--service-account-key-file=" + testCertsDir + "/sa.pub", "--service-account-key-file=" + testCertsDir + "/sa.pub",
@ -357,6 +362,7 @@ func TestGetAPIServerCommand(t *testing.T) {
endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"}, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"},
expected: []string{ expected: []string{
"kube-apiserver", "kube-apiserver",
"--insecure-port=0",
"--enable-admission-plugins=NodeRestriction", "--enable-admission-plugins=NodeRestriction",
"--service-cluster-ip-range=bar", "--service-cluster-ip-range=bar",
"--service-account-key-file=" + testCertsDir + "/sa.pub", "--service-account-key-file=" + testCertsDir + "/sa.pub",
@ -385,14 +391,14 @@ func TestGetAPIServerCommand(t *testing.T) {
}, },
}, },
{ {
name: "secure-port extra-args", name: "insecure-port extra-args",
cfg: &kubeadmapi.ClusterConfiguration{ cfg: &kubeadmapi.ClusterConfiguration{
Networking: kubeadmapi.Networking{ServiceSubnet: "bar"}, Networking: kubeadmapi.Networking{ServiceSubnet: "bar"},
CertificatesDir: testCertsDir, CertificatesDir: testCertsDir,
APIServer: kubeadmapi.APIServer{ APIServer: kubeadmapi.APIServer{
ControlPlaneComponent: kubeadmapi.ControlPlaneComponent{ ControlPlaneComponent: kubeadmapi.ControlPlaneComponent{
ExtraArgs: map[string]string{ ExtraArgs: map[string]string{
"secure-port": "123", "insecure-port": "1234",
}, },
}, },
}, },
@ -400,6 +406,7 @@ func TestGetAPIServerCommand(t *testing.T) {
endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"}, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"},
expected: []string{ expected: []string{
"kube-apiserver", "kube-apiserver",
"--insecure-port=1234",
"--enable-admission-plugins=NodeRestriction", "--enable-admission-plugins=NodeRestriction",
"--service-cluster-ip-range=bar", "--service-cluster-ip-range=bar",
"--service-account-key-file=" + testCertsDir + "/sa.pub", "--service-account-key-file=" + testCertsDir + "/sa.pub",
@ -443,6 +450,7 @@ func TestGetAPIServerCommand(t *testing.T) {
endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"}, endpoint: &kubeadmapi.APIEndpoint{BindPort: 123, AdvertiseAddress: "1.2.3.4"},
expected: []string{ expected: []string{
"kube-apiserver", "kube-apiserver",
"--insecure-port=0",
"--enable-admission-plugins=NodeRestriction", "--enable-admission-plugins=NodeRestriction",
"--service-cluster-ip-range=bar", "--service-cluster-ip-range=bar",
"--service-account-key-file=" + testCertsDir + "/sa.pub", "--service-account-key-file=" + testCertsDir + "/sa.pub",

2
cmd/kubeadm/app/phases/selfhosting/selfhosting_test.go
View File

@ -52,6 +52,7 @@ spec:
- --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
- --advertise-address=192.168.1.115 - --advertise-address=192.168.1.115
- --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
- --insecure-port=0
- --experimental-bootstrap-token-auth=true - --experimental-bootstrap-token-auth=true
- --requestheader-username-headers=X-Remote-User - --requestheader-username-headers=X-Remote-User
- --requestheader-extra-headers-prefix=X-Remote-Extra- - --requestheader-extra-headers-prefix=X-Remote-Extra-
@ -134,6 +135,7 @@ spec:
- --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
- --advertise-address=$(HOST_IP) - --advertise-address=$(HOST_IP)
- --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
- --insecure-port=0
- --experimental-bootstrap-token-auth=true - --experimental-bootstrap-token-auth=true
- --requestheader-username-headers=X-Remote-User - --requestheader-username-headers=X-Remote-User
- --requestheader-extra-headers-prefix=X-Remote-Extra- - --requestheader-extra-headers-prefix=X-Remote-Extra-