Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kubelet / Master Authentication Options #2831

Merged
merged 1 commit into from
Jul 1, 2017
Merged

Kubelet / Master Authentication Options #2831

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions pkg/apis/kops/componentconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,11 @@ type KubeletConfigSpec struct {
// not used for clusters version 1.6 and later - flag removed
APIServers string `json:"apiServers,omitempty" flag:"api-servers"`

// AnonymousAuth permits you to control auth to the kubelet api
AnonymousAuth *bool `json:"anonymousAuth,omitempty" flag:"anonymous-auth"`
// ClientCAFile is the path to a CA certificate
ClientCAFile string `json:"clientCaFile,omitempty" flag:"client-ca-file"`

// kubeconfigPath is the path to the kubeconfig file with authorization
// information and API server location
// kops will only use this for clusters version 1.6 and later
Expand Down Expand Up @@ -414,6 +419,9 @@ type KubeAPIServerConfig struct {
// TODO: Remove unused TLSPrivateKeyFile
TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"`

KubeletClientCertificate string `json:"kubeletClientCertificate,omitempty" flag:"kubelet-client-certificate"`
KubeletClientKey string `json:"kubeletClientKey,omitempty" flag:"kubelet-client-key"`

// TODO: Remove unused TokenAuthFile
TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"`

Expand Down
8 changes: 8 additions & 0 deletions pkg/apis/kops/v1alpha1/componentconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,11 @@ type KubeletConfigSpec struct {
// not used for clusters version 1.6 and later
APIServers string `json:"apiServers,omitempty" flag:"api-servers"`

// AnonymousAuth chooses if you want anonymous auth on the kubelet api
AnonymousAuth *bool `json:"anonymousAuth,omitempty" flag:"anonymous-auth"`
// ClientCAFile is the path to a file container the CA certificate
ClientCAFile string `json:"clientCaFile,omitempty" flag:"client-ca-file"`

// kubeconfigPath is the path to the kubeconfig file with authorization
// information and API server location
// kops will only use this for clusters version 1.6 and later
Expand Down Expand Up @@ -408,6 +413,9 @@ type KubeAPIServerConfig struct {
APIServerCount *int32 `json:"apiServerCount,omitempty" flag:"apiserver-count"`
RuntimeConfig map[string]string `json:"runtimeConfig,omitempty" flag:"runtime-config"`

KubeletClientCertificate string `json:"kubeletClientCertificate,omitempty" flag:"kubelet-client-certificate"`
KubeletClientKey string `json:"kubeletClientKey,omitempty" flag:"kubelet-client-key"`

AnonymousAuth *bool `json:"anonymousAuth,omitempty" flag:"anonymous-auth"`

KubeletPreferredAddressTypes []string `json:"kubeletPreferredAddressTypes,omitempty" flag:"kubelet-preferred-address-types"`
Expand Down
8 changes: 8 additions & 0 deletions pkg/apis/kops/v1alpha1/zz_generated.conversion.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1203,6 +1203,8 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.BasicAuthFile = in.BasicAuthFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.KubeletClientCertificate = in.KubeletClientCertificate
out.KubeletClientKey = in.KubeletClientKey
out.TokenAuthFile = in.TokenAuthFile
out.AllowPrivileged = in.AllowPrivileged
out.APIServerCount = in.APIServerCount
Expand Down Expand Up @@ -1247,6 +1249,8 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.KubeletClientCertificate = in.KubeletClientCertificate
out.KubeletClientKey = in.KubeletClientKey
out.TokenAuthFile = in.TokenAuthFile
out.AllowPrivileged = in.AllowPrivileged
out.APIServerCount = in.APIServerCount
Expand Down Expand Up @@ -1428,9 +1432,11 @@ func Convert_kops_KubeSchedulerConfig_To_v1alpha1_KubeSchedulerConfig(in *kops.K

func autoConvert_v1alpha1_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *KubeletConfigSpec, out *kops.KubeletConfigSpec, s conversion.Scope) error {
out.APIServers = in.APIServers
out.AnonymousAuth = in.AnonymousAuth
out.KubeconfigPath = in.KubeconfigPath
out.RequireKubeconfig = in.RequireKubeconfig
out.LogLevel = in.LogLevel
out.ClientCAFile = in.ClientCAFile
out.PodManifestPath = in.PodManifestPath
out.HostnameOverride = in.HostnameOverride
out.AllowPrivileged = in.AllowPrivileged
Expand Down Expand Up @@ -1476,9 +1482,11 @@ func Convert_v1alpha1_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *KubeletCon

func autoConvert_kops_KubeletConfigSpec_To_v1alpha1_KubeletConfigSpec(in *kops.KubeletConfigSpec, out *KubeletConfigSpec, s conversion.Scope) error {
out.APIServers = in.APIServers
out.AnonymousAuth = in.AnonymousAuth
out.KubeconfigPath = in.KubeconfigPath
out.RequireKubeconfig = in.RequireKubeconfig
out.LogLevel = in.LogLevel
out.ClientCAFile = in.ClientCAFile
out.PodManifestPath = in.PodManifestPath
out.HostnameOverride = in.HostnameOverride
out.AllowPrivileged = in.AllowPrivileged
Expand Down
8 changes: 8 additions & 0 deletions pkg/apis/kops/v1alpha2/componentconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,11 @@ type KubeletConfigSpec struct {
// not used for clusters version 1.6 and later
APIServers string `json:"apiServers,omitempty" flag:"api-servers"`

// AnonymousAuth chooses if you want anonymous auth on the kubelet api
AnonymousAuth *bool `json:"anonymousAuth,omitempty" flag:"anonymous-auth"`
// The client CA which the requestes for the above must be signed by
ClientCAFile string `json:"clientCaFile,omitempty" flag:"client-ca-file"`

// kubeconfigPath is the path to the kubeconfig file with authorization
// information and API server location
// kops will only use this for clusters version 1.6 and later
Expand Down Expand Up @@ -196,6 +201,9 @@ type KubeAPIServerConfig struct {
// Use this to enable alpha resources on kube-apiserver
RuntimeConfig map[string]string `json:"runtimeConfig,omitempty" flag:"runtime-config"`

KubeletClientCertificate string `json:"kubeletClientCertificate,omitempty" flag:"kubelet-client-certificate"`
KubeletClientKey string `json:"kubeletClientKey,omitempty" flag:"kubelet-client-key"`

AnonymousAuth *bool `json:"anonymousAuth,omitempty" flag:"anonymous-auth"`

KubeletPreferredAddressTypes []string `json:"kubeletPreferredAddressTypes,omitempty" flag:"kubelet-preferred-address-types"`
Expand Down
8 changes: 8 additions & 0 deletions pkg/apis/kops/v1alpha2/zz_generated.conversion.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1301,6 +1301,8 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
out.BasicAuthFile = in.BasicAuthFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.KubeletClientCertificate = in.KubeletClientCertificate
out.KubeletClientKey = in.KubeletClientKey
out.TokenAuthFile = in.TokenAuthFile
out.AllowPrivileged = in.AllowPrivileged
out.APIServerCount = in.APIServerCount
Expand Down Expand Up @@ -1345,6 +1347,8 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko
out.ClientCAFile = in.ClientCAFile
out.TLSCertFile = in.TLSCertFile
out.TLSPrivateKeyFile = in.TLSPrivateKeyFile
out.KubeletClientCertificate = in.KubeletClientCertificate
out.KubeletClientKey = in.KubeletClientKey
out.TokenAuthFile = in.TokenAuthFile
out.AllowPrivileged = in.AllowPrivileged
out.APIServerCount = in.APIServerCount
Expand Down Expand Up @@ -1526,9 +1530,11 @@ func Convert_kops_KubeSchedulerConfig_To_v1alpha2_KubeSchedulerConfig(in *kops.K

func autoConvert_v1alpha2_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *KubeletConfigSpec, out *kops.KubeletConfigSpec, s conversion.Scope) error {
out.APIServers = in.APIServers
out.AnonymousAuth = in.AnonymousAuth
out.KubeconfigPath = in.KubeconfigPath
out.RequireKubeconfig = in.RequireKubeconfig
out.LogLevel = in.LogLevel
out.ClientCAFile = in.ClientCAFile
out.PodManifestPath = in.PodManifestPath
out.HostnameOverride = in.HostnameOverride
out.AllowPrivileged = in.AllowPrivileged
Expand Down Expand Up @@ -1574,9 +1580,11 @@ func Convert_v1alpha2_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *KubeletCon

func autoConvert_kops_KubeletConfigSpec_To_v1alpha2_KubeletConfigSpec(in *kops.KubeletConfigSpec, out *KubeletConfigSpec, s conversion.Scope) error {
out.APIServers = in.APIServers
out.AnonymousAuth = in.AnonymousAuth
out.KubeconfigPath = in.KubeconfigPath
out.RequireKubeconfig = in.RequireKubeconfig
out.LogLevel = in.LogLevel
out.ClientCAFile = in.ClientCAFile
out.PodManifestPath = in.PodManifestPath
out.HostnameOverride = in.HostnameOverride
out.AllowPrivileged = in.AllowPrivileged
Expand Down