External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-03-11 14:39:39 -02:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2554 from georgejdli/fix-sa-token-signing

Browse Source 
Fix kubespray's ServiceAccount token signing keys
This commit is contained in:
Andreas Krüger
2018-03-31 09:59:22 +02:00
committed by GitHub
parent 2c89a02db3 572ab650db
commit d9418b1dc4
5 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/kubernetes/master/tasks/kubeadm-migrate-certs.yml
View File

@@ -9,4 +9,6 @@
- {src: apiserver-key.pem, dest: apiserver.key}
- {src: ca.pem, dest: ca.crt}
- {src: ca-key.pem, dest: ca.key}
- {src: service-account-key.pem, dest: sa.pub}
- {src: service-account-key.pem, dest: sa.key}
register: kubeadm_copy_old_certs

2
roles/kubernetes/master/templates/manifests/kube-apiserver.manifest.j2
View File

@@ -63,7 +63,7 @@ spec:
{% if kube_token_auth|default(true) %}
- --token-auth-file={{ kube_token_dir }}/known_tokens.csv
{% endif %}
- --service-account-key-file={{ kube_cert_dir }}/apiserver-key.pem
- --service-account-key-file={{ kube_cert_dir }}/service-account-key.pem
{% if kube_oidc_auth|default(false) and kube_oidc_url is defined and kube_oidc_client_id is defined %}
- --oidc-issuer-url={{ kube_oidc_url }}
- --oidc-client-id={{ kube_oidc_client_id }}

2
roles/kubernetes/master/templates/manifests/kube-controller-manager.manifest.j2
View File

@@ -29,7 +29,7 @@ spec:
- controller-manager
- --kubeconfig={{ kube_config_dir }}/kube-controller-manager-kubeconfig.yaml
- --leader-elect=true
- --service-account-private-key-file={{ kube_cert_dir }}/apiserver-key.pem
- --service-account-private-key-file={{ kube_cert_dir }}/service-account-key.pem
- --root-ca-file={{ kube_cert_dir }}/ca.pem
- --cluster-signing-cert-file={{ kube_cert_dir }}/ca.pem
- --cluster-signing-key-file={{ kube_cert_dir }}/ca-key.pem