Skip to content

Commit a1650b2

Browse files
author
dlorenc
committed
Stop using insecure serving.
1 parent 29a7d71 commit a1650b2

File tree

14 files changed

+168
-71
lines changed

14 files changed

+168
-71
lines changed

‎deploy/addons/addon-manager.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ spec:
2626
containers:
2727
- name: kube-addon-manager
2828
image: gcr.io/google-containers/kube-addon-manager:v6.4-beta.2
29+
env:
30+
- name: KUBECONFIG
31+
value: /var/lib/localkube/kubeconfig
2932
imagePullPolicy: IfNotPresent
3033
resources:
3134
requests:
@@ -35,7 +38,13 @@ spec:
3538
- mountPath: /etc/kubernetes/
3639
name: addons
3740
readOnly: true
41+
- mountPath: /var/lib/localkube
42+
name: kubeconfig
43+
readOnly: true
3844
volumes:
3945
- hostPath:
4046
path: /etc/kubernetes/
4147
name: addons
48+
- hostPath:
49+
path: /var/lib/localkube
50+
name: kubeconfig

‎hack/jenkins/linux_integration_tests_none.sh

+2-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ OS_ARCH="linux-amd64"
3030
VM_DRIVER="none"
3131
JOB_NAME="Linux-None"
3232
EXTRA_BUILD_ARGS="$EXTRA_BUILD_ARGS --use-vendored-driver"
33-
SUDO_PREFIX="sudo "
33+
SUDO_PREFIX="sudo -E "
34+
export KUBECONFIG="/root/.kube/config"
3435

3536
# Download files and set permissions
3637
source common.sh

‎pkg/localkube/apiserver.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ func StartAPIServer(lk LocalkubeServer) func() error {
3939
config.SecureServing.BindAddress = lk.APIServerAddress
4040
config.SecureServing.BindPort = lk.APIServerPort
4141

42-
config.InsecureServing.BindAddress = lk.APIServerInsecureAddress
43-
config.InsecureServing.BindPort = lk.APIServerInsecurePort
42+
// 0 turns off insecure serving.
43+
config.InsecureServing.BindPort = 0
4444

4545
config.Authentication.ClientCert.ClientCA = lk.GetCAPublicKeyCertPath()
4646

@@ -84,7 +84,7 @@ func StartAPIServer(lk LocalkubeServer) func() error {
8484
}
8585

8686
func readyFunc(lk LocalkubeServer) HealthCheck {
87-
hostport := net.JoinHostPort(lk.APIServerInsecureAddress.String(), strconv.Itoa(lk.APIServerInsecurePort))
88-
addr := "http://" + path.Join(hostport, "healthz")
89-
return healthCheck(addr)
87+
hostport := net.JoinHostPort("localhost", strconv.Itoa(lk.APIServerPort))
88+
addr := "https://" + path.Join(hostport, "healthz")
89+
return healthCheck(addr, lk)
9090
}

‎pkg/localkube/controller-manager.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ package localkube
1919
import (
2020
controllerManager "k8s.io/kubernetes/cmd/kube-controller-manager/app"
2121
"k8s.io/kubernetes/cmd/kube-controller-manager/app/options"
22+
"k8s.io/minikube/pkg/util"
2223
)
2324

2425
func (lk LocalkubeServer) NewControllerManagerServer() Server {
@@ -28,7 +29,7 @@ func (lk LocalkubeServer) NewControllerManagerServer() Server {
2829
func StartControllerManagerServer(lk LocalkubeServer) func() error {
2930
config := options.NewCMServer()
3031

31-
config.Master = lk.GetAPIServerInsecureURL()
32+
config.Kubeconfig = util.DefaultKubeConfigPath
3233

3334
// defaults from command
3435
config.DeletingPodsQps = 0.1

‎pkg/localkube/kubelet.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,10 @@ limitations under the License.
1717
package localkube
1818

1919
import (
20+
"k8s.io/apiserver/pkg/util/flag"
2021
kubelet "k8s.io/kubernetes/cmd/kubelet/app"
2122
"k8s.io/kubernetes/cmd/kubelet/app/options"
23+
"k8s.io/minikube/pkg/util"
2224
)
2325

2426
func (lk LocalkubeServer) NewKubeletServer() Server {
@@ -29,7 +31,8 @@ func StartKubeletServer(lk LocalkubeServer) func() error {
2931
config := options.NewKubeletServer()
3032

3133
// Master details
32-
config.APIServerList = []string{lk.GetAPIServerInsecureURL()}
34+
config.KubeConfig = flag.NewStringFlag(util.DefaultKubeConfigPath)
35+
config.RequireKubeConfig = true
3336

3437
// Set containerized based on the flag
3538
config.Containerized = lk.Containerized

‎pkg/localkube/proxy.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package localkube
1818

1919
import (
2020
kubeproxy "k8s.io/kubernetes/cmd/kube-proxy/app"
21+
"k8s.io/minikube/pkg/util"
2122

2223
"time"
2324

@@ -40,16 +41,17 @@ func StartProxyServer(lk LocalkubeServer) func() error {
4041
config := &componentconfig.KubeProxyConfiguration{
4142
OOMScoreAdj: &OOMScoreAdj,
4243
ClientConnection: componentconfig.ClientConnectionConfiguration{
43-
Burst: 10,
44-
QPS: 5,
44+
Burst: 10,
45+
QPS: 5,
46+
KubeConfigFile: util.DefaultKubeConfigPath,
4547
},
4648
ConfigSyncPeriod: v1.Duration{Duration: 15 * time.Minute},
4749
IPTables: componentconfig.KubeProxyIPTablesConfiguration{
4850
MasqueradeBit: &MasqueradeBit,
4951
SyncPeriod: v1.Duration{Duration: 30 * time.Second},
5052
MinSyncPeriod: v1.Duration{Duration: 5 * time.Second},
5153
},
52-
BindAddress: lk.APIServerInsecureAddress.String(),
54+
BindAddress: lk.APIServerAddress.String(),
5355
Mode: componentconfig.ProxyModeIPTables,
5456
FeatureGates: lk.FeatureGates,
5557
// Disable the healthz check
@@ -60,7 +62,7 @@ func StartProxyServer(lk LocalkubeServer) func() error {
6062

6163
return func() error {
6264
// Creating this config requires the API Server to be up, so do it in the start function itself.
63-
server, err := kubeproxy.NewProxyServer(config, false, runtime.NewScheme(), lk.GetAPIServerInsecureURL())
65+
server, err := kubeproxy.NewProxyServer(config, false, runtime.NewScheme(), "")
6466
if err != nil {
6567
panic(err)
6668
}

‎pkg/localkube/ready.go

+27-2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ limitations under the License.
1717
package localkube
1818

1919
import (
20+
"crypto/tls"
21+
"crypto/x509"
2022
"io/ioutil"
2123
"net/http"
2224

@@ -25,10 +27,33 @@ import (
2527

2628
type HealthCheck func() bool
2729

28-
func healthCheck(addr string) HealthCheck {
30+
func healthCheck(addr string, lk LocalkubeServer) HealthCheck {
2931
return func() bool {
3032
glog.Infof("Performing healthcheck on %s\n", addr)
31-
resp, err := http.Get(addr)
33+
34+
cert, err := tls.LoadX509KeyPair(lk.GetPublicKeyCertPath(), lk.GetPrivateKeyCertPath())
35+
if err != nil {
36+
glog.Error(err)
37+
return false
38+
}
39+
40+
// Load CA cert
41+
caCert, err := ioutil.ReadFile(lk.GetCAPublicKeyCertPath())
42+
if err != nil {
43+
glog.Warning(err)
44+
return false
45+
}
46+
caCertPool := x509.NewCertPool()
47+
caCertPool.AppendCertsFromPEM(caCert)
48+
tlsConfig := &tls.Config{
49+
Certificates: []tls.Certificate{cert},
50+
RootCAs: caCertPool,
51+
}
52+
tlsConfig.BuildNameToCertificate()
53+
transport := &http.Transport{TLSClientConfig: tlsConfig}
54+
client := &http.Client{Transport: transport}
55+
56+
resp, err := client.Get(addr)
3257
if err != nil {
3358
glog.Errorf("Error performing healthcheck: %s", err)
3459
return false

‎pkg/localkube/scheduler.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ package localkube
1919
import (
2020
scheduler "k8s.io/kubernetes/plugin/cmd/kube-scheduler/app"
2121
"k8s.io/kubernetes/plugin/cmd/kube-scheduler/app/options"
22+
"k8s.io/minikube/pkg/util"
2223
)
2324

2425
func (lk LocalkubeServer) NewSchedulerServer() Server {
@@ -29,7 +30,7 @@ func StartSchedulerServer(lk LocalkubeServer) func() error {
2930
config := options.NewSchedulerServer()
3031

3132
// master details
32-
config.Master = lk.GetAPIServerInsecureURL()
33+
config.Kubeconfig = util.DefaultKubeConfigPath
3334

3435
// defaults from command
3536
config.EnableProfiling = true

‎pkg/localkube/storage_provisioner.go

+7-6
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,8 @@ import (
3232
"k8s.io/apimachinery/pkg/util/wait"
3333
"k8s.io/client-go/kubernetes"
3434
"k8s.io/client-go/pkg/api/v1"
35-
"k8s.io/client-go/rest"
35+
"k8s.io/client-go/tools/clientcmd"
36+
"k8s.io/minikube/pkg/util"
3637
)
3738

3839
const (
@@ -121,12 +122,12 @@ func (lk LocalkubeServer) NewStorageProvisionerServer() Server {
121122

122123
func StartStorageProvisioner(lk LocalkubeServer) func() error {
123124

124-
// Create an InClusterConfig and use it to create a client for the controller
125-
// to use to communicate with Kubernetes
126-
config := rest.Config{Host: "http://localhost:8080"}
127125
return func() error {
128-
129-
clientset, err := kubernetes.NewForConfig(&config)
126+
config, err := clientcmd.BuildConfigFromFlags("", util.DefaultKubeConfigPath)
127+
if err != nil {
128+
return err
129+
}
130+
clientset, err := kubernetes.NewForConfig(config)
130131
if err != nil {
131132
glog.Fatalf("Failed to create client: %v", err)
132133
}

‎pkg/minikube/assets/addons.go

+28-28
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,12 @@ import (
2828
)
2929

3030
type Addon struct {
31-
Assets []*MemoryAsset
31+
Assets []*BinDataAsset
3232
enabled bool
3333
addonName string
3434
}
3535

36-
func NewAddon(assets []*MemoryAsset, enabled bool, addonName string) *Addon {
36+
func NewAddon(assets []*BinDataAsset, enabled bool, addonName string) *Addon {
3737
a := &Addon{
3838
Assets: assets,
3939
enabled: enabled,
@@ -55,107 +55,107 @@ func (a *Addon) IsEnabled() (bool, error) {
5555
}
5656

5757
var Addons = map[string]*Addon{
58-
"addon-manager": NewAddon([]*MemoryAsset{
59-
NewMemoryAsset(
58+
"addon-manager": NewAddon([]*BinDataAsset{
59+
NewBinDataAsset(
6060
"deploy/addons/addon-manager.yaml",
6161
"/etc/kubernetes/manifests/",
6262
"addon-manager.yaml",
6363
"0640"),
6464
}, true, "addon-manager"),
65-
"dashboard": NewAddon([]*MemoryAsset{
66-
NewMemoryAsset(
65+
"dashboard": NewAddon([]*BinDataAsset{
66+
NewBinDataAsset(
6767
"deploy/addons/dashboard/dashboard-rc.yaml",
6868
constants.AddonsPath,
6969
"dashboard-rc.yaml",
7070
"0640"),
71-
NewMemoryAsset(
71+
NewBinDataAsset(
7272
"deploy/addons/dashboard/dashboard-svc.yaml",
7373
constants.AddonsPath,
7474
"dashboard-svc.yaml",
7575
"0640"),
7676
}, true, "dashboard"),
77-
"default-storageclass": NewAddon([]*MemoryAsset{
78-
NewMemoryAsset(
77+
"default-storageclass": NewAddon([]*BinDataAsset{
78+
NewBinDataAsset(
7979
"deploy/addons/storageclass/storageclass.yaml",
8080
constants.AddonsPath,
8181
"storageclass.yaml",
8282
"0640"),
8383
}, true, "default-storageclass"),
84-
"kube-dns": NewAddon([]*MemoryAsset{
85-
NewMemoryAsset(
84+
"kube-dns": NewAddon([]*BinDataAsset{
85+
NewBinDataAsset(
8686
"deploy/addons/kube-dns/kube-dns-controller.yaml",
8787
constants.AddonsPath,
8888
"kube-dns-controller.yaml",
8989
"0640"),
90-
NewMemoryAsset(
90+
NewBinDataAsset(
9191
"deploy/addons/kube-dns/kube-dns-cm.yaml",
9292
constants.AddonsPath,
9393
"kube-dns-cm.yaml",
9494
"0640"),
95-
NewMemoryAsset(
95+
NewBinDataAsset(
9696
"deploy/addons/kube-dns/kube-dns-svc.yaml",
9797
constants.AddonsPath,
9898
"kube-dns-svc.yaml",
9999
"0640"),
100100
}, true, "kube-dns"),
101-
"heapster": NewAddon([]*MemoryAsset{
102-
NewMemoryAsset(
101+
"heapster": NewAddon([]*BinDataAsset{
102+
NewBinDataAsset(
103103
"deploy/addons/heapster/influxGrafana-rc.yaml",
104104
constants.AddonsPath,
105105
"influxGrafana-rc.yaml",
106106
"0640"),
107-
NewMemoryAsset(
107+
NewBinDataAsset(
108108
"deploy/addons/heapster/grafana-svc.yaml",
109109
constants.AddonsPath,
110110
"grafana-svc.yaml",
111111
"0640"),
112-
NewMemoryAsset(
112+
NewBinDataAsset(
113113
"deploy/addons/heapster/influxdb-svc.yaml",
114114
constants.AddonsPath,
115115
"influxdb-svc.yaml",
116116
"0640"),
117-
NewMemoryAsset(
117+
NewBinDataAsset(
118118
"deploy/addons/heapster/heapster-rc.yaml",
119119
constants.AddonsPath,
120120
"heapster-rc.yaml",
121121
"0640"),
122-
NewMemoryAsset(
122+
NewBinDataAsset(
123123
"deploy/addons/heapster/heapster-svc.yaml",
124124
constants.AddonsPath,
125125
"heapster-svc.yaml",
126126
"0640"),
127127
}, false, "heapster"),
128-
"ingress": NewAddon([]*MemoryAsset{
129-
NewMemoryAsset(
128+
"ingress": NewAddon([]*BinDataAsset{
129+
NewBinDataAsset(
130130
"deploy/addons/ingress/ingress-configmap.yaml",
131131
constants.AddonsPath,
132132
"ingress-configmap.yaml",
133133
"0640"),
134-
NewMemoryAsset(
134+
NewBinDataAsset(
135135
"deploy/addons/ingress/ingress-rc.yaml",
136136
constants.AddonsPath,
137137
"ingress-rc.yaml",
138138
"0640"),
139-
NewMemoryAsset(
139+
NewBinDataAsset(
140140
"deploy/addons/ingress/ingress-svc.yaml",
141141
constants.AddonsPath,
142142
"ingress-svc.yaml",
143143
"0640"),
144144
}, false, "ingress"),
145-
"registry": NewAddon([]*MemoryAsset{
146-
NewMemoryAsset(
145+
"registry": NewAddon([]*BinDataAsset{
146+
NewBinDataAsset(
147147
"deploy/addons/registry/registry-rc.yaml",
148148
constants.AddonsPath,
149149
"registry-rc.yaml",
150150
"0640"),
151-
NewMemoryAsset(
151+
NewBinDataAsset(
152152
"deploy/addons/registry/registry-svc.yaml",
153153
constants.AddonsPath,
154154
"registry-svc.yaml",
155155
"0640"),
156156
}, false, "registry"),
157-
"registry-creds": NewAddon([]*MemoryAsset{
158-
NewMemoryAsset(
157+
"registry-creds": NewAddon([]*BinDataAsset{
158+
NewBinDataAsset(
159159
"deploy/addons/registry-creds/registry-creds-rc.yaml",
160160
constants.AddonsPath,
161161
"registry-creds-rc.yaml",

0 commit comments

Comments
 (0)