From c8f47fd79c99237252184578cfc2afd034b206cc Mon Sep 17 00:00:00 2001 From: "Dr. Stefan Schimanski" Date: Wed, 5 Sep 2018 09:11:45 +0200 Subject: [PATCH 1/2] apiserver: fix misleading delegated authn/z warnings Kubernetes-commit: 059fce63b755ef6052db273fd6c91f3090036389 --- pkg/server/options/authentication.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/server/options/authentication.go b/pkg/server/options/authentication.go index 5a08faabc..2df58f985 100644 --- a/pkg/server/options/authentication.go +++ b/pkg/server/options/authentication.go @@ -230,10 +230,10 @@ func (s *DelegatingAuthenticationOptions) lookupMissingConfigInCluster(client ku } if client == nil { if len(s.ClientCert.ClientCA) == 0 { - glog.Warningf("No authentication-kubeconfig provided in order to lookup client-ca-file in configmap/%s in %s, so client certificate authentication to extension api-server won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) + glog.Warningf("No authentication-kubeconfig provided in order to lookup client-ca-file in configmap/%s in %s, so client certificate authentication won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) } if len(s.RequestHeader.ClientCAFile) == 0 { - glog.Warningf("No authentication-kubeconfig provided in order to lookup requestheader-client-ca-file in configmap/%s in %s, so request-header client certificate authentication to extension api-server won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) + glog.Warningf("No authentication-kubeconfig provided in order to lookup requestheader-client-ca-file in configmap/%s in %s, so request-header client certificate authentication won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) } return nil } @@ -262,7 +262,7 @@ func (s *DelegatingAuthenticationOptions) lookupMissingConfigInCluster(client ku } } if len(s.ClientCert.ClientCA) == 0 { - glog.Warningf("Cluster doesn't provide client-ca-file in configmap/%s in %s, so client certificate authentication to extension api-server won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) + glog.Warningf("Cluster doesn't provide client-ca-file in configmap/%s in %s, so client certificate authentication won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) } } @@ -277,7 +277,7 @@ func (s *DelegatingAuthenticationOptions) lookupMissingConfigInCluster(client ku } } if len(s.RequestHeader.ClientCAFile) == 0 { - glog.Warningf("Cluster doesn't provide requestheader-client-ca-file in configmap/%s in %s, so request-header client certificate authentication to extension api-server won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) + glog.Warningf("Cluster doesn't provide requestheader-client-ca-file in configmap/%s in %s, so request-header client certificate authentication won't work.", authenticationConfigMapName, authenticationConfigMapNamespace) } } From 1a58e1c6ad64a3443b38d1b2d91a5b6579cfaff0 Mon Sep 17 00:00:00 2001 From: "Dr. Stefan Schimanski" Date: Wed, 5 Sep 2018 09:12:19 +0200 Subject: [PATCH 2/2] apiserver: make InClusterConfig errs for delegated authn/z non-fatal Kubernetes-commit: 04e793e65ad70df5c4ab280c42740864e54163cd --- pkg/server/options/authentication.go | 7 +++++-- pkg/server/options/authorization.go | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/pkg/server/options/authentication.go b/pkg/server/options/authentication.go index 2df58f985..5c8209c35 100644 --- a/pkg/server/options/authentication.go +++ b/pkg/server/options/authentication.go @@ -364,9 +364,12 @@ func (s *DelegatingAuthenticationOptions) getClient() (kubernetes.Interface, err clientConfig, err = loader.ClientConfig() } else { // without the remote kubeconfig file, try to use the in-cluster config. Most addon API servers will - // use this path + // use this path. If it is optional, ignore errors. clientConfig, err = rest.InClusterConfig() - if err == rest.ErrNotInCluster && s.RemoteKubeConfigFileOptional { + if err != nil && s.RemoteKubeConfigFileOptional { + if err != rest.ErrNotInCluster { + glog.Warningf("failed to read in-cluster kubeconfig for delegated authentication: %v", err) + } return nil, nil } } diff --git a/pkg/server/options/authorization.go b/pkg/server/options/authorization.go index a014d94a2..7c65dd391 100644 --- a/pkg/server/options/authorization.go +++ b/pkg/server/options/authorization.go @@ -151,9 +151,12 @@ func (s *DelegatingAuthorizationOptions) getClient() (kubernetes.Interface, erro clientConfig, err = loader.ClientConfig() } else { // without the remote kubeconfig file, try to use the in-cluster config. Most addon API servers will - // use this path + // use this path. If it is optional, ignore errors. clientConfig, err = rest.InClusterConfig() - if err == rest.ErrNotInCluster && s.RemoteKubeConfigFileOptional { + if err != nil && s.RemoteKubeConfigFileOptional { + if err != rest.ErrNotInCluster { + glog.Warningf("failed to read in-cluster kubeconfig for delegated authorization: %v", err) + } return nil, nil } }