Use kubernetes.default for OIDC discovery in gossip clusters

It doesn't make sense to use a gossip hostname as the discovery url because it wont be resolveable. For gossip clusters that dont provide a public VFS store, we can at least use kubernetes.default for internal oidc usage.
kubernetes · May 12, 2021 · 9165309 · 9165309
1 parent 6dd743f
commit 9165309
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/pkg/model/iam/BUILD.bazel b/pkg/model/iam/BUILD.bazel
diff --git a/pkg/model/iam/subject.go b/pkg/model/iam/subject.go
@@ -23,6 +23,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/kops/pkg/apis/kops"
+	"k8s.io/kops/pkg/dns"
 	"k8s.io/kops/pkg/wellknownusers"
 	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/util/pkg/vfs"
@@ -136,6 +137,9 @@ func ServiceAccountIssuer(clusterSpec *kops.ClusterSpec) (string, error) {
 			return "", fmt.Errorf("locationStore=%q is of unexpected type %T", store, base)
 		}
 	} else {
+		if dns.IsGossipHostname(clusterSpec.MasterInternalName) {
+			return "https://kubernetes.default", nil
+		}
 		if supportsPublicJWKS(clusterSpec) {
 			return "https://" + clusterSpec.MasterPublicName, nil
 		}