From 4b27e6c8ee3495f4bd7118459f1d6fb9c0dece6c Mon Sep 17 00:00:00 2001 From: "fernando.carletti" Date: Wed, 8 Aug 2018 19:59:46 -0400 Subject: [PATCH] Add flag to disable Basic Auth. --- docs/cluster_spec.md | 10 ++++++++++ nodeup/pkg/model/kube_apiserver.go | 5 ++++- pkg/apis/kops/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha1/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha1/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha2/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha2/zz_generated.conversion.go | 2 ++ 7 files changed, 24 insertions(+), 1 deletion(-) diff --git a/docs/cluster_spec.md b/docs/cluster_spec.md index 0175b4c1b0712..a6e7b20032bb6 100644 --- a/docs/cluster_spec.md +++ b/docs/cluster_spec.md @@ -264,6 +264,16 @@ spec: serviceNodePortRange: 30000-33000 ``` +#### Disable Basic Auth + +This will disable the passing of the `--basic-auth-file` flag. + +```yaml +spec: + kubeAPIServer: + disableBasicAuth: true +``` + #### targetRamMb Memory limit for apiserver in MB (used to configure sizes of caches, etc.) diff --git a/nodeup/pkg/model/kube_apiserver.go b/nodeup/pkg/model/kube_apiserver.go index 42806ca438d29..422cb8c891c46 100644 --- a/nodeup/pkg/model/kube_apiserver.go +++ b/nodeup/pkg/model/kube_apiserver.go @@ -283,9 +283,12 @@ func (b *KubeAPIServerBuilder) buildPod() (*v1.Pod, error) { kubeAPIServer.ClientCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt") kubeAPIServer.TLSCertFile = filepath.Join(b.PathSrvKubernetes(), "server.cert") kubeAPIServer.TLSPrivateKeyFile = filepath.Join(b.PathSrvKubernetes(), "server.key") - kubeAPIServer.BasicAuthFile = filepath.Join(b.PathSrvKubernetes(), "basic_auth.csv") kubeAPIServer.TokenAuthFile = filepath.Join(b.PathSrvKubernetes(), "known_tokens.csv") + if !kubeAPIServer.DisableBasicAuth { + kubeAPIServer.BasicAuthFile = filepath.Join(b.PathSrvKubernetes(), "basic_auth.csv") + } + if b.UseEtcdTLS() { kubeAPIServer.EtcdCAFile = filepath.Join(b.PathSrvKubernetes(), "ca.crt") kubeAPIServer.EtcdCertFile = filepath.Join(b.PathSrvKubernetes(), "etcd-client.pem") diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index 94718d3546c96..494b47eb758fa 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -224,6 +224,8 @@ type KubeProxyConfig struct { type KubeAPIServerConfig struct { // Image is the docker container used Image string `json:"image,omitempty"` + // DisableBasicAuth removes the --basic-auth-file flag + DisableBasicAuth bool `json:"disableBasicAuth,omitempty"` // LogLevel is the logging level of the api LogLevel int32 `json:"logLevel,omitempty" flag:"v" flag-empty:"0"` // CloudProvider is the name of the cloudProvider we are using, aws, gce etcd diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index 8669377ff8d52..eb1691bfbd247 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -224,6 +224,8 @@ type KubeProxyConfig struct { type KubeAPIServerConfig struct { // Image is the docker container used Image string `json:"image,omitempty"` + // DisableBasicAuth removes the --basic-auth-file flag + DisableBasicAuth bool `json:"disableBasicAuth,omitempty"` // LogLevel is the logging level of the api LogLevel int32 `json:"logLevel,omitempty" flag:"v" flag-empty:"0"` // CloudProvider is the name of the cloudProvider we are using, aws, gce etcd diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 97f005eadabda..b0cd843d335ed 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -2163,6 +2163,7 @@ func Convert_kops_KopeioNetworkingSpec_To_v1alpha1_KopeioNetworkingSpec(in *kops func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAPIServerConfig, out *kops.KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image + out.DisableBasicAuth = in.DisableBasicAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort @@ -2236,6 +2237,7 @@ func Convert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAP func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *kops.KubeAPIServerConfig, out *KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image + out.DisableBasicAuth = in.DisableBasicAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 3d50d3a39f96e..097f0001abbfc 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -224,6 +224,8 @@ type KubeProxyConfig struct { type KubeAPIServerConfig struct { // Image is the docker container used Image string `json:"image,omitempty"` + // DisableBasicAuth removes the --basic-auth-file flag + DisableBasicAuth bool `json:"disableBasicAuth,omitempty"` // LogLevel is the logging level of the api LogLevel int32 `json:"logLevel,omitempty" flag:"v" flag-empty:"0"` // CloudProvider is the name of the cloudProvider we are using, aws, gce etcd diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 1afc069620d4b..89e62e3dc7b0e 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -2427,6 +2427,7 @@ func Convert_kops_KopeioNetworkingSpec_To_v1alpha2_KopeioNetworkingSpec(in *kops func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAPIServerConfig, out *kops.KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image + out.DisableBasicAuth = in.DisableBasicAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort @@ -2500,6 +2501,7 @@ func Convert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *KubeAP func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *kops.KubeAPIServerConfig, out *KubeAPIServerConfig, s conversion.Scope) error { out.Image = in.Image + out.DisableBasicAuth = in.DisableBasicAuth out.LogLevel = in.LogLevel out.CloudProvider = in.CloudProvider out.SecurePort = in.SecurePort