add client-ca to configmap in kube-public

cmd/kube-apiserver/app/server.go

@@ -22,6 +22,7 @@ package app
 import (
 	"crypto/tls"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -331,9 +332,26 @@ func Run(s *options.ServerRunOptions) error {
 		return err
 	}
 
+	clientCA, err := readCAorNil(s.Authentication.ClientCert.ClientCA)
+	if err != nil {
+		return err
+	}
+	requestHeaderProxyCA, err := readCAorNil(s.Authentication.RequestHeader.ClientCAFile)
+	if err != nil {
+		return err
+	}
 	config := &master.Config{
 		GenericConfig: genericConfig,
 
+		ClientCARegistrationHook: master.ClientCARegistrationHook{
+			ClientCA:                         clientCA,
+			RequestHeaderUsernameHeaders:     s.Authentication.RequestHeader.UsernameHeaders,
+			RequestHeaderGroupHeaders:        s.Authentication.RequestHeader.GroupHeaders,
+			RequestHeaderExtraHeaderPrefixes: s.Authentication.RequestHeader.ExtraHeaderPrefixes,
+			RequestHeaderCA:                  requestHeaderProxyCA,
+			RequestHeaderAllowedNames:        s.Authentication.RequestHeader.AllowedNames,
+		},
+
 		APIResourceConfigSource: storageFactory.APIResourceConfigSource,
 		StorageFactory:          storageFactory,
 		EnableCoreControllers:   true,
@@ -372,6 +390,13 @@ func Run(s *options.ServerRunOptions) error {
 	return nil
 }
 
+func readCAorNil(file string) ([]byte, error) {
+	if len(file) == 0 {
+		return nil, nil
+	}
+	return ioutil.ReadFile(file)
+}
+
 // PostProcessSpec adds removed definitions for backward compatibility
 func postProcessOpenAPISpecForBackwardCompatibility(s *spec.Swagger) (*spec.Swagger, error) {
 	compatibilityMap := map[string]string{

pkg/master/BUILD

@@ -11,6 +11,7 @@ load(
 go_library(
     name = "go_default_library",
     srcs = [
+        "client_ca_hook.go",
         "controller.go",
         "doc.go",
         "import_known_versions.go",
@@ -90,6 +91,7 @@ go_library(
 go_test(
     name = "go_default_test",
     srcs = [
+        "client_ca_hook_test.go",
         "controller_test.go",
         "import_known_versions_test.go",
         "master_openapi_test.go",
@@ -125,6 +127,7 @@ go_test(
         "//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
         "//vendor:k8s.io/apimachinery/pkg/runtime",
         "//vendor:k8s.io/apimachinery/pkg/runtime/schema",
+        "//vendor:k8s.io/apimachinery/pkg/util/diff",
         "//vendor:k8s.io/apimachinery/pkg/util/intstr",
         "//vendor:k8s.io/apimachinery/pkg/util/net",
         "//vendor:k8s.io/apimachinery/pkg/util/sets",

pkg/master/client_ca_hook.go

@@ -0,0 +1,124 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package master
+
+import (
+	"encoding/json"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	genericapiserver "k8s.io/apiserver/pkg/server"
+	"k8s.io/kubernetes/pkg/api"
+	coreclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/internalversion"
+)
+
+type ClientCARegistrationHook struct {
+	ClientCA []byte
+
+	RequestHeaderUsernameHeaders     []string
+	RequestHeaderGroupHeaders        []string
+	RequestHeaderExtraHeaderPrefixes []string
+	RequestHeaderCA                  []byte
+	RequestHeaderAllowedNames        []string
+}
+
+func (h ClientCARegistrationHook) PostStartHook(hookContext genericapiserver.PostStartHookContext) error {
+	if len(h.ClientCA) == 0 && len(h.RequestHeaderCA) == 0 {
+		return nil
+	}
+
+	client, err := coreclient.NewForConfig(hookContext.LoopbackClientConfig)
+	if err != nil {
+		utilruntime.HandleError(err)
+		return nil
+	}
+
+	h.writeClientCAs(client)
+	return nil
+}
+
+// writeClientCAs is here for unit testing with a fake client
+func (h ClientCARegistrationHook) writeClientCAs(client coreclient.CoreInterface) {
+	if _, err := client.Namespaces().Create(&api.Namespace{ObjectMeta: metav1.ObjectMeta{Name: metav1.NamespaceSystem}}); err != nil && !apierrors.IsAlreadyExists(err) {
+		utilruntime.HandleError(err)
+		return
+	}
+
+	data := map[string]string{}
+	if len(h.ClientCA) > 0 {
+		data["client-ca-file"] = string(h.ClientCA)
+	}
+
+	if len(h.RequestHeaderCA) > 0 {
+		var err error
+
+		data["requestheader-username-headers"], err = jsonSerializeStringSlice(h.RequestHeaderUsernameHeaders)
+		if err != nil {
+			utilruntime.HandleError(err)
+			return
+		}
+		data["requestheader-group-headers"], err = jsonSerializeStringSlice(h.RequestHeaderGroupHeaders)
+		if err != nil {
+			utilruntime.HandleError(err)
+			return
+		}
+		data["requestheader-extra-headers-prefix"], err = jsonSerializeStringSlice(h.RequestHeaderExtraHeaderPrefixes)
+		if err != nil {
+			utilruntime.HandleError(err)
+			return
+		}
+		data["requestheader-client-ca-file"] = string(h.RequestHeaderCA)
+		data["requestheader-allowed-names"], err = jsonSerializeStringSlice(h.RequestHeaderAllowedNames)
+		if err != nil {
+			utilruntime.HandleError(err)
+			return
+		}
+	}
+
+	if err := writeConfigMap(client, "extension-apiserver-authentication", data); err != nil {
+		utilruntime.HandleError(err)
+	}
+
+	return
+}
+
+func jsonSerializeStringSlice(in []string) (string, error) {
+	out, err := json.Marshal(in)
+	if err != nil {
+		return "", err
+	}
+	return string(out), err
+}
+
+func writeConfigMap(client coreclient.ConfigMapsGetter, name string, data map[string]string) error {
+	existing, err := client.ConfigMaps(metav1.NamespaceSystem).Get(name, metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		_, err := client.ConfigMaps(metav1.NamespaceSystem).Create(&api.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{Namespace: metav1.NamespaceSystem, Name: name},
+			Data:       data,
+		})
+		return err
+	}
+	if err != nil {
+		return err
+	}
+
+	existing.Data = data
+	_, err = client.ConfigMaps(metav1.NamespaceSystem).Update(existing)
+	return err
+}