Updates kube-apiserver configuration for KUBE_ADMISSION_CONTROL

[navidshaikh]

Fixes: #75

Removes ServiceAccount from the value of KUBE_ADMISSION_CONTROL variable
in /etc/kubernetes/apiserver

[LalatenduMohanty]

@navidshaikh I dont understand why we need to remove "ServiceAccount". We need more details.

[liggitt]

Removing it is not correct. The correct change is to set up the signing key for service account token generation

[liggitt]

See kubernetes/kubernetes#11355 (comment)

[navidshaikh]

@liggitt : ACK!

Chose location for key at /etc/pki/kube-apiserver/ rather using /tmp/, thoughts?

[liggitt]

sure, whatever path is appropriate

[LalatenduMohanty]

@navidshaikh do u have a scratch build with this patch? Also the patch looks like 2 commits. I think it should be just one commit as the previous commit not relevant anymore.

[dustymabe]

@navidshaikh This looks wrong:

sed -i.back '/KUBE_API_ARGS=*/c\KUBE_API_ARGS="/etc/pki/kube-apiserver/serviceaccount.key"' /etc/kubernetes/apiserver

Shouldn't it be KUBE_API_ARGS=--service_account_key_file=/etc/pki/kube-apiserver/serviceaccount.key ?

[jasonbrooks]

FWIW, this is how it looks when configured w/ https://github.com/kubernetes/contrib/tree/master/ansible:

KUBE_API_ARGS="--tls-cert-file=/etc/kubernetes/certs/server.crt --tls-private-key-file=/etc/kubernetes/certs/server.key --client-ca-file=/etc/kubernetes/certs/ca.crt --token-auth-file=/etc/kubernetes/tokens/known_tokens.csv --service-account-key-file=/etc/kubernetes/certs/server.crt"

[LalatenduMohanty]

LGTM. Scratch build by @navidshaikh at http://cbs.centos.org/koji/taskinfo?taskID=29206

[LalatenduMohanty]

Scratch build is working fine.

 1  ls
    2  kubectl get nodes
    3  systemctl status docker
    4  atomic run projectatomic/helloapache
    5  kubectl get pods
    6  history 
    7  kubectl get pods
    8  curl localhost

[vagrant@localhost ~]$ kubectl get pods
NAME          READY     STATUS    RESTARTS   AGE
helloapache   1/1       Running   0          2m

[vincentvdk]

Hi,
Just stumbled on this thread because i have a similar issue deploying the load-balancer (kubernetes contrib). On the latest F23 images the ServiceAccount is left out. When adding it, i need to generate the certs and add

KUBE_API_ARGS="--service_account_key_file=/path/secret.key"

I'm building my own Ansible playbooks so not a big deal, but I couldn't find this in the docs on the ProjectAtomic website. Also not sure if this should be the default or not.