public/k3s
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/k3s.git synced 2026-07-28 23:39:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add anonymous-auth to flags gated on empty authorization-config value

Browse Source 
Also warn if default flags are not set due to user provided config

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 921e502918)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
This commit is contained in:
Brad Davidson
2025-05-06 20:02:26 +00:00
committed by Brad Davidson
parent 4242f22883
commit bc389abf52
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/daemons/control/server.go
View File

@@ -212,7 +212,9 @@ func apiServer(ctx context.Context, cfg *config.Control) error {
argsMap["allow-privileged"] = "true"
argsMap["enable-bootstrap-token-auth"] = "true"
if authConfigFile := util.ArgValue("authorization-config", cfg.ExtraAPIArgs); authConfigFile == "" {
logrus.Warn("Not setting kube-apiserver 'authorization-mode' and 'anonymous-auth' flags due to user-provided 'authorization-config' file.")
argsMap["authorization-mode"] = strings.Join([]string{modes.ModeNode, modes.ModeRBAC}, ",")
argsMap["anonymous-auth"] = "false"
}
argsMap["service-account-signing-key-file"] = runtime.ServiceCurrentKey
argsMap["service-cluster-ip-range"] = util.JoinIPNets(cfg.ServiceIPRanges)
@@ -253,7 +255,6 @@ func apiServer(ctx context.Context, cfg *config.Control) error {
argsMap["requestheader-username-headers"] = "X-Remote-User"
argsMap["client-ca-file"] = runtime.ClientCA
argsMap["enable-admission-plugins"] = "NodeRestriction"
argsMap["anonymous-auth"] = "false"
argsMap["profiling"] = "false"
if cfg.EncryptSecrets {
argsMap["encryption-provider-config"] = runtime.EncryptionConfig

3
pkg/daemons/control/server_test.go
View File

@@ -112,11 +112,12 @@ func Test_UnitServer(t *testing.T) {
executor := mock.NewExecutorWithEmbeddedETCD(t)
// authorization-mode should not be set when user sets --authorization-config
// authorization-mode and anonymous-auth should not be set when user sets --authorization-config
control.ExtraAPIArgs = []string{"authorization-config=/dev/null"}
matchAuthArgs := mock.GM(And(
ContainElement(ContainSubstring("--authorization-config")),
Not(ContainElement(ContainSubstring("--authorization-mode"))),
Not(ContainElement(ContainSubstring("--anonymous-auth"))),
))
// leader-elect should be disabled when using kine+sqlite