From 1a58e1c6ad64a3443b38d1b2d91a5b6579cfaff0 Mon Sep 17 00:00:00 2001 From: "Dr. Stefan Schimanski" Date: Wed, 5 Sep 2018 09:12:19 +0200 Subject: [PATCH] apiserver: make InClusterConfig errs for delegated authn/z non-fatal Kubernetes-commit: 04e793e65ad70df5c4ab280c42740864e54163cd --- pkg/server/options/authentication.go | 7 +++++-- pkg/server/options/authorization.go | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/pkg/server/options/authentication.go b/pkg/server/options/authentication.go index 2df58f985..5c8209c35 100644 --- a/pkg/server/options/authentication.go +++ b/pkg/server/options/authentication.go @@ -364,9 +364,12 @@ func (s *DelegatingAuthenticationOptions) getClient() (kubernetes.Interface, err clientConfig, err = loader.ClientConfig() } else { // without the remote kubeconfig file, try to use the in-cluster config. Most addon API servers will - // use this path + // use this path. If it is optional, ignore errors. clientConfig, err = rest.InClusterConfig() - if err == rest.ErrNotInCluster && s.RemoteKubeConfigFileOptional { + if err != nil && s.RemoteKubeConfigFileOptional { + if err != rest.ErrNotInCluster { + glog.Warningf("failed to read in-cluster kubeconfig for delegated authentication: %v", err) + } return nil, nil } } diff --git a/pkg/server/options/authorization.go b/pkg/server/options/authorization.go index a014d94a2..7c65dd391 100644 --- a/pkg/server/options/authorization.go +++ b/pkg/server/options/authorization.go @@ -151,9 +151,12 @@ func (s *DelegatingAuthorizationOptions) getClient() (kubernetes.Interface, erro clientConfig, err = loader.ClientConfig() } else { // without the remote kubeconfig file, try to use the in-cluster config. Most addon API servers will - // use this path + // use this path. If it is optional, ignore errors. clientConfig, err = rest.InClusterConfig() - if err == rest.ErrNotInCluster && s.RemoteKubeConfigFileOptional { + if err != nil && s.RemoteKubeConfigFileOptional { + if err != rest.ErrNotInCluster { + glog.Warningf("failed to read in-cluster kubeconfig for delegated authorization: %v", err) + } return nil, nil } }