kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9284 from johngmyers/remove-export-password 

Don't export basic auth credentials if basic auth is disabled
This commit is contained in:
Kubernetes Prow Robot 2020-06-08 08:39:47 -07:00 committed by GitHub
parent cd8681ccd0 49ea71dec9
commit 7650a988ce
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/kubeconfig/BUILD.bazel
View File

@ -11,6 +11,7 @@ go_library(
visibility = ["//visibility:public"],
deps = [
"//pkg/apis/kops:go_default_library",
"//pkg/apis/kops/util:go_default_library",
"//pkg/dns:go_default_library",
"//upup/pkg/fi:go_default_library",
"//vendor/k8s.io/client-go/rest:go_default_library",

20
pkg/kubeconfig/create_kubecfg.go
View File

@ -23,6 +23,7 @@ import (
"k8s.io/client-go/tools/clientcmd"
"k8s.io/klog"
"k8s.io/kops/pkg/apis/kops"
"k8s.io/kops/pkg/apis/kops/util"
"k8s.io/kops/pkg/dns"
"k8s.io/kops/upup/pkg/fi"
)
@ -127,7 +128,24 @@ func BuildKubecfg(cluster *kops.Cluster, keyStore fi.Keystore, secretStore fi.Se
b.Server = server
if secretStore != nil {
k8sVersion, err := util.ParseKubernetesVersion(cluster.Spec.KubernetesVersion)
if err != nil || k8sVersion == nil {
klog.Warningf("unable to parse KubernetesVersion %q", cluster.Spec.KubernetesVersion)
k8sVersion, _ = util.ParseKubernetesVersion("1.0.0")
}
basicAuthEnabled := false
if !util.IsKubernetesGTE("1.18", *k8sVersion) {
if cluster.Spec.KubeAPIServer == nil || cluster.Spec.KubeAPIServer.DisableBasicAuth == nil || !*cluster.Spec.KubeAPIServer.DisableBasicAuth {
basicAuthEnabled = true
}
} else if !util.IsKubernetesGTE("1.19", *k8sVersion) {
if cluster.Spec.KubeAPIServer != nil && cluster.Spec.KubeAPIServer.DisableBasicAuth != nil && !*cluster.Spec.KubeAPIServer.DisableBasicAuth {
basicAuthEnabled = true
}
}
if basicAuthEnabled && secretStore != nil {
secret, err := secretStore.FindSecret("kube")
if err != nil {
return nil, err