kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use consistent ServiceAccountJWKSURI default for PublicJWKS

This commit is contained in:
John Gardiner Myers 2021-05-06 00:15:15 -07:00
parent a79da8ee86
commit d21cb0f306
2 changed files with 3 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pkg/model/components/discovery.go
View File

@ -17,8 +17,6 @@ limitations under the License.
package components package components
import ( import (
"strings"
"k8s.io/kops/pkg/apis/kops" "k8s.io/kops/pkg/apis/kops"
"k8s.io/kops/pkg/featureflag" "k8s.io/kops/pkg/featureflag"
"k8s.io/kops/pkg/model/iam" "k8s.io/kops/pkg/model/iam"
@ -64,14 +62,9 @@ func (b *DiscoveryOptionsBuilder) BuildOptions(o interface{}) error {
kubeAPIServer.FeatureGates = make(map[string]string) kubeAPIServer.FeatureGates = make(map[string]string)
} }
kubeAPIServer.FeatureGates["ServiceAccountIssuerDiscovery"] = "true" kubeAPIServer.FeatureGates["ServiceAccountIssuerDiscovery"] = "true"
}
if kubeAPIServer.ServiceAccountJWKSURI == nil { if kubeAPIServer.ServiceAccountJWKSURI == nil {
jwksURL := *kubeAPIServer.ServiceAccountIssuer
jwksURL = strings.TrimSuffix(jwksURL, "/") + "/keys.json"
kubeAPIServer.ServiceAccountJWKSURI = &jwksURL
}
} else if kubeAPIServer.ServiceAccountJWKSURI == nil {
jwksURI, err := iam.ServiceAccountIssuer(clusterSpec) jwksURI, err := iam.ServiceAccountIssuer(clusterSpec)
if err != nil { if err != nil {
return err return err

2
tests/integration/update_cluster/public-jwks-apiserver/data/aws_launch_template_master-us-test-1a.masters.minimal.example.com_user_data
View File

@ -208,7 +208,7 @@ kubeAPIServer:
- X-Remote-User - X-Remote-User
securePort: 443 securePort: 443
serviceAccountIssuer: https://discovery.example.com/minimal.example.com/oidc serviceAccountIssuer: https://discovery.example.com/minimal.example.com/oidc
serviceAccountJWKSURI: https://discovery.example.com/minimal.example.com/oidc/keys.json serviceAccountJWKSURI: https://discovery.example.com/minimal.example.com/oidc/openid/v1/jwks
serviceClusterIPRange: 100.64.0.0/13 serviceClusterIPRange: 100.64.0.0/13
storageBackend: etcd3 storageBackend: etcd3
kubeControllerManager: kubeControllerManager: