dynamic reload cluster authentication info for aggregated API servers #85004
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
k8s-ci-robot
added
release-note-none
k8s-ci-robot
added
approved
deads2k
force-pushed
the
dynamic-agg-cert
branch
from
424bd7b
to
70a1beb
Compare
k8s-ci-robot
added
size/XL
deads2k
force-pushed
the
dynamic-agg-cert
branch
from
70a1beb
to
5984ada
Compare
k8s-ci-robot
added
size/XXL
deads2k
changed the title
k8s-ci-robot
added
release-note
deads2k
force-pushed
the
dynamic-agg-cert
branch
from
5984ada
to
0afeb3c
Compare
k8s-ci-robot
removed
the
approved
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: deads2k, sttts The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
tedyu
reviewed
Nov 13, 2019
| return result, err | ||
| } | ||
| proxyCACertFile := path.Join(s.SecureServing.ServerCert.CertDirectory, "proxy-ca.crt") | ||
| if err := ioutil.WriteFile(proxyCACertFile, testutil.EncodeCertPEM(proxySigningCert), 0644); err != nil { |
There was a problem hiding this comment.
Should the proxyCACertFile be deleted if there is error in subsequent handling in this func ?
tedyu
reviewed
Nov 13, 2019
|
|
||
| // check to see if we have a change. If the values are the same, do nothing. | ||
| existing, ok := uncastExisting.(*caBundleAndVerifier) | ||
| if !ok { |
There was a problem hiding this comment.
Should c.caBundle be unloaded (cleared) in this case ?
tedyu
reviewed
Nov 13, 2019
| return nil // this can happen if we've been unable load data from the apiserver for some reason | ||
| } | ||
|
|
||
| return c.caBundle.Load().(*caBundleAndVerifier).caBundle |
There was a problem hiding this comment.
Probably we should add verification that cast to *caBundleAndVerifier is successful.
tedyu
reviewed
Nov 13, 2019
| if err != nil { | ||
| return nil, err | ||
| } | ||
| defer conn.Close() |
There was a problem hiding this comment.
It seems we can directly close (without deferring)
tedyu
reviewed
Nov 13, 2019
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
| conn.Close() |
There was a problem hiding this comment.
conn.ConnectionState() depends on completed handshake.
I think we should check the return code from Close() where:
if c.handshakeComplete() {
alertErr = c.closeNotify()
If error is returned from Close(), most likely the assignment on line 77 wouldn't be useful.
There was a problem hiding this comment.
conn.ConnectionState() depends on completed handshake.
I think we should check the return code from Close() where:
if c.handshakeComplete() { alertErr = c.closeNotify()If error is returned from Close(), most likely the assignment on line 77 wouldn't be useful.
Yes, this is a reasonable change. Feel free to get me on slack to review/approve the change. Please update the rest of the file to be consistent.
tamalsaha
added a commit
to stashed/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to stashed/installer
that referenced
this pull request
May 31, 2020
#55) xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to kubevault/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to kubevault/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to kubevault/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to kubedb/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to kubedb/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to open-viz/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to open-viz/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to kubeshield/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to kubeshield/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to kubepack/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
tamalsaha
added a commit
to kubepack/installer
that referenced
this pull request
May 31, 2020
xref: kubernetes/kubernetes#85004 Signed-off-by: Tamal Saha <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #82141
Final step to automatically reload cluster authentication.
/kind bug
@kubernetes/sig-api-machinery-bugs
/priority important-soon