C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #1907 from mattymo/disable_anon_auth

Browse source 
Block anonymous auth requests to kubelet
This commit is contained in:
Spencer Smith 2017-11-02 12:01:39 -04:00 committed by GitHub
commit 4771716ab2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
roles/kubernetes/node/templates/kubelet.kubeadm.env.j2
View file

@ -28,6 +28,7 @@ KUBELET_HOSTNAME="--hostname-override={{ kube_override_hostname }}"
--node-status-update-frequency={{ kubelet_status_update_frequency }} \ --node-status-update-frequency={{ kubelet_status_update_frequency }} \
--cgroup-driver={{ kubelet_cgroup_driver|default(kubelet_cgroup_driver_detected) }} \ --cgroup-driver={{ kubelet_cgroup_driver|default(kubelet_cgroup_driver_detected) }} \
--docker-disable-shared-pid={{ kubelet_disable_shared_pid }} \ --docker-disable-shared-pid={{ kubelet_disable_shared_pid }} \
--anonymous-auth=false \
{% if kube_version | version_compare('v1.8', '<') %} {% if kube_version | version_compare('v1.8', '<') %}
--experimental-fail-swap-on={{ kubelet_fail_swap_on|default(true)}} \ --experimental-fail-swap-on={{ kubelet_fail_swap_on|default(true)}} \
{% else %} {% else %}

1
roles/kubernetes/node/templates/kubelet.standard.env.j2
View file

@ -17,6 +17,7 @@ KUBELET_HOSTNAME="--hostname-override={{ kube_override_hostname }}"
--client-ca-file={{ kube_cert_dir }}/ca.pem \ --client-ca-file={{ kube_cert_dir }}/ca.pem \
--tls-cert-file={{ kube_cert_dir }}/node-{{ inventory_hostname }}.pem \ --tls-cert-file={{ kube_cert_dir }}/node-{{ inventory_hostname }}.pem \
--tls-private-key-file={{ kube_cert_dir }}/node-{{ inventory_hostname }}-key.pem \ --tls-private-key-file={{ kube_cert_dir }}/node-{{ inventory_hostname }}-key.pem \
--anonymous-auth=false \
{% if kube_version | version_compare('v1.6', '>=') %} {% if kube_version | version_compare('v1.6', '>=') %}
{# flag got removed with 1.7.0 #} {# flag got removed with 1.7.0 #}
{% if kube_version | version_compare('v1.7', '<') %} {% if kube_version | version_compare('v1.7', '<') %}