Skip to content

K
k3s
Commit 3cb4ca4b authored by Brad Davidson's avatar Brad Davidson Committed by Brad Davidson
Browse files
Options

Use same SANs on ServingKubeAPICert as dynamiclistener

The kube-apiserver cert should have the same SANs in the same order, excluding the extra user-configured SANs since this will only be used in-cluster. Signed-off-by: 's avatarBrad Davidson <brad.davidson@rancher.com>
parent 8f1a20c0
Hide whitespace changes
Inline Side-by-side
Showing with 3 additions and 3 deletions
pkg/daemons/control/deps/deps.go
View file @ 3cb4ca4b
......@@ -319,7 +319,7 @@ func genServerCerts(config *config.Control, runtime *config.ControlRuntime) erro
}
altNames := &certutil.AltNames{
DNSNames: []string{"kubernetes.default.svc", "kubernetes.default", "kubernetes", "localhost"},
DNSNames: []string{"localhost", "kubernetes", "kubernetes.default", "kubernetes.default.svc." + config.ClusterDomain},
IPs: []net.IP{apiServerServiceIP},
}
......
pkg/daemons/control/server.go
View file @ 3cb4ca4b
......@@ -172,8 +172,8 @@ func apiServer(ctx context.Context, cfg *config.Control, runtime *config.Control
argsMap["tls-cert-file"] = runtime.ServingKubeAPICert
argsMap["tls-private-key-file"] = runtime.ServingKubeAPIKey
argsMap["service-account-key-file"] = runtime.ServiceKey
argsMap["service-account-issuer"] = "https://kubernetes.default.svc.cluster.local"
argsMap["api-audiences"] = "https://kubernetes.default.svc.cluster.local," + version.Program
argsMap["service-account-issuer"] = "https://kubernetes.default.svc." + cfg.ClusterDomain
argsMap["api-audiences"] = "https://kubernetes.default.svc." + cfg.ClusterDomain + "," + version.Program
argsMap["kubelet-certificate-authority"] = runtime.ServerCA
argsMap["kubelet-client-certificate"] = runtime.ClientKubeAPICert
argsMap["kubelet-client-key"] = runtime.ClientKubeAPIKey
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment