Merge pull request #9769 from brendandburns/secure

cluster/aws/config-default.sh

@@ -70,8 +70,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-true}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true

cluster/aws/config-test.sh

@@ -67,8 +67,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-false}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true

cluster/gce/config-default.sh

@@ -69,8 +69,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-gcp}" # options: elasticsearch,
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-true}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true

cluster/gce/config-test.sh

@@ -67,8 +67,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-true}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true

cluster/gce/coreos/helper.sh

@@ -84,7 +84,7 @@ ADMISSION_CONTROL=$(yaml-quote ${ADMISSION_CONTROL:-})
 MASTER_IP_RANGE=$(yaml-quote ${MASTER_IP_RANGE})
 KUBERNETES_MASTER_NAME=$(yaml-quote ${MASTER_NAME})
 ZONE=$(yaml-quote ${ZONE})
-EXTRA_DOCKER_OPTS=$(yaml-quote ${EXTRA_DOCKER_OPTS})
+EXTRA_DOCKER_OPTS=$(yaml-quote ${EXTRA_DOCKER_OPTS:-})
 ENABLE_DOCKER_REGISTRY_CACHE=$(yaml-quote ${ENABLE_DOCKER_REGISTRY_CACHE:-false})
 PROJECT_ID=$(yaml-quote ${PROJECT})
 KUBERNETES_CONTAINER_RUNTIME=$(yaml-quote ${CONTAINER_RUNTIME})

cluster/gce/debian/helper.sh

@@ -70,7 +70,7 @@ EOF
     cat >>$file <<EOF
 KUBERNETES_MASTER: "false"
 ZONE: $(yaml-quote ${ZONE})
-EXTRA_DOCKER_OPTS: $(yaml-quote ${EXTRA_DOCKER_OPTS})
+EXTRA_DOCKER_OPTS: $(yaml-quote ${EXTRA_DOCKER_OPTS:-})
 ENABLE_DOCKER_REGISTRY_CACHE: $(yaml-quote ${ENABLE_DOCKER_REGISTRY_CACHE:-false})
 KUBELET_CERT: $(yaml-quote ${KUBELET_CERT_BASE64:-})
 KUBELET_KEY: $(yaml-quote ${KUBELET_KEY_BASE64:-})

cluster/saltbase/salt/docker/default

 {% set docker_opts = "" -%}
-{% if grains.docker_opts is defined -%}
+{% if grains.docker_opts is defined and grains.docker_opts -%}
   {% set docker_opts = grains.docker_opts -%}
 {% endif -%}