BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

kubernetes module: webhook authorization for kubelet

Browse source
This commit is contained in:
Jaka Hudoklin 2017-09-01 12:20:10 +02:00 committed by Robin Gloster
parent 7c893623d4
commit 9d97c92d68
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
nixos/modules/services/cluster/kubernetes/default.nix
View file

@ -334,7 +334,7 @@ in {
Api runtime configuration. See
<link xlink:href="http://kubernetes.io/docs/admin/cluster-management.html"/>
'';
default = "";
default = "authentication.k8s.io/v1beta1=true";
example = "api/all=false,api/v1=true";
type = types.str;
};
@ -535,6 +535,12 @@ in {
type = types.nullOr types.path;
};
clientCaFile = mkOption {
description = "Kubernetes apiserver CA file for client authentication.";
default = cfg.caFile;
type = types.nullOr types.path;
};
healthz = {
bind = mkOption {
description = "Kubernetes kubelet healthz listening address.";
@ -794,6 +800,11 @@ in {
"--tls-cert-file=${cfg.kubelet.tlsCertFile}"} \
${optionalString (cfg.kubelet.tlsKeyFile != null)
"--tls-private-key-file=${cfg.kubelet.tlsKeyFile}"} \
${optionalString (cfg.kubelet.clientCaFile != null)
"--client-ca-file=${cfg.kubelet.clientCaFile}"} \
--authentication-token-webhook \
--authentication-token-webhook-cache-ttl="10s" \
--authorization-mode=Webhook \
--healthz-bind-address=${cfg.kubelet.healthz.bind} \
--healthz-port=${toString cfg.kubelet.healthz.port} \
--hostname-override=${cfg.kubelet.hostname} \