refactor for dynamic audit enablement
@@ -13,11 +13,13 @@ import (
"k8s.io/apimachinery/pkg/util/sets"
genericapiserver "k8s.io/apiserver/pkg/server"
genericapiserveroptions "k8s.io/apiserver/pkg/server/options"
+ "k8s.io/apiserver/pkg/util/webhook"
cacheddiscovery "k8s.io/client-go/discovery/cached"
"k8s.io/client-go/informers"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/restmapper"
"k8s.io/client-go/tools/cache"
+ aggregatorapiserver "k8s.io/kube-aggregator/pkg/apiserver"
"k8s.io/kubernetes/pkg/api/legacyscheme"
openshiftcontrolplanev1 "github.com/openshift/api/openshiftcontrolplane/v1"
@@ -130,6 +132,17 @@ func NewOpenshiftAPIConfig(config *openshiftcontrolplanev1.OpenShiftAPIServerCon
return nil, err
}
+ informers, err := NewInformers(kubeInformers, kubeClientConfig, genericConfig.LoopbackClientConfig)
+ if err != nil {
+ return nil, err
+ }
+ if err := informers.GetOpenshiftUserInformers().User().V1().Groups().Informer().AddIndexers(cache.Indexers{
+ usercache.ByUserIndexName: usercache.ByUserIndexKeys,
+ }); err != nil {
+ return nil, err
+ }
+
+ authInfoResolverWrapper := webhook.NewDefaultAuthenticationInfoResolverWrapper(nil, genericConfig.LoopbackClientConfig)
auditFlags := configflags.AuditFlags(&config.AuditConfig, configflags.ArgsWithPrefix(config.APIServerArguments, "audit-"))
auditOpt := genericapiserveroptions.NewAuditOptions()
fs := pflag.NewFlagSet("audit", pflag.ContinueOnError)
@@ -140,17 +153,17 @@ func NewOpenshiftAPIConfig(config *openshiftcontrolplanev1.OpenShiftAPIServerCon
if errs := auditOpt.Validate(); len(errs) > 0 {
return nil, errors.NewAggregate(errs)
}
- if err := auditOpt.ApplyTo(&genericConfig.Config); err != nil {
- return nil, err
- }
-
- informers, err := NewInformers(kubeInformers, kubeClientConfig, genericConfig.LoopbackClientConfig)
- if err != nil {
- return nil, err
- }
- if err := informers.GetOpenshiftUserInformers().User().V1().Groups().Informer().AddIndexers(cache.Indexers{
- usercache.ByUserIndexName: usercache.ByUserIndexKeys,
- }); err != nil {
+ if err := auditOpt.ApplyTo(
+ &genericConfig.Config,
+ genericConfig.Config.LoopbackClientConfig,
+ informers.kubernetesInformers,
+ genericapiserveroptions.NewProcessInfo("openshift-apiserver", "openshift-apiserver"),
+ &genericapiserveroptions.WebhookOptions{
+ AuthInfoResolverWrapper: authInfoResolverWrapper,
+ // the openshift-apiserver runs on cluster as a normal pod, accessed by a service, so it should always have access to the service network
+ ServiceResolver: aggregatorapiserver.NewClusterIPServiceResolver(informers.kubernetesInformers.Core().V1().Services().Lister()),
+ },
+ ); err != nil {
return nil, err
}
