read image import CAs from mounted configmap
@@ -4,10 +4,15 @@ import (
"crypto/tls"
"crypto/x509"
"fmt"
+ "io/ioutil"
"net/http"
+ "os"
+ "path/filepath"
"sync"
"time"
+ "github.com/golang/glog"
+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/serializer"
@@ -144,10 +149,29 @@ func (c *completedConfig) newV1RESTStorage() (map[string]rest.Storage, error) {
tlsConfig.RootCAs = x509.NewCertPool()
}
- if len(c.ExtraConfig.AdditionalTrustedCA) != 0 {
- if ok := tlsConfig.RootCAs.AppendCertsFromPEM(c.ExtraConfig.AdditionalTrustedCA); !ok {
- return nil, fmt.Errorf("No valid certificates read from %v", c.ExtraConfig.AdditionalTrustedCA)
+ err = filepath.Walk("/var/run/configmaps/image-import-ca", func(path string, info os.FileInfo, err error) error {
+ glog.V(2).Infof("reading image import ca path: %s, incoming err: %v", path, err)
+ if err != nil {
+ return err
+ }
+ if !info.Mode().IsRegular() {
+ glog.V(2).Infof("skipping dir or symlink: %s", path)
+ return nil
}
+ data, err := ioutil.ReadFile(path)
+ if err != nil {
+ glog.Errorf("error reading file: %s, err: %v", path, err)
+ // we don't want to abandon trying to read additional files
+ return nil
+ }
+ pemOk := tlsConfig.RootCAs.AppendCertsFromPEM(data)
+ if !pemOk {
+ glog.Errorf("unable to read certificate data from %s", path)
+ }
+ return nil
+ })
+ if err != nil {
+ glog.Errorf("unable to process additional image import certificates: %v", err)
}
transport := knet.SetTransportDefaults(&http.Transport{
