UPSTREAM: <drop>: wait for loopback permissions, remove after updating loopback authenticator
@@ -20,12 +20,16 @@ import (
"errors"
"fmt"
"net/http"
+ "time"
"github.com/golang/glog"
+ "k8s.io/kubernetes/pkg/api"
+ coreclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/internalversion"
"k8s.io/kubernetes/pkg/client/restclient"
"k8s.io/kubernetes/pkg/healthz"
utilruntime "k8s.io/kubernetes/pkg/util/runtime"
+ "k8s.io/kubernetes/pkg/util/wait"
)
// PostStartHookFunc is a function that is called after the server has started.
@@ -93,6 +97,22 @@ func (s *GenericAPIServer) RunPostStartHooks() {
context := PostStartHookContext{LoopbackClientConfig: s.LoopbackClientConfig}
+ // we need to wait until our loopback client has enough rights to actually loopback
+ // the core APIs cannot be disabled, so we'll use that as a proxy for the information instead
+ // of attempting a SAR (which can be disabled, though that would be a very bad idea)
+ // TODO remove once openshift starts using the kube loopback connection.
+ err := wait.PollImmediate(30*time.Millisecond, 30*time.Second, func() (bool, error) {
+ client := coreclient.NewForConfigOrDie(s.LoopbackClientConfig)
+ // we can have other errors in our level, like etcd not being up. Treat them all the same
+ if _, err := client.Namespaces().List(api.ListOptions{}); err != nil {
+ return false, nil
+ }
+ return true, nil
+ })
+ if err != nil {
+ glog.Fatalf("LoopbackClient was unable to list namespaces: %v", err)
+ }
+
for hookName, hookEntry := range s.postStartHooks {
go runPostStartHook(hookName, hookEntry, context)
}
