UPSTREAM: 44639: Set fed apiserver to bind to 8443 instead of 443
@@ -43,6 +43,7 @@ import (
"k8s.io/apimachinery/pkg/api/resource"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+ "k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/apimachinery/pkg/util/uuid"
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/client-go/tools/clientcmd"
@@ -92,6 +93,12 @@ const (
apiserverAdvertiseAddressFlag = "api-server-advertise-address"
dnsProviderSecretName = "federation-dns-provider.conf"
+
+ apiServerSecurePortName = "https"
+ // Set the secure port to 8443 to avoid requiring root privileges
+ // to bind to port < 1000. The apiserver's service will still
+ // expose on port 443.
+ apiServerSecurePort = 8443
)
var (
@@ -439,6 +446,7 @@ func createService(clientset client.Interface, namespace, svcName, apiserverAdve
Name: "https",
Protocol: "TCP",
Port: 443,
+ TargetPort: intstr.FromString(apiServerSecurePortName),
},
},
},
@@ -657,7 +665,7 @@ func createAPIServer(clientset client.Interface, namespace, name, image, adverti
argsMap := map[string]string{
"--bind-address": "0.0.0.0",
"--etcd-servers": "http://localhost:2379",
- "--secure-port": "443",
+ "--secure-port": fmt.Sprintf("%d", apiServerSecurePort),
"--client-ca-file": "/etc/federation/apiserver/ca.crt",
"--tls-cert-file": "/etc/federation/apiserver/server.crt",
"--tls-private-key-file": "/etc/federation/apiserver/server.key",
@@ -698,8 +706,8 @@ func createAPIServer(clientset client.Interface, namespace, name, image, adverti
Command: command,
Ports: []api.ContainerPort{
{
- Name: "https",
- ContainerPort: 443,
+ Name: apiServerSecurePortName,
+ ContainerPort: apiServerSecurePort,
},
{
Name: "local",
