Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix service account issuer in case of custom cluster domain #21

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from

Conversation

vardhaman-surana
Copy link

@vardhaman-surana vardhaman-surana commented Dec 18, 2024

What issue type does this pull request address? (keep at least one, remove the others)
/kind bugfix

What does this pull request do? Which issues does it resolve? (use resolves #<issue_number> if possible)
The PR adds the correct service account issuer to the apiserver in case custom clusterdomain is set using networking.advanced.clusterDomain.
It also fixes _coredns.tpl in the chart to correctly use custom clusterdomain in coredns configuration.

Please provide a short message that should be published in the vcluster release notes
Fixed an issue where vcluster was setting wrong service account issuer in case of custom cluster domain.

What else do we need to know?

in case of the custom cluster domain the service account token for the vcluster pods is created with audiences

"https://kubernetes.default.svc.<custom-domain>", "https://kubernetes.default.svc", "https://kubernetes.default"

and because of the issuer set to https://kubernetes.default.svc.cluster.local the apiserver rejects the authentication request for the token. with the error

invalid bearer token, token audiences ["https://kubernetes.default.svc.<custom-domain>", "https://kubernetes.default.svc", "https://kubernetes.default"] is invalid for the target audiences ["https://kubernetes.default.svc.cluster.local"]

for k0s setting just the cluster domain in the config works. and for k3s users needs to use correct settings as below

networking:
  advanced:
    clusterDomain: "k8s.my-cluster"
controlPlane:
  distro:
    k3s:
      enabled: true
      extraArgs: ["--cluster-domain=k8s.my-cluster"]

@vardhaman-surana vardhaman-surana marked this pull request as ready for review December 18, 2024 05:07
@vardhaman-surana vardhaman-surana force-pushed the bugfix/custom-clusterdomain branch from 79443b7 to 2ed2297 Compare December 18, 2024 05:07
Copy link
Collaborator

@neogopher neogopher left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants