Skip to content

Commit c786913

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#84744 from immutableT/isolate-etcd-config
Isolate configuration of etcd related parameters into a separate function.
2 parents 83b991a + f7bd545 commit c786913

File tree

3 files changed

+172
-39
lines changed

3 files changed

+172
-39
lines changed

‎cluster/gce/gci/apiserver_etcd_test.go‎

Lines changed: 126 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,132 @@ import (
2222
)
2323

2424
type kubeAPIServeETCDEnv struct {
25-
KubeHome string
26-
ETCDServers string
27-
CAKey string
28-
CACert string
29-
CACertPath string
30-
APIServerKey string
31-
APIServerCert string
32-
APIServerCertPath string
33-
APIServerKeyPath string
34-
ETCDKey string
35-
ETCDCert string
25+
KubeHome string
26+
ETCDServers string
27+
ETCDServersOverride string
28+
CAKey string
29+
CACert string
30+
CACertPath string
31+
APIServerKey string
32+
APIServerCert string
33+
APIServerCertPath string
34+
APIServerKeyPath string
35+
ETCDKey string
36+
ETCDCert string
37+
StorageBackend string
38+
StorageMediaType string
39+
CompactionInterval string
40+
}
41+
42+
func TestServerOverride(t *testing.T) {
43+
testCases := []struct {
44+
desc string
45+
env kubeAPIServeETCDEnv
46+
want []string
47+
}{
48+
{
49+
desc: "ETCD-SERVERS is not set - default override",
50+
want: []string{
51+
"--etcd-servers-overrides=/events#http://127.0.0.1:4002",
52+
},
53+
},
54+
{
55+
desc: "ETCD-SERVERS and ETCD_SERVERS_OVERRIDES iare set",
56+
env: kubeAPIServeETCDEnv{
57+
ETCDServers: "ETCDServers",
58+
ETCDServersOverride: "ETCDServersOverrides",
59+
},
60+
want: []string{
61+
"--etcd-servers-overrides=ETCDServersOverrides",
62+
},
63+
},
64+
}
65+
66+
for _, tc := range testCases {
67+
t.Run(tc.desc, func(t *testing.T) {
68+
c := newManifestTestCase(t, kubeAPIServerManifestFileName, kubeAPIServerStartFuncName, nil)
69+
defer c.tearDown()
70+
tc.env.KubeHome = c.kubeHome
71+
72+
c.mustInvokeFunc(
73+
tc.env,
74+
kubeAPIServerConfigScriptName,
75+
"etcd.template",
76+
"testdata/kube-apiserver/base.template",
77+
"testdata/kube-apiserver/etcd.template",
78+
)
79+
c.mustLoadPodFromManifest()
80+
81+
execArgs := c.pod.Spec.Containers[0].Command[2]
82+
for _, f := range tc.want {
83+
if !strings.Contains(execArgs, f) {
84+
t.Fatalf("Got %q, want it to contain %q", execArgs, f)
85+
}
86+
}
87+
})
88+
}
89+
}
90+
91+
func TestStorageOptions(t *testing.T) {
92+
testCases := []struct {
93+
desc string
94+
env kubeAPIServeETCDEnv
95+
want []string
96+
dontWant []string
97+
}{
98+
{
99+
desc: "storage options are supplied",
100+
env: kubeAPIServeETCDEnv{
101+
StorageBackend: "StorageBackend",
102+
StorageMediaType: "StorageMediaType",
103+
CompactionInterval: "1s",
104+
},
105+
want: []string{
106+
"--storage-backend=StorageBackend",
107+
"--storage-media-type=StorageMediaType",
108+
"--etcd-compaction-interval=1s",
109+
},
110+
},
111+
{
112+
desc: "storage options not not supplied",
113+
env: kubeAPIServeETCDEnv{},
114+
dontWant: []string{
115+
"--storage-backend",
116+
"--storage-media-type",
117+
"--etcd-compaction-interval",
118+
},
119+
},
120+
}
121+
122+
for _, tc := range testCases {
123+
t.Run(tc.desc, func(t *testing.T) {
124+
c := newManifestTestCase(t, kubeAPIServerManifestFileName, kubeAPIServerStartFuncName, nil)
125+
defer c.tearDown()
126+
tc.env.KubeHome = c.kubeHome
127+
128+
c.mustInvokeFunc(
129+
tc.env,
130+
kubeAPIServerConfigScriptName,
131+
"etcd.template",
132+
"testdata/kube-apiserver/base.template",
133+
"testdata/kube-apiserver/etcd.template",
134+
)
135+
c.mustLoadPodFromManifest()
136+
137+
execArgs := c.pod.Spec.Containers[0].Command[2]
138+
for _, f := range tc.want {
139+
if !strings.Contains(execArgs, f) {
140+
t.Fatalf("Got %q, want it to contain %q", execArgs, f)
141+
}
142+
}
143+
144+
for _, f := range tc.dontWant {
145+
if strings.Contains(execArgs, f) {
146+
t.Fatalf("Got %q, but it was not expected it to contain %q", execArgs, f)
147+
}
148+
}
149+
})
150+
}
36151
}
37152

38153
func TestTLSFlags(t *testing.T) {
@@ -89,7 +204,6 @@ func TestTLSFlags(t *testing.T) {
89204
t.Fatalf("Got %q, want it to contain %q", execArgs, f)
90205
}
91206
}
92-
93207
})
94208
}
95209
}

‎cluster/gce/gci/configure-kubeapiserver.sh‎

Lines changed: 42 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,43 @@
1313
# See the License for the specific language governing permissions and
1414
# limitations under the License.
1515

16+
17+
# Configures etcd related flags of kube-apiserver.
18+
function configure-etcd-params {
19+
local -n params_ref=$1
20+
21+
if [[ -n "${ETCD_APISERVER_CA_KEY:-}" && -n "${ETCD_APISERVER_CA_CERT:-}" && -n "${ETCD_APISERVER_SERVER_KEY:-}" && -n "${ETCD_APISERVER_SERVER_CERT:-}" && -n "${ETCD_APISERVER_CLIENT_KEY:-}" && -n "${ETCD_APISERVER_CLIENT_CERT:-}" ]]; then
22+
params_ref+=" --etcd-servers=${ETCD_SERVERS:-https://127.0.0.1:2379}"
23+
params_ref+=" --etcd-cafile=${ETCD_APISERVER_CA_CERT_PATH}"
24+
params_ref+=" --etcd-certfile=${ETCD_APISERVER_CLIENT_CERT_PATH}"
25+
params_ref+=" --etcd-keyfile=${ETCD_APISERVER_CLIENT_KEY_PATH}"
26+
elif [[ -z "${ETCD_APISERVER_CA_KEY:-}" && -z "${ETCD_APISERVER_CA_CERT:-}" && -z "${ETCD_APISERVER_SERVER_KEY:-}" && -z "${ETCD_APISERVER_SERVER_CERT:-}" && -z "${ETCD_APISERVER_CLIENT_KEY:-}" && -z "${ETCD_APISERVER_CLIENT_CERT:-}" ]]; then
27+
params_ref+=" --etcd-servers=${ETCD_SERVERS:-http://127.0.0.1:2379}"
28+
echo "WARNING: ALL of ETCD_APISERVER_CA_KEY, ETCD_APISERVER_CA_CERT, ETCD_APISERVER_SERVER_KEY, ETCD_APISERVER_SERVER_CERT, ETCD_APISERVER_CLIENT_KEY and ETCD_APISERVER_CLIENT_CERT are missing, mTLS between etcd server and kube-apiserver is not enabled."
29+
else
30+
echo "ERROR: Some of ETCD_APISERVER_CA_KEY, ETCD_APISERVER_CA_CERT, ETCD_APISERVER_SERVER_KEY, ETCD_APISERVER_SERVER_CERT, ETCD_APISERVER_CLIENT_KEY and ETCD_APISERVER_CLIENT_CERT are missing, mTLS between etcd server and kube-apiserver cannot be enabled. Please provide all mTLS credential."
31+
exit 1
32+
fi
33+
34+
if [[ -z "${ETCD_SERVERS:-}" ]]; then
35+
params_ref+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-/events#http://127.0.0.1:4002}"
36+
elif [[ -n "${ETCD_SERVERS_OVERRIDES:-}" ]]; then
37+
params_ref+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-}"
38+
fi
39+
40+
if [[ -n "${STORAGE_BACKEND:-}" ]]; then
41+
params_ref+=" --storage-backend=${STORAGE_BACKEND}"
42+
fi
43+
44+
if [[ -n "${STORAGE_MEDIA_TYPE:-}" ]]; then
45+
params_ref+=" --storage-media-type=${STORAGE_MEDIA_TYPE}"
46+
fi
47+
48+
if [[ -n "${ETCD_COMPACTION_INTERVAL_SEC:-}" ]]; then
49+
params_ref+=" --etcd-compaction-interval=${ETCD_COMPACTION_INTERVAL_SEC}s"
50+
fi
51+
}
52+
1653
# Starts kubernetes apiserver.
1754
# It prepares the log file, loads the docker image, calculates variables, sets them
1855
# in the manifest file, and then copies the manifest file to /etc/kubernetes/manifests.
@@ -34,23 +71,10 @@ function start-kube-apiserver {
3471
params+=" --allow-privileged=true"
3572
params+=" --cloud-provider=gce"
3673
params+=" --client-ca-file=${CA_CERT_BUNDLE_PATH}"
37-
if [[ -n "${ETCD_APISERVER_CA_KEY:-}" && -n "${ETCD_APISERVER_CA_CERT:-}" && -n "${ETCD_APISERVER_SERVER_KEY:-}" && -n "${ETCD_APISERVER_SERVER_CERT:-}" && -n "${ETCD_APISERVER_CLIENT_KEY:-}" && -n "${ETCD_APISERVER_CLIENT_CERT:-}" ]]; then
38-
params+=" --etcd-servers=${ETCD_SERVERS:-https://127.0.0.1:2379}"
39-
params+=" --etcd-cafile=${ETCD_APISERVER_CA_CERT_PATH}"
40-
params+=" --etcd-certfile=${ETCD_APISERVER_CLIENT_CERT_PATH}"
41-
params+=" --etcd-keyfile=${ETCD_APISERVER_CLIENT_KEY_PATH}"
42-
elif [[ -z "${ETCD_APISERVER_CA_KEY:-}" && -z "${ETCD_APISERVER_CA_CERT:-}" && -z "${ETCD_APISERVER_SERVER_KEY:-}" && -z "${ETCD_APISERVER_SERVER_CERT:-}" && -z "${ETCD_APISERVER_CLIENT_KEY:-}" && -z "${ETCD_APISERVER_CLIENT_CERT:-}" ]]; then
43-
params+=" --etcd-servers=${ETCD_SERVERS:-http://127.0.0.1:2379}"
44-
echo "WARNING: ALL of ETCD_APISERVER_CA_KEY, ETCD_APISERVER_CA_CERT, ETCD_APISERVER_SERVER_KEY, ETCD_APISERVER_SERVER_CERT, ETCD_APISERVER_CLIENT_KEY and ETCD_APISERVER_CLIENT_CERT are missing, mTLS between etcd server and kube-apiserver is not enabled."
45-
else
46-
echo "ERROR: Some of ETCD_APISERVER_CA_KEY, ETCD_APISERVER_CA_CERT, ETCD_APISERVER_SERVER_KEY, ETCD_APISERVER_SERVER_CERT, ETCD_APISERVER_CLIENT_KEY and ETCD_APISERVER_CLIENT_CERT are missing, mTLS between etcd server and kube-apiserver cannot be enabled. Please provide all mTLS credential."
47-
exit 1
48-
fi
49-
if [[ -z "${ETCD_SERVERS:-}" ]]; then
50-
params+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-/events#http://127.0.0.1:4002}"
51-
elif [[ -n "${ETCD_SERVERS_OVERRIDES:-}" ]]; then
52-
params+=" --etcd-servers-overrides=${ETCD_SERVERS_OVERRIDES:-}"
53-
fi
74+
75+
# params is passed by reference, so no "$"
76+
configure-etcd-params params
77+
5478
params+=" --secure-port=443"
5579
if [[ "${ENABLE_APISERVER_INSECURE_PORT:-false}" != "true" ]]; then
5680
# Default is :8080
@@ -80,15 +104,7 @@ function start-kube-apiserver {
80104
if [[ -n "${KUBE_PASSWORD:-}" && -n "${KUBE_USER:-}" ]]; then
81105
params+=" --basic-auth-file=/etc/srv/kubernetes/basic_auth.csv"
82106
fi
83-
if [[ -n "${STORAGE_BACKEND:-}" ]]; then
84-
params+=" --storage-backend=${STORAGE_BACKEND}"
85-
fi
86-
if [[ -n "${STORAGE_MEDIA_TYPE:-}" ]]; then
87-
params+=" --storage-media-type=${STORAGE_MEDIA_TYPE}"
88-
fi
89-
if [[ -n "${ETCD_COMPACTION_INTERVAL_SEC:-}" ]]; then
90-
params+=" --etcd-compaction-interval=${ETCD_COMPACTION_INTERVAL_SEC}s"
91-
fi
107+
92108
if [[ -n "${KUBE_APISERVER_REQUEST_TIMEOUT_SEC:-}" ]]; then
93109
params+=" --request-timeout=${KUBE_APISERVER_REQUEST_TIMEOUT_SEC}s"
94110
fi
@@ -268,7 +284,6 @@ function start-kube-apiserver {
268284
fi
269285
fi
270286

271-
272287
local authorization_mode="RBAC"
273288
local -r src_dir="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty"
274289

‎cluster/gce/gci/testdata/kube-apiserver/etcd.template‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,7 @@ readonly ETCD_SERVERS={{.ETCDServers}}
99
readonly ETCD_APISERVER_CA_CERT_PATH={{.CACertPath}}
1010
readonly ETCD_APISERVER_CLIENT_CERT_PATH={{.APIServerCertPath}}
1111
readonly ETCD_APISERVER_CLIENT_KEY_PATH={{.APIServerKeyPath}}
12+
readonly ETCD_SERVERS_OVERRIDES={{.ETCDServersOverride}}
13+
readonly STORAGE_BACKEND={{.StorageBackend}}
14+
readonly STORAGE_MEDIA_TYPE={{.StorageMediaType}}
15+
readonly ETCD_COMPACTION_INTERVAL_SEC={{.CompactionInterval}}

0 commit comments

Comments
 (0)