Skip to content

Commit

Permalink
Fix volume names and TLS config for auditforwarder with reversed vpn
Browse files Browse the repository at this point in the history
  • Loading branch information
mreiger committed May 17, 2023
1 parent 09578bb commit 09eb8f7
Showing 1 changed file with 9 additions and 5 deletions.
14 changes: 9 additions & 5 deletions pkg/webhook/controlplane/ensurer.go
Original file line number Diff line number Diff line change
Expand Up @@ -241,24 +241,28 @@ var (
}
reversedVpnVolumeMounts = []corev1.VolumeMount{
{
Name: "kube-apiserver-http-proxy",
Name: "ca-vpn",
MountPath: "/proxy/ca",
ReadOnly: true,
},
{
Name: "kube-aggregator",
Name: "http-proxy",
MountPath: "/proxy/client",
ReadOnly: true,
},
}
kubeAggregatorClientTlsEnvVars = []corev1.EnvVar{
{
Name: "AUDIT_PROXY_CA_FILE",
Value: "/proxy/ca/bundle.crt",
},
{
Name: "AUDIT_PROXY_CLIENT_CRT_FILE",
Value: "/proxy/client/kube-aggregator.crt",
Value: "/proxy/client/tls.crt",
},
{
Name: "AUDIT_PROXY_CLIENT_KEY_FILE",
Value: "/proxy/client/kube-aggregator.key",
Value: "/proxy/client/tls.key",
},
}
auditForwarderSidecarTemplate = corev1.Container{
Expand Down Expand Up @@ -379,7 +383,7 @@ func ensureAuditForwarder(ps *corev1.PodSpec, auditToSplunk bool) error {

for _, volume := range ps.Volumes {
switch volume.Name {
case "kube-apiserver-http-proxy":
case "egress-selection-config":
proxyHost = "vpn-seed-server"
}
}
Expand Down

0 comments on commit 09eb8f7

Please sign in to comment.