Use TLS when connecting to apiserver (#335)

canonical · Apr 16, 2024 · dc04e76 · dc04e76
1 parent c765923
commit dc04e76
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/src/k8s/pkg/k8sd/setup/embed/apiserver/auth-token-webhook.conf b/src/k8s/pkg/k8sd/setup/embed/apiserver/auth-token-webhook.conf
@@ -3,7 +3,8 @@ kind: Config
 clusters:
   - name: k8s-token-auth-service
     cluster:
-      insecure-skip-tls-verify: true
+      certificate-authority: "{{ .CAPath }}"
+      tls-server-name: 127.0.0.1
       server: "{{ .URL }}"
 current-context: webhook
 contexts:

diff --git a/src/k8s/pkg/k8sd/setup/kube_apiserver.go b/src/k8s/pkg/k8sd/setup/kube_apiserver.go
@@ -12,7 +12,8 @@ import (
 )
 
 type apiserverAuthTokenWebhookTemplateConfig struct {
-	URL string
+	URL    string
+	CAPath string
 }
 
 var SupportedDatastores = []string{"k8s-dqlite", "external"}
@@ -52,8 +53,10 @@ func KubeAPIServer(snap snap.Snap, serviceCIDR string, authWebhookURL string, en
 	if err != nil {
 		return fmt.Errorf("failed to open auth-token-webhook.conf: %w", err)
 	}
+
 	if err := apiserverAuthTokenWebhookTemplate.Execute(authTokenWebhookFile, apiserverAuthTokenWebhookTemplateConfig{
-		URL: authWebhookURL,
+		URL:    authWebhookURL,
+		CAPath: path.Join(snap.K8sdStateDir(), "cluster.crt"),
 	}); err != nil {
 		return fmt.Errorf("failed to write auth-token-webhook.conf: %w", err)
 	}