From 883f3c5ce2e05d5a568d54f65f5e4d63823956d2 Mon Sep 17 00:00:00 2001
From: Charandas <542168+charandas@users.noreply.github.com>
Date: Tue, 18 Feb 2025 19:14:22 -0800
Subject: [PATCH] K8s: add a bool setting to select request header auth versus
 enterprise behavior (#100877)

---
 pkg/services/apiserver/aggregator/aggregator.go  | 16 +++++++++-------
 .../apiserver/options/kube-aggregator.go         |  4 ++++
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/pkg/services/apiserver/aggregator/aggregator.go b/pkg/services/apiserver/aggregator/aggregator.go
index 67611fc3a71..76a446c8990 100644
--- a/pkg/services/apiserver/aggregator/aggregator.go
+++ b/pkg/services/apiserver/aggregator/aggregator.go
@@ -57,7 +57,8 @@ import (
 // making sure we only register metrics once into legacy registry
 var registerIntoLegacyRegistryOnce sync.Once
 
-func readCABundlePEM(path string, devMode bool) ([]byte, error) {
+//nolint:unused
+func _readCABundlePEM(path string, devMode bool) ([]byte, error) {
 	if devMode {
 		return nil, nil
 	}
@@ -128,8 +129,6 @@ func CreateAggregatorConfig(commandOptions *options.Options, sharedConfig generi
 		},
 		ExtraConfig: aggregatorapiserver.ExtraConfig{
 			DisableRemoteAvailableConditionController: true,
-			ProxyClientCertFile:                       commandOptions.KubeAggregatorOptions.ProxyClientCertFile,
-			ProxyClientKeyFile:                        commandOptions.KubeAggregatorOptions.ProxyClientKeyFile,
 			// NOTE: while ProxyTransport can be skipped in the configuration, it allows honoring
 			// DISABLE_HTTP2, HTTPS_PROXY and NO_PROXY env vars as needed
 			ProxyTransport:  createProxyTransport(),
@@ -137,6 +136,13 @@ func CreateAggregatorConfig(commandOptions *options.Options, sharedConfig generi
 		},
 	}
 
+	if commandOptions.KubeAggregatorOptions.LegacyClientCertAuth {
+		// NOTE: the availability controller below is a bit different and uses the cert/key pair regardless
+		// of the legacy bool, this is because we are still using that for discovery requests
+		aggregatorConfig.ExtraConfig.ProxyClientCertFile = commandOptions.KubeAggregatorOptions.ProxyClientCertFile
+		aggregatorConfig.ExtraConfig.ProxyClientKeyFile = commandOptions.KubeAggregatorOptions.ProxyClientKeyFile
+	}
+
 	if err := commandOptions.KubeAggregatorOptions.ApplyTo(aggregatorConfig, commandOptions.RecommendedOptions.Etcd); err != nil {
 		return nil, err
 	}
@@ -152,10 +158,6 @@ func CreateAggregatorConfig(commandOptions *options.Options, sharedConfig generi
 		return NewConfig(aggregatorConfig, sharedInformerFactory, []builder.APIGroupBuilder{serviceAPIBuilder}, nil), nil
 	}
 
-	_, err = readCABundlePEM(commandOptions.KubeAggregatorOptions.APIServiceCABundleFile, commandOptions.ExtraOptions.DevMode)
-	if err != nil {
-		return nil, err
-	}
 	remoteServices, err := ReadRemoteServices(commandOptions.KubeAggregatorOptions.RemoteServicesFile)
 	if err != nil {
 		return nil, err
diff --git a/pkg/services/apiserver/options/kube-aggregator.go b/pkg/services/apiserver/options/kube-aggregator.go
index ced1599729c..20e48c7a7ed 100644
--- a/pkg/services/apiserver/options/kube-aggregator.go
+++ b/pkg/services/apiserver/options/kube-aggregator.go
@@ -23,6 +23,7 @@ type KubeAggregatorOptions struct {
 	AlternateDNS           []string
 	ProxyClientCertFile    string
 	ProxyClientKeyFile     string
+	LegacyClientCertAuth   bool
 	RemoteServicesFile     string
 	APIServiceCABundleFile string
 }
@@ -46,6 +47,9 @@ func (o *KubeAggregatorOptions) AddFlags(fs *pflag.FlagSet) {
 
 	fs.StringVar(&o.ProxyClientKeyFile, "proxy-client-key-file", o.ProxyClientKeyFile,
 		"path to proxy client key file")
+
+	fs.BoolVar(&o.LegacyClientCertAuth, "legacy_client_cert_auth", true,
+		"whether to use legacy client cert auth")
 }
 
 func (o *KubeAggregatorOptions) Validate() []error {