app-admin/kubelet-wrapper: fix stage1 reference

since rkt 1.3.0, rkt has began checking stage1 hashes, and will do so if
the stage1 is not in the default stage1 directory. for compatibility,
df131e85d5240a75fb9cd4e1fb85e86e6f5290c1 symlinked the old stage1
directory to the new one, however, if a stage1 is referred to by the old
stage1 path under rkt >1.3.0, image verification will fail because no
signature exists.

instead of using a path, use stage1-fly.aci by name and let rkt handle
finding it in the default directory.
This commit is contained in:
Nick Owens 2016-05-12 21:32:13 -07:00
parent 1616098d8f
commit acf641ca67
2 changed files with 2 additions and 1 deletions

View File

@ -34,5 +34,6 @@ exec /usr/bin/rkt run \
--mount volume=run,target=/run \ --mount volume=run,target=/run \
--trust-keys-from-https \ --trust-keys-from-https \
$RKT_OPTS \ $RKT_OPTS \
--stage1-path=/usr/share/rkt/stage1-fly.aci \ --stage1-from-dir=stage1-fly.aci \
${KUBELET_ACI}:${KUBELET_VERSION} --exec=/kubelet -- "$@" ${KUBELET_ACI}:${KUBELET_VERSION} --exec=/kubelet -- "$@"