Enable apiserver to access updated encryption-config.json

pkg/podexecutor/staticpod.go

@@ -314,6 +314,10 @@ func (s *StaticPodConfig) APIServer(_ context.Context, etcdReady <-chan struct{}
 		dirs = append(dirs, filepath.Dir(auditLogFile))
 		excludeFiles = append(excludeFiles, auditLogFile)
 	}
+	// encryption config is refreshed by the secrets-encryption controller
+	// so we mount the directory to allow the pod to see the updates
+	dirs = append(dirs, filepath.Join(s.DataDir, "server/cred"))
+	excludeFiles = append(excludeFiles, filepath.Join(s.DataDir, "server/cred/encryption-config.json"))
 
 	return after(etcdReady, func() error {
 		return staticpod.Run(s.ManifestsDir, staticpod.Args{

pkg/staticpod/staticpod.go

@@ -103,6 +103,15 @@ func Run(dir string, args Args) error {
 		return err
 	}
 
+	// Check to make sure we aren't double mounting directories and the files in those directories
+	for _, dir := range args.Dirs {
+		for _, file := range files {
+			if strings.HasPrefix(file, dir) {
+				logrus.Warnf("file %s is being double mounted with directory %s", file, dir)
+			}
+		}
+	}
+
 	args.Files = append(args.Files, files...)
 	pod, err := pod(args)
 	if err != nil {
@@ -375,6 +384,9 @@ func addExtraEnv(p *v1.Pod, extraEnv []string) {
 	}
 }
 
+// readFiles takes in the arguments passed to the static pod and returns a list of all files
+// embedded in those arguments to be included in the pod manifest as volumes.
+// excludeFiles are not included in the returned list.
 func readFiles(args, excludeFiles []string) ([]string, error) {
 	files := map[string]bool{}
 	excludes := map[string]bool{}