Address comments.

Signed-off-by: Lantao Liu <[email protected]>

Author: Random-Liu

cluster/gce/configure.sh

@@ -42,27 +42,27 @@ fetch_metadata() {
 # and generate a env file under ${CONTAINERD_HOME}. It assumes that
 # the environment variables in metadata are in yaml format.
 fetch_env() {
-  local -r env_name=$1
+  local -r env_file_name=$1
   (
-    umask 700;
-    local -r tmp_env="/tmp/${env_name}.yaml"
-    tmp_env_content=$(fetch_metadata "${env_name}")
+    umask 077;
+    local -r tmp_env_file="/tmp/${env_file_name}.yaml"
+    tmp_env_content=$(fetch_metadata "${env_file_name}")
     if [ -z "${tmp_env_content}" ]; then
-      echo "No environment variable is specified in ${env_name}"
+      echo "No environment variable is specified in ${env_file_name}"
       return
     fi
-    echo "${tmp_env_content}" > "${tmp_env}"
+    echo "${tmp_env_content}" > "${tmp_env_file}"
     # Convert the yaml format file into a shell-style file.
     eval $(python -c '''
 import pipes,sys,yaml
 for k,v in yaml.load(sys.stdin).iteritems():
   print("readonly {var}={value}".format(var = k, value = pipes.quote(str(v))))
-''' < "${tmp_env}" > "${CONTAINERD_HOME}/${env_name}")
-    rm -f "${tmp_env}"
+''' < "${tmp_env_file}" > "${CONTAINERD_HOME}/${env_file_name}")
+    rm -f "${tmp_env_file}"
   )
 }
 
-# is_preloaded checks whether containerd is preloaded in the image.
+# is_preloaded checks whether a package has been preloaded in the image.
 is_preloaded() {
   local -r tar=$1
   local -r sha1=$2
@@ -138,6 +138,7 @@ config_path="${CONTAINERD_CONFIG_PATH:-"/etc/containerd/config.toml"}"
 mkdir -p $(dirname ${config_path})
 cni_bin_dir="${CONTAINERD_HOME}/opt/cni/bin"
 cni_template_path="${CONTAINERD_HOME}/opt/containerd/cluster/gce/cni.template"
+# NETWORK_POLICY_PROVIDER is from kube-env.
 network_policy_provider="${NETWORK_POLICY_PROVIDER:-"none"}"
 if [ -n "${network_policy_provider}" ] && [ "${network_policy_provider}" != "none" ] && [ "${KUBERNETES_MASTER:-}" != "true" ]; then
   # Use Kubernetes cni daemonset on node if network policy provider is specified.