Added Addon Authn Pattern proposal #29714

erictune · 2016-07-28T00:57:53Z

This change is

erictune · 2016-07-28T01:02:52Z

@kubernetes/sig-auth @bryk

bryk · 2016-07-28T20:54:39Z

docs/proposals/addon-auth-pattern.md

+1. Dashboard is running with service `dashboard` in namespace `kube-system`.
+1. User runs `kubectl proxy -p 8001 &`.
+  -  Same as before.
+1. User enters this into their browser navigation bar: `http://localhost:8001/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard/?add-auth=true#/workload`


Hmm... Cannot kubectl proxy inject the header? E.g., currently when I do kubectl get pods it is equivalent to running curl -k -v -XGET -H "Authorization: Basic <redacted>==" https://<redacted>/api/v1/namespaces/default/pods. What if kubectl injected this auth:basic header to user's requests?

It does inject the Authorization header with the user's long-lived, unscoped token. We want Dashboard to see a short-lived, scoped token.

liggitt · 2016-08-02T03:23:48Z

is it unreasonable to require TLS between the API proxy and the pod? if we did that, the proxy could add a header containing user information, and identify itself to the pod using a client certificate (enabled in #26634). Pods could verify the client certificate on the request, then use the user information in the header.

erictune · 2016-08-02T15:52:13Z

@liggitt

I like the idea of TLS, and I like the idea of the API server presenting a client cert.

The reason I didn't include TLS in this proposal is I didn't know a nice way to generate and distribute a server cert for the "pod", signed by a CA that the apiserver would recognize. And I don't want to solve the general problem of cert distribution this month.

Do you see any way to skirt the issue of distributing a valid TLS cert to the pod-as-a-server?

erictune · 2016-08-02T16:15:05Z

Okay, I just read #26634. I that PR, the apiserver, as a client, accepts an invalid cert from the pod-as-server. Let me comment on that PR.

bryk · 2016-08-08T08:11:20Z

is it unreasonable to require TLS between the API proxy and the pod?

Sounds good to me, as long as it is feasible to implement. @erictune What do you think after reviewing the PR #26634?

erictune · 2016-08-16T19:23:47Z

Updated to use client cert and #26634.

bgrant0607 · 2016-08-26T21:40:11Z

@enisoc, you may be interested

enisoc · 2016-08-26T22:34:52Z

docs/proposals/addon-auth-pattern.md

+1. User runs `kubectl proxy -p 8001 &`.
+  -  Same as before.
+1. User enters this into their browser navigation bar: `http://localhost:8001/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard/?add-auth=true#/workload`
+  - Difference is the addition of the `add-auth=true` query parameter, which is handled by the APIserver.


What will the URL look like if the target service already has its own query parameters?

For example, what if the URL before add-auth is:

http://localhost:8001/api/v1/proxy/namespaces/default/services/my-dashboard/page?arg=value

Good point, what I said won't work. I've changed this to not use a query parameter, but instead use an annotation on the service. This makes more sense than requiring the user to specify it, since the need for authentication headers is a property of the service.

k8s-bot · 2016-08-30T00:36:58Z

Can one of the admins verify that this patch is reasonable to test? If so, please reply "ok to test".
(Note: "add to whitelist" is no longer supported. Please update configurations in kubernetes/test-infra/jenkins/job-configs/kubernetes-jenkins-pull instead.)

This message will repeat several times in short succession due to jenkinsci/ghprb-plugin#292. Sorry.

erictune · 2016-08-30T05:48:47Z

ok-to-test

bgrant0607 · 2016-08-30T17:32:01Z

cc @pwittrock @deads2k

bgrant0607 · 2016-08-30T17:37:07Z

Could this also be used for monitoring (e.g., heapster) and logging (e.g., elasticsearch), or is the dashboard the main use case right now?

erictune · 2016-08-31T21:58:11Z

Other use case: federation apiserver hosted on one of the clusters of a
federation (currently it has no authn integration)

On Wed, Aug 31, 2016 at 2:11 PM, Brian Grant notifications@github.com
wrote:

Other obvious use cases:

heapster

other monitoring solutions (e.g., kube-state-metrics)

logging (elasticsearch)

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#29714 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AHuudo0NtGnvPCGzGq7FTdO3ovYkErlOks5qle37gaJpZM4JWxY9
.

erictune · 2016-08-31T21:58:52Z

Good point Solly, I updated to include this at the end of the doc.

On Wed, Aug 31, 2016 at 2:58 PM, Eric Tune etune@google.com wrote:

Other use case: federation apiserver hosted on one of the clusters of a
federation (currently it has no authn integration)

On Wed, Aug 31, 2016 at 2:11 PM, Brian Grant notifications@github.com
wrote:

Other obvious use cases:

heapster

other monitoring solutions (e.g., kube-state-metrics)

logging (elasticsearch)

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#29714 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AHuudo0NtGnvPCGzGq7FTdO3ovYkErlOks5qle37gaJpZM4JWxY9
.

k8s-bot · 2016-08-31T22:33:28Z

GCE e2e build/test passed for commit 76d57af.

floreks · 2016-09-19T08:21:42Z

I'm willing to help with this proposal. Still there are some things that are a bit vague to me and my background regarding security is not that great but as I'm going through the code It's getting more clear.

Few questions:

Should it be brand new authn plugin or should some existing one be altered?
Should apiserver only authenticate requests to service proxy based on user certificate (if signed by same CA?) and forward them further thus letting application authorize it?
How should apiserver get X-Remote-User header in order to inject it into the request? Check CN of the certificate?

There will be more once I dive into the code :)

Some detailed scenario would help me understand it better if someone has time to write one.

DirectXMan12 · 2016-09-19T18:09:44Z

Should apiserver only authenticate requests to service proxy based on user certificate (if signed by same CA?) and forward them further thus letting application authorize it?

Presumably, it would work based on any auth method, then the strip the actual auth info, and the application would just use X-Remote-User (and the service proxy's certificate to guarantee that the request is genuine).

How should apiserver get X-Remote-User header in order to inject it into the request? Check CN of the certificate?

This would be information passed through by the auth system, presumably -- it populates a nice UserInfo struct (I think that's the name, IIRC) that has all that required info. Take a look at the authentication interface in the code for more details.

floreks · 2016-09-20T08:10:43Z

Presumably, it would work based on any auth method, then the strip the actual auth info, and the application would just use X-Remote-User (and the service proxy's certificate to guarantee that the request is genuine).

Then apiserver authn should pretty much stay as it is and after that there should be new part(plugin?) that either proxies request directly to the application (should we skip apiserver authz and admission controller or only authz?) or uses default path (authz + admission controller) before passing it further.

This would be information passed through by the auth system, presumably -- it populates a nice UserInfo struct (I think that's the name, IIRC) that has all that required info. Take a look at the authentication interface in the code for more details.

Thanks! I've found that in the code and you're right. user.Info is already filled with data on request authn.

erictune · 2016-10-03T17:40:38Z

@pwittrock
We had talked about the UX issues around proxying to web pages on kube

bgrant0607 · 2016-10-28T23:32:04Z

cc @smawson @louiscryan

k8s-github-robot · 2016-12-01T01:16:58Z

Adding label:do-not-merge because PR changes docs prohibited to auto merge
See http://kubernetes.io/editdocs/ for information about editing docs

bryk · 2016-12-12T11:56:36Z

cc @rf232

k8s-github-robot · 2017-01-23T22:06:08Z

[APPROVALNOTIFIER] Needs approval from an approver in each of these OWNERS Files:

docs/OWNERS

We suggest the following people:
cc @brendandburns
You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

k8s-github-robot · 2017-03-12T16:51:25Z

This PR hasn't been active in 90 days. Closing this PR. Please reopen if you would like to work towards merging this change, if/when the PR is ready for the next round of review.

cc @bgrant0607 @erictune @smarterclayton

You can add 'keep-open' label to prevent this from happening again, or add a comment to keep it open another 90 days

jlzhao27 · 2017-04-24T18:21:47Z

docs/proposals/addon-auth-pattern.md

+1. User enters this into their browser navigation bar: `http://localhost:8001/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard/#/workload`
+  - This causes the API server to proxy a single HTTP request.
+  - The effect of the two proxies is that an HTTP request on localhost:8001 becomes an HTTP request for `/#/workloads` on port 80 on the pod IP of one of the Pods that backs services `dashboard` in namespace `kube-system`.  So far so good.
+1. *NEW* When the API server proxies a request to a service with annotation `alpha.service-proxy.kubernetes.io/proxy-authentication`, it does the following extra steps:


it feels odd that the proxy-authentication annotation only works when proxy-ing through the API server, would it make sense to implement this lower in the stack (at the same level as kube-proxy for example) such that if the annotation is applied, a proxy-authn add-on will do the exact same logic as the proposed solution for the API server.

This way, this annotation is a lot more powerful since it will seamlessly be applied regardless of how the end-user chooses to access a service.

destijl · 2017-05-01T17:30:16Z

docs/proposals/addon-auth-pattern.md

+1. User enters this into their browser navigation bar: `http://localhost:8001/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard/#/workload`
+  - This causes the API server to proxy a single HTTP request.
+  - The effect of the two proxies is that an HTTP request on localhost:8001 becomes an HTTP request for `/#/workloads` on port 80 on the pod IP of one of the Pods that backs services `dashboard` in namespace `kube-system`.  So far so good.
+1. *NEW* When the API server proxies a request to a service with annotation `alpha.service-proxy.kubernetes.io/proxy-authentication`, it does the following extra steps:


Is there a backwards compat or performance reason to make it opt-in? Could the api server always add the header?

k8s-github-robot · 2017-07-31T00:00:33Z

This PR hasn't been active in 90 days. Closing this PR. Please reopen if you would like to work towards merging this change, if/when the PR is ready for the next round of review.

cc @bgrant0607 @erictune @smarterclayton

You can add 'keep-open' label to prevent this from happening again, or add a comment to keep it open another 90 days

amostech · 2017-11-13T03:02:04Z

Is there an update on this functionality? I'm trying to expose the Dashboard through address 0.0.0.0 port 8001 but sending the Authorization: Bearer XXXXX always gives a message Unauthorized anyways. How to access dashboard?

googlebot added the cla: yes label Jul 28, 2016

k8s-github-robot assigned bgrant0607 Jul 28, 2016

k8s-github-robot added kind/design Categorizes issue or PR as related to design. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. release-note-label-needed labels Jul 28, 2016

erictune force-pushed the addon-auth-pattern branch from 493876d to c2945d6 Compare July 28, 2016 01:02

k8s-github-robot added the do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. label Jul 28, 2016

bryk reviewed Jul 28, 2016
View reviewed changes

apelisse removed the do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. label Aug 11, 2016

erictune force-pushed the addon-auth-pattern branch from c2945d6 to 26bdaf3 Compare August 16, 2016 19:23

erictune added release-note-none Denotes a PR that doesn't merit a release note. and removed release-note-label-needed labels Aug 23, 2016

enisoc reviewed Aug 26, 2016
View reviewed changes

erictune force-pushed the addon-auth-pattern branch from 26bdaf3 to efba0ac Compare August 30, 2016 05:48

Added Addon Authn Pattern proposal

76d57af

erictune force-pushed the addon-auth-pattern branch from efba0ac to 76d57af Compare August 31, 2016 21:57

k8s-github-robot added kind/design Categorizes issue or PR as related to design. kind/old-docs do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. labels Dec 1, 2016

k8s-github-robot assigned smarterclayton and unassigned bgrant0607 Jan 30, 2017

apelisse assigned bgrant0607 Jan 31, 2017

liggitt added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Mar 8, 2017

k8s-github-robot closed this Mar 12, 2017

foxish reopened this Apr 14, 2017

jlzhao27 reviewed Apr 24, 2017

View reviewed changes

destijl reviewed May 1, 2017

View reviewed changes

floreks mentioned this pull request Jun 10, 2017

Authentication guidelines kubernetes/dashboard#574

Closed

k8s-github-robot closed this Jul 31, 2017

chrissound mentioned this pull request Aug 17, 2018

Not able to login with token kubernetes/dashboard#3216

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added Addon Authn Pattern proposal #29714

Added Addon Authn Pattern proposal #29714

erictune commented Jul 28, 2016 •

edited by k8s-github-robot

Loading

erictune commented Jul 28, 2016

bryk Jul 28, 2016

erictune Jul 28, 2016

liggitt commented Aug 2, 2016 •

edited

Loading

erictune commented Aug 2, 2016

erictune commented Aug 2, 2016

bryk commented Aug 8, 2016

erictune commented Aug 16, 2016

bgrant0607 commented Aug 26, 2016

enisoc Aug 26, 2016

erictune Aug 30, 2016

k8s-bot commented Aug 30, 2016

erictune commented Aug 30, 2016

bgrant0607 commented Aug 30, 2016

bgrant0607 commented Aug 30, 2016

erictune commented Aug 31, 2016

erictune commented Aug 31, 2016

k8s-bot commented Aug 31, 2016

floreks commented Sep 19, 2016 •

edited

Loading

DirectXMan12 commented Sep 19, 2016 •

edited

Loading

floreks commented Sep 20, 2016

erictune commented Oct 3, 2016

bgrant0607 commented Oct 28, 2016

k8s-github-robot commented Dec 1, 2016

bryk commented Dec 12, 2016

k8s-github-robot commented Jan 23, 2017

k8s-github-robot commented Mar 12, 2017

jlzhao27 Apr 24, 2017

destijl May 1, 2017

k8s-github-robot commented Jul 31, 2017

amostech commented Nov 13, 2017

Added Addon Authn Pattern proposal #29714

Added Addon Authn Pattern proposal #29714

Conversation

erictune commented Jul 28, 2016 • edited by k8s-github-robot Loading

erictune commented Jul 28, 2016

bryk Jul 28, 2016

Choose a reason for hiding this comment

erictune Jul 28, 2016

Choose a reason for hiding this comment

liggitt commented Aug 2, 2016 • edited Loading

erictune commented Aug 2, 2016

erictune commented Aug 2, 2016

bryk commented Aug 8, 2016

erictune commented Aug 16, 2016

bgrant0607 commented Aug 26, 2016

enisoc Aug 26, 2016

Choose a reason for hiding this comment

erictune Aug 30, 2016

Choose a reason for hiding this comment

k8s-bot commented Aug 30, 2016

erictune commented Aug 30, 2016

bgrant0607 commented Aug 30, 2016

bgrant0607 commented Aug 30, 2016

erictune commented Aug 31, 2016

erictune commented Aug 31, 2016

k8s-bot commented Aug 31, 2016

floreks commented Sep 19, 2016 • edited Loading

DirectXMan12 commented Sep 19, 2016 • edited Loading

floreks commented Sep 20, 2016

erictune commented Oct 3, 2016

bgrant0607 commented Oct 28, 2016

k8s-github-robot commented Dec 1, 2016

bryk commented Dec 12, 2016

k8s-github-robot commented Jan 23, 2017

k8s-github-robot commented Mar 12, 2017

jlzhao27 Apr 24, 2017

Choose a reason for hiding this comment

destijl May 1, 2017

Choose a reason for hiding this comment

k8s-github-robot commented Jul 31, 2017

amostech commented Nov 13, 2017

erictune commented Jul 28, 2016 •

edited by k8s-github-robot

Loading

liggitt commented Aug 2, 2016 •

edited

Loading

floreks commented Sep 19, 2016 •

edited

Loading

DirectXMan12 commented Sep 19, 2016 •

edited

Loading