Webhook Token Authenticator #24902

cjcullen · 2016-04-28T01:17:54Z

Add a webhook token authenticator plugin to allow a remote service to make authentication decisions.

cjcullen · 2016-04-28T01:20:08Z

@ericchiang @bobbyrullo @erictune @deads2k

Mostly in an RFC state right now. I want something exactly like the webhook authorizer, but for token authn.

smarterclayton · 2016-04-28T03:46:08Z

plugin/pkg/webhook/webhook.go

+	if err != nil {
+		return nil, err
+	}
+	serializer := json.NewSerializer(json.DefaultMetaFactory, api.Scheme, runtime.ObjectTyperToTyper(api.Scheme), false)


api.Codecs.LegacyCodec(groupVersions...) would be equivalent, unless you had a concrete reason to init your own

I just pulled this over from the webhook authorizer. I can change it to use the LegacyCodec if that is a better approach.

Yeah, anyone doing json.NewSerializer like the should be using LegacyCodec

very few people should ever be using anything except a)
NegotiatedSerializer or b) api.Codecs.LegacyCodec()

On Thu, Apr 28, 2016 at 5:58 PM, CJ Cullen notifications@github.com wrote:

In plugin/pkg/webhook/webhook.go
#24902 (comment)
:

+func NewGenericWebhook(kubeConfigFile string, groupVersions []unversioned.GroupVersion) (*GenericWebhook, error) {

for _, groupVersion := range groupVersions {

if !registered.IsEnabledVersion(groupVersion) {

return nil, fmt.Errorf("webhook plugin requires enabling extension resource: %s", groupVersion)

}

}

loadingRules := clientcmd.NewDefaultClientConfigLoadingRules()

loadingRules.ExplicitPath = kubeConfigFile

loader := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, &clientcmd.ConfigOverrides{})

clientConfig, err := loader.ClientConfig()

if err != nil {

return nil, err

}

serializer := json.NewSerializer(json.DefaultMetaFactory, api.Scheme, runtime.ObjectTyperToTyper(api.Scheme), false)

I just pulled this over from the webhook authorizer. I can change it to
use the LegacyCode if that is a better approach.

—
You are receiving this because you were assigned.
Reply to this email directly or view it on GitHub
https://github.com/kubernetes/kubernetes/pull/24902/files/765d75020629d41818092cba9da5d6a1c4ee3287#r61509591

deads2k · 2016-04-28T15:03:11Z

pkg/apis/authentication/register.go

+)
+
+// GroupName is the group name use in this package
+const GroupName = "authentication.k8s.io"


to play nice with the client generators, I'm pretty sure you have to put it in a folder called pkg/apis/authentication.k8s.io I'm having to make that change for authorization.k8s.io in a different pull.

deads2k · 2016-04-28T15:16:58Z

I like it, but I'd like to see some tests that actually set up the configuration and confirm it works in the same pull that adds the external option. I'm fine merging pulls working up to it without the full check as long as they don't add the option to commands.

cjcullen · 2016-04-28T21:59:56Z

I'll add tests (including some sort of integration test) to this PR. I just wanted to make sure I'm on the right track first.

erictune · 2016-04-29T07:01:04Z

plugin/pkg/webhook/webhook.go

+limitations under the License.
+*/
+
+// Package webhook implements the authorizer.Authorizer interface using HTTP webhooks.


Comment needs update after refactor.

cjcullen · 2016-04-30T00:13:13Z

Fixed up the first round of comments. Leaving the WIP tag on here until I add tests.

cjcullen · 2016-05-10T22:18:09Z

I changed TokenReview.User.Name to TokenReview.User.Username. Apparently "Name" should only be used for the actual name of the REST resource.

k8s-bot · 2016-05-10T22:53:45Z

GCE e2e build/test passed for commit eb3b0e7.

k8s-github-robot · 2016-05-12T04:26:48Z

@k8s-bot test this [submit-queue is verifying that this PR is safe to merge]

k8s-bot · 2016-05-12T05:08:03Z

GCE e2e build/test passed for commit eb3b0e7.

k8s-github-robot · 2016-05-12T05:08:58Z

Automatic merge from submit-queue

xiaochunyn · 2016-05-31T08:45:27Z

Under what circumstance will invoke "webhook" to implements authorization and authentication, and where can I find it in source code? Thanks

erictune · 2016-07-07T20:37:50Z

@xiaochunyn http://kubernetes.io/docs/admin/authorization/ and https://github.com/kubernetes/kubernetes/blob/f2ddd60eb9e7e9e29f7a105a9a8fa020042e8e52/plugin/pkg/auth/authenticator/token/webhook/webhook.go

erictune · 2016-07-07T20:39:04Z

webhook authenticator is not yet documented here:
http://kubernetes.io/docs/admin/authentication/ but between that and the source code you should be able to figure out how to use it.

googlebot added the cla: yes label Apr 28, 2016

k8s-github-robot assigned smarterclayton Apr 28, 2016

k8s-github-robot added kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/new-api size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Apr 28, 2016

smarterclayton reviewed Apr 28, 2016
View reviewed changes

smarterclayton assigned deads2k and unassigned smarterclayton Apr 28, 2016

deads2k reviewed Apr 28, 2016
View reviewed changes

erictune reviewed Apr 29, 2016
View reviewed changes

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 29, 2016

cjcullen added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-label-needed labels Apr 29, 2016

cjcullen force-pushed the webhookAuthn branch 3 times, most recently from e6228a5 to eaf367a Compare April 30, 2016 00:11

k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 30, 2016

cjcullen force-pushed the webhookAuthn branch 2 times, most recently from 8716b72 to bb79bf7 Compare May 4, 2016 00:56

k8s-github-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels May 4, 2016

cjcullen changed the title ~~WIP: Webhook Token Authenticator~~ Webhook Token Authenticator May 4, 2016

cjcullen added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 9, 2016

erictune mentioned this pull request May 9, 2016

Keystone auth fails for v3 #25066

Closed

cjcullen mentioned this pull request May 9, 2016

Configuration for GCP webhook authentication. #25380

Closed

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 10, 2016

cjcullen force-pushed the webhookAuthn branch from 94c67cd to a08c694 Compare May 10, 2016 13:56

k8s-github-robot removed lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels May 10, 2016

cjcullen force-pushed the webhookAuthn branch from a08c694 to c7f7916 Compare May 10, 2016 14:15

cjcullen added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 10, 2016

cjcullen force-pushed the webhookAuthn branch from c7f7916 to 33716e9 Compare May 10, 2016 21:02

k8s-github-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. labels May 10, 2016

cjcullen added 2 commits May 10, 2016 14:41

Pull common webhook code into generic webhook plugin.

1d096d2

Add a webhook token authenticator plugin.

eb3b0e7

cjcullen force-pushed the webhookAuthn branch from 33716e9 to eb3b0e7 Compare May 10, 2016 21:55

k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 10, 2016

cjcullen added lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. labels May 10, 2016

k8s-github-robot merged commit 0ef4c64 into kubernetes:master May 12, 2016

deads2k mentioned this pull request May 20, 2016

Can't generate client and protobuf code simultaneously for API groups with dots in their name #25860

Closed

liggitt mentioned this pull request May 20, 2016

Add RBAC authorization API group and authorizer #25634

Merged

deads2k mentioned this pull request Jul 12, 2016

add tokenreviews endpoint to implement webhook #28788

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Webhook Token Authenticator #24902

Webhook Token Authenticator #24902

cjcullen commented Apr 28, 2016

cjcullen commented Apr 28, 2016

smarterclayton Apr 28, 2016

cjcullen Apr 28, 2016 •

edited

Loading

smarterclayton Apr 29, 2016

cjcullen Apr 30, 2016

deads2k Apr 28, 2016

cjcullen Apr 30, 2016

deads2k commented Apr 28, 2016

cjcullen commented Apr 28, 2016

erictune Apr 29, 2016

cjcullen Apr 30, 2016

cjcullen commented Apr 30, 2016

cjcullen commented May 10, 2016

k8s-bot commented May 10, 2016

k8s-github-robot commented May 12, 2016

k8s-bot commented May 12, 2016

k8s-github-robot commented May 12, 2016

xiaochunyn commented May 31, 2016

erictune commented Jul 7, 2016

erictune commented Jul 7, 2016

Webhook Token Authenticator #24902

Webhook Token Authenticator #24902

Conversation

cjcullen commented Apr 28, 2016

cjcullen commented Apr 28, 2016

smarterclayton Apr 28, 2016

Choose a reason for hiding this comment

cjcullen Apr 28, 2016 • edited Loading

Choose a reason for hiding this comment

smarterclayton Apr 29, 2016

Choose a reason for hiding this comment

cjcullen Apr 30, 2016

Choose a reason for hiding this comment

deads2k Apr 28, 2016

Choose a reason for hiding this comment

cjcullen Apr 30, 2016

Choose a reason for hiding this comment

deads2k commented Apr 28, 2016

cjcullen commented Apr 28, 2016

erictune Apr 29, 2016

Choose a reason for hiding this comment

cjcullen Apr 30, 2016

Choose a reason for hiding this comment

cjcullen commented Apr 30, 2016

cjcullen commented May 10, 2016

k8s-bot commented May 10, 2016

k8s-github-robot commented May 12, 2016

k8s-bot commented May 12, 2016

k8s-github-robot commented May 12, 2016

xiaochunyn commented May 31, 2016

erictune commented Jul 7, 2016

erictune commented Jul 7, 2016

cjcullen Apr 28, 2016 •

edited

Loading