Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[GEP-12] OIDC Webhook Authenticator #2481

Merged
merged 2 commits into from
Jul 10, 2020
Merged

[GEP-12] OIDC Webhook Authenticator #2481

merged 2 commits into from
Jul 10, 2020

Conversation

mvladev
Copy link

@mvladev mvladev commented Jun 19, 2020

How to categorize this PR?

/area operations
/area security
/area user-management
/kind enhancement
/priority normal

What this PR does / why we need it:

This enhancement proposal adds ODIC Webhook Authenticator which can be used to add multiple OIDC providers to a standard Kubernetes API Server.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

Added GEP-12 for dynamic OIDC webhook authenticator.

@mvladev mvladev requested a review from a team as a code owner June 19, 2020 17:36
@gardener-robot gardener-robot added area/security Security related area/user-management User-management related kind/enhancement Enhancement, improvement, extension priority/normal labels Jun 19, 2020
@gardener-robot
Copy link

@mvladev Label area/operations does not exist.

rfranzke
rfranzke reviewed Jun 22, 2020
View reviewed changes
Copy link
Member

@rfranzke rfranzke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/invite @holgerkoser @donistz @ThormaehlenFred @ccwienk

@mvladev can you also explain how you envision this to be implemented? Would it be a Gardener extension that, if deployed via ControllerRegistration, would deploy the necessary components and inject the necessary shoot kube-apiserver configuration via webhook?

docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
@rfranzke rfranzke changed the title Add [GEP-12] OIDC Webhook Authenticator [GEP-12] OIDC Webhook Authenticator Jun 22, 2020
danielfoehrKn
danielfoehrKn reviewed Jun 22, 2020
View reviewed changes
Copy link
Contributor

@danielfoehrKn danielfoehrKn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice GEP. I have some minor questions.

docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
docs/proposals/12-oidc-webhook-authenticator.md Outdated Show resolved Hide resolved
@mvladev mvladev force-pushed the add-oidc-webhook-authenticator-gep branch from b400c7f to 09b8e3d Compare June 23, 2020 09:31
@rfranzke
Copy link
Member

rfranzke commented Jun 24, 2020 •
edited

/invite @donistz @ThormaehlenFred @ccwienk @vlerenc @holgerkoser

@rfranzke
Copy link
Member

@holgerkoser @ThormaehlenFred @vlerenc @ccwienk @donistz any comments from you or anybody else?
If not, we should probably go ahead and merge this GEP within the next days?

@danielfoehrKn
Copy link
Contributor

@rfranzke Besides the open points I would also vote for merging this PR soon. There is no need to keep it open if there are no further comments.

@mvladev
Copy link
Author

mvladev commented Jul 3, 2020

Sorry for the delay - I've updated the PR and resolved the comments.

@ialidzhikov
Copy link
Member

/needs rebase
because of #2541

Martin Vladev added 2 commits July 8, 2020 11:44
Add [GEP-12] OIDC Webhook Authenticator
8ee5114 
This enchancement proposal adds ODIC Webhook Authenticator which can be
used to add multiple OIDC providers in a standard Kubernetes API Server.
web-authenticator-gep add examples
5cd1b9d
@mvladev mvladev force-pushed the add-oidc-webhook-authenticator-gep branch from cc18826 to 5cd1b9d Compare July 8, 2020 08:44
@mvladev
Copy link
Author

mvladev commented Jul 9, 2020

@danielfoehrKn can you have another look?

danielfoehrKn
danielfoehrKn approved these changes Jul 10, 2020
View reviewed changes
Copy link
Contributor

@danielfoehrKn danielfoehrKn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, looks good to me.

@timebertt timebertt merged commit 5eb40b5 into gardener:master Jul 10, 2020
@mvladev mvladev deleted the add-oidc-webhook-authenticator-gep branch July 10, 2020 12:59
@gardener-robot gardener-robot added priority/3 Priority (lower number equals higher priority) and removed priority/3 Priority (lower number equals higher priority) labels Mar 8, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rfranzke rfranzke rfranzke left review comments

@danielfoehrKn danielfoehrKn danielfoehrKn approved these changes

@ccwienk ccwienk Awaiting requested review from ccwienk

@donistz donistz Awaiting requested review from donistz

@ThormaehlenFred ThormaehlenFred Awaiting requested review from ThormaehlenFred

@vlerenc vlerenc Awaiting requested review from vlerenc

@holgerkoser holgerkoser Awaiting requested review from holgerkoser

Assignees
No one assigned
Labels
area/security Security related area/user-management User-management related kind/enhancement Enhancement, improvement, extension
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
9 participants
@mvladev @gardener-robot @rfranzke @danielfoehrKn @ialidzhikov @gardener-robot-ci-1 @timebertt @gardener-robot-ci-2 @gardener-robot-ci-3