kubelet authn/authz #34381

liggitt · 2016-10-08T05:57:11Z

Implements https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/kubelet-auth.md

Part of Authenticated/Authorized access to kubelet API feature

Access to the Kubelet HTTPS port can now be authenticated using X509 client certificates or API bearer tokens, and anonymous access can be disallowed. Access to the Kubelet HTTPS port can also be authorized using the same authorization configured for the API server.

This change is

liggitt · 2016-10-10T17:27:02Z

initial implementation of Authenticated/Authorized access to kubelet API feature

cc @kubernetes/sig-auth @kubernetes/sig-node

deads2k · 2016-10-10T17:43:09Z

Can you split out "Allow webhook authorizer to use SubjectAccessReviewInterface" and we can get it in separately?

liggitt · 2016-10-10T17:44:03Z

Can you split out "Allow webhook authorizer to use SubjectAccessReviewInterface" and we can get it in separately?

Already in #34071, as noted

deads2k · 2016-10-10T17:45:10Z

pkg/apis/componentconfig/types.go

+	ClientCAFile string `json:"clientCAFile"`
+
+	// enableWebhookToken enables bearer token authentication using the tokenreviews.authentication.k8s.io API
+	EnableWebhookToken bool `json:"enableWebhookToken"`


Group the two webhook related fields into a substruct to keep the associated. Also, add indications that this functions against the API server.

philips · 2016-10-13T16:13:50Z

pkg/kubelet/server/auth.go

+		attrs.Subresource = "metrics"
+	case isSubpath(requestPath, logsPath):
+		attrs.Verb = apiVerb
+		attrs.Subresource = "log"


Reading through this I am confused why this is log vs logs. stats above matches the resource /stats/

trying to match existing log subresources (pods/log), to try to avoid typos in policy that controls both

philips · 2016-10-13T16:15:27Z

overall looks fine. the subresource == log vs path == logs is confusing but if correct deserves a comment.

timstclair · 2016-10-13T18:36:08Z

pkg/kubelet/server/auth.go

+	// This allows subdividing access to the kubelet API
+	switch {
+	case isSubpath(requestPath, statsPath):
+		attrs.Verb = apiVerb


nit: Verb is already initialized to apiVerb above

deads2k · 2016-10-13T19:42:14Z

cmd/kubelet/app/options/options.go

@@ -96,6 +96,29 @@ func (s *KubeletServer) AddFlags(fs *pflag.FlagSet) {
 	fs.Var(componentconfig.IPVar{Val: &s.Address}, "address", "The IP address for the Kubelet to serve on (set to 0.0.0.0 for all interfaces)")
 	fs.Int32Var(&s.Port, "port", s.Port, "The port for the Kubelet to serve on.")
 	fs.Int32Var(&s.ReadOnlyPort, "read-only-port", s.ReadOnlyPort, "The read-only port for the Kubelet to serve on with no authentication/authorization (set to 0 to disable)")
+
+	// Authentication
+	fs.BoolVar(&s.Authentication.Anonymous.Enabled, "anonymous-auth", s.Authentication.Anonymous.Enabled, ""+


This defaults on?

deads2k · 2016-10-13T19:43:22Z

cmd/kubelet/app/options/options.go

+		"Enables anonymous requests to the Kubelet server. Requests that are not rejected by another "+
+		"authentication method are treated as anonymous requests. Anonymous requests have a username "+
+		"of system:anonymous, and a group name of system:unauthenticated.")
+	fs.BoolVar(&s.Authentication.Webhook.Enabled, "authentication-token-webhook", s.Authentication.Webhook.Enabled, ""+


I'd like to see this default-on too. One level release skew should be safe since we supported the endpoint in 1.4.

we shouldn't default this on if the corresponding API isn't defaulted on

we shouldn't default this on if the corresponding API isn't defaulted on

beta API that I thought I turned on by default. It's not?

You're right, the backing API is on. However, the kubelet isn't guaranteed to have an API client. I can look into dynamically enabling it as a follow up, but the stateless default has to be off, I think

deads2k · 2016-10-13T19:46:47Z

pkg/apis/componentconfig/types.go

+	// KubeletAuthorizationModeAlwaysAllow authorizes all authenticated requests
+	KubeletAuthorizationModeAlwaysAllow KubeletAuthorizationMode = "AlwaysAllow"
+	// KubeletAuthorizationModeWebhook uses the SubjectAccessReview API to determine authorization
+	KubeletAuthorizationModeWebhook KubeletAuthorizationMode = "Webhook"


This seems more, "ClusterBased" or something right? As opposed to a generic webhook they get to choose a destination on.

This seems more, "ClusterBased" or something right? As opposed to a generic webhook they get to choose a destination on.

the remote authz check runs against the kubelet's apiserver by default, but some deployments will not enable that API. I want to retain the future ability to point this at the same webhook the apiserver supports without duplicating all the associated cache flags.

deads2k · 2016-10-13T19:47:03Z

pkg/apis/componentconfig/types.go

+	// x509 contains settings related to x509 client certificate authentication
+	X509 KubeletX509Authentication `json:"x509"`
+	// webhook contains settings related to webhook bearer token authentication
+	Webhook KubeletWebhookAuthentication `json:"webhook"`


apiserver token based as opposed to generic webhook, isn't it?

apiserver token based as opposed to generic webhook, isn't it?

same reasoning as the remote authorizer

deads2k · 2016-10-13T19:48:30Z

relatively minor comments. Core code looks good.

k8s-ci-robot · 2016-10-18T16:57:36Z

Jenkins GCI GKE smoke e2e failed for commit 1e87267b2b3e575fd0ede772b588e5d2f0a3b8bf. Full PR test history.

The magic incantation to run this job again is @k8s-bot gci gke e2e test this. Please help us cut down flakes by linking to an open flake issue when you hit one in your PR.

k8s-ci-robot · 2016-10-25T06:34:47Z

Jenkins unit/integration failed for commit 0b4c46bfdd2d6abf5ce2448fe9bc81911c7d87ca. Full PR test history.

The magic incantation to run this job again is @k8s-bot unit test this. Please help us cut down flakes by linking to an open flake issue when you hit one in your PR.

k8s-ci-robot · 2016-10-25T07:02:19Z

Jenkins verification failed for commit 137a304f5256ab420875050d90910f97e5d22c73. Full PR test history.

The magic incantation to run this job again is @k8s-bot verify test this. Please help us cut down flakes by linking to an open flake issue when you hit one in your PR.

deads2k · 2016-10-25T20:01:50Z

lgtm

k8s-github-robot · 2016-10-26T00:02:09Z

@k8s-bot test this [submit-queue is verifying that this PR is safe to merge]

k8s-github-robot · 2016-10-26T00:40:27Z

Automatic merge from submit-queue

erictune · 2016-11-02T18:08:35Z

@cjcullen did you see this.

erictune · 2016-11-02T18:08:50Z

@alex-mohr

googlebot added the cla: yes label Oct 8, 2016

liggitt mentioned this pull request Oct 8, 2016

Authenticated/Authorized access to kubelet API kubernetes/enhancements#89

Closed

22 tasks

liggitt added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Oct 8, 2016

k8s-github-robot assigned smarterclayton Oct 8, 2016

k8s-github-robot added kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. release-note-label-needed labels Oct 8, 2016

liggitt force-pushed the kubelet-auth branch from e33ef10 to c9909b1 Compare October 10, 2016 16:34

liggitt added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-label-needed labels Oct 10, 2016

liggitt changed the title ~~WIP - kubelet authn/authz~~ kubelet authn/authz Oct 10, 2016

deads2k reviewed Oct 10, 2016

View reviewed changes

deads2k mentioned this pull request Oct 12, 2016

Secure master -> node communication #11816

Closed

edevil mentioned this pull request Oct 12, 2016

kubelet: simple tls auth #31562

Closed

liggitt force-pushed the kubelet-auth branch from c9909b1 to de7e635 Compare October 12, 2016 19:08

philips reviewed Oct 13, 2016

View reviewed changes

timstclair reviewed Oct 13, 2016

View reviewed changes

deads2k reviewed Oct 13, 2016

View reviewed changes

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 17, 2016

liggitt force-pushed the kubelet-auth branch from de7e635 to 6736b65 Compare October 17, 2016 21:22

k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 17, 2016

liggitt force-pushed the kubelet-auth branch from 6736b65 to 1e87267 Compare October 18, 2016 06:48

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 19, 2016

liggitt force-pushed the kubelet-auth branch from 1e87267 to d67bc8c Compare October 20, 2016 18:57

liggitt added this to the v1.5 milestone Oct 25, 2016

liggitt force-pushed the kubelet-auth branch 2 times, most recently from 05698df to 0b4c46b Compare October 25, 2016 06:15

k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 25, 2016

liggitt added 2 commits October 25, 2016 02:37

Kubelet authentication/authorization config

7bb84dc

Kubelet authentication/authorization config - generated

c7d5516

liggitt force-pushed the kubelet-auth branch from 0b4c46b to 137a304 Compare October 25, 2016 06:37

liggitt added 3 commits October 25, 2016 03:40

Kubelet auth flags

426caf5

Move kubelet api paths to constants

a602ae7

Wire kubelet authn/authz

c83f580

liggitt force-pushed the kubelet-auth branch from 137a304 to c83f580 Compare October 25, 2016 07:40

deads2k added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 25, 2016

k8s-github-robot merged commit a898f3d into kubernetes:master Oct 26, 2016

liggitt deleted the kubelet-auth branch October 27, 2016 05:37

wlan0 mentioned this pull request Oct 27, 2016

start breaking up controller manager into two pieces #34273

Merged

DirectXMan12 mentioned this pull request Aug 23, 2018

Prep for v0.3.0 release kubernetes-sigs/metrics-server#113

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

kubelet authn/authz #34381

kubelet authn/authz #34381

liggitt commented Oct 8, 2016 •

edited

Loading

liggitt commented Oct 10, 2016 •

edited

Loading

deads2k commented Oct 10, 2016

liggitt commented Oct 10, 2016

deads2k Oct 10, 2016

liggitt Oct 12, 2016

philips Oct 13, 2016

liggitt Oct 13, 2016

philips commented Oct 13, 2016

timstclair Oct 13, 2016

deads2k Oct 13, 2016

liggitt Oct 13, 2016

deads2k Oct 13, 2016

liggitt Oct 13, 2016

deads2k Oct 14, 2016

liggitt Oct 25, 2016

deads2k Oct 13, 2016

liggitt Oct 25, 2016

deads2k Oct 13, 2016

liggitt Oct 25, 2016

deads2k commented Oct 13, 2016

k8s-ci-robot commented Oct 18, 2016

k8s-ci-robot commented Oct 25, 2016

k8s-ci-robot commented Oct 25, 2016

deads2k commented Oct 25, 2016

k8s-github-robot commented Oct 26, 2016

k8s-github-robot commented Oct 26, 2016

erictune commented Nov 2, 2016

erictune commented Nov 2, 2016

kubelet authn/authz #34381

kubelet authn/authz #34381

Conversation

liggitt commented Oct 8, 2016 • edited Loading

liggitt commented Oct 10, 2016 • edited Loading

deads2k commented Oct 10, 2016

liggitt commented Oct 10, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

philips commented Oct 13, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k commented Oct 13, 2016

k8s-ci-robot commented Oct 18, 2016

k8s-ci-robot commented Oct 25, 2016

k8s-ci-robot commented Oct 25, 2016

deads2k commented Oct 25, 2016

k8s-github-robot commented Oct 26, 2016

k8s-github-robot commented Oct 26, 2016

erictune commented Nov 2, 2016

erictune commented Nov 2, 2016

liggitt commented Oct 8, 2016 •

edited

Loading

liggitt commented Oct 10, 2016 •

edited

Loading