plugin/pkg/client/auth: add openstack auth provider #39587

zhouhaibing089 · Jan 9, 2017

This is an implementation of auth provider for OpenStack world, just like python-openstackclient, we read the environment variables of a list OS_*, and client will cache a token to interact with each components, we can do the same here, the client side can cache a token locally at the first time, and rotate automatically when it expires.

This requires an implementation of token authenticator at server side, refer:

[made by me] #25536, I can carry this on when it is fine to go.
[made by @kfox1111] #25391

The reason why I want to add this is due to the client-side nature, it will be confusing to implement it downstream, we would like to add this support here, and customers can get kubectl like they usually do(brew install kubernetes-cli), and it will just work.

When this is done, we can deprecate the password keystone authenticator as the following reasons:

as mentioned at some other places, the domain is another parameters which should be provided.
in case the user supplies apikey and secrets, we might want to fill the UserInfo with the real name which is not implemented for now.

cc @erictune @liggitt

add openstack auth provider

k8s-ci-robot · Jan 9, 2017

Hi @zhouhaibing089. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with @k8s-bot ok to test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-reviewable · Jan 9, 2017

This change is

anguslees · Jan 14, 2017

@k8s-bot ok to test
/lgtm

k8s-ci-robot · Jan 14, 2017

@anguslees: you can't LGTM a PR unless you are an assignee.

In response to this comment:

@k8s-bot ok to test
/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

anguslees · Jan 14, 2017

@idvoretskyi sig-openstack area tag please

liggitt · Jan 14, 2017

liggitt reviewed Jan 14, 2017

View changes

liggitt · Jan 14, 2017

plugin/pkg/client/auth/openstack/openstack.go

+
+// refreshToken token by authenticate with openstack again
+func refreshToken() (string, error) {
+	options, err := openstack.AuthOptionsFromEnv()


Is an openstack token ever obtained from then env directly? cc @kfox1111

@liggitt no it is not, it needs to call keystone with these env vars, and then, a token will be returned.

liggitt · Jan 14, 2017

liggitt reviewed Jan 14, 2017

View changes

liggitt · Jan 14, 2017

plugin/pkg/client/auth/openstack/openstack.go

+
+// RoundTrip adds the bearer token into the request, and rotate it automatically
+func (t *tokenRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Authorization", "Bearer "+t.token)


It looks like the first time, the token will always be blank. Is that expected?

well, you catch it! it still works though(the auto renew). I will add a call once the round tripper is initialized.

liggitt · Jan 14, 2017

liggitt reviewed Jan 14, 2017

View changes

liggitt · Jan 14, 2017

plugin/pkg/client/auth/openstack/openstack.go

+	}
+	t.failed = true
+	// will need to refresh the token, and redo the request
+	if t.token, err = t.getToken(); err != nil {


Is the same auth provider reused if a single CLI instance makes multiple API calls? I think @ericchiang just made some changes to the OIDC auth provider to avoid multiple expensive reconstructions in that case. Would be worth logging the number of times a token is requested and making sure it only happens once in the normal case.

I'm also not seeing where the retrieved token is persisted.

@liggitt each call via cli(kubectl), it will be reconstructed, this is true. a better way to handle this is to cache(truly) the token into the kubeconfig, if that do makes it better.

I think @ericchiang just made some changes to the OIDC auth provider to avoid multiple expensive reconstructions in that case.

To reiterate the auth provider is going to be constantly re-initialized within the span on a single kubeclt call. We remedied that by having a global cache of clients and did a lookup on initialization. If initialization is expensive, you'll need to cache the results.

liggitt · Jan 14, 2017

liggitt reviewed Jan 14, 2017

View changes

liggitt · Jan 14, 2017

plugin/pkg/client/auth/openstack/openstack_test.go

+func RandStringBytes(n int) string {
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = LetterBytes[rand.Intn(len(LetterBytes))]


You need your own instance of math.Rand seeded with something actually random

Well, maybe not in a test

liggitt · Jan 14, 2017

cc @kubernetes/sig-openstack-misc

wjun · Jan 14, 2017

As long as any approach cannot keep end users unaware of openstack specific information besides domain name, username, password which other systems also have, we cannot remove the current username/password authn which hide openstack specific information from end users perfectly. k8s users do not need to know openstack's information in some cases.

ericchiang · Jan 14, 2017

ericchiang reviewed Jan 14, 2017

View changes

ericchiang · Jan 14, 2017

plugin/pkg/client/auth/openstack/openstack.go

+	return &tokenRoundTripper{RoundTripper: rt, getToken: refreshToken}
+}
+
+func (c *openstackAuthProvider) Login() error { return nil }


Maybe we should just remove this from the interface? Nothing implements it and there's no way to trigger it.

well, I think it is not tied with this pr, but I am wiling to check and remove it.

ericchiang · Jan 14, 2017

ericchiang reviewed Jan 14, 2017

View changes

ericchiang · Jan 14, 2017

plugin/pkg/client/auth/openstack/openstack.go

+// RoundTrip adds the bearer token into the request, and rotate it automatically
+func (t *tokenRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Authorization", "Bearer "+t.token)
+	resp, err := t.RoundTripper.RoundTrip(req)


We removed similar logic from the OIDC plugin. I don't think http.RoundTrippers should be retrying requests. Is there a way to determine if a token is invalid without getting back a StatusUnauthorized?

Is there a way to determine if a token is invalid without getting back a StatusUnauthorized?

As far as I know, there is no easy way:

call keystone token api, but it requires admin role(at least in our openstack deployment).

local validation, the PKI token can be validated locally by: 1) download the keystone certificate, 2) decode the token. but it only handles PKI tokens, also if it is totally local, the revocation will not be aware of.

zhouhaibing089 · Jan 15, 2017

Well, I have no idea on why the Jenkins verification failed, I've already fixed the bazel things as I can see..

zhouhaibing089 · Aug 3, 2017

@sttts @liggitt is this PR in good shape now and can we get this in?

sttts · Aug 3, 2017

The plumbing looks fine. Do you have anybody reviewing the actual plugin logic in staging/src/k8s.io/client-go/plugin/pkg/client/auth/openstack/openstack.go ? @liggitt ?

zhouhaibing089 · Aug 3, 2017

@sttts I think @liggitt and @ericchiang and folks in sig-openstack already give it a review.

sttts · Aug 3, 2017

Alright.

/lgtm
/approve no-issue

k8s-ci-robot · Aug 3, 2017

@zhouhaibing089: you can't request testing unless you are a kubernetes member.

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sttts · Aug 3, 2017

/retest

zhouhaibing089 · Aug 4, 2017

updated BUILD file.

dims · Aug 6, 2017

/ok-to-test

dims · Aug 6, 2017

/lgtm

k8s-merge-robot · Aug 6, 2017

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anguslees, dims, sttts, zhouhaibing089

Associated issue requirement bypassed by: sttts

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~staging/src/k8s.io/client-go/OWNERS~~ [sttts]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

zhouhaibing089 · Aug 6, 2017

just run ./hack/update-staging-godeps.sh..

dims · Aug 6, 2017

/retest

sttts · Aug 7, 2017

/retest

fejta-bot · Aug 7, 2017

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to @fejta).

Review the full test history for this PR.

fejta-bot · Aug 7, 2017

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to @fejta).

Review the full test history for this PR.

k8s-merge-robot · Aug 7, 2017

Automatic merge from submit-queue (batch tested with PRs 50087, 39587, 50042, 50241, 49914)

k8s-ci-robot added the cncf-cla: yes label Jan 9, 2017

k8s-merge-robot assigned davidopp Jan 9, 2017

k8s-merge-robot added size/L release-note-label-needed labels Jan 9, 2017

zhouhaibing089 referenced this pull request Jan 11, 2017
Closed
OpenStack Keystone Token Authentication #25391

liggitt added the sig/auth label Jan 13, 2017

liggitt referenced this pull request Jan 13, 2017
Closed
Add authentication on keystone v3 #37669

liggitt assigned liggitt and unassigned davidopp Jan 14, 2017

liggitt added the sig/openstack label Jan 14, 2017

liggitt referenced this pull request Jan 18, 2017
Closed
[WIP] - keystone token authentication #25536

k8s-merge-robot added the needs-rebase label Jan 20, 2017

k8s-merge-robot assigned lavalamp and unassigned liggitt Jan 30, 2017

apelisse assigned liggitt Jan 31, 2017

k8s-merge-robot assigned thockin Jan 31, 2017

k8s-ci-robot added the lgtm label Aug 3, 2017

k8s-merge-robot added the approved label Aug 3, 2017

k8s-merge-robot added needs-rebase and removed lgtm needs-rebase labels Aug 4, 2017

k8s-ci-robot assigned dims Aug 6, 2017

k8s-ci-robot added the lgtm label Aug 6, 2017

plugin/pkg/client/auth: add openstack auth provider

Loading status checks…

a0cebcb

k8s-merge-robot removed the lgtm label Aug 6, 2017

sttts added the lgtm label Aug 7, 2017

liggitt referenced this pull request Feb 8, 2018
Merged
Remove experimental keystone authenticator #59492

kubernetes/kubernetes

Join GitHub today

plugin/pkg/client/auth: add openstack auth provider #39587

Conversation

zhouhaibing089 commented Jan 9, 2017 • edited

This comment has been minimized.

k8s-ci-robot commented Jan 9, 2017

k8s-ci-robot added the cncf-cla: yes label Jan 9, 2017

This comment has been minimized.

k8s-reviewable commented Jan 9, 2017

k8s-merge-robot assigned davidopp Jan 9, 2017

k8s-merge-robot added size/L release-note-label-needed labels Jan 9, 2017

zhouhaibing089 referenced this pull request Jan 11, 2017

liggitt added the sig/auth label Jan 13, 2017

liggitt referenced this pull request Jan 13, 2017

This comment has been minimized.

anguslees commented Jan 14, 2017

This comment has been minimized.

k8s-ci-robot commented Jan 14, 2017

This comment has been minimized.

anguslees commented Jan 14, 2017

liggitt assigned liggitt and unassigned davidopp Jan 14, 2017

liggitt reviewed Jan 14, 2017 View changes

This comment has been minimized.

liggitt Jan 14, 2017 • edited

This comment has been minimized.

liggitt reviewed Jan 14, 2017 View changes

This comment has been minimized.

This comment has been minimized.

liggitt reviewed Jan 14, 2017 View changes

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

liggitt reviewed Jan 14, 2017 View changes

This comment has been minimized.

This comment has been minimized.

liggitt added the sig/openstack label Jan 14, 2017

This comment has been minimized.

liggitt commented Jan 14, 2017

This comment has been minimized.

wjun commented Jan 14, 2017

ericchiang reviewed Jan 14, 2017 View changes

This comment has been minimized.

This comment has been minimized.

ericchiang reviewed Jan 14, 2017 View changes

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

zhouhaibing089 commented Jan 15, 2017

liggitt referenced this pull request Jan 18, 2017

k8s-merge-robot added the needs-rebase label Jan 20, 2017

k8s-merge-robot assigned lavalamp and unassigned liggitt Jan 30, 2017

apelisse assigned liggitt Jan 31, 2017

k8s-merge-robot assigned thockin Jan 31, 2017

This comment has been minimized.

zhouhaibing089 commented Aug 3, 2017 • edited

This comment has been minimized.

sttts commented Aug 3, 2017

This comment has been minimized.

zhouhaibing089 commented Aug 3, 2017

This comment has been minimized.

sttts commented Aug 3, 2017

k8s-ci-robot added the lgtm label Aug 3, 2017

k8s-merge-robot added the approved label Aug 3, 2017

This comment has been minimized.

k8s-ci-robot commented Aug 3, 2017

This comment has been minimized.

sttts commented Aug 3, 2017

This comment has been minimized.

zhouhaibing089 commented Aug 4, 2017

k8s-merge-robot added needs-rebase and removed lgtm needs-rebase labels Aug 4, 2017

This comment has been minimized.

dims commented Aug 6, 2017

This comment has been minimized.

dims commented Aug 6, 2017

k8s-ci-robot assigned dims Aug 6, 2017

k8s-ci-robot added the lgtm label Aug 6, 2017

This comment has been minimized.

k8s-merge-robot commented Aug 6, 2017

zhouhaibing089 commented Jan 9, 2017 •

edited

liggitt reviewed Jan 14, 2017

View changes

liggitt Jan 14, 2017 •

edited

liggitt reviewed Jan 14, 2017

View changes

liggitt reviewed Jan 14, 2017

View changes

liggitt reviewed Jan 14, 2017

View changes

ericchiang reviewed Jan 14, 2017

View changes

ericchiang reviewed Jan 14, 2017

View changes

zhouhaibing089 commented Aug 3, 2017 •

edited

k8s-merge-robot merged commit `59b8fa3` into kubernetes:master Aug 7, 2017
10 checks passed