apiserver: document how to run sample-apiserver standalone outside the cluster #55476

sttts · 2017-11-10T12:23:30Z

This PR documents how to run the sample-apiserver outside of a cluster for development.

tl/dr: local client CA with system:masters group membership. Then authorization is skipped.

deads2k · 2017-11-10T12:33:59Z

staging/src/k8s.io/apiserver/pkg/server/options/authentication.go

@@ -375,6 +375,10 @@ func (s *DelegatingAuthenticationOptions) getClientConfig() (*rest.Config, error
 }

 func (s *DelegatingAuthenticationOptions) newTokenAccessReview() (authenticationclient.TokenReviewInterface, error) {
+	if len(s.RequestHeader.ClientCAFile) > 0 || s.SkipInClusterLookup {


I can have a clientCAFile and a tokenaccessreview.

deads2k · 2017-11-10T12:34:29Z

staging/src/k8s.io/apiserver/pkg/server/options/authorization.go

@@ -35,6 +35,9 @@ type DelegatingAuthorizationOptions struct {
 	// SubjectAccessReview.authorization.k8s.io endpoint for checking tokens.
 	RemoteKubeConfigFile string

+	// DisableAuthorization is used to explicitly disable any authorization, mostly for development purposes.
+	DisableAuthorization bool


Why would I want this lever? What's hard about doing development with a pod and image?

we want to extract openapi from a server, i.e. just launch the server, do one curl and terminate.

and about pod and image: people want to run an apiserver inside an idea. a multi-process setup is far too complicated. Am happy to call this option explicitly "dev-only" or something like that.

Am happy to call this option explicitly "dev-only" or something like that.

Thing is, I really don't even want devs using it. Lack of consideration for security has produced sins we're still paying for after 3 years. What if you made it system:masters only and used a client cert. That gives you the single file.

If it starts up without a config, but only accepts system:masters, that sounds fine, works for development, but any non-dev use-case immediately need a secure setup. Is this was what you mean? If not, please elaborate.

deads2k · 2017-11-10T12:34:52Z

staging/src/k8s.io/apiserver/pkg/server/options/authorization.go

-	if err != nil {
-		return err
+	if s.DisableAuthorization {
+		c.Authorizer = authorizerfactory.NewAlwaysAllowAuthorizer()


return early here, then no else.

tamalsaha · 2017-11-10T12:39:59Z

Thanks @sttts ! This will be very handy for dev setup and openapi generation for non-GO clients.

deads2k · 2017-11-10T12:50:57Z

we want to extract openapi from a server, i.e. just launch the server, do one curl and terminate.

This seems like the wrong way to go about that. I would instead try to find a way to get openapi docs without launching a server at all.

tamalsaha · 2017-11-10T12:52:24Z

@deads2k , do you how to get the openapi doc without any api server? May be something like that can be added to code-generators.

sttts · 2017-11-10T12:54:17Z

This seems like the wrong way to go about that. I would instead try to find a way to get openapi docs without launching a server at all.

I don't disagree, but I fear this means a huge refactoring of our openapi code.

sttts · 2017-11-14T09:30:21Z

@deads2k updated, only granting access to group system:master using client certs.

k8s-ci-robot · 2018-04-27T07:36:45Z

@sttts: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sttts · 2018-04-27T07:38:06Z

@deads2k @liggitt this is now docs only. ptal.

xmudrii

LGTM. Can confirm this works for local development.

sttts · 2018-04-27T12:16:14Z

/retest

…e cluster

sttts · 2018-05-07T11:55:30Z

@deads2k lgty?

deads2k · 2018-05-07T12:35:47Z

/lgtm

k8s-ci-robot · 2018-05-07T12:36:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, sttts

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~staging/src/k8s.io/sample-apiserver/OWNERS~~ [deads2k,sttts]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-github-robot · 2018-05-07T12:36:54Z

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here.

k8s-ci-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Nov 10, 2017

k8s-github-robot assigned lavalamp and liggitt Nov 10, 2017

sttts assigned deads2k and unassigned lavalamp and liggitt Nov 10, 2017

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Nov 10, 2017

sttts force-pushed the sttts-sample-apiserver-standalone branch from 06014f4 to 770bc0c Compare November 10, 2017 12:24

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Nov 10, 2017

sttts added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Nov 10, 2017

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Nov 10, 2017

deads2k reviewed Nov 10, 2017

View reviewed changes

sttts force-pushed the sttts-sample-apiserver-standalone branch from 770bc0c to 2464fe5 Compare November 14, 2017 09:27

sttts force-pushed the sttts-sample-apiserver-standalone branch from 2464fe5 to f703bc2 Compare November 14, 2017 12:44

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Nov 14, 2017

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 15, 2017

sttts force-pushed the sttts-sample-apiserver-standalone branch 2 times, most recently from 582508c to 64b50c8 Compare November 15, 2017 12:58

sttts force-pushed the sttts-sample-apiserver-standalone branch from 48dcdb7 to d22ec24 Compare April 26, 2018 10:22

k8s-ci-robot added the retest-not-required-docs-only label Apr 26, 2018

kubernetes deleted a comment from k8s-github-robot Apr 26, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 26, 2018

sttts force-pushed the sttts-sample-apiserver-standalone branch 5 times, most recently from 1ea8307 to 1c8d56a Compare April 27, 2018 07:35

k8s-ci-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. and removed release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Apr 27, 2018

sttts changed the title ~~apiserver: allow sample-apiserver to be run standalone for development~~ apiserver: document how to run sample-apiserver standalone outside the cluster Apr 27, 2018

sttts force-pushed the sttts-sample-apiserver-standalone branch from 1c8d56a to 9222aa6 Compare April 27, 2018 07:39

sttts added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Apr 27, 2018

sttts force-pushed the sttts-sample-apiserver-standalone branch from 9222aa6 to c14fa27 Compare April 27, 2018 07:41

xmudrii approved these changes Apr 27, 2018

View reviewed changes

sttts force-pushed the sttts-sample-apiserver-standalone branch from c14fa27 to 81b0198 Compare April 27, 2018 07:42

apiserver: document how to run sample-apiserver standalone outside th…

ad21a4a

…e cluster

sttts force-pushed the sttts-sample-apiserver-standalone branch from 81b0198 to ad21a4a Compare April 27, 2018 12:58

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 7, 2018

k8s-github-robot merged commit 239d612 into kubernetes:master May 7, 2018

xmudrii mentioned this pull request Aug 29, 2018

REQUEST: New membership for xmudrii kubernetes/org#48

Closed

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

apiserver: document how to run sample-apiserver standalone outside the cluster #55476

apiserver: document how to run sample-apiserver standalone outside the cluster #55476

sttts commented Nov 10, 2017 •

edited

Loading

deads2k Nov 10, 2017

deads2k Nov 10, 2017

sttts Nov 10, 2017

sttts Nov 10, 2017

deads2k Nov 10, 2017

sttts Nov 10, 2017

deads2k Nov 10, 2017

sttts Nov 13, 2017

tamalsaha commented Nov 10, 2017

deads2k commented Nov 10, 2017

tamalsaha commented Nov 10, 2017

sttts commented Nov 10, 2017

sttts commented Nov 14, 2017

k8s-ci-robot commented Apr 27, 2018

sttts commented Apr 27, 2018

xmudrii left a comment

sttts commented Apr 27, 2018

sttts commented May 7, 2018

deads2k commented May 7, 2018

k8s-ci-robot commented May 7, 2018

k8s-github-robot commented May 7, 2018

apiserver: document how to run sample-apiserver standalone outside the cluster #55476

apiserver: document how to run sample-apiserver standalone outside the cluster #55476

Conversation

sttts commented Nov 10, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tamalsaha commented Nov 10, 2017

deads2k commented Nov 10, 2017

tamalsaha commented Nov 10, 2017

sttts commented Nov 10, 2017

sttts commented Nov 14, 2017

k8s-ci-robot commented Apr 27, 2018

sttts commented Apr 27, 2018

xmudrii left a comment

Choose a reason for hiding this comment

sttts commented Apr 27, 2018

sttts commented May 7, 2018

deads2k commented May 7, 2018

k8s-ci-robot commented May 7, 2018

k8s-github-robot commented May 7, 2018

sttts commented Nov 10, 2017 •

edited

Loading