client-go: add an exec-based client auth provider #59495

ericchiang · 2018-02-07T18:44:24Z

Updates kubernetes/enhancements#541
Implements kubernetes/community#1503
Closes #57164

client-go: alpha support for exec-based credential providers

/sig auth
/kind feature

caesarxuchao · 2018-02-08T00:22:52Z

cc @mikedanese

ericchiang · 2018-02-08T00:27:46Z

cc @kubernetes/sig-auth-pr-reviews
cc @nckturner
cc @perotinus
cc @ericavonb

php-coder · 2018-02-08T00:32:01Z

staging/src/k8s.io/client-go/pkg/apis/clientauthentication/types.go

+// Response defines metadata about a failed request, including HTTP status code and
+// response headers.
+type Response struct {
+	// HTTP header returned by the server.


s/header/headers/

php-coder · 2018-02-08T00:42:18Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/testdata/test-plugin

@@ -0,0 +1,4 @@
+#!/bin/sh -e


I'd rather name it test-plugin.sh.

php-coder · 2018-02-08T00:44:11Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/testdata/test-plugin

@@ -0,0 +1,4 @@
+#!/bin/sh -e
+
+(>&2 echo "$KUBERNETES_EXEC_INFO")


Why do we need a sub-shell here? And how it differs from echo >&2 "$KUBERNETES_EXEC_INFO" that is easier to understand IMHO.

No reason. Updated.

ericchiang · 2018-02-08T18:18:33Z

Flaking on #59426

/test pull-kubernetes-unit

mikedanese · 2018-02-08T22:37:46Z

staging/src/k8s.io/client-go/tools/clientcmd/api/types.go

@@ -119,6 +119,9 @@ type AuthInfo struct {
 	// AuthProvider specifies a custom authentication plugin for the kubernetes cluster.
 	// +optional
 	AuthProvider *AuthProviderConfig `json:"auth-provider,omitempty"`
+	// Exec specifies a custom exec-based authentication plugin for the kubernetes cluster.
+	// +optional
+	Exec *ExecConfig `json:"exec,omitempty"`


Why did you decide not to implement this as another AuthProvider?

Was called out in the proposal. We know the structure and map[string]string is awkward for expressing things like a list of key/value environment variables.

https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/kubectl-exec-plugins.md#kubeconfig-changes

mikedanese · 2018-02-09T04:23:30Z

staging/src/k8s.io/client-go/pkg/apis/clientauthentication/types.go

+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient


Do we need this?

mikedanese · 2018-02-09T04:24:41Z

staging/src/k8s.io/client-go/pkg/apis/clientauthentication/v1alpha1/conversion.go

+)
+
+func Convert_clientauthentication_ExecCredentials_To_v1alpha1_ExecCredentials(in *clientauthentication.ExecInfo, out *ExecInfo, s conversion.Scope) error {
+	return autoConvert_clientauthentication_ExecInfo_To_v1alpha1_ExecInfo(in, out, s)


Why do we need this if it just calls autoConvert?

mikedanese · 2018-02-09T04:27:29Z

staging/src/k8s.io/client-go/pkg/apis/clientauthentication/types.go

+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ExecCredentials are credentials returned by the plugin.
+type ExecCredentials struct {


Request/response non-storage APIs have used a single type and spec/status in the past. Any reason to deviate from that convention?

Good point, I don't have a good reason. Switched to spec/status.

mikedanese · 2018-02-09T04:43:48Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go

+func (c *cache) get(s string) (*Authenticator, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	a, ok := c.m[s]


return c.m[s]

Doesn't seem like that works https://play.golang.org/p/2dzFfrrGBkR

mikedanese · 2018-02-09T04:43:51Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go

+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if len(c.m) == 0 {
+		c.m = make(map[string]*Authenticator)


why not expect this to happen on cache initialization?

mikedanese · 2018-02-09T04:57:32Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go

+)
+
+func cacheKey(c *api.ExecConfig) string {
+	h := fnv.New32a()


The hash map is already hashing. Do we need to double hash?

mikedanese · 2018-02-09T05:09:12Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go

+			a.group, schema.GroupVersion{Group: gvk.Group, Version: gvk.Version})
+	}
+
+	if !creds.Expiry.IsZero() {


isn't this if block the same as a.exp = creds.Expiry.Time?

nckturner · 2018-02-27T23:50:22Z

LGTM

ericchiang · 2018-02-27T23:52:55Z

/assign @smarterclayton

For final approval

liggitt · 2018-02-28T03:42:29Z

staging/src/k8s.io/client-go/pkg/apis/clientauthentication/v1alpha1/types.go

+type ExecCredentialStatus struct {
+	// ExpirationTimestamp indicates a time when the provided credentials expire.
+	// +optional
+	ExpirationTimestamp metav1.Time `json:"expirationTimestamp,omitempty"`


this has to be a pointer if you actually want it omitted from serialization

liggitt · 2018-02-28T04:08:54Z

staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go

+	}
+
+	a := &Authenticator{
+		cmd:   config.Command,


it seems like there are three possibilities for this path:

relative (e.g. ./foo)

absolute (e.g. /path/to/foo)

$PATH-based (e.g. curl)

Was there discussion about how to resolve the referenced command here?

There is already code for resolving files referenced from kubeconfig files so that relative paths are resolved relative to the kubeconfig file (see ResolvePaths and GetAuthInfoFileReferences).

My instinct would be to resolve explicitly relative paths ./foo in GetAuthInfoFileReferences, leave absolute paths alone, and resolve bare commands (e.g. curl) using $PATH. Thoughts?

I like keeping the relative path logic the same as other files in kubeconfig files. Let me update this.

I guess if you want $PATH behavior you can invoke a local script

I guess if you want $PATH behavior you can invoke a local script

exec.Command already does that: https://golang.org/pkg/os/exec/#Command

liggitt · 2018-02-28T05:11:47Z

no other comments from me

ericchiang · 2018-02-28T05:22:12Z

staging/src/k8s.io/client-go/tools/clientcmd/loader.go

-	return []*string{&authInfo.ClientCertificate, &authInfo.ClientKey, &authInfo.TokenFile}
+	s := []*string{&authInfo.ClientCertificate, &authInfo.ClientKey, &authInfo.TokenFile}
+	// Only resolve exec command if it isn't PATH based.
+	if authInfo.Exec != nil && strings.ContainsRune(authInfo.Exec.Command, filepath.Separator) {


Relative logic added

SGTM... make sure this nuance makes it into the docs ("./foo is relative to the kubeconfig file, foo looks in the $PATH")

liggitt · 2018-02-28T05:31:43Z

/lgtm

ericchiang · 2018-02-28T16:51:53Z

(nits addressed)

smarterclayton · 2018-03-01T04:05:46Z

/approve based on sig commentary

…

On Wed, Feb 28, 2018 at 11:52 AM, Eric Chiang ***@***.***> wrote: (nits addressed) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#59495 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_px_KPEqe1BIklvUf51IMQeGfx-2Qks5tZYQ4gaJpZM4R9MxO> .

k8s-ci-robot · 2018-03-01T04:05:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ericchiang, liggitt, mikedanese, smarterclayton

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~pkg/OWNERS~~ [smarterclayton]
~~staging/OWNERS~~ [smarterclayton]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-github-robot · 2018-03-01T05:00:45Z

/test all [submit-queue is verifying that this PR is safe to merge]

k8s-github-robot · 2018-03-01T06:03:16Z

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here.

rajatjindal · 2018-03-24T05:47:04Z

Hi @ericchiang

is there any documentation that I can refer to to use this. I tried with 1.10 RC kubectl, but it does not seem to call my external command at all.

…t out Matches Go client's behavior: kubernetes/kubernetes#59495 (comment) Distinguish 3 cases: - absolute (e.g. /path/to/foo) - $PATH-based (e.g. curl) - relative to config file's dir (e.g. ./foo) If base dir explicitly set to nil, refuse to execute external commands, matching existing opt-out from file lookups (ManageIQ#372). Document security aspects of credential plugins.

k8s-ci-robot requested review from caesarxuchao, cheftako, dchen1107, deads2k, liggitt, mwielgus, nikhita, sttts, thockin and timothysc February 7, 2018 18:44

ericchiang force-pushed the client-auth-exec branch from 4694bec to 8a2464e Compare February 7, 2018 18:59

ericchiang mentioned this pull request Feb 7, 2018

hack: update bazel-gazelle to 0.9 #59509

Closed

ericchiang force-pushed the client-auth-exec branch from 8a2464e to e8c6647 Compare February 8, 2018 00:10

php-coder reviewed Feb 8, 2018

View reviewed changes

ericchiang force-pushed the client-auth-exec branch 2 times, most recently from 4aeb04b to ffcd361 Compare February 8, 2018 17:14

mikedanese reviewed Feb 9, 2018

View reviewed changes

ericchiang force-pushed the client-auth-exec branch 3 times, most recently from da3b7e9 to 08fedf5 Compare February 9, 2018 17:20

k8s-ci-robot assigned smarterclayton Feb 27, 2018

liggitt reviewed Feb 28, 2018

View reviewed changes

ericchiang force-pushed the client-auth-exec branch from e89b3c0 to 36d94c5 Compare February 28, 2018 05:19

ericchiang added 2 commits February 27, 2018 21:21

client-go: add an exec-based client auth provider

6463e9e

generated

01801ae

ericchiang force-pushed the client-auth-exec branch from 36d94c5 to 01801ae Compare February 28, 2018 05:21

ericchiang commented Feb 28, 2018

View reviewed changes

k8s-ci-robot assigned liggitt Feb 28, 2018

k8s-github-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 28, 2018

ericchiang added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 28, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 1, 2018

k8s-github-robot merged commit cb9d6b5 into kubernetes:master Mar 1, 2018

dlipovetsky mentioned this pull request Mar 4, 2018

pkg/client/auth/openstack does not persist the token it obtains #60541

Closed

dims mentioned this pull request Mar 27, 2018

Kubectl exec-based client auth provider for Keystone kubernetes/cloud-provider-openstack#54

Closed

wojtek-t mentioned this pull request Apr 5, 2018

'PATCH node-status' latency slo violations #62064

Closed

leosunmo mentioned this pull request Apr 19, 2018

Docker for Mac with Kubernetes in Edge channel breaks Kubernetes 1.10 kubeconfig docker/for-mac#2829

Closed

3 tasks

cben mentioned this pull request Dec 9, 2018

Credential plugins: lookup command relative to config's dir, nil = opt-out ManageIQ/kubeclient#375

Merged

sczizzo mentioned this pull request May 11, 2020

idea: Credential plugin for kubectl gravitational/teleport#3690

Closed

		@@ -0,0 +1,4 @@
		#!/bin/sh -e

		(>&2 echo "$KUBERNETES_EXEC_INFO")

client-go: add an exec-based client auth provider #59495

client-go: add an exec-based client auth provider #59495

Conversation

ericchiang commented Feb 7, 2018 • edited

caesarxuchao commented Feb 8, 2018

ericchiang commented Feb 8, 2018 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ericchiang commented Feb 8, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nckturner commented Feb 27, 2018

ericchiang commented Feb 27, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Feb 28, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Feb 28, 2018

ericchiang commented Feb 28, 2018

smarterclayton commented Mar 1, 2018 via email

k8s-ci-robot commented Mar 1, 2018

k8s-github-robot commented Mar 1, 2018

k8s-github-robot commented Mar 1, 2018

rajatjindal commented Mar 24, 2018

ericchiang commented Feb 7, 2018 •

edited

ericchiang commented Feb 8, 2018 •

edited