Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Switch bootstrap token authenticator informer to external types #70174

Merged
merged 3 commits into from
Oct 24, 2018
Merged

Switch bootstrap token authenticator informer to external types #70174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e3b61ea
switch informer in token authn
yue9944882 Oct 24, 2018
e4a8ad4
sync missing secret type to external api repo
yue9944882 Oct 24, 2018
38ddb44
update token authn constructor
yue9944882 Oct 24, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 3 additions & 3 deletions cmd/kube-apiserver/app/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -524,7 +524,7 @@ func buildGenericConfig(
}
serviceResolver = aggregatorapiserver.NewLoopbackServiceResolver(serviceResolver, localHost)

genericConfig.Authentication.Authenticator, genericConfig.OpenAPIConfig.SecurityDefinitions, err = BuildAuthenticator(s, clientgoExternalClient, sharedInformers)
genericConfig.Authentication.Authenticator, genericConfig.OpenAPIConfig.SecurityDefinitions, err = BuildAuthenticator(s, clientgoExternalClient, versionedInformers)
if err != nil {
lastErr = fmt.Errorf("invalid authentication config: %v", err)
return
Expand Down Expand Up @@ -625,13 +625,13 @@ func BuildAdmissionPluginInitializers(
}

// BuildAuthenticator constructs the authenticator
func BuildAuthenticator(s *options.ServerRunOptions, extclient clientgoclientset.Interface, sharedInformers informers.SharedInformerFactory) (authenticator.Request, *spec.SecurityDefinitions, error) {
func BuildAuthenticator(s *options.ServerRunOptions, extclient clientgoclientset.Interface, versionedInformer clientgoinformers.SharedInformerFactory) (authenticator.Request, *spec.SecurityDefinitions, error) {
authenticatorConfig := s.Authentication.ToAuthenticationConfig()
if s.Authentication.ServiceAccounts.Lookup {
authenticatorConfig.ServiceAccountTokenGetter = serviceaccountcontroller.NewGetterFromClient(extclient)
}
authenticatorConfig.BootstrapTokenAuthenticator = bootstrap.NewTokenAuthenticator(
sharedInformers.Core().InternalVersion().Secrets().Lister().Secrets(v1.NamespaceSystem),
versionedInformer.Core().V1().Secrets().Lister().Secrets(v1.NamespaceSystem),
)

return authenticatorConfig.New()
Expand Down
6 changes: 3 additions & 3 deletions plugin/pkg/auth/authenticator/token/bootstrap/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ go_test(
srcs = ["bootstrap_test.go"],
embed = [":go_default_library"],
deps = [
"//pkg/apis/core:go_default_library",
"//staging/src/k8s.io/api/core/v1:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/labels:go_default_library",
Expand All @@ -26,12 +26,12 @@ go_library(
srcs = ["bootstrap.go"],
importpath = "k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/bootstrap",
deps = [
"//pkg/apis/core:go_default_library",
"//pkg/client/listers/core/internalversion:go_default_library",
"//staging/src/k8s.io/api/core/v1:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/authentication/user:go_default_library",
"//staging/src/k8s.io/client-go/listers/core/v1:go_default_library",
"//staging/src/k8s.io/cluster-bootstrap/token/api:go_default_library",
"//staging/src/k8s.io/cluster-bootstrap/token/util:go_default_library",
"//vendor/github.com/golang/glog:go_default_library",
Expand Down
16 changes: 8 additions & 8 deletions plugin/pkg/auth/authenticator/token/bootstrap/bootstrap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,14 +29,14 @@ import (

"github.com/golang/glog"

corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/user"
corev1listers "k8s.io/client-go/listers/core/v1"
bootstrapapi "k8s.io/cluster-bootstrap/token/api"
bootstraputil "k8s.io/cluster-bootstrap/token/util"
api "k8s.io/kubernetes/pkg/apis/core"
"k8s.io/kubernetes/pkg/client/listers/core/internalversion"
)

// TODO: A few methods in this package is copied from other sources. Either
Expand All @@ -46,21 +46,21 @@ import (
// NewTokenAuthenticator initializes a bootstrap token authenticator.
//
// Lister is expected to be for the "kube-system" namespace.
func NewTokenAuthenticator(lister internalversion.SecretNamespaceLister) *TokenAuthenticator {
func NewTokenAuthenticator(lister corev1listers.SecretNamespaceLister) *TokenAuthenticator {
return &TokenAuthenticator{lister}
}

// TokenAuthenticator authenticates bootstrap tokens from secrets in the API server.
type TokenAuthenticator struct {
lister internalversion.SecretNamespaceLister
lister corev1listers.SecretNamespaceLister
}

// tokenErrorf prints a error message for a secret that has matched a bearer
// token but fails to meet some other criteria.
//
// tokenErrorf(secret, "has invalid value for key %s", key)
//
func tokenErrorf(s *api.Secret, format string, i ...interface{}) {
func tokenErrorf(s *corev1.Secret, format string, i ...interface{}) {
format = fmt.Sprintf("Bootstrap secret %s/%s matching bearer token ", s.Namespace, s.Name) + format
glog.V(3).Infof(format, i...)
}
Expand Down Expand Up @@ -155,7 +155,7 @@ func (t *TokenAuthenticator) AuthenticateToken(ctx context.Context, token string
}

// Copied from k8s.io/cluster-bootstrap/token/api
func getSecretString(secret *api.Secret, key string) string {
func getSecretString(secret *corev1.Secret, key string) string {
data, ok := secret.Data[key]
if !ok {
return ""
Expand All @@ -165,7 +165,7 @@ func getSecretString(secret *api.Secret, key string) string {
}

// Copied from k8s.io/cluster-bootstrap/token/api
func isSecretExpired(secret *api.Secret) bool {
func isSecretExpired(secret *corev1.Secret) bool {
expiration := getSecretString(secret, bootstrapapi.BootstrapTokenExpirationKey)
if len(expiration) > 0 {
expTime, err2 := time.Parse(time.RFC3339, expiration)
Expand Down Expand Up @@ -205,7 +205,7 @@ func parseToken(s string) (string, string, error) {
// getGroups loads and validates the bootstrapapi.BootstrapTokenExtraGroupsKey
// key from the bootstrap token secret, returning a list of group names or an
// error if any of the group names are invalid.
func getGroups(secret *api.Secret) ([]string, error) {
func getGroups(secret *corev1.Secret) ([]string, error) {
// always include the default group
groups := sets.NewString(bootstrapapi.BootstrapDefaultGroup)

Expand Down
40 changes: 20 additions & 20 deletions plugin/pkg/auth/authenticator/token/bootstrap/bootstrap_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,24 +21,24 @@ import (
"reflect"
"testing"

corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apiserver/pkg/authentication/user"
bootstrapapi "k8s.io/cluster-bootstrap/token/api"
api "k8s.io/kubernetes/pkg/apis/core"
)

type lister struct {
secrets []*api.Secret
secrets []*corev1.Secret
}

func (l *lister) List(selector labels.Selector) (ret []*api.Secret, err error) {
func (l *lister) List(selector labels.Selector) (ret []*corev1.Secret, err error) {
return l.secrets, nil
}

func (l *lister) Get(name string) (*api.Secret, error) {
func (l *lister) Get(name string) (*corev1.Secret, error) {
for _, s := range l.secrets {
if s.Name == name {
return s, nil
Expand All @@ -58,15 +58,15 @@ func TestTokenAuthenticator(t *testing.T) {
tests := []struct {
name string

secrets []*api.Secret
secrets []*corev1.Secret
token string

wantNotFound bool
wantUser *user.DefaultInfo
}{
{
name: "valid token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
Expand All @@ -87,7 +87,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "valid token with extra group",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
Expand All @@ -109,7 +109,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "invalid group",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
Expand All @@ -128,7 +128,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "invalid secret name",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: "bad-name",
Expand All @@ -146,7 +146,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "no usage",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
Expand All @@ -163,7 +163,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "wrong token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
Expand All @@ -181,7 +181,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "deleted token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
Expand All @@ -200,7 +200,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "expired token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
Expand All @@ -219,7 +219,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "not expired token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
Expand All @@ -241,7 +241,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "token id wrong length",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + "foo",
Expand Down Expand Up @@ -292,21 +292,21 @@ func TestTokenAuthenticator(t *testing.T) {
func TestGetGroups(t *testing.T) {
tests := []struct {
name string
secret *api.Secret
secret *corev1.Secret
expectResult []string
expectError bool
}{
{
name: "not set",
secret: &api.Secret{
secret: &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Name: "test"},
Data: map[string][]byte{},
},
expectResult: []string{"system:bootstrappers"},
},
{
name: "set to empty value",
secret: &api.Secret{
secret: &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Name: "test"},
Data: map[string][]byte{
bootstrapapi.BootstrapTokenExtraGroupsKey: []byte(""),
Expand All @@ -316,7 +316,7 @@ func TestGetGroups(t *testing.T) {
},
{
name: "invalid prefix",
secret: &api.Secret{
secret: &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Name: "test"},
Data: map[string][]byte{
bootstrapapi.BootstrapTokenExtraGroupsKey: []byte("foo"),
Expand All @@ -326,7 +326,7 @@ func TestGetGroups(t *testing.T) {
},
{
name: "valid",
secret: &api.Secret{
secret: &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Name: "test"},
Data: map[string][]byte{
bootstrapapi.BootstrapTokenExtraGroupsKey: []byte("system:bootstrappers:foo,system:bootstrappers:bar,system:bootstrappers:bar"),
Expand Down
4 changes: 4 additions & 0 deletions staging/src/k8s.io/api/core/v1/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4996,6 +4996,10 @@ const (
TLSCertKey = "tls.crt"
// TLSPrivateKeyKey is the key for the private key field in a TLS secret.
TLSPrivateKeyKey = "tls.key"
// SecretTypeBootstrapToken is used during the automated bootstrap process (first
// implemented by kubeadm). It stores tokens that are used to sign well known
// ConfigMaps. They are used for authn.
SecretTypeBootstrapToken SecretType = "bootstrap.kubernetes.io/token"
)

// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
Expand Down
22 changes: 11 additions & 11 deletions test/integration/auth/bootstraptoken_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,24 +24,24 @@ import (
"testing"
"time"

corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/apiserver/pkg/authentication/request/bearertoken"
bootstrapapi "k8s.io/cluster-bootstrap/token/api"
api "k8s.io/kubernetes/pkg/apis/core"
"k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/bootstrap"
bootstraputil "k8s.io/kubernetes/test/e2e/lifecycle/bootstrap"
"k8s.io/kubernetes/test/integration"
"k8s.io/kubernetes/test/integration/framework"
)

type bootstrapSecrets []*api.Secret
type bootstrapSecrets []*corev1.Secret

func (b bootstrapSecrets) List(selector labels.Selector) (ret []*api.Secret, err error) {
func (b bootstrapSecrets) List(selector labels.Selector) (ret []*corev1.Secret, err error) {
return b, nil
}

func (b bootstrapSecrets) Get(name string) (*api.Secret, error) {
func (b bootstrapSecrets) Get(name string) (*corev1.Secret, error) {
return b[0], nil
}

Expand All @@ -55,36 +55,36 @@ func TestBootstrapTokenAuth(t *testing.T) {
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
var bootstrapSecretValid = &api.Secret{
var bootstrapSecretValid = &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Namespace: metav1.NamespaceSystem,
Name: bootstrapapi.BootstrapTokenSecretPrefix,
},
Type: api.SecretTypeBootstrapToken,
Type: corev1.SecretTypeBootstrapToken,
Data: map[string][]byte{
bootstrapapi.BootstrapTokenIDKey: []byte(tokenId),
bootstrapapi.BootstrapTokenSecretKey: []byte(secret),
bootstrapapi.BootstrapTokenUsageAuthentication: []byte("true"),
},
}
var bootstrapSecretInvalid = &api.Secret{
var bootstrapSecretInvalid = &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Namespace: metav1.NamespaceSystem,
Name: bootstrapapi.BootstrapTokenSecretPrefix,
},
Type: api.SecretTypeBootstrapToken,
Type: corev1.SecretTypeBootstrapToken,
Data: map[string][]byte{
bootstrapapi.BootstrapTokenIDKey: []byte(tokenId),
bootstrapapi.BootstrapTokenSecretKey: []byte("invalid"),
bootstrapapi.BootstrapTokenUsageAuthentication: []byte("true"),
},
}
var expiredBootstrapToken = &api.Secret{
var expiredBootstrapToken = &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Namespace: metav1.NamespaceSystem,
Name: bootstrapapi.BootstrapTokenSecretPrefix,
},
Type: api.SecretTypeBootstrapToken,
Type: corev1.SecretTypeBootstrapToken,
Data: map[string][]byte{
bootstrapapi.BootstrapTokenIDKey: []byte(tokenId),
bootstrapapi.BootstrapTokenSecretKey: []byte("invalid"),
Expand All @@ -101,7 +101,7 @@ func TestBootstrapTokenAuth(t *testing.T) {
tests := []struct {
name string
request request
secret *api.Secret
secret *corev1.Secret
}{
{
name: "valid token",
Expand Down