control-plane: sds: support k8s environment #201
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yskopets
force-pushed
the
feature/sds-on-k8s
branch
from
7621069
to
17650e9
Compare
jakubdyszkiewicz
requested changes
Sep 9, 2019
pkg/sds/auth/k8s/authenticator.go
Outdated
| @@ -41,6 +41,9 @@ func (k *kubeAuthenticator) Authenticate(ctx context.Context, proxyId core_xds.P | |||
| } | |||
|
|
|||
| func (k *kubeAuthenticator) reviewToken(ctx context.Context, proxyId core_xds.ProxyId, credential sds_auth.Credential) error { | |||
| if credential == "" { | |||
| return errors.Errorf("authentication failed: k8s token is missing") | |||
There was a problem hiding this comment.
nit: errors.New is enough
pkg/xds/envoy/envoy_test.go
Outdated
| } | ||
|
|
||
| // when | ||
| resource := envoy.CreateInboundListener(ctx, "inbound:192.168.0.1:8080", "192.168.0.1", 8080, "localhost:8080", true) | ||
| DescribeTable("should inject Kuma into a Pod", |
There was a problem hiding this comment.
Message copy paste?
yskopets
force-pushed
the
feature/sds-on-k8s
branch
from
17650e9
to
aad8f46
Compare
jakubdyszkiewicz
approved these changes
Sep 9, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
changes:
k8s, generated Envoy SDS config must includeCallCredentialsin order to passk8s tokentoSDS servertokenreviewspermission tokuma-control-planeservice account (to be able to make calls to Token Review API)kubernetes/controller-runtimefetches all Secrets in the cluster which we cannot allow from security perspective)make run/k8s(since we only auto-generate TLS cert inuniversalcase)