Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

todo [Terminal]: 完善WithoutToken功能 #12

Closed
cuisongliu opened this issue Mar 6, 2019 · 2 comments
Closed

todo [Terminal]: 完善WithoutToken功能 #12

cuisongliu opened this issue Mar 6, 2019 · 2 comments

Comments

@cuisongliu
Copy link
Collaborator

在k8s环境下完善WithoutToken功能
做法:

  1. 在部署Terminal时候挂载kubeConfig文件。
  2. 在Terminal项目中加载器中的配置文件到Secrets 并绑定到ttyd的k8s-volume中。
    对于Terminal的请求参数新增KubeConfigPath参数 主要是绑定Terminal环境中配置文件的路径。这样可以做到多个Terminal使用不同的配置文件。
  3. 每新建一个TerminalID且WithoutToken=true的时候会自动创建新的Secrets(name为secrets+ t.TerminalID)
  4. Heartbeater定时扫描需要删除deploy时候同时删除对应的Secrets(name为secrets+ t.TerminalID)
@cuisongliu
Copy link
Collaborator Author

https://github.com/cuisongliu/fist/tree/terminal-fix-kubeconfig
老大,功能完成。找时间review一下代码。

@fanux
Copy link
Member

fanux commented Mar 6, 2019

这样后续安全性问题是不是有点不太好控制,后续调这个接口时可能得检查是不是管理员。 更简单的实现是不是可以拿admin的service account token去渲染kubeconfig文件。

@fanux fanux closed this as completed Mar 7, 2019
fanux pushed a commit that referenced this issue Mar 8, 2019
fanux pushed a commit that referenced this issue Mar 14, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants