MCS service account authentication with Mkube #166
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I'm testing it with m3 using minio/m3#407, |
|
not happening with master |
do you know which request its getting this response? this seems to be mirroring but that endpoint got removed since minio-operator removed that functionality itself |
it was while doing POST on |
dvaldivia
previously approved these changes
Jun 19, 2020
Alevsk
force-pushed
the
sa-authentication
branch
from
4a5e3fb to
65ec350
Compare
dvaldivia
previously approved these changes
Jun 21, 2020
Alevsk
force-pushed
the
sa-authentication
branch
2 times, most recently
from
3a336bd to
d68a456
Compare
I included the fix for this on this PR, please review |
bexsoft
requested changes
Jun 23, 2020
There was a problem hiding this comment.
Functionality works good, tests need to be fixed:
/opt/hostedtoolcache/go/1.14.4/x64/src/testing/testing.go:940 +0x421
testing.tRunner.func1(0xc00010cb40)
/opt/hostedtoolcache/go/1.14.4/x64/src/testing/testing.go:943 +0x600
panic(0x235a300, 0x43314b0)
/opt/hostedtoolcache/go/1.14.4/x64/src/runtime/panic.go:975 +0x3e3
bytes.(*Buffer).ReadFrom(0xc0001e7860, 0x0, 0x0, 0x0, 0x0, 0xc000470b20)
/opt/hostedtoolcache/go/1.14.4/x64/src/bytes/buffer.go:204 +0x122
github.com/minio/mcs/restapi.serverMkube(0xc0001e6b70, 0x2c65d80, 0xc0005806c0, 0xc00041ed00)
/home/runner/work/mcs/mcs/restapi/mkube.go:50 +0x445
github.com/minio/mcs/restapi.Test_serverMkube.func4(0xc00010cb40)
/home/runner/work/mcs/mcs/restapi/mkube_test.go:155 +0xcd
testing.tRunner(0xc00010cb40, 0xc0002f64d0)
/opt/hostedtoolcache/go/1.14.4/x64/src/testing/testing.go:991 +0x1ec
created by testing.(*T).Run
/opt/hostedtoolcache/go/1.14.4/x64/src/testing/testing.go:1042 +0x661
FAIL github.com/minio/mcs/restapi 12.326s
? github.com/minio/mcs/restapi/operations [no test files]
? github.com/minio/mcs/restapi/operations/admin_api [no test files]
? github.com/minio/mcs/restapi/operations/user_api [no test files]
FAIL
Makefile:42: recipe for target 'test' failed
make: *** [test] Error 1
`MCS` will authenticate against `Mkube`using bearer tokens via HTTP
`Authorization` header. The user will provide this token once
in the login form, MCS will validate it against Mkube (list tenants) and
if valid will generate and return a new MCS sessions
with encrypted claims (the user Service account token will be inside the
JWT in the data field)
Kubernetes
The provided `JWT token` corresponds to the `Kubernetes service account`
that `Mkube` will use to run tasks on behalf of the
user, ie: list, create, edit, delete tenants, storage class, etc.
Development
If you are running mcs in your local environment and wish to make
request to `Mkube` you can set `MCS_M3_HOSTNAME`, if
the environment variable is not present by default `MCS` will use
`"http://m3:8787"`, additionally you will need to set the
`MCS_MKUBE_ADMIN_ONLY=on` variable to make MCS display the Mkube UI
Extract the Service account token and use it with MCS
For local development you can use the jwt associated to the `m3-sa`
service account, you can get the token running
the following command in your terminal:
```
kubectl get secret $(kubectl get serviceaccount m3-sa -o
jsonpath="{.secrets[0].name}") -o jsonpath="{.data.token}" | base64
--decode
```
Then run the mcs server
```
MCS_M3_HOSTNAME=http://localhost:8787 MCS_MKUBE_ADMIN_ONLY=on ./mcs
server
```
Self-signed certificates and Custom certificate authority for Mkube
If Mkube uses TLS with a self-signed certificate, or a certificate
issued by a custom certificate authority you can add those
certificates usinng the `MCS_M3_SERVER_TLS_CA_CERTIFICATE` env variable
````
MCS_M3_SERVER_TLS_CA_CERTIFICATE=cert1.pem,cert2.pem,cert3.pem ./mcs
server
````
Alevsk
force-pushed
the
sa-authentication
branch
from
d68a456 to
b640743
Compare
|
Can you please update the commit comments, seems that they changed |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
MCSwill authenticate againstMkubeusing bearer tokens via HTTPAuthorizationheader. The user will provide this token oncein the login form, MCS will validate it against Mkube (list tenants) and
if valid will generate and return a new MCS sessions
with encrypted claims (the user Service account token will be inside the
JWT in the data field)
Kubernetes
The provided
JWT tokencorresponds to theKubernetes service accountthat
Mkubewill use to run tasks on behalf of theuser, ie: list, create, edit, delete tenants, storage class, etc.
Development
If you are running mcs in your local environment and wish to make
request to
Mkubeyou can setMCS_M3_HOSTNAME, ifthe environment variable is not present by default
MCSwill use"http://m3:8787", additionally you will need to set theMCS_MKUBE_ADMIN_ONLY=onvariable to make MCS display the Mkube UIExtract the Service account token and use it with MCS
For local development you can use the jwt associated to the
m3-saservice account, you can get the token running
the following command in your terminal:
Then run the mcs server
Self-signed certificates and Custom certificate authority for Mkube
If Mkube uses TLS with a self-signed certificate, or a certificate
issued by a custom certificate authority you can add those
certificates usinng the
MCS_M3_SERVER_TLS_CA_CERTIFICATEenv variable