Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug 1879492: Add secure access token annotation controller to handle downgrade from 4.6 #153

Merged
merged 2 commits into from Sep 26, 2020
Merged

Bug 1879492: Add secure access token annotation controller to handle downgrade from 4.6 #153

merged 2 commits into from Sep 26, 2020

Conversation

sttts
Copy link
Contributor

@sttts sttts commented Sep 15, 2020 •
edited by markmc

The annotation oauth-apiserver.openshift.io/secure-token-storage: true set on the config/v1 apiserver object make openshift-apiserver deeply log oauth tokens, noth access and authorize (if openshift-apiserver is responsible for this; in fresh 4.6 install it is not, but oauth-apiserver is).

This requires that there are no non-sha256 tokens in the system. For 4.6 installs this is guaranteed.

This PR adds a controller to remove the "oauth-apiserver.openshift.io/secure-token-storage" annotation from the APIServer config/v1 object after a potential downgrade from 4.6, to allow for the fact that non-sha256 are created on 4.5.

Counterpart to 4.6 PRs:

@openshift-ci-robot openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 15, 2020
@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 15, 2020
@sttts sttts changed the base branch from master to release-4.5 September 15, 2020 15:25
@sttts sttts force-pushed the sttts-secure-access-token-audit-logs-4.5 branch from 8f91c7a to c19d380 Compare September 15, 2020 15:26
@openshift-ci-robot
Copy link

@sttts: No Bugzilla bug is referenced in the title of this pull request.
To reference a bug, add 'Bug XXX:' to the title of this pull request and request another bug refresh with /bugzilla refresh.

In response to this:

Add secure access token annotation controller

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 15, 2020
p0lyn0mial
p0lyn0mial reviewed Sep 15, 2020
View reviewed changes
pkg/operator/secureaccesstoken/controller.go Outdated
}
return factory.New().
WithInformers(
operatorClient.Informer(),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we need this informer?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we don't

@sttts sttts force-pushed the sttts-secure-access-token-audit-logs-4.5 branch from c19d380 to bc8bef9 Compare September 16, 2020 09:17
p0lyn0mial
p0lyn0mial reviewed Sep 16, 2020
View reviewed changes
pkg/operator/secureaccesstoken/controller.go Outdated
func (c Controller) sync(ctx context.Context, syncCtx factory.SyncContext) error {
obj, err := c.apiserverLister.Get("cluster")
if errors.IsNotFound(err) {
syncCtx.Recorder().Warningf("SecureAccessTokenAnnotationController", "Required apiservers.%s/cluster not found", configv1.GroupName)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

usually, events are reserved for informing about the state change.

@p0lyn0mial
Copy link
Contributor

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Sep 16, 2020
@sttts sttts force-pushed the sttts-secure-access-token-audit-logs-4.5 branch from fedf089 to efbfab5 Compare September 16, 2020 10:03
@openshift-ci-robot openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Sep 16, 2020
@sttts sttts force-pushed the sttts-secure-access-token-audit-logs-4.5 branch from efbfab5 to a192891 Compare September 16, 2020 10:19
@sttts sttts changed the title Add secure access token annotation controller Bug 1878648: Add secure access token annotation controller Sep 16, 2020
@openshift-ci-robot openshift-ci-robot added bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Sep 16, 2020
@openshift-ci-robot
Copy link

@sttts: This pull request references Bugzilla bug 1878648, which is invalid:

  • expected the bug to target the "4.5.z" release, but it targets "4.6.0" instead
  • expected Bugzilla bug 1878648 to depend on a bug targeting a release in 4.6.0, 4.6.z and in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but no dependents were found

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1878648: Add secure access token annotation controller

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@sttts sttts changed the title Bug 1878648: Add secure access token annotation controller Bug 1879492: Add secure access token annotation controller Sep 16, 2020
@openshift-ci-robot
Copy link

@sttts: This pull request references Bugzilla bug 1879492, which is invalid:

  • expected Bugzilla bug 1879492 to depend on a bug targeting a release in 4.6.0, 4.6.z and in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but no dependents were found

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1879492: Add secure access token annotation controller

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@sttts sttts force-pushed the sttts-secure-access-token-audit-logs-4.5 branch from a192891 to 8e6a9b9 Compare September 16, 2020 12:18
@p0lyn0mial
Copy link
Contributor

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Sep 16, 2020
@sttts sttts force-pushed the sttts-secure-access-token-audit-logs-4.5 branch from 8e6a9b9 to 483686f Compare September 16, 2020 12:51
@openshift-ci-robot openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Sep 16, 2020
@openshift-bot
Copy link
Contributor

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

@openshift-ci-robot
Copy link

@openshift-bot: This pull request references Bugzilla bug 1879492, which is invalid:

  • expected dependent Bugzilla bug 1880407 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ASSIGNED instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@sttts
Copy link
Contributor Author

sttts commented Sep 23, 2020

/bugzilla-refresh

@openshift-bot
Copy link
Contributor

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

@openshift-ci-robot
Copy link

@openshift-bot: This pull request references Bugzilla bug 1879492, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

6 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.5.z) matches configured target release for branch (4.5.z)
  • bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)
  • dependent bug Bugzilla bug 1880407 is in the state VERIFIED, which is one of the valid states (VERIFIED, RELEASE_PENDING, CLOSED (ERRATA))
  • dependent Bugzilla bug 1880407 targets the "4.6.0" release, which is one of the valid target releases: 4.6.0, 4.6.z
  • bug has dependents

In response to this:

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot added bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. and removed bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Sep 24, 2020
@openshift-ci-robot
Copy link

@sttts: This pull request references Bugzilla bug 1879492, which is valid.

6 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.5.z) matches configured target release for branch (4.5.z)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)
  • dependent bug Bugzilla bug 1880407 is in the state VERIFIED, which is one of the valid states (VERIFIED, RELEASE_PENDING, CLOSED (ERRATA))
  • dependent Bugzilla bug 1880407 targets the "4.6.0" release, which is one of the valid target releases: 4.6.0, 4.6.z
  • bug has dependents

In response to this:

Bug 1879492: Add secure access token annotation controller

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@markmc
Copy link

markmc commented Sep 24, 2020

/retitle Bug 1879492: Add secure access token annotation controller to handle downgrade from 4.6

@openshift-ci-robot openshift-ci-robot changed the title Bug 1879492: Add secure access token annotation controller Bug 1879492: Add secure access token annotation controller to handle downgrade from 4.6 Sep 24, 2020
@markmc markmc added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Sep 24, 2020
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

6 similar comments
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@sttts
Copy link
Contributor Author

sttts commented Sep 25, 2020

/retest

1 similar comment
@sttts
Copy link
Contributor Author

sttts commented Sep 25, 2020

/retest

@sttts
Copy link
Contributor Author

sttts commented Sep 25, 2020

/test e2e-gcp

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

5 similar comments
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-ci-robot
Copy link

@sttts: The following test failed, say /retest to rerun all failed tests:

Test name Commit Details Rerun command
ci/prow/e2e-gcp 483686f link /test e2e-gcp

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-merge-robot openshift-merge-robot merged commit 58aa18e into openshift:release-4.5 Sep 26, 2020
@openshift-ci-robot
Copy link

@sttts: All pull requests linked via external trackers have merged:

Bugzilla bug 1879492 has been moved to the MODIFIED state.

In response to this:

Bug 1879492: Add secure access token annotation controller to handle downgrade from 4.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@p0lyn0mial p0lyn0mial p0lyn0mial left review comments

@mfojtik mfojtik Awaiting requested review from mfojtik

@soltysh soltysh Awaiting requested review from soltysh

Assignees

@p0lyn0mial p0lyn0mial

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@sttts @openshift-ci-robot @p0lyn0mial @openshift-bot @markmc @openshift-merge-robot