AGENT-875: Authenticate agents #8395
Conversation
pawanpinjarkar
commented
May 11, 2024
•
pawanpinjarkar
commented
- Set JWT token in the expected env var AGENT_AUTH_TOKEN
- Set authorization header in the API requests
openshift-ci-robot
added
the
jira/valid-reference
|
@pawanpinjarkar: This pull request references AGENT-875 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.16.0" version, but no target version was set. In response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
/hold |
openshift-ci
bot
added
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
pawanpinjarkar
force-pushed
the
authenticate-agent-service
branch
from
a8e2c8b
to
863fcec
Compare
|
@pawanpinjarkar: This pull request references AGENT-875 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.16.0" version, but no target version was set. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/hold cancel |
|
/cc @rwsu @andfasano |
pkg/asset/agent/image/ignition.go
Outdated
| } | ||
|
|
||
| // Probably also need to add PULL_SECRET_TOKEN for authentication. |
There was a problem hiding this comment.
@rwsu WDYT? I think the token will be needed for the nodes making API requests to assisted service once the new auth type is enabled.
openshift-ci
bot
removed
the
do-not-merge/hold
| @@ -411,10 +411,12 @@ func getRendezvousHostEnv(serviceProtocol, nodeZeroIP string, workflowType workf | |||
| return fmt.Sprintf(`NODE_ZERO_IP=%s | |||
| SERVICE_BASE_URL=%s | |||
| IMAGE_SERVICE_BASE_URL=%s | |||
| PULL_SECRET_TOKEN=%s | |||
There was a problem hiding this comment.
This currently results in the same token being used for both the agents and the scripts that drive the assisted API. I can't remember what we said about how we would do authz in the future, but maybe it makes sense to pass them separately even if they have the same value right now.
I guess that would also solve the issue that "PULL_SECRET_TOKEN" is not the ideal name from assisted-service's perspective, bit is required for assisted-installer-agent.
There was a problem hiding this comment.
yes, its been renamed to AGENT_AUTH_TOKEN
|
@pawanpinjarkar: This pull request references AGENT-875 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.16.0" version, but no target version was set. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
pawanpinjarkar
force-pushed
the
authenticate-agent-service
branch
from
863fcec
to
779715e
Compare
|
To test the authentication feature, this and other code changes from relevant PRs need to work together.
And most importantly, updating the auth type env var |
pawanpinjarkar
force-pushed
the
authenticate-agent-service
branch
from
779715e
to
4fe147f
Compare
…red by assisted installer agent
pawanpinjarkar
force-pushed
the
authenticate-agent-service
branch
from
4fe147f
to
3ae28e8
Compare
|
@pawanpinjarkar: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
