UPSTREAM: <carry>: Enable timeout validator to run in kube-apiserver #263

vareti · 2020-07-20T12:38:55Z

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespace from that line:

/kind api-change
/kind bug
/kind cleanup
/kind deprecation
/kind design
/kind documentation
/kind failing-test

/kind feature

/kind flake

What this PR does / why we need it:
This PR has changes to enable timeout validator in kube-apiserver. The timeout validator will not have any effect unless a timeout value is configured in KubeAPIServerConfig.

Depends openshift/cluster-kube-apiserver-operator#874 and openshift/oauth-server#49 to work

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

vareti · 2020-07-20T13:16:23Z

/test unit

sttts · 2020-07-20T13:30:13Z

pkg/kubeapiserver/authenticator/patch_authenticator.go

+	enablement.AddPostStartHookOrDie("openshift.io-TokenTimeoutUpdater", func(context genericapiserver.PostStartHookContext) error {
+		go timeoutValidator.Run(context.StopCh)
+		return nil
+	})


should we move this inside the if enablement.OpenshiftConfig().OAuthConfig != nil ?

what would be the point, we mean to run it all the time, no?

In the oauth-off mode we will get (keycloak), don't we want to disable this?

these authenticators are only configured if webhook authenticators aren't, so that's ok

see

kubernetes/pkg/kubeapiserver/authenticator/config.go

Lines 185 to 199 in f325571

if len(config.WebhookTokenAuthnConfigFile) > 0 {

webhookTokenAuth, err := newWebhookTokenAuthenticator(config)

if err != nil {

return nil, nil, err

}

tokenAuthenticators = append(tokenAuthenticators, webhookTokenAuth)

} else {

// openshift gets injected here as a separate token authenticator because we also add a special group to our oauth authorized

// tokens that allows us to recognize human users differently than machine users. The openAPI is always correct because we always

// configuration service account tokens, so we just have to create and add another authenticator.

// TODO make this a webhook authenticator and remove this patch.

// TODO - remove in 4.7, kept here not to disrupt authentication during 4.5->4.6 upgrade

tokenAuthenticators = AddOAuthServerAuthenticatorIfNeeded(tokenAuthenticators, config.APIAudiences)

}

stlaz · 2020-07-20T14:15:09Z

/test unit
weird, is that a unit test flake?

https://prow.ci.openshift.org/view/gs/origin-ci-test/pr-logs/pull/openshift_kubernetes/263/pull-ci-openshift-kubernetes-master-unit/1285201955584479232

vareti · 2020-07-20T15:52:19Z

unit test failure looks consistent?

/test unit
/test e2e-cmd

vareti · 2020-07-20T17:43:42Z

/test kubernetes-e2e

vareti · 2020-07-20T18:41:53Z

/test e2e-cmd

stlaz · 2020-07-21T07:42:16Z

/lgtm

stlaz · 2020-07-21T07:53:02Z

/retest

vareti · 2020-07-21T12:02:15Z

/retest

sttts · 2020-07-21T12:05:40Z

/approve

openshift-ci-robot · 2020-07-21T12:06:02Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stlaz, sttts, vareti

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [sttts]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2020-07-21T13:26:46Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-21T14:31:49Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-21T14:57:50Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-21T15:38:21Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-21T19:18:04Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-21T19:31:01Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-21T20:48:46Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-21T23:37:53Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-21T23:50:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T06:08:59Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T07:14:14Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T07:40:05Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T07:53:02Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T08:19:29Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T09:11:29Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T09:57:45Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T10:14:13Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T11:31:58Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T12:10:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T13:15:58Z

/retest

Please review the full test history for this PR and help us cut down flakes.

sttts · 2020-07-23T14:13:42Z

/override ci/prow/e2e-aws-fips

openshift-ci-robot · 2020-07-23T14:14:36Z

@sttts: Overrode contexts on behalf of sttts: ci/prow/e2e-aws-fips

In response to this:

/override ci/prow/e2e-aws-fips

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-07-23T14:47:02Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T15:52:29Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T17:35:36Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T18:40:24Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T20:26:26Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T20:39:33Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-23T23:02:29Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-24T01:38:20Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-24T02:56:19Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-24T03:09:23Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-24T03:48:22Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-24T06:11:21Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-07-24T08:21:27Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci-robot · 2020-07-24T09:16:40Z

@vareti: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-cmd	`372323f`	link	`/test e2e-cmd`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-bot · 2020-07-24T09:26:22Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Jul 20, 2020

openshift-ci-robot requested review from sjenning and sttts July 20, 2020 12:40

UPSTREAM: <carry>: use new access token inactivity timeout field.

372323f

vareti force-pushed the use-new-access-token-inactivity-timeout-field branch from 24bbd73 to 372323f Compare July 20, 2020 12:48

vareti mentioned this pull request Jul 20, 2020

Use new access token inactivity timeout field openshift/origin#25223

Closed

stlaz mentioned this pull request Jul 20, 2020

Add token validation endpoint for token webhook authentication openshift/openshift-apiserver#122

Closed

sttts reviewed Jul 20, 2020

View reviewed changes

openshift-ci-robot assigned stlaz Jul 21, 2020

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 21, 2020

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 21, 2020

openshift-merge-robot merged commit 9ba0c16 into openshift:master Jul 24, 2020

vareti mentioned this pull request Jul 29, 2020

Controller to check the different endpoints for authentication openshift/cluster-authentication-operator#306

Merged

	if len(config.WebhookTokenAuthnConfigFile) > 0 {
	webhookTokenAuth, err := newWebhookTokenAuthenticator(config)
	if err != nil {
	return nil, nil, err
	}

	tokenAuthenticators = append(tokenAuthenticators, webhookTokenAuth)
	} else {
	// openshift gets injected here as a separate token authenticator because we also add a special group to our oauth authorized
	// tokens that allows us to recognize human users differently than machine users. The openAPI is always correct because we always
	// configuration service account tokens, so we just have to create and add another authenticator.
	// TODO make this a webhook authenticator and remove this patch.
	// TODO - remove in 4.7, kept here not to disrupt authentication during 4.5->4.6 upgrade
	tokenAuthenticators = AddOAuthServerAuthenticatorIfNeeded(tokenAuthenticators, config.APIAudiences)
	}

UPSTREAM: <carry>: Enable timeout validator to run in kube-apiserver #263

UPSTREAM: <carry>: Enable timeout validator to run in kube-apiserver #263

Conversation

vareti commented Jul 20, 2020 • edited

vareti commented Jul 20, 2020

sttts Jul 20, 2020

Choose a reason for hiding this comment

stlaz Jul 20, 2020

Choose a reason for hiding this comment

sttts Jul 20, 2020

Choose a reason for hiding this comment

stlaz Jul 20, 2020

Choose a reason for hiding this comment

stlaz Jul 20, 2020

Choose a reason for hiding this comment

stlaz commented Jul 20, 2020

vareti commented Jul 20, 2020

vareti commented Jul 20, 2020

vareti commented Jul 20, 2020

stlaz commented Jul 21, 2020

stlaz commented Jul 21, 2020

vareti commented Jul 21, 2020

sttts commented Jul 21, 2020

openshift-ci-robot commented Jul 21, 2020

openshift-bot commented Jul 21, 2020

openshift-bot commented Jul 21, 2020

openshift-bot commented Jul 21, 2020

openshift-bot commented Jul 21, 2020

openshift-bot commented Jul 21, 2020

openshift-bot commented Jul 21, 2020

openshift-bot commented Jul 21, 2020

openshift-bot commented Jul 21, 2020

openshift-bot commented Jul 21, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

sttts commented Jul 23, 2020

openshift-ci-robot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 23, 2020

openshift-bot commented Jul 24, 2020

openshift-bot commented Jul 24, 2020

openshift-bot commented Jul 24, 2020

openshift-bot commented Jul 24, 2020

openshift-bot commented Jul 24, 2020

openshift-bot commented Jul 24, 2020

openshift-ci-robot commented Jul 24, 2020 • edited

openshift-bot commented Jul 24, 2020

vareti commented Jul 20, 2020 •

edited

openshift-ci-robot commented Jul 24, 2020 •

edited