add a custom authorizer to ensure kube-apiserver can always access tokenreviews webhook #41
Conversation
openshift-ci-robot
added
the
approved
|
/hold This demonstrates the how. It would need unit tests at least. |
openshift-ci-robot
added
the
do-not-merge/hold
| type tokenReviewAuthorizer struct{} | ||
|
|
||
| func (tokenReviewAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) { | ||
| if a.GetUser().GetName() != "system:serviceaccount:openshift-authentication:tokenreviewer"{ |
There was a problem hiding this comment.
alright, so this is a service account token used by the KAS, right?
There was a problem hiding this comment.
alright, so this is a service account token used by the KAS, right?
In @stlaz's PR, yes.
There was a problem hiding this comment.
Got it. This is just an example. Thanks for sharing it with me.
lgtm
deads2k
force-pushed
the
custom-authz
branch
from
1ff5310
to
4856240
Compare
openshift-ci-robot
added
the
needs-rebase
deads2k
force-pushed
the
custom-authz
branch
from
4856240
to
5864f3f
Compare
openshift-ci-robot
removed
the
needs-rebase
deads2k
force-pushed
the
custom-authz
branch
from
5864f3f
to
d9f38e9
Compare
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: deads2k, stlaz The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/hold cancel |
openshift-ci-robot
removed
the
do-not-merge/hold
Adds a hardcoded authorizer to avoid unnecessary SAR calls. This could be made generic. We could also add one for handling /metrics