Skip to content

🌱 Envtest exports secure config, helpers for simplify users adding #1477

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 5 commits into from
Closed

🌱 Envtest exports secure config, helpers for simplify users adding #1477

wants to merge 5 commits into from

Conversation

lobziik
Copy link
Member

@lobziik lobziik commented Apr 14, 2021 •
edited
Loading

fixes #983

Bit extended #984, added token-auth-file generation with "kubeadmin" user, added couple helpers to envstest for users creation.

This PR added:
internal.integration.APIServer: expose TLSClientConfig to connect its secure endpoint (@everpeace)
envtest.Environment: introduce SecureConfig that just contains kube-apiserver's secure endpoint and its TLSClientConfig. (@everpeace)
envtest.AddAPIServerUser helper for adding additional users
envtest.GetConfigForUser helper for getting rest.Config with respective credentials
token-auth-file creates automatically during APIServer startup
fixed issue with missing certificates for APIServer after its restart, certs regenerates after controlplane start/stop

@k8s-ci-robot
Copy link
Contributor

Welcome @lobziik!

It looks like this is your first PR to kubernetes-sigs/controller-runtime 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/controller-runtime has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot
Copy link
Contributor

Hi @lobziik. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 14, 2021
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: lobziik
To complete the pull request process, please assign mengqiy after the PR has been reviewed.
You can assign the PR to them by writing /assign @mengqiy in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Apr 14, 2021
@lobziik
Copy link
Member Author

lobziik commented Apr 14, 2021

cc @alvaroaleman, please take a look

@Danil-Grigorev
Copy link
Member

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 15, 2021
@lobziik
Copy link
Member Author

lobziik commented Apr 15, 2021

/retest

@everpeace
APIServer in envtest should expose TLSClientConfig so that user can c…
3b7a519 
…onnect 'https' endpoint of kube-apiserver
@everpeace
envtest expose 'SecureConfig' for user conveinience.
4c4a3c2 
Please note that this just contains secure endpoint itself and its CA
certs.  User will have to set authentication information by themselves
and configure some authn module in kube-apiserver.
elmiko
elmiko reviewed Apr 15, 2021
View reviewed changes
Copy link

@elmiko elmiko left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i am not overly familiar with this code, but the pr generally makes sense to me. i have a few minor suggestions and a question.

pkg/envtest/server.go
newUser := integration.User{
Token: uuid.New().String(),
Name: username,
UID: username,
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'm guessing this does not need to be a numeric value?

(i see it's a string in the struct, just curious)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be a string, as I understand from doc:
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authentication-strategies

UID: a string which identifies the end user and attempts to be more consistent and unique than username.

@alvaroaleman
Copy link
Member

The underlying issue this fixes is assigned to @DirectXMan12 (ref #1357 (comment)) and they mentioned over Slack that something to review will be ready in the next couple of days. I'll refrain from reviewing this one for now.

Denis Moiseev added 3 commits April 15, 2021 19:07
Add token-auth-file creation during APIServer startup process. Fix po…
fc4c618 
…tential issue with missing certificates in case of APIServer stop/start
Add IsStarted method for ControlPlane
ce1ae9d
Add helper methods for adding users and getting particular user confi…
3befec0 
…g. Add default user bearer token to SecureConfig. Tests.
@lobziik
Copy link
Member Author

lobziik commented Apr 15, 2021

/retest

@lobziik
Copy link
Member Author

lobziik commented Apr 20, 2021

/close
because of #1486 . These is cooler.

@lobziik lobziik closed this Apr 20, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@elmiko elmiko elmiko left review comments

@joelanford joelanford Awaiting requested review from joelanford

@pwittrock pwittrock Awaiting requested review from pwittrock

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
6 participants
@lobziik @k8s-ci-robot @Danil-Grigorev @alvaroaleman @elmiko @everpeace