djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,372 Commits 30 Branches 34 Tags 22 MiB
10b769c676
Commit Graph

1372 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Margo Crawford
10b769c676 Fixed integration tests for load balancer capabilities 2021-02-17 10:55:49 -08:00
Margo Crawford
67da840097 Add loadbalancer for impersonation proxy when needed 2021-02-16 15:57:02 -08:00
Andrew Keesler
eb19980110
internal/concierge/impersonator: set user extra impersonation headers 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-16 09:26:47 -05:00
Andrew Keesler
c7905c6638
internal/concierge/impersonator: fail if impersonation headers set 
If someone has already set impersonation headers in their request, then
we should fail loudly so the client knows that its existing impersonation
headers will not work.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-16 08:15:50 -05:00
Andrew Keesler
fdd8ef5835
internal/concierge/impersonator: handle custom login API group 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-16 07:55:09 -05:00
Andrew Keesler
25bc8dd8a9
test/integration: hopefully fix TestImpersonationProxy 
I think we were assuming the name of our Concierge app, and getting lucky
because it was the name we use when testing locally (but not in CI).

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-15 18:04:21 -05:00
Andrew Keesler
6512ab1351
internal/concierge/impersonator: don't care about namespace 
Concierge APIs are no longer namespaced (see f015ad5852).

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-15 17:11:59 -05:00
Ryan Richard
5cd60fa5f9 Move starting/stopping impersonation proxy server to a new controller 
- Watch a configmap to read the configuration of the impersonation
  proxy and reconcile it.
- Implements "auto" mode by querying the API for control plane nodes.
- WIP: does not create a load balancer or proper TLS certificates yet.
  Those will come in future commits.

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-11 17:25:52 -08:00
Andrew Keesler
9b87906a30
Merge remote-tracking branch 'upstream/main' into impersonation-proxy 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-11 11:03:33 -05:00
Mo Khan
f015ad5852
Merge pull request #405 from enj/enj/i/cluster_scope_concierge 
Cluster scope all concierge APIs
 2021-02-11 08:50:42 -05:00
Monis Khan
b04fd46319
Update federation domain logic to use status subresource 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:10 -05:00
Monis Khan
4c304e4224
Assert all APIs have a status subresource 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:10 -05:00
Monis Khan
0a9f446893
Update credential issuer logic to use status subresource 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:10 -05:00
Monis Khan
96cec59236
Generated 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:09 -05:00
Monis Khan
4faf724c2c
Make credential issuer status optional 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:09 -05:00
Monis Khan
de88ae2f61
Fix status related RBAC 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:09 -05:00
Monis Khan
dd3d1c8b1b
Generated 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:09 -05:00
Monis Khan
2e9baf9fa6
Correctly generate status subresource for all CRDs 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:08 -05:00
Monis Khan
ac01186499
Use API service as owner ref for cluster scoped resources 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:08 -05:00
Monis Khan
2eb01bd307
authncache: remove namespace concept 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:08 -05:00
Monis Khan
741b8fe88d
Generated 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:08 -05:00
Monis Khan
d25c6d9d0a
Make kubebuilder CRDs cluster scoped 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:08 -05:00
Monis Khan
89b00e3702
Declare war on namespaces 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:07 -05:00
Monis Khan
d2480e6300
Generated 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:07 -05:00
Monis Khan
4205e3dedc
Make concierge APIs cluster scoped 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:07 -05:00
Matt Moyer
ee80920ffd
Merge pull request #409 from mattmoyer/upgrade-debian 
Upgrade Debian base images from 10.7 to 10.8.
 2021-02-10 16:57:09 -06:00
Matt Moyer
45f4a0528c
Upgrade Debian base images from 10.7 to 10.8. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-02-10 15:57:16 -06:00
Andrew Keesler
d0266cecdb
Merge pull request #390 from ankeesler/use-more-middleware 
Use middleware to mutate TokenCredentialRequest.Spec.Authenticator.APIGroup
 2021-02-10 16:38:54 -05:00
Andrew Keesler
0fc1f17866
internal/groupsuffix: mutate TokenCredentialRequest's Authenticator 
This is a partial revert of 288d9c999e. For some reason it didn't occur to me
that we could do it this way earlier. Whoops.

This also contains a middleware update: mutation funcs can return an error now
and short-circuit the rest of the request/response flow. The idea here is that
if someone is configuring their kubeclient to use middleware, they are agreeing
to a narrow-er client contract by doing so (e.g., their TokenCredentialRequest's
must have an Spec.Authenticator.APIGroup set).

I also updated some internal/groupsuffix tests to be more realistic.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-10 15:53:44 -05:00
Andrew Keesler
ae6503e972
internal/plog: add KObj() and KRef() 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-10 14:25:39 -05:00
Mo Khan
44b7679e9f
Merge pull request #407 from ankeesler/test-flake 
test/integration: make TestKubeCertAgent more stable
 2021-02-10 14:24:44 -05:00
Andrew Keesler
12d5b8959d
test/integration: make TestKubeCertAgent more stable 
I think the reason we were seeing flakes here is because the kube cert agent
pods had not reached a steady state even though our test assertions passed, so
the test would proceed immediately and run more assertions on top of a weird
state of the kube cert agent pods.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-10 12:08:34 -05:00
Andrew Keesler
5b076e7421
Merge pull request #404 from ankeesler/remove-deprecated-commands 
cmd/pinniped: delete get-kubeconfig + exchange-token
 2021-02-10 08:33:00 -05:00
Andrew Keesler
1ffe70bbea
cmd/pinniped: delete get-kubeconfig + exchange-token 
These were deprecated in v0.3.0.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-09 17:01:57 -05:00
Ryan Richard
e4c49c37b9 Merge branch 'main' into impersonation-proxy 2021-02-09 13:45:37 -08:00
Ryan Richard
268ca5b7f6 Add config structs in impersonator package 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-09 13:44:19 -08:00
Mo Khan
cf735715f6
Merge pull request #394 from enj/enj/i/server_side_tcr_api_group 
Use server scheme to handle credential request API group changes
 2021-02-09 16:36:13 -05:00
Monis Khan
2679d27ced
Use server scheme to handle credential request API group changes 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-09 15:51:38 -05:00
Monis Khan
6b71b8d8ad
Revert server side token credential request API group changes 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-09 15:51:35 -05:00
Andrew Keesler
8697488126
internal/concierge/impersonator: use kubeconfig from kubeclient 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-09 15:28:56 -05:00
Margo Crawford
dfcc2a1eb8 Introduce clusterhost package to determine whether a cluster has control plane nodes 
Also added hasExternalLoadBalancerProvider key to cluster capabilities
for integration testing.

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-09 11:16:01 -08:00
Andrew Keesler
812f5084a1
internal/concierge/impersonator: don't mutate ServeHTTP() req 
I added that test helper to create an http.Request since I wanted to properly
initialize the http.Request's context.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-09 13:25:32 -05:00
Andrew Keesler
43da4ab2e0
SECURITY.md: follow established pattern 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-09 09:08:19 -05:00
Matt Moyer
e4d8af6701
Merge pull request #399 from mattmoyer/upgrade-go 
Upgrade Go from 1.15.7 to 1.15.8.
 2021-02-08 18:17:17 -06:00
Matt Moyer
d06c935c2c
Upgrade Go from 1.15.7 to 1.15.8. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-02-08 10:58:51 -06:00
Mo Khan
9399b5d800
Merge pull request #395 from enj/enj/i/remove_multierror 
Remove multierror package and migrate callers to k8s.io/apimachinery/pkg/util/errors.NewAggregate
 2021-02-05 15:14:25 -05:00
Monis Khan
05a471fdf9
Migrate callers to k8s.io/apimachinery/pkg/util/errors.NewAggregate 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-05 12:56:05 -05:00
Monis Khan
81d4e50f94
Remove multierror package 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-05 12:55:18 -05:00
Matt Moyer
850f030fe3
Merge pull request #393 from enj/enj/i/no_op_tcr_list 
Add no-op list support to token credential request
 2021-02-05 11:09:09 -06:00
Monis Khan
f7958ae75b
Add no-op list support to token credential request 
This allows us to keep all of our resources in the pinniped category
while not having kubectl return errors for calls such as:

kubectl get pinniped -A

Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-05 10:59:39 -05:00