ca2cc40769
Add impersonationProxyServerPort to the Concierge's static ConfigMap
...
- Used to determine on which port the impersonation proxy will bind
- Defaults to 8444, which is the old hard-coded port value
- Allow the port number to be configured to any value within the
range 1024 to 65535
- This commit does not include adding new config knobs to the ytt
values file, so while it is possible to change this port without
needing to recompile, it is not convenient
2021-11-17 13:27:59 -08:00
2383a88612
Add aggregatedAPIServerPort to the Concierge's static ConfigMap
...
- Allow the port number to be configured to any value within the
range 1024 to 65535
- This commit does not include adding new config knobs to the ytt
values file, so while it is possible to change this port without
needing to recompile, it is not convenient
2021-11-16 16:43:51 -08:00
c570f08b2b
Merge pull request #885 from vmware-tanzu/dependabot/docker/golang-1.17.3
...
Bump golang from 1.17.2 to 1.17.3
2021-11-05 21:45:56 -04:00
2aeb464b43
Bump golang from 1.17.2 to 1.17.3
...
Bumps golang from 1.17.2 to 1.17.3.
---
updated-dependencies:
- dependency-name: golang
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2021-11-06 00:55:39 +00:00
5a3f83f90f
Merge pull request #877 from vmware-tanzu/upstream-ldap-refresh
...
Upstream ldap refresh
2021-11-05 18:08:45 -04:00
cb60a44f8a
extract ldap refresh search into helper function
...
also added an integration test for refresh failing after updating the username attribute
2021-11-05 14:22:43 -07:00
b5b8cab717
Refactors:
...
- pull construction of authenticators.Response into searchAndBindUser
- remove information about the identity provider in the error that gets
returned to users. Put it in debug instead, where it may show up in
logs.
Signed-off-by: Margo Crawford <margaretc@vmware.com>
2021-11-05 14:22:43 -07:00
c84329d7a4
Fix broken ldap_client_test
2021-11-05 14:22:43 -07:00
f988879b6e
Addressing code review changes
...
- changed to use custom authenticators.Response rather than the k8s one
that doesn't include space for a DN
- Added more checking for correct idp type in token handler
- small style changes
Signed-off-by: Margo Crawford <margaretc@vmware.com>
2021-11-05 14:22:43 -07:00
84edfcb541
Refactor out a function, add tests for getting the wrong idp uid
2021-11-05 14:22:43 -07:00
722b5dcc1b
Test for change to stored username or subject.
...
All of this is still done staticly.
2021-11-05 14:22:43 -07:00
8396937503
Updates to tests and some error assertions
2021-11-05 14:22:43 -07:00
2c4dc2951d
resolved a couple of testing related todos
2021-11-05 14:22:43 -07:00
7a58086040
Check that username and subject remain the same for ldap refresh
2021-11-05 14:22:43 -07:00
19281313dd
Basic upstream LDAP/AD refresh
...
This stores the user DN in the session data upon login and checks that
the entry still exists upon refresh. It doesn't check anything
else about the entry yet.
2021-11-05 14:22:42 -07:00
71f7ea686d
Fix typo in community meeting time
2021-11-04 12:02:46 -04:00
d5d957f6ee
Fix CONTRIBUTING zoom link
2021-11-04 11:53:14 -04:00
e371c34237
Fix README zoom link
2021-11-04 11:52:28 -04:00
b5be763631
Fix typo in community meeting time
2021-11-04 08:38:33 -04:00
f03e5f4fef
Merge pull request #883 from enj/enj/i/dockerfile_tweaks
...
Dockerfile: build all files and trim file system paths
2021-11-03 14:45:23 -04:00
a042f74a88
Dockerfile: build all files and trim file system paths
...
Use "..." instead of "main.go" as the build target since we may have
extra files in the future.
https://pkg.go.dev/cmd/go#hdr-Compile_packages_and_dependencies
-trimpath
remove all file system paths from the resulting executable.
Instead of absolute file system paths, the recorded file names
will begin with either "go" (for the standard library),
or a module path@version (when using modules),
or a plain import path (when using GOPATH).
Signed-off-by: Monis Khan <mok@vmware.com>
2021-11-03 10:26:13 -04:00
aae586b4ef
Merge pull request #879 from vmware-tanzu/dependabot/docker/distroless/static-bca3c20
...
Bump distroless/static from `07869ab` to `bca3c20`
2021-11-02 09:54:48 -04:00
1c3545e234
Bump distroless/static from `07869ab` to `bca3c20`
...
Bumps distroless/static from `07869ab` to `bca3c20`.
---
updated-dependencies:
- dependency-name: distroless/static
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2021-10-28 01:02:33 +00:00
c494f65b84
Update ROADMAP.md
...
Updating roadmap to reflect dates when we will have Upstream Refresh released
2021-10-27 10:43:31 -04:00
6c47c3327a
Add hint to hack/prepare-for-integration-tests.sh
...
I keep forgetting the name of the --get-active-directory-vars flag.
2021-10-26 16:25:34 -07:00
3f698d24e5
Merge pull request #878 from enj/enj/i/cli_link
...
Change default install hint to use get.pinniped.dev/cli
2021-10-26 17:42:53 -04:00
2ba5d51120
Change default install hint to use get.pinniped.dev/cli
...
This avoids a hard link against a docs page that may change over
time.
Signed-off-by: Monis Khan <mok@vmware.com>
2021-10-26 17:14:13 -04:00
c3060e3474
Merge pull request #872 from anjaltelang/main
...
Architecture should be on top on the documentation webpage
2021-10-26 13:41:17 -07:00
59256264ec
Changing the architecture.md weight back to 100
...
Signed-off-by: Anjali Telang <atelang@vmware.com>
2021-10-26 16:34:32 -04:00
3aa14accd7
Merge pull request #875 from siddhant94/add-install-hint-kubeconfig
...
Add --install-hint flag to `get kubeconfig` command
2021-10-26 15:38:39 -04:00
f93cdcb9c5
Merge remote-tracking branch 'upstream/main' into main
2021-10-26 15:29:56 -04:00
1b6b4106db
Add --install-hint flag to `get kubeconfig` command
...
This populates the installHint attribute in the exec section of the
generated kubeconfig.
For more details, see installHint documentation:
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#configuration
Reviewed-by: Monis Khan <mok@vmware.com>
2021-10-26 14:26:47 -04:00
f25d2870ce
Merge pull request #874 from enj/enj/i/distroless_nonroot
...
Use 65532 instead of 1001 as non-root user
2021-10-25 16:54:47 -04:00
7921a58988
Use 65532 instead of 1001 as non-root user
...
Signed-off-by: Monis Khan <mok@vmware.com>
2021-10-25 16:21:54 -04:00
7d30bfc22c
Start using CodeQL
2021-10-25 16:05:12 -04:00
bdb199c53a
Merge pull request #858 from vmware-tanzu/upstream_refresh
...
For OIDCIdenitityProviders perform an upstream refresh during downstream refresh
2021-10-25 12:32:35 -04:00
1e17418585
TestSupervisorUpstreamOIDCDiscovery: include AdditionalAuthorizeParametersValid condition
...
Signed-off-by: Monis Khan <mok@vmware.com>
2021-10-25 10:21:51 -04:00
303b1f07d3
Fix mistake in previous commit
2021-10-22 14:06:31 -07:00
e0db59fd09
More small updates based on PR feedback
2021-10-22 10:23:21 -07:00
867853016f
Merge branch 'main' into upstream_refresh
2021-10-22 09:23:52 -07:00
be6c335bb8
Update ROADMAP.md
...
Minor changes
2021-10-21 10:16:54 -04:00
b3a1dcd634
Update ROADMAP.md
...
Updated roadmap to reflect current focus of Pinniped project
2021-10-21 10:10:19 -04:00
dec43289f6
Lots of small updates based on PR feedback
2021-10-20 15:53:25 -07:00
7ec0304472
Add offline_access scope for integration tests when using Dex
2021-10-19 12:25:51 -07:00
a22507f835
Architecture should be on top of the docs page
...
Signed-off-by: Anjali Telang <atelang@vmware.com>
2021-10-19 13:46:30 -04:00
d3ade82f3f
Update docs
2021-10-19 09:48:40 -07:00
c43e019d3a
Change default of additionalScopes and disallow "hd" in additionalAuthorizeParameters
2021-10-18 16:41:31 -07:00
d68bebeb49
Merge branch 'main' into upstream_refresh
2021-10-18 15:35:46 -07:00
c51d7c08b9
Add a comment that might be useful some day
2021-10-18 15:35:22 -07:00
ddb23bd2ed
Add upstream refresh related config to OIDCIdentityProvider CRD
...
Also update related docs.
2021-10-14 15:49:44 -07:00
Ryan Richard