ContainerImage.Pinniped/CONTRIBUTING.md
Monis Khan cd686ffdf3
Force the use of secure TLS config
This change updates the TLS config used by all pinniped components.
There are no configuration knobs associated with this change.  Thus
this change tightens our static defaults.

There are four TLS config levels:

1. Secure (TLS 1.3 only)
2. Default (TLS 1.2+ best ciphers that are well supported)
3. Default LDAP (TLS 1.2+ with less good ciphers)
4. Legacy (currently unused, TLS 1.2+ with all non-broken ciphers)

Highlights per component:

1. pinniped CLI
   - uses "secure" config against KAS
   - uses "default" for all other connections
2. concierge
   - uses "secure" config as an aggregated API server
   - uses "default" config as a impersonation proxy API server
   - uses "secure" config against KAS
   - uses "default" config for JWT authenticater (mostly, see code)
   - no changes to webhook authenticater (see code)
3. supervisor
   - uses "default" config as a server
   - uses "secure" config against KAS
   - uses "default" config against OIDC IDPs
   - uses "default LDAP" config against LDAP IDPs

Signed-off-by: Monis Khan <mok@vmware.com>
2021-11-17 16:55:35 -05:00

6.6 KiB

Contributing to Pinniped

Contributions to Pinniped are welcome. Here are some things to help you get started.

Code of Conduct

Please see the Code of Conduct.

Project Scope

See SCOPE.md for some guidelines about what we consider in and out of scope for Pinniped.

Roadmap

The near-term and mid-term roadmap for the work planned for the project maintainers is documented in ROADMAP.md.

Community Meetings

Pinniped is better because of our contributors and maintainers. It is because of you that we can bring great software to the community. Please join us during our online community meetings, occurring every first and third Thursday of the month at 9 AM PT / 12 PM ET. Use this Zoom Link to attend and add any agenda items you wish to discuss to the notes document. Join our Google Group to receive invites to this meeting.

If the meeting day falls on a US holiday, please consider that occurrence of the meeting to be canceled.

Discussion

Got a question, comment, or idea? Please don't hesitate to reach out via GitHub Discussions, GitHub Issues, or in the Kubernetes Slack Workspace within the #pinniped channel.

Issues

Need an idea for a project to get started contributing? Take a look at the open issues. Also check to see if any open issues are labeled with "good first issue" or "help wanted".

Bugs

To file a bug report, please first open an issue. The project team will work with you on your bug report.

Once the bug has been validated, a pull request can be opened to fix the bug.

For specifics on what to include in your bug report, please follow the guidelines in the issue and pull request templates.

Features

To suggest a feature, please first open an issue and tag it with proposal, or create a new Discussion. The project maintainers will work with you on your feature request.

Once the feature request has been validated, a pull request can be opened to implement the feature.

For specifics on what to include in your feature request, please follow the guidelines in the issue and pull request templates.

Reporting security vulnerabilities

Please follow the procedure described in SECURITY.md.

CLA

We welcome contributions from everyone but we can only accept them if you sign our Contributor License Agreement (CLA). If you would like to contribute and you have not signed it, our CLA-bot will walk you through the process when you open a Pull Request. For questions about the CLA process, see the FAQ or submit a question through the GitHub issue tracker.

Building

The Dockerfile at the root of the repo can be used to build and package the code. After making a change to the code, rebuild the docker image with the following command.

# From the root directory of the repo...
docker build .

Testing

Running Lint

./hack/module.sh lint

Running Unit Tests

./hack/module.sh units

Running Integration Tests

  1. Install dependencies:

    On macOS, these tools can be installed with Homebrew (assuming you have Chrome installed already):

    brew install kind k14s/tap/ytt k14s/tap/kapp kubectl chromedriver nmap && brew cask install docker
    
  2. Create a kind cluster, compile, create container images, and install Pinniped and supporting dependencies using:

    ./hack/prepare-for-integration-tests.sh
    
  3. Run the Pinniped integration tests:

    source /tmp/integration-test-env && go test -v -count 1 -timeout 0 ./test/integration
    
  4. After making production code changes, recompile, redeploy, and run tests again by repeating the same commands described above. If there are only test code changes, then simply run the tests again.

To destroy the local Kubernetes cluster, run ./hack/kind-down.sh.

Observing Tests on the Continuous Integration Environment

CI will not be triggered on a pull request until the pull request is reviewed and approved for CI by a project maintainer. Once CI is triggered, the progress and results will appear on the Github page for that pull request as checks. Links will appear to view the details of each check.

Documentation

Any pull request which adds a new feature or changes the behavior of any feature which was previously documented should include updates to the documentation. All documentation lives in this repository. This project aspires to follow the Kubernetes documentation style guide.

Pre-commit Hooks

This project uses pre-commit to agree on some conventions about whitespace/file encoding.

$ brew install pre-commit
[...]
$ pre-commit install
pre-commit installed at .git/hooks/pre-commit

Becoming a Pinniped Maintainer

Regular contributors who are active in the Pinniped community and who have contributed at least several significant pull requests may be considered for promotion to become a maintainer upon request. Please contact an existing maintainer if you would like to be considered.