Feature/k8s token authentication #64
Conversation
|
All contributors have signed the CLA ✍️ ✅ |
when token volume is updated
|
I have read the CLA Document and I hereby sign the CLA |
strings.HasPrefix with a switch statement
AuthService.IsAccessGrantedWithToken, pass into AuthService constructor
issuer from the token
looking at issuer url
kubernetes.oidc.Verifier
nurtai325
force-pushed
the
feature/k8s-token-authentication
branch
from
da0c408 to
6f92c54
Compare
|
| http: 0.0.0.0:5556 | ||
|
|
||
| telemetry: | ||
| http: 0.0.0.0:5558 |
| http: 0.0.0.0:5558 | ||
|
|
||
| grpc: | ||
| addr: 0.0.0.0:5557 |
| issuer: http://oidc-server:5556/dex | ||
|
|
||
| storage: | ||
| type: sqlite3 |
There was a problem hiding this comment.
do we need sqlite3 for tests?
| grpc: | ||
| addr: 0.0.0.0:5557 | ||
|
|
||
| connectors: |
| ) | ||
| .withNetwork(TEST_NETWORK) | ||
| .withExposedPorts(8080) | ||
| .withCopyFileToContainer(MountableFile.forHostPath(oidcTokenTempFile.toAbsolutePath()), "/var/run/secrets/kubernetes.io/serviceaccount/token") |
There was a problem hiding this comment.
where are the actual tests that use new auth ?
There was a problem hiding this comment.
this is added because when application starts it looks for token and makes OIDC discovery. and this is added to prevent app from crashing at start in tests
| account = serviceAccount | ||
| default: | ||
| if slices.Contains(roles, model.AnonymousRole) { | ||
| log.WarnC(userCtx, "Anonymous access will be dropped in future releases for: %s", ctx.OriginalURL()) |
There was a problem hiding this comment.
code duplication. just check if the role == AnonymousRole in the beginning and skip other steps
|
|
||
| log.InfoC(ctx, "Received request on create one more manage account") | ||
| if _, err := a.service.IsAccessGranted(ctx, username, password, model.ManagerAccountNamespace, []model.RoleName{model.ManagerRole}); err != nil { | ||
| if _, err := a.service.IsAccessGrantedWithBasic(ctx, username, password, model.ManagerAccountNamespace, []model.RoleName{model.ManagerRole}); err != nil { |
There was a problem hiding this comment.
so we have no option to create manager accounts with token? how can we deprecate the basic auth approach then?
There was a problem hiding this comment.
what about client account for deployer v3?
There was a problem hiding this comment.
it is not decided yet. it will be decided when maas becomes an operator. see stage 3 here. https://bass.netcracker.com/display/CPSEC/M2M+MaaS+Design
No description provided.