mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-20 23:14:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update comment for skipGroupRefresh

Browse Source
This commit is contained in:
Margo Crawford
2022-02-17 12:50:28 -08:00
parent e2c6dcd6e6
commit b9582f864e
26 changed files with 540 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apis/supervisor/idp/v1alpha1/types_activedirectoryidentityprovider.go.tmpl
+24 -4
View File
@@ -132,10 +132,30 @@ type ActiveDirectoryIdentityProviderGroupSearch struct {
// +optional
Attributes ActiveDirectoryIdentityProviderGroupSearchAttributes `json:"attributes,omitempty"`
// SkipGroupRefresh skips the group refresh operation that occurs with each refresh
// (every 5 minutes). This can be done if group search is very slow or resource intensive for the AD
// server.
SkipGroupRefresh bool `json:"skipGroupRefresh"`
// The user's group membership is refreshed as they interact with the supervisor
// to obtain new credentials (as their old credentials expire). This allows group
// membership changes to be quickly reflected into Kubernetes clusters. Since
// group membership is often used to bind authorization policies, it is important
// to keep the groups observed in Kubernetes clusters in-sync with the identity
// provider.
//
// In some environments, frequent group membership queries may result in a
// significant performance impact on the identity provider and/or the supervisor.
// The best approach to handle performance impacts is to tweak the group query
// to be more performant, for example by disabling nested group search or by
// using a more targeted group search base.
//
// If the group search query cannot be made performant and you are willing to
// have group memberships remain static for approximately a day, then set
// skipGroupRefresh to true. This is an insecure configuration as authorization
// policies that are bound to group membership will not notice if a user has
// been removed from a particular group until their next login.
//
// This is an experimental feature that may be removed or significantly altered
// in the future. Consumers of this configuration should carefully read all
// release notes before upgrading to ensure that the meaning of this field has
// not changed.
SkipGroupRefresh bool `json:"skipGroupRefresh,omitempty"`
}
// Spec for configuring an ActiveDirectory identity provider.
apis/supervisor/idp/v1alpha1/types_ldapidentityprovider.go.tmpl
+24 -4
View File
@@ -120,10 +120,30 @@ type LDAPIdentityProviderGroupSearch struct {
// +optional
Attributes LDAPIdentityProviderGroupSearchAttributes `json:"attributes,omitempty"`
// SkipGroupRefresh skips the group refresh operation that occurs with each refresh
// (every 5 minutes). This can be done if group search is very slow or resource intensive for the LDAP
// server.
SkipGroupRefresh bool `json:"skipGroupRefresh"`
// The user's group membership is refreshed as they interact with the supervisor
// to obtain new credentials (as their old credentials expire). This allows group
// membership changes to be quickly reflected into Kubernetes clusters. Since
// group membership is often used to bind authorization policies, it is important
// to keep the groups observed in Kubernetes clusters in-sync with the identity
// provider.
//
// In some environments, frequent group membership queries may result in a
// significant performance impact on the identity provider and/or the supervisor.
// The best approach to handle performance impacts is to tweak the group query
// to be more performant, for example by disabling nested group search or by
// using a more targeted group search base.
//
// If the group search query cannot be made performant and you are willing to
// have group memberships remain static for approximately a day, then set
// skipGroupRefresh to true. This is an insecure configuration as authorization
// policies that are bound to group membership will not notice if a user has
// been removed from a particular group until their next login.
//
// This is an experimental feature that may be removed or significantly altered
// in the future. Consumers of this configuration should carefully read all
// release notes before upgrading to ensure that the meaning of this field has
// not changed.
SkipGroupRefresh bool `json:"skipGroupRefresh,omitempty"`
}
// Spec for configuring an LDAP identity provider.