mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-08-01 04:46:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
1,654 Commits 19 Branches 54 Tags
331fef8faebf9ab4b60d4e7c94ce42fe72da033e
Commit Graph
560 Commits
Author SHA1 Message Date
Matt Moyer c94ee7188c Factor out issuerconfig.UpdateStrategy helper. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-01 16:21:10 -06:00
Matt Moyer c832cab8d0 Update internal/oidc/token_exchange.go for latest Fosite version. 
The `fosite.TokenEndpointHandler` changed and now requires some additional methods.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-01 13:08:41 -06:00
Matt Moyer 234465789b Regenerate gomock mocks with v1.5.0. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-01 11:44:27 -06:00
Ryan RichardandMargo Crawford f1eeae8c71 Parse out ports from impersonation proxy endpoint config 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-26 15:01:38 -08:00
Ryan Richard 41e4a74b57 impersonator_config_test.go: more small refactoring of test helpers 2021-02-26 13:53:30 -08:00
Margo CrawfordandRyan Richard fa49beb623 Change length of TLS certs and CA. 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-26 12:05:17 -08:00
Margo CrawfordandRyan Richard 9bd206cedb impersonator_config_test.go: small refactor of test helpers 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-26 11:27:19 -08:00
Ryan RichardandMargo Crawford 5b01e4be2d impersonator_config.go: handle more error cases 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-26 10:58:56 -08:00
Ryan RichardandMargo Crawford bbbb40994d Prefer hostnames over IPs when making certs to match load balancer ingress 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-25 17:03:34 -08:00
Margo CrawfordandRyan Richard f709da5569 Updated test assertions for new logger version 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-25 15:18:36 -08:00
Ryan Richard f8111db5ff Merge branch 'main' into impersonation-proxy 2021-02-25 14:50:40 -08:00
Ryan RichardandMargo Crawford 0cae72b391 Get hostname from load balancer ingress to use for impersonator certs 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-25 11:40:14 -08:00
Margo CrawfordandRyan Richard 9a8c80f20a Impersonator checks cert addresses when endpoint config is a hostname 
Also update concierge_impersonation_proxy_test.go integration test
to use real TLS when calling the impersonator.

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-25 10:27:19 -08:00
Matt Moyer c8fc8a0b65 Reformat some log-based test assertions. 
These are prone to breaking when stdr is upgraded because they rely on the exact ordering of keys in the log message. If we have more problems we can rewrite the assertions to be more robust, but for this time I'm just fixing them to match the new output.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-02-25 08:11:37 -06:00
Margo CrawfordandRyan Richard 8fc68a4b21 WIP improved cert management in impersonator config 
- Allows Endpoint to be a hostname, not just an IP address

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-24 17:08:58 -08:00
Ryan Richard aee7a7a72b More WIP managing TLS secrets from the impersonation config controller 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-24 16:03:26 -08:00
Ryan RichardandMargo Crawford d42c533fbb WIP managing TLS secrets from the impersonation config controller 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-24 10:57:36 -08:00
Andrew Keesler 069b3fba37 Merge remote-tracking branch 'upstream/main' into impersonation-proxy 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-23 12:10:52 -05:00
Ryan RichardandMargo Crawford 80ff5c1f17 Fix bug which prevented watches from working through impersonator 
Also:
- Changed base64 encoding of impersonator bearer tokens to use
  `base64.StdEncoding` to make it easier for users to manually
  create a token using the unix `base64` command
- Test the headers which are and are not passed through to the Kube API
  by the impersonator more carefully in the unit tests
- More WIP on concierge_impersonation_proxy_test.go

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-22 17:23:11 -08:00
Monis Khan abc941097c Add WhoAmIRequest Aggregated Virtual REST API 
This change adds a new virtual aggregated API that can be used by
any user to echo back who they are currently authenticated as.  This
has general utility to end users and can be used in tests to
validate if authentication was successful.

Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-22 20:02:41 -05:00
Monis Khan 62630d6449 getAggregatedAPIServerScheme: move group version logic internally 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-19 11:10:54 -05:00
Margo CrawfordandRyan Richard 19881e4d7f Increase how long we wait for loadbalancers to be deleted for int test 
Also add some log messages which might help us debug issues like this
in the future.

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-18 15:58:27 -08:00
Ryan RichardandMargo Crawford 126f9c0da3 certs_manager.go: Rename some local variables 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-18 11:16:34 -08:00
Andrew Keesler 957cb2d56c Merge remote-tracking branch 'upstream/main' into impersonation-proxy 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-18 13:37:28 -05:00
Andrew Keesler b3cdc438ce internal/concierge/impersonator: reuse kube bearertoken.Authenticator 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-18 10:13:24 -05:00
Margo CrawfordandRyan Richard 22a3e73bac impersonator_config_test.go: use require.Len() when applicable 
Also fix a lint error in concierge_impersonation_proxy_test.go

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-17 17:29:56 -08:00
Margo CrawfordandRyan Richard 0ad91c43f7 ImpersonationConfigController uses servicesinformer 
This is a more reliable way to determine whether the load balancer
is already running.
Also added more unit tests for the load balancer.

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-17 17:22:13 -08:00
Margo Crawford 67da840097 Add loadbalancer for impersonation proxy when needed 2021-02-16 15:57:02 -08:00
Matt Moyer 6565265bee Use new 'go.pinniped.dev/generated/latest' package. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-02-16 13:00:08 -06:00
Andrew Keesler eb19980110 internal/concierge/impersonator: set user extra impersonation headers 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-16 09:26:47 -05:00
Andrew Keesler c7905c6638 internal/concierge/impersonator: fail if impersonation headers set 
If someone has already set impersonation headers in their request, then
we should fail loudly so the client knows that its existing impersonation
headers will not work.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-16 08:15:50 -05:00
Andrew Keesler fdd8ef5835 internal/concierge/impersonator: handle custom login API group 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-16 07:55:09 -05:00
Andrew Keesler 6512ab1351 internal/concierge/impersonator: don't care about namespace 
Concierge APIs are no longer namespaced (see f015ad5852).

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-15 17:11:59 -05:00
Ryan Richard 5cd60fa5f9 Move starting/stopping impersonation proxy server to a new controller 
- Watch a configmap to read the configuration of the impersonation
  proxy and reconcile it.
- Implements "auto" mode by querying the API for control plane nodes.
- WIP: does not create a load balancer or proper TLS certificates yet.
  Those will come in future commits.

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-11 17:25:52 -08:00
Andrew Keesler 9b87906a30 Merge remote-tracking branch 'upstream/main' into impersonation-proxy 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-11 11:03:33 -05:00
Monis Khan b04fd46319 Update federation domain logic to use status subresource 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:10 -05:00
Monis Khan 0a9f446893 Update credential issuer logic to use status subresource 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:10 -05:00
Monis Khan ac01186499 Use API service as owner ref for cluster scoped resources 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:08 -05:00
Monis Khan 2eb01bd307 authncache: remove namespace concept 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:08 -05:00
Monis Khan 89b00e3702 Declare war on namespaces 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:07 -05:00
Monis Khan 4205e3dedc Make concierge APIs cluster scoped 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-10 21:52:07 -05:00
Andrew Keesler 0fc1f17866 internal/groupsuffix: mutate TokenCredentialRequest's Authenticator 
This is a partial revert of 288d9c999e. For some reason it didn't occur to me
that we could do it this way earlier. Whoops.

This also contains a middleware update: mutation funcs can return an error now
and short-circuit the rest of the request/response flow. The idea here is that
if someone is configuring their kubeclient to use middleware, they are agreeing
to a narrow-er client contract by doing so (e.g., their TokenCredentialRequest's
must have an Spec.Authenticator.APIGroup set).

I also updated some internal/groupsuffix tests to be more realistic.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-10 15:53:44 -05:00
Andrew Keesler ae6503e972 internal/plog: add KObj() and KRef() 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-10 14:25:39 -05:00
Ryan Richard e4c49c37b9 Merge branch 'main' into impersonation-proxy 2021-02-09 13:45:37 -08:00
Ryan Richard 268ca5b7f6 Add config structs in impersonator package 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-02-09 13:44:19 -08:00
Monis Khan 2679d27ced Use server scheme to handle credential request API group changes 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-09 15:51:38 -05:00
Monis Khan 6b71b8d8ad Revert server side token credential request API group changes 
Signed-off-by: Monis Khan <mok@vmware.com>
 2021-02-09 15:51:35 -05:00
Andrew Keesler 8697488126 internal/concierge/impersonator: use kubeconfig from kubeclient 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-09 15:28:56 -05:00
Margo Crawford dfcc2a1eb8 Introduce clusterhost package to determine whether a cluster has control plane nodes 
Also added hasExternalLoadBalancerProvider key to cluster capabilities
for integration testing.

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-02-09 11:16:01 -08:00
Andrew Keesler 812f5084a1 internal/concierge/impersonator: don't mutate ServeHTTP() req 
I added that test helper to create an http.Request since I wanted to properly
initialize the http.Request's context.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-02-09 13:25:32 -05:00