mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-24 17:12:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
505 Commits 31 Branches 54 Tags
9735122db9be6b442154076bf0d339a2cdc482ed
Commit Graph
505 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andrew Keesler 9735122db9 Wire in kubecertagent.NewExecerController() to server 
Also fill in a couple of low-hanging unit tests.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-09-23 11:01:41 -04:00
Andrew Keesler 4948e1702f Merge remote-tracking branch 'upstream/main' into 1-19-exec-strategy 2020-09-23 09:54:45 -04:00
Andrew Keesler 406f2723ce internal/certauthority/dynamiccertauthority: add new dynamic cert issuer 
This thing is supposed to be used to help our CredentialRequest handler issue certs with a dynamic
CA keypair.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-09-23 09:53:21 -04:00
Andrew Keesler 6c555f94e3 internal/provider -> internal/dynamiccert 
3 main reasons:
- The cert and key that we store in this object are not always used for TLS.
- The package name "provider" was a little too generic.
- dynamiccert.Provider reads more go-ish than provider.DynamicCertProvider.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-09-23 08:29:35 -04:00
Andrew Keesler f8e872d1af Please linter to get back to passing lint+unit-test 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-09-23 08:02:04 -04:00
Andrew Keesler 3e45bfc97d internal/controller/issuerconfig: Publisher -> KubeConfigInfoPublisher 
The new symbol more specifically describes what the controller does.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-09-23 07:58:01 -04:00
Andrew Keesler a55e9de4fc Use existing clock test double to get kubecertagent units passing 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-09-23 07:50:45 -04:00
Ryan RichardandAndrew Keesler eb0d9a15fc WIP: start replacing the kubecertauthority pkg with a new controller 
- Lots of TODOs added that need to be resolved to finish this WIP
- execer_test.go seems like it should be passing, but it fails (sigh)

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-09-22 17:45:20 -07:00
Matt MoyerandGitHub 6063674623 Merge pull request #130 from mattmoyer/add-cla-doc 
Add a section about our CLA.
 2020-09-22 14:20:19 -05:00
Matt Moyer d574fe05ba Add a section about our CLA. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 14:15:14 -05:00
Matt MoyerandGitHub 4369cc9ff2 Merge pull request #129 from mattmoyer/test-fixes 
Test fixes and hardening
 2020-09-22 13:33:40 -05:00
Matt Moyer adf263b566 Harden some tests against slow IDP controllers using Eventually(). 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 12:43:35 -05:00
Matt Moyer 4edda802e5 Avoid a bug where long test names overflow the max label length. 
Annotations do not have this restriction, so we can put it there instead. This only currently occurs on clusters without the cluster signing capability (GKE).

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 11:23:34 -05:00
Andrew Keesler db9a97721f Merge remote-tracking branch 'upstream/main' into 1-19-exec-strategy 2020-09-22 11:54:47 -04:00
Matt MoyerandGitHub 3578d7cb9a Merge pull request #128 from mattmoyer/add-idp-selector 
Support multiple IDPs by adding IdentityProvider selector to TokenCredentialRequest spec.
 2020-09-22 10:51:44 -05:00
Andrew Keesler 83920db502 Merge remote-tracking branch 'upstream/main' into 1-19-exec-strategy 2020-09-22 11:39:07 -04:00
Andrew Keesler 1a4f9e3466 kubecertagent: get integration tests passing again 
Note: the non-kubecertagent integration tests are still failing :).
 2020-09-22 11:38:13 -04:00
Matt Moyer e574a99c5e Add an integration test that tries to use a non-existent IDP. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:16:47 -05:00
Matt Moyer 16ef2baf8a Sort idpcache keys to make things as deterministic as possible. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:32 -05:00
Matt Moyer 9beb3855b5 Create webhooks per-test and explicitly in demo.md instead of with ytt in ./deploy. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:32 -05:00
Matt Moyer 81f2362543 Remove fallback support for implicitly choosing an IDP in TokenCredentialRequest. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:32 -05:00
Matt Moyer 07f0181fa3 Add IDP selection to get-kubeconfig command. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:32 -05:00
Matt Moyer 481308215d Pass namespace properly in client.ExchangeToken. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:32 -05:00
Matt Moyer 381fd51e13 Refactor get_kubeconfig.go. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:32 -05:00
Matt Moyer 541336b997 Fix docstring for exchange credential CLI. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:32 -05:00
Matt Moyer 6cdd4a9506 Add support for multiple IDPs selected using IdentityProvider field. 
This also has fallback compatibility support if no IDP is specified and there is exactly one IDP in the cache.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:31 -05:00
Matt Moyer fbe0551426 Add IDP selector support in client code. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:31 -05:00
Matt Moyer 164f64a370 Add IdentityProvider field to TokenCredentialRequestSpec. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-22 10:03:31 -05:00
Ryan Richard 526be79b11 Finish WIP from previous commits: agent pods created in install namespace 2020-09-21 17:15:36 -07:00
Ryan Richard 820f1e977e Continue the WIP from the previous commit: finish adding second informer 
- All of the `kubecertagent` controllers now take two informers
- This is moving in the direction of creating the agent pods in the
  Pinniped installation namespace, but that will come in a future
  commit
 2020-09-21 16:37:22 -07:00
Andrew Keesler 50258fc569 WIP: start to create kube-cert-agent pods in namespace 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-09-21 16:27:00 -04:00
Ryan Richard 0d3ad0085d Fix lint error from previous commit 2020-09-21 12:30:53 -07:00
Ryan Richard cfb76a538c Refactor kubectl exec test in TestCLI to avoid assuming any RBAC settings 2020-09-21 11:40:11 -07:00
Andrew Keesler e18b6fdddc deploy: add kube-cert-agent deployment knobs 2020-09-21 14:16:32 -04:00
Andrew Keesler 5a608cc84c Add kube-cert-agent controller for getting kube API keypair 2020-09-21 14:16:14 -04:00
Ryan RichardandGitHub 49145791cc Merge pull request #127 from vmware-tanzu/rename_stuff 
Rename many of resources that are created in Kubernetes by Pinniped
 2020-09-18 16:58:44 -07:00
Ryan Richard 6989e5da63 Merge branch 'main' into rename_stuff 2020-09-18 16:39:58 -07:00
Ryan Richard a2365b1cce Remove -count 1 from unit test running in module.sh 2020-09-18 15:58:22 -07:00
Ryan Richard 80a520390b Rename many of resources that are created in Kubernetes by Pinniped 
New resource naming conventions:
- Do not repeat the Kind in the name,
  e.g. do not call it foo-cluster-role-binding, just call it foo
- Names will generally start with a prefix to identify our component,
  so when a user lists all objects of that kind, they can tell to which
  component it is related,
  e.g. `kubectl get configmaps` would list one named "pinniped-config"
- It should be possible for an operator to make the word "pinniped"
  mostly disappear if they choose, by specifying the app_name in
  values.yaml, to the extent that is practical (but not from APIService
  names because those are hardcoded in golang)
- Each role/clusterrole and its corresponding binding have the same name
- Pinniped resource names that must be known by the server golang code
  are passed to the code at run time via ConfigMap, rather than
  hardcoded in the golang code. This also allows them to be prepended
  with the app_name from values.yaml while creating the ConfigMap.
- Since the CLI `get-kubeconfig` command cannot guess the name of the
  CredentialIssuerConfig resource in advance anymore, it lists all
  CredentialIssuerConfig in the app's namespace and returns an error
  if there is not exactly one found, and then uses that one regardless
  of its name
 2020-09-18 15:56:50 -07:00
Matt MoyerandGitHub 86e1c99dcd Merge pull request #126 from mattmoyer/remove-old-apis 
Remove deprecated "pinniped.dev" API group.
 2020-09-18 17:52:14 -05:00
Matt Moyer 78ac27c262 Remove deprecated "pinniped.dev" API group. 
This has been replaced by the "login.pinniped.dev" group with a slightly different API.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-18 17:32:15 -05:00
PinnyandGitHub f86a5244a6 Merge pull request #125 from mattmoyer/remove-old-apis 
Move CredentialIssuerConfig into new "config.pinniped.dev" API group.
 2020-09-18 16:55:09 -05:00
Matt Moyer 907ccb68f5 Move CredentialIssuerConfig into new "config.pinniped.dev" API group. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-18 16:38:45 -05:00
Matt MoyerandGitHub 98490b1a1b Merge pull request #124 from mattmoyer/add-vanity-imports 
Add Go vanity import paths.
 2020-09-18 15:18:32 -05:00
Matt Moyer 2d4d7e588a Add Go vanity import paths. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-09-18 14:56:24 -05:00
Ryan Richard 24f962f1b8 Ignore a lint err in cli_test.go 2020-09-18 10:52:31 -07:00
Ryan Richard 2ecb43154b Enhance TestCLI integration test so it can catch mistakes with env vars 
- Also remove a log statement from a test which caused a lot of extra
  output when the tests are run with `go test -v`
 2020-09-18 10:27:15 -07:00
Ryan RichardandGitHub dba951fe89 Note that CLI warning can be ignored in demo.md 2020-09-18 09:24:04 -07:00
Ryan RichardandGitHub 245854b85a Update demo.md 2020-09-18 09:11:56 -07:00
Andrew KeeslerandGitHub 5867f3699c Merge pull request #123 from ankeesler/kubernetes-deep-equal 
internal/controller/issuerconfig: use Kubernetes DeepEqual
 2020-09-18 07:48:57 -04:00