github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-25 12:43:23 +00:00
Code Issues Projects Releases Wiki Activity

apiserver: allow disabling authz/n via options

Browse Source
This commit is contained in:
Dr. Stefan Schimanski 2017-09-06 18:15:43 +02:00
parent 1bcea54104
commit dffe50f8bd
3 changed files with 13 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
staging/src/k8s.io/apiextensions-apiserver/test/integration/testserver/start.go
View File

@ -30,7 +30,6 @@ import (
"k8s.io/apiextensions-apiserver/pkg/cmd/server" "k8s.io/apiextensions-apiserver/pkg/cmd/server"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
"k8s.io/apimachinery/pkg/util/wait" "k8s.io/apimachinery/pkg/util/wait"
"k8s.io/apiserver/pkg/authorization/authorizerfactory"
genericapiserver "k8s.io/apiserver/pkg/server" genericapiserver "k8s.io/apiserver/pkg/server"
"k8s.io/client-go/dynamic" "k8s.io/client-go/dynamic"
) )
@ -44,7 +43,8 @@ func DefaultServerConfig() (*extensionsapiserver.Config, error) {
options := server.NewCustomResourceDefinitionsServerOptions(os.Stdout, os.Stderr) options := server.NewCustomResourceDefinitionsServerOptions(os.Stdout, os.Stderr)
options.RecommendedOptions.Audit.LogOptions.Path = "-" options.RecommendedOptions.Audit.LogOptions.Path = "-"
options.RecommendedOptions.SecureServing.BindPort = port options.RecommendedOptions.SecureServing.BindPort = port
options.RecommendedOptions.Authentication.SkipInClusterLookup = true options.RecommendedOptions.Authentication = nil // disable
options.RecommendedOptions.Authorization = nil // disable
options.RecommendedOptions.SecureServing.BindAddress = net.ParseIP("127.0.0.1") options.RecommendedOptions.SecureServing.BindAddress = net.ParseIP("127.0.0.1")
etcdURL, ok := os.LookupEnv("KUBE_INTEGRATION_ETCD_URL") etcdURL, ok := os.LookupEnv("KUBE_INTEGRATION_ETCD_URL")
if !ok { if !ok {
@ -53,26 +53,12 @@ func DefaultServerConfig() (*extensionsapiserver.Config, error) {
options.RecommendedOptions.Etcd.StorageConfig.ServerList = []string{etcdURL} options.RecommendedOptions.Etcd.StorageConfig.ServerList = []string{etcdURL}
options.RecommendedOptions.Etcd.StorageConfig.Prefix = uuid.New() options.RecommendedOptions.Etcd.StorageConfig.Prefix = uuid.New()
// TODO stop copying this
// because there isn't currently a way to disable authentication or authorization from options
// explode options.Config here
genericConfig := genericapiserver.NewConfig(extensionsapiserver.Codecs) genericConfig := genericapiserver.NewConfig(extensionsapiserver.Codecs)
genericConfig.Authenticator = nil
genericConfig.Authorizer = authorizerfactory.NewAlwaysAllowAuthorizer()
if err := options.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", nil, []net.IP{net.ParseIP("127.0.0.1")}); err != nil { if err := options.RecommendedOptions.SecureServing.MaybeDefaultWithSelfSignedCerts("localhost", nil, []net.IP{net.ParseIP("127.0.0.1")}); err != nil {
return nil, fmt.Errorf("error creating self-signed certificates: %v", err) return nil, fmt.Errorf("error creating self-signed certificates: %v", err)
} }
if err := options.RecommendedOptions.Etcd.ApplyTo(genericConfig); err != nil { if err := options.RecommendedOptions.ApplyTo(genericConfig); err != nil {
return nil, err
}
if err := options.RecommendedOptions.SecureServing.ApplyTo(genericConfig); err != nil {
return nil, err
}
if err := options.RecommendedOptions.Audit.ApplyTo(genericConfig); err != nil {
return nil, err
}
if err := options.RecommendedOptions.Features.ApplyTo(genericConfig); err != nil {
return nil, err return nil, err
} }

5
staging/src/k8s.io/apiserver/pkg/server/options/authentication.go
View File

@ -143,6 +143,11 @@ func (s *DelegatingAuthenticationOptions) AddFlags(fs *pflag.FlagSet) {
} }
func (s *DelegatingAuthenticationOptions) ApplyTo(c *server.Config) error { func (s *DelegatingAuthenticationOptions) ApplyTo(c *server.Config) error {
if s == nil {
c.Authenticator = nil
return nil
}
clientCA, err := s.getClientCA() clientCA, err := s.getClientCA()
if err != nil { if err != nil {
return err return err

5
staging/src/k8s.io/apiserver/pkg/server/options/authorization.go
View File

@ -71,6 +71,11 @@ func (s *DelegatingAuthorizationOptions) AddFlags(fs *pflag.FlagSet) {
} }
func (s *DelegatingAuthorizationOptions) ApplyTo(c *server.Config) error { func (s *DelegatingAuthorizationOptions) ApplyTo(c *server.Config) error {
if s == nil {
c.Authorizer = authorizerfactory.NewAlwaysAllowAuthorizer()
return nil
}
cfg, err := s.ToAuthorizationConfig() cfg, err := s.ToAuthorizationConfig()
if err != nil { if err != nil {
return err return err