github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-21 08:47:16 +00:00
Code Issues Projects Releases Wiki Activity

Allow disabling caching for webhook authorizers when using apiserver.config.k8s.io/v1{alpha1,beta1}.AuthorizationConfiguration (#129237)

Browse Source 
* Introduce new boolean `cache{Una,A}uthorizedRequests` field

* Run `hack/update-codegen.sh`

* Respect legacy flags values for caching

With the legacy `--authorization-webhook-cache-{un}authorized-ttl`
flags, caching was disabled when the TTL was set to `0`, so let's
continue doing so when building the authz configuration struct.

* Pass TTL=0 to webhook authz plugin when cache disabled
This commit is contained in:
Rafael Franzke
2025-04-23 22:30:52 +02:00
committed by GitHub
parent 04b1ef3624
commit fa8e37f780
16 changed files with 279 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/kubeapiserver/authorizer/reload.go
View File

@@ -141,10 +141,18 @@ func (r *reloadableAuthorizerResolver) newForConfig(authzConfig *authzconfig.Aut
default:
return nil, nil, fmt.Errorf("unknown failurePolicy %q", configuredAuthorizer.Webhook.FailurePolicy)
}
authorizedTTL, unauthorizedTTL := configuredAuthorizer.Webhook.AuthorizedTTL.Duration, configuredAuthorizer.Webhook.UnauthorizedTTL.Duration
if !configuredAuthorizer.Webhook.CacheAuthorizedRequests {
authorizedTTL = 0
}
if !configuredAuthorizer.Webhook.CacheUnauthorizedRequests {
unauthorizedTTL = 0
}
webhookAuthorizer, err := webhook.New(clientConfig,
configuredAuthorizer.Webhook.SubjectAccessReviewVersion,
configuredAuthorizer.Webhook.AuthorizedTTL.Duration,
configuredAuthorizer.Webhook.UnauthorizedTTL.Duration,
authorizedTTL,
unauthorizedTTL,
*r.initialConfig.WebhookRetryBackoff,
decisionOnError,
configuredAuthorizer.Webhook.MatchConditions,

7
pkg/kubeapiserver/options/authorization.go
View File

@@ -33,7 +33,6 @@ import (
authzconfig "k8s.io/apiserver/pkg/apis/apiserver"
genericoptions "k8s.io/apiserver/pkg/server/options"
versionedinformers "k8s.io/client-go/informers"
"k8s.io/kubernetes/pkg/kubeapiserver/authorizer"
authzmodes "k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
)
@@ -273,8 +272,10 @@ func (o *BuiltInAuthorizationOptions) buildAuthorizationConfiguration() (*authzc
Type: authzconfig.TypeWebhook,
Name: defaultWebhookName,
Webhook: &authzconfig.WebhookConfiguration{
AuthorizedTTL: metav1.Duration{Duration: o.WebhookCacheAuthorizedTTL},
UnauthorizedTTL: metav1.Duration{Duration: o.WebhookCacheUnauthorizedTTL},
AuthorizedTTL: metav1.Duration{Duration: o.WebhookCacheAuthorizedTTL},
CacheAuthorizedRequests: o.WebhookCacheAuthorizedTTL != 0,
UnauthorizedTTL: metav1.Duration{Duration: o.WebhookCacheUnauthorizedTTL},
CacheUnauthorizedRequests: o.WebhookCacheUnauthorizedTTL != 0,
// Timeout and FailurePolicy are required for the new configuration.
// Setting these two implicitly to preserve backward compatibility.
Timeout: metav1.Duration{Duration: 30 * time.Second},