6 Commits

Author	SHA1	Message	Date
Matt Moyer	fd5c00b38d	Implement auth-extra-groups in bootstrap token authenticator. ... This implements support for the new `auth-extra-groups` key in `bootstrap.kubernetes.io/token` secrets by adding extra groups to the user info returned for valid bootstrap tokens.	2017-08-25 16:23:01 -05:00
Matt Moyer	33e02aff60	Add extra group constants and validation to pkg/bootstrap/api. ... This adds constants and validation for a new `auth-extra-groups` key on `bootstrap.kubernetes.io/token` secrets. This key allows a bootstrap token to authenticate to extra groups in addition to the `system:bootstrappers` group. Extra groups are always applied in addition to the `system:bootstrappers` group, must begin with a `system:bootstrappers:` prefix, are limited in length, and are limited to a restricted set of characters (alphanumeric, colons, and dashes without a trailing colon/dash).	2017-08-25 16:04:53 -05:00
Eric Chiang	f719b2670c	bootstrap token auth: don't accept deleted tokens	2017-07-17 15:22:18 -07:00
Eric Chiang	f5fa115536	kube-apiserver: improve bootstrap token authentication error messages	2017-04-25 12:59:48 -07:00
Joe Beda	c46d6bb825	Use constant time compare for bootstrap tokens ... Signed-off-by: Joe Beda <joe.github@bedafamily.com>	2017-03-14 14:06:33 +00:00
Eric Chiang	a0df658b20	kube-apiserver: add a bootstrap token authenticator for TLS bootstrapping	2017-02-21 08:43:55 -08:00