rancher/rke
1
0
Fork 0
mirror of https://github.com/rancher/rke.git synced 2025-09-17 23:49:06 +00:00
Code Issues Releases Wiki Activity

Add support for Kubernetes API Authn Webhook

Browse Source 
Allow multiple authn strategies to be defined, including new 'webhook'
strategy. Webhook strategy configuration contains the contents of the
authentication webhook file as well as the cache timeout period.

This change allows a Kubernetes API Auth service to authenticate
user requests without proxying through the Rancher server.
This commit is contained in:
Erik Wilson
2018-12-28 09:41:37 -07:00
committed by Craig Jellick
parent 30d8c8a30f
commit e04b7d4413
9 changed files with 162 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
cluster/defaults.go
View File

@@ -10,6 +10,7 @@ import (
"github.com/rancher/rke/k8s"
"github.com/rancher/rke/log"
"github.com/rancher/rke/services"
"github.com/rancher/rke/templates"
"github.com/rancher/types/apis/management.cattle.io/v3"
)
@@ -30,6 +31,9 @@ const (
DefaultAuthStrategy = "x509"
DefaultAuthorizationMode = "rbac"
DefaultAuthnWebhookFile = templates.AuthnWebhook
DefaultAuthnCacheTimeout = "5s"
DefaultNetworkPlugin = "canal"
DefaultNetworkCloudProvider = "none"
@@ -137,6 +141,7 @@ func (c *Cluster) setClusterDefaults(ctx context.Context) {
c.setClusterImageDefaults()
c.setClusterServicesDefaults()
c.setClusterNetworkDefaults()
c.setClusterAuthnDefaults()
}
func (c *Cluster) setClusterServicesDefaults() {
@@ -162,7 +167,6 @@ func (c *Cluster) setClusterServicesDefaults() {
&c.Services.Kubelet.ClusterDNSServer: DefaultClusterDNSService,
&c.Services.Kubelet.ClusterDomain: DefaultClusterDomain,
&c.Services.Kubelet.InfraContainerImage: c.SystemImages.PodInfraContainer,
&c.Authentication.Strategy: DefaultAuthStrategy,
&c.Services.Etcd.Creation: DefaultEtcdBackupCreationPeriod,
&c.Services.Etcd.Retention: DefaultEtcdBackupRetentionPeriod,
}
@@ -268,6 +272,28 @@ func (c *Cluster) setClusterNetworkDefaults() {
}
}
func (c *Cluster) setClusterAuthnDefaults() {
setDefaultIfEmpty(&c.Authentication.Strategy, DefaultAuthStrategy)
for _, strategy := range strings.Split(c.Authentication.Strategy, "|") {
strategy = strings.ToLower(strings.TrimSpace(strategy))
c.AuthnStrategies[strategy] = true
}
if c.AuthnStrategies[AuthnWebhookProvider] && c.Authentication.Webhook == nil {
c.Authentication.Webhook = &v3.AuthWebhookConfig{}
}
if c.Authentication.Webhook != nil {
webhookConfigDefaultsMap := map[*string]string{
&c.Authentication.Webhook.ConfigFile: DefaultAuthnWebhookFile,
&c.Authentication.Webhook.CacheTimeout: DefaultAuthnCacheTimeout,
}
for k, v := range webhookConfigDefaultsMap {
setDefaultIfEmpty(k, v)
}
}
}
func d(image, defaultRegistryURL string) string {
if len(defaultRegistryURL) == 0 {
return image