Commit Graph

25 Commits

Author SHA1 Message Date
Jordan Liggitt c6b4e07ee4 Fix indentation/spacing in comments to render correctly in godoc
Kubernetes-commit: 78cb3862f11225135afdf76f3424e2d7b33104c7
2022-12-17 17:31:05 -05:00
Davanum Srinivas 7e94033a61 Generate and format files
- Run hack/update-codegen.sh
- Run hack/update-generated-device-plugin.sh
- Run hack/update-generated-protobuf.sh
- Run hack/update-generated-runtime.sh
- Run hack/update-generated-swagger-docs.sh
- Run hack/update-openapi-spec.sh
- Run hack/update-gofmt.sh

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Kubernetes-commit: a9593d634c6a053848413e600dadbf974627515f
2022-07-19 20:54:13 -04:00
Lukasz Szaszkiewicz 9ff2637133 adds metrics for authorization webhook
Kubernetes-commit: 4a2aef00d6dd2543b011aa7e5af28df598a0cd72
2021-03-17 16:30:40 +01:00
Lukasz Szaszkiewicz b5be45a80f DelegatingAuthOptions: allows for specifying a middleware function for custom HTTP behaviour for the auth webhook client
Kubernetes-commit: ea7d94497b5fef2fe7b925d378f425b94448f01b
2021-03-04 12:35:09 +01:00
David Eads 4925be5c06 Update delegated authorization options default to eliminate unnecessary
SARs

healthz, readyz, and livez are canonical names for checks that the kubelet does.  By default, allow access to them in the options. Callers can adjust the defaults if they have a reason to require checks.

system:masters has full power, so the authorization check is unnecessary and just uses an extra call for in-cluster access.  Callers can adjust the defaults if they have a reason to require checks.

Kubernetes-commit: cebce291ddcb8490a705c79623c0b4f13faef6e7
2021-01-22 16:16:14 -05:00
xiongzhongliang 351f1ab57a use klog.Info and klog.Warning when had no format
Kubernetes-commit: 90f4aeeea4cc5f96caa6ed87c67ca7e62d1ba21c
2020-11-14 00:55:06 +08:00
yue9944882 54481aaf0e fixes nil panic for nil delegated auth options
Kubernetes-commit: 9ade821baab1fa5573f4a36eb7d7098b033ec17c
2021-01-12 17:12:33 +08:00
Abu Kashem 5254108841 make backoff parameters configurable for webhook
Currently webhook retry backoff parameters are hard coded, we want
to have the ability to configure the backoff parameters for webhook
retry logic.

Kubernetes-commit: 53a1307f68ccf6c9ffd252eeea2b333e818c1103
2020-10-30 11:25:32 -04:00
Lukasz Szaszkiewicz 972d12cb5f DelegatingAuthorizationOptions: exposes and sets a default timeout for SubjectAccessReview client
previously no timeout was set. Requests without explicit timeout might potentially hang forever and lead to starvation of the application.

Kubernetes-commit: 2160cbc53fdd27a3cbc1b361e523abda4c39ac42
2020-10-20 14:39:45 +02:00
Davanum Srinivas 5879417a28 switch over k/k to use klog v2
Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Kubernetes-commit: 442a69c3bdf6fe8e525b05887e57d89db1e2f3a5
2020-04-17 15:25:06 -04:00
Jordan Liggitt 52b3bfb8fa Switch kubelet/aggregated API servers to use v1 subjectaccessreviews
Kubernetes-commit: d54a70db5cfc0887e2f5177b0c3f795947be6eb4
2019-11-04 23:29:56 -05:00
Davanum Srinivas 2710b17b80 Move from glog to klog
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135

Kubernetes-commit: 954996e231074dc7429f7be1256a579bedd8344c
2018-11-09 13:49:10 -05:00
David Eads 257a06e88a add With method for allowed URL options on delegated authorization
Kubernetes-commit: 77b56ec9e36dd721c341ce838d608e8af10ce51f
2018-11-06 10:44:29 -05:00
David Eads 83c8e657ed allow delegated authorization to have privileged groups
Kubernetes-commit: 0b70b7a7c975589f7019e5017c334cf0ee6b819f
2018-11-05 16:23:20 -05:00
Dr. Stefan Schimanski 1a58e1c6ad apiserver: make InClusterConfig errs for delegated authn/z non-fatal
Kubernetes-commit: 04e793e65ad70df5c4ab280c42740864e54163cd
2018-09-05 09:12:19 +02:00
Dr. Stefan Schimanski 16d4968bf9 authn/z: optionally opt-out of mandatory authn/authz kubeconfig
Kubernetes-commit: a671d65673590f0dfcf5c2b673e1518d11510bdb
2018-08-22 11:56:07 +02:00
Dr. Stefan Schimanski cfb1e16b55 apiserver: unify handling of unspecified options in authn+z
Kubernetes-commit: 0ede948e47d33474a4e30c845d7896c58a319e39
2018-08-21 16:42:13 +02:00
Dr. Stefan Schimanski a8bd1ddbf7 delegated authz: add AlwaysAllowPaths mechanism to exclude e.g. /healthz
Kubernetes-commit: 6142e2f8f7c8b1c5d32a2f9aa3715ea0b5baf167
2018-08-17 17:03:16 +02:00
Dr. Stefan Schimanski 65f0646df4 apiserver: add context to authn/authz kubeconfig errors
Kubernetes-commit: 99eda24de01c8b1b84b54cb763b540de35084ade
2018-06-14 15:30:25 +02:00
Dr. Stefan Schimanski 28595d407b apiserver: add warning about not trusting authz of aggregator
Kubernetes-commit: 50b98169ede9648769ce471150b1ab9ceb06bc0c
2018-03-19 13:37:52 +01:00
Dr. Stefan Schimanski 338a852bbb apiserver: make SecureServingOptions and authz/n options re-usable
Kubernetes-commit: 4e0114b0dd3701b68c02d038edcf4fbe84515a68
2018-01-31 16:17:48 +01:00
Dr. Stefan Schimanski a063c5336d apiserver: avoid panics on nil sub-option structs
Kubernetes-commit: b153268da79d2acf14e042945959801c3dba8221
2017-09-09 21:44:32 +00:00
Dr. Stefan Schimanski 8ec769da6b apiserver: allow disabling authz/n via options
Kubernetes-commit: dffe50f8bd820295f7f1fbc56a6269b6b8c6966b
2017-09-09 21:44:32 +00:00
deads2k 284a95797b apiserver command line options lead to config 2017-02-13 07:36:41 -05:00
deads2k c4b078bb1d move apiserver options 2017-02-02 09:36:48 -05:00