✨ Envtest exports rest.Config for the secure endpoint of kube-apiserver #984

everpeace · 2020-06-06T09:05:04Z

fixes #983

This PR added:

internal.integration.APISever: expose TLSClientConfig to connect its secure endpoint
envtest.Environment: introduce SecureConfig that just contains kube-apiserver's secure endpoint and its TLSClientConfig.

Note: To work with SecureConfig, users will have to set authn information like this.

te := &envtest.Environment{
  KubeAPIServerFlags: append(
    envtest.DefaultKubeAPIServerFlags, 
    "--basic-auth-file=my-file", "--authorization-mode=RBAC",
  ),
}
te.Start()
cfg := rest.CopyConfig(te.SecureConfig)
cfg.Username = "myname"
cfg.Password = "mypassword"

// This client can send a request as "myname" user.
client.New(cfg)

…onnect 'https' endpoint of kube-apiserver

k8s-ci-robot · 2020-06-06T09:05:11Z

Welcome @everpeace!

It looks like this is your first PR to kubernetes-sigs/controller-runtime 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/controller-runtime has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2020-06-06T09:05:12Z

Hi @everpeace. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

everpeace · 2020-06-24T11:58:52Z

/assign @droot

vincepri · 2020-07-22T22:37:46Z

/assign @alvaroaleman @DirectXMan12

james-w · 2020-07-29T13:26:26Z

Hi, I also had a need to do this, so I am using this branch and it is working well for me, thanks.

vincepri · 2020-07-29T15:34:53Z

/ok-to-test

k8s-ci-robot · 2020-07-29T16:15:54Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: everpeace
To complete the pull request process, please assign alvaroaleman
You can assign the PR to them by writing /assign @alvaroaleman in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Please note that this just contains secure endpoint itself and its CA certs. User will have to set authentication information by themselves and configure some authn module in kube-apiserver.

DirectXMan12 · 2020-08-17T21:44:26Z

I'm tempted to approve this as-is (it looks pretty reasonable), but it's also kind of a half-measure, due to forcing folks to override the apiserver flags, etc. Can we think of a good way around that? I've got a pretty complicated prototype hanging around over at #645 -- maybe we could adapt/simplify that?

james-w · 2020-08-18T21:07:48Z

Yeah, it's a half-measure for testing with auth, but at least this allows for that testing to take place. Without this change users would have to resort to horrible hacks to get access to the secure port, even with overriding auth apiserver flags. What about merging this to at least make it possible to do these things, and then look at improvements to make it a better experience?

everpeace · 2020-08-21T01:24:35Z

I agree that it's kind of half-measure and this should be more simple. However, as james pointed out, users currently have heavy pain to access to a secure endpoint. So, I would like to add 👍 to james' idea. WDYT?

fejta-bot · 2020-11-19T02:17:22Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

everpeace · 2020-11-19T03:52:25Z

/remove-lifecycle stale

fejta-bot · 2021-02-17T04:31:54Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

everpeace · 2021-02-17T07:55:14Z

/lifecycle stale

alvaroaleman

I am very sorry this didn't get any attention for so long, it appears I missed it in my queue :(

alvaroaleman · 2021-03-14T23:22:21Z

pkg/envtest/server.go

+	// te := &envtest.Environment{
+	//   KubeAPIServerFlags: append(
+	//     envtest.DefaultKubeAPIServerFlags,
+	//     "--basic-auth-file=my-file", "--authorization-mode=RBAC",


@everpeace what about extending envtest to generate a token-auth-file with a token that is member of the system:masters group so this just works by default?

Also, a test would be great 🙃

If you do not have time to pick that up, we can also merge this as-is and I will address my comments in a follow-up.

@alvaroaleman Thank you for your review!!

If you do not have time to pick that up, we can also merge this as-is and I will address my comments in a follow-up.

sorry... I couldn't spare time to do this currently. I'm very glad if we take this way 🙇 🙇

@alvaroaleman As I understand it you suggestion is just to provide a static user in the token-auth-file? I think it would be better to have an option to add individual users (maybe in addition to a default) so that you can specify particular groups that the user may be a member of.

One example of where this may be useful is testing CSRs, where the API server uses the requesting parties credentials to become part of the CSR request. Typically here you'd want to be able to specify the exact groups that the user belongs to to be able to get the right groups plumbed into that CSR

@JoelSpeed you can just create a SA and then use impersonation for that. @DirectXMan12 is working on an updated version of this afaik

lobziik · 2021-03-18T13:36:28Z

Works well for me. I applied this patch on 0.8.2 release, works as expected.
Would be awesome to have it merged!

everpeace · 2021-04-21T06:32:15Z

/close
because of #1486 .

APIServer in envtest should expose TLSClientConfig so that user can c…

b231ddb

…onnect 'https' endpoint of kube-apiserver

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 6, 2020

k8s-ci-robot requested a review from alenkacz June 6, 2020 09:05

k8s-ci-robot requested a review from joelanford June 6, 2020 09:05

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 6, 2020

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jun 6, 2020

everpeace changed the title ~~:sparkles Envtest exports rest.Config for the secure endpoint of kube-apiserver~~ ✨ Envtest exports rest.Config for the secure endpoint of kube-apiserver Jun 6, 2020

k8s-ci-robot assigned droot Jun 24, 2020

k8s-ci-robot assigned alvaroaleman and DirectXMan12 Jul 22, 2020

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 29, 2020

everpeace force-pushed the envtest-exports-tlsconfig-for-kubeapiserver branch from 7db3b83 to 034f8e3 Compare July 29, 2020 16:15

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 29, 2020

envtest expose 'SecureConfig' for user conveinience.

7dd198f

Please note that this just contains secure endpoint itself and its CA certs. User will have to set authentication information by themselves and configure some authn module in kube-apiserver.

everpeace force-pushed the envtest-exports-tlsconfig-for-kubeapiserver branch from 034f8e3 to 7dd198f Compare July 29, 2020 16:24

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 19, 2020

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 19, 2020

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 17, 2021

alvaroaleman reviewed Mar 14, 2021

View reviewed changes

alvaroaleman mentioned this pull request Mar 15, 2021

envtest with Kubernetes 1.20 #1357

Closed

lobziik mentioned this pull request Apr 14, 2021

🌱 Envtest exports secure config, helpers for simplify users adding #1477

Closed

everpeace closed this Apr 21, 2021

everpeace deleted the envtest-exports-tlsconfig-for-kubeapiserver branch April 21, 2021 06:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Envtest exports rest.Config for the secure endpoint of kube-apiserver #984

✨ Envtest exports rest.Config for the secure endpoint of kube-apiserver #984

everpeace commented Jun 6, 2020 •

edited

k8s-ci-robot commented Jun 6, 2020

k8s-ci-robot commented Jun 6, 2020

everpeace commented Jun 24, 2020

vincepri commented Jul 22, 2020

james-w commented Jul 29, 2020

vincepri commented Jul 29, 2020

k8s-ci-robot commented Jul 29, 2020

DirectXMan12 commented Aug 17, 2020

james-w commented Aug 18, 2020

everpeace commented Aug 21, 2020

fejta-bot commented Nov 19, 2020

everpeace commented Nov 19, 2020

fejta-bot commented Feb 17, 2021

everpeace commented Feb 17, 2021

alvaroaleman left a comment

alvaroaleman Mar 14, 2021

everpeace Mar 15, 2021

JoelSpeed Apr 12, 2021

alvaroaleman Apr 12, 2021

lobziik commented Mar 18, 2021

everpeace commented Apr 21, 2021

✨ Envtest exports rest.Config for the secure endpoint of kube-apiserver #984

✨ Envtest exports rest.Config for the secure endpoint of kube-apiserver #984

Conversation

everpeace commented Jun 6, 2020 • edited

k8s-ci-robot commented Jun 6, 2020

k8s-ci-robot commented Jun 6, 2020

everpeace commented Jun 24, 2020

vincepri commented Jul 22, 2020

james-w commented Jul 29, 2020

vincepri commented Jul 29, 2020

k8s-ci-robot commented Jul 29, 2020

DirectXMan12 commented Aug 17, 2020

james-w commented Aug 18, 2020

everpeace commented Aug 21, 2020

fejta-bot commented Nov 19, 2020

everpeace commented Nov 19, 2020

fejta-bot commented Feb 17, 2021

everpeace commented Feb 17, 2021

alvaroaleman left a comment

Choose a reason for hiding this comment

alvaroaleman Mar 14, 2021

Choose a reason for hiding this comment

everpeace Mar 15, 2021

Choose a reason for hiding this comment

JoelSpeed Apr 12, 2021

Choose a reason for hiding this comment

alvaroaleman Apr 12, 2021

Choose a reason for hiding this comment

lobziik commented Mar 18, 2021

everpeace commented Apr 21, 2021

everpeace commented Jun 6, 2020 •

edited