github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

switch informer in token authn

pull/58/head
zuoxiu.jm 2018-10-24 14:37:52 +08:00
parent 0d17976413
commit e3b61ea9cf
3 changed files with 31 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
plugin/pkg/auth/authenticator/token/bootstrap/BUILD
View File

@ -11,7 +11,7 @@ go_test(
srcs = ["bootstrap_test.go"],
embed = [":go_default_library"],
deps = [
"//pkg/apis/core:go_default_library",
"//staging/src/k8s.io/api/core/v1:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/labels:go_default_library",
@ -26,12 +26,12 @@ go_library(
srcs = ["bootstrap.go"],
importpath = "k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/bootstrap",
deps = [
"//pkg/apis/core:go_default_library",
"//pkg/client/listers/core/internalversion:go_default_library",
"//staging/src/k8s.io/api/core/v1:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/authentication/user:go_default_library",
"//staging/src/k8s.io/client-go/listers/core/v1:go_default_library",
"//staging/src/k8s.io/cluster-bootstrap/token/api:go_default_library",
"//staging/src/k8s.io/cluster-bootstrap/token/util:go_default_library",
"//vendor/github.com/golang/glog:go_default_library",

16
plugin/pkg/auth/authenticator/token/bootstrap/bootstrap.go
View File

@ -29,14 +29,14 @@ import (
"github.com/golang/glog"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/user"
corev1listers "k8s.io/client-go/listers/core/v1"
bootstrapapi "k8s.io/cluster-bootstrap/token/api"
bootstraputil "k8s.io/cluster-bootstrap/token/util"
api "k8s.io/kubernetes/pkg/apis/core"
"k8s.io/kubernetes/pkg/client/listers/core/internalversion"
)
// TODO: A few methods in this package is copied from other sources. Either
@ -46,13 +46,13 @@ import (
// NewTokenAuthenticator initializes a bootstrap token authenticator.
//
// Lister is expected to be for the "kube-system" namespace.
func NewTokenAuthenticator(lister internalversion.SecretNamespaceLister) *TokenAuthenticator {
func NewTokenAuthenticator(lister corev1listers.SecretNamespaceLister) *TokenAuthenticator {
return &TokenAuthenticator{lister}
}
// TokenAuthenticator authenticates bootstrap tokens from secrets in the API server.
type TokenAuthenticator struct {
lister internalversion.SecretNamespaceLister
lister corev1listers.SecretNamespaceLister
}
// tokenErrorf prints a error message for a secret that has matched a bearer
@ -60,7 +60,7 @@ type TokenAuthenticator struct {
//
// tokenErrorf(secret, "has invalid value for key %s", key)
//
func tokenErrorf(s *api.Secret, format string, i ...interface{}) {
func tokenErrorf(s *corev1.Secret, format string, i ...interface{}) {
format = fmt.Sprintf("Bootstrap secret %s/%s matching bearer token ", s.Namespace, s.Name) + format
glog.V(3).Infof(format, i...)
}
@ -155,7 +155,7 @@ func (t *TokenAuthenticator) AuthenticateToken(ctx context.Context, token string
}
// Copied from k8s.io/cluster-bootstrap/token/api
func getSecretString(secret *api.Secret, key string) string {
func getSecretString(secret *corev1.Secret, key string) string {
data, ok := secret.Data[key]
if !ok {
return ""
@ -165,7 +165,7 @@ func getSecretString(secret *api.Secret, key string) string {
}
// Copied from k8s.io/cluster-bootstrap/token/api
func isSecretExpired(secret *api.Secret) bool {
func isSecretExpired(secret *corev1.Secret) bool {
expiration := getSecretString(secret, bootstrapapi.BootstrapTokenExpirationKey)
if len(expiration) > 0 {
expTime, err2 := time.Parse(time.RFC3339, expiration)
@ -205,7 +205,7 @@ func parseToken(s string) (string, string, error) {
// getGroups loads and validates the bootstrapapi.BootstrapTokenExtraGroupsKey
// key from the bootstrap token secret, returning a list of group names or an
// error if any of the group names are invalid.
func getGroups(secret *api.Secret) ([]string, error) {
func getGroups(secret *corev1.Secret) ([]string, error) {
// always include the default group
groups := sets.NewString(bootstrapapi.BootstrapDefaultGroup)

40
plugin/pkg/auth/authenticator/token/bootstrap/bootstrap_test.go
View File

@ -21,24 +21,24 @@ import (
"reflect"
"testing"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apiserver/pkg/authentication/user"
bootstrapapi "k8s.io/cluster-bootstrap/token/api"
api "k8s.io/kubernetes/pkg/apis/core"
)
type lister struct {
secrets []*api.Secret
secrets []*corev1.Secret
}
func (l *lister) List(selector labels.Selector) (ret []*api.Secret, err error) {
func (l *lister) List(selector labels.Selector) (ret []*corev1.Secret, err error) {
return l.secrets, nil
}
func (l *lister) Get(name string) (*api.Secret, error) {
func (l *lister) Get(name string) (*corev1.Secret, error) {
for _, s := range l.secrets {
if s.Name == name {
return s, nil
@ -58,7 +58,7 @@ func TestTokenAuthenticator(t *testing.T) {
tests := []struct {
name string
secrets []*api.Secret
secrets []*corev1.Secret
token string
wantNotFound bool
@ -66,7 +66,7 @@ func TestTokenAuthenticator(t *testing.T) {
}{
{
name: "valid token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
@ -87,7 +87,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "valid token with extra group",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
@ -109,7 +109,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "invalid group",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
@ -128,7 +128,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "invalid secret name",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: "bad-name",
@ -146,7 +146,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "no usage",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
@ -163,7 +163,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "wrong token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
@ -181,7 +181,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "deleted token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
@ -200,7 +200,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "expired token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
@ -219,7 +219,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "not expired token",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + tokenID,
@ -241,7 +241,7 @@ func TestTokenAuthenticator(t *testing.T) {
},
{
name: "token id wrong length",
secrets: []*api.Secret{
secrets: []*corev1.Secret{
{
ObjectMeta: metav1.ObjectMeta{
Name: bootstrapapi.BootstrapTokenSecretPrefix + "foo",
@ -292,13 +292,13 @@ func TestTokenAuthenticator(t *testing.T) {
func TestGetGroups(t *testing.T) {
tests := []struct {
name string
secret *api.Secret
secret *corev1.Secret
expectResult []string
expectError bool
}{
{
name: "not set",
secret: &api.Secret{
secret: &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Name: "test"},
Data: map[string][]byte{},
},
@ -306,7 +306,7 @@ func TestGetGroups(t *testing.T) {
},
{
name: "set to empty value",
secret: &api.Secret{
secret: &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Name: "test"},
Data: map[string][]byte{
bootstrapapi.BootstrapTokenExtraGroupsKey: []byte(""),
@ -316,7 +316,7 @@ func TestGetGroups(t *testing.T) {
},
{
name: "invalid prefix",
secret: &api.Secret{
secret: &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Name: "test"},
Data: map[string][]byte{
bootstrapapi.BootstrapTokenExtraGroupsKey: []byte("foo"),
@ -326,7 +326,7 @@ func TestGetGroups(t *testing.T) {
},
{
name: "valid",
secret: &api.Secret{
secret: &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Name: "test"},
Data: map[string][]byte{
bootstrapapi.BootstrapTokenExtraGroupsKey: []byte("system:bootstrappers:foo,system:bootstrappers:bar,system:bootstrappers:bar"),