Added basic interface for authorizer implementations.
Added default "authorize everything" and "authorize nothing
implementations.
Added authorization check immediately after authentication check.
Added an integration test of authorization at the HTTP level of
abstraction.
Callsites no longer allocate a mux.
Master now exposes method to install handlers
which use the master's auth code. Not used
but forks (openshift) are expected to use these
methods. These methods will later be a point
for additional plug-in functionality.
Integration tests now use the master-provided
handler which has auth, rather than using the mux,
which didn't. Fix TestWhoAmI now that /_whoami
sits behind auth.
Moved code from cmd/apiserver to pkg/master.
test/integration/client_test made to use a master object,
instead of an apiserver.Handle.
Subsequent PRs will move more handler-installation into
pkg/master, with the goal that every http.Handler of a
standalone apiserver process can also be tested
in a "testing"-style go test.
In particular, a subsequent PR will test
authorization.
Prepares for the meta object to front multiple underlying types
when TypeMeta and ObjectMeta is split in internal and v1beta3, but
combined in v1beta1 and v1beta2
Allows us to define different watch versioning regimes in the future
as well as to encode information with the resource version.
This changes /watch/resources?resourceVersion=3 to start the watch at
4 instead of 3, which means clients can read a resource version and
then send it back to the server. Clients should no longer do math on
resource versions.
* Default file based implementation
* Define some simple interfaces
* Add -token_auth_file to apiserver that will start the apiserver
with a request filter for tokens
Public access to the DockerHub is not guaranteed in all environments,
add a flag to the kubelet that allows it to use a different image (like
one on a private registry) as well as only pull the first time the
image is needed.
Fixes#1545
* Allows consumers to provide their own transports for common cases.
* Supports KUBE_API_VERSION on test cases for controlling which
api version they test against
* Provides a common flag registration method for CLIs that need
to connect to an API server (to avoid duplicating flags)
* Ensures errors are properly returned by the server
* Add a Context field to client.Config
* Defaults to v1beta1
* apiserver takes -storage_version which controls etcd storage version
and the version of the client used to connect to other apiservers
* Changed signature of client.New to add version parameter
* All controller code and component code prefers the oldest (most common)
server version
* Make Codec separate from Scheme
* Move EncodeOrDie off Scheme to take a Codec
* Make Copy work without a Codec
* Create a "latest" package that imports all versions and
sets global defaults for "most recent encoding"
* v1beta1 is the current "latest", v1beta2 exists
* Kill DefaultCodec, replace it with "latest.Codec"
* This updates the client and etcd to store the latest known version
* EmbeddedObject is per schema and per package now
* Move runtime.DefaultScheme to api.Scheme
* Split out WatchEvent since it's not an API object today, treat it
like a special object in api
* Kill DefaultResourceVersioner, instead place it on "latest" (as the
package that understands all packages)
* Move objDiff to runtime.ObjectDiff
Currently the apiserver will not start unless a machine list or a
valid cloud provider is specified. This prevents a workflow that
manages machines solely through the minions API.
Fix the issue by changing the apiserver to only log a message that
the apiserver is being started with an empty machine list.
This patch results in a change in behavior. The apiserver will no
longer exit non-zero if a cloud provider or machine list is not
configured.
In particular, add support for -server_version=raw and use matching
format for the output of -version and -server_version.
The "normal" format is essentially defined by (version.Info) String()
method, so future updates to that method will be reflected on both.
Full version information is still available by using the "raw" flag.
Tested:
- Used cluster/kubecfg.sh to query local build and the server.
$ cluster/kubecfg.sh -version
Kubernetes version 0.2+, build 9316edfc0d2b28923fbb6eafa38458350859f926
$ cluster/kubecfg.sh -server_version
Server: Kubernetes version 0.2, build a0abb38157
$ cluster/kubecfg.sh -version=raw
version.Info{Major:"0", Minor:"2+", GitVersion:"v0.2-25-g9316edfc0d2b28", GitCommit:"9316edfc0d2b28923fbb6eafa38458350859f926", GitTreeState:"clean"}
$ cluster/kubecfg.sh -server_version=raw
version.Info{Major:"0", Minor:"2", GitVersion:"v0.2", GitCommit:"a0abb3815755d6a77eed2d07bb0aa7d255e4e769", GitTreeState:"clean"}
Fixes: #1092
Signed-off-by: Filipe Brandenburger <filbranden@google.com>
Cloud providers may need specific configurations to run properly (e.g.
authentication parameters, uri, etc.).
This patch adds the simplest implementation for passing configurations
to cloudproviders: a new apiserver -cloud_config flag to specify the
path to an arbitrary configuration file.
Signed-off-by: Federico Simoncelli <fsimonce@redhat.com>
Use images and some better formatting. Also add scripts to help prevent typos.
This based on an improved version done by Julia Ferraioli. She came up with the cool images.
This avoids some conflict with the built-in `flag` module in Go. The
module was already being renamed to `verflag` on import anyways, so we
might as well just call it that.
Tested:
- hack/build-go.sh and ran the resulting binaries with -version args.
Signed-off-by: Filipe Brandenburger <filbranden@google.com>
Convert host:port and URLs passed to client.New() into the proper
values, and return an error if the value is invalid. Change CLI
to return an error if -master is invalid. Remove Client.rawRequest
which was not in use, and fix the involved tests. Add NewOrDie
Preserves the behavior of the client to not auth when a non-https
URL is passed (although in the future this should be corrected).
Also rename some to other names that make better reading. There are still a
bunch of "make" functions but they do things like assemble a string from parts
or build an array of things. It seemed that "make" there seemed fine. "New"
is for "constructors".