mirror of https://github.com/k3s-io/k3s
42adb9ef25
Automatic merge from submit-queue (batch tested with PRs 49488, 50407, 46105, 50456, 50258) Enable caching successful token authentication Resolves #50472 To support revocation of service account tokens, an etcd lookup of the token and service account is done by the token authenticator. Controllers that make dozens or hundreds of API calls per second (like the endpoints controller) cause this lookup to be done very frequently on the same objects. This PR: * Implements a cached token authenticator that conforms to the authenticator.Token interface * Implements a union token authenticator (same approach as the union request authenticator, conforming to the authenticator.Token interface) * Cleans up the auth chain construction to group all token authenticators (means we only do bearer and websocket header parsing once) * Adds a 10-second TTL cache to successful token authentication ```release-note API server authentication now caches successful bearer token authentication results for a few seconds. ``` |
||
|---|---|---|
| .. | ||
| admission | ||
| authenticator | ||
| authorizer | ||
| options | ||
| server | ||
| BUILD | ||
| OWNERS | ||
| default_storage_factory_builder.go | ||
| default_storage_factory_builder_test.go | ||
| doc.go | ||