Use upstream delegating authn/z logic #215

stlaz · 2022-12-09T10:12:17Z

This PR brings the upstream logic for delegated authentication and a bit of reworked authz bits to fit the upstream WithAuthorization http handling.

It's built on top of #213 so that one needs to merge first.

We may want to consider doing a minor release before merging this PR because these changes might change the behavior quite a bit (automatic in-cluster client CA retrieval is a good example that I can think of from the top of my head).

Related to #169

README.md

ibihim

Amazing effort! 🎉

cmd/kube-rbac-proxy/app/options/legacyoptions.go

ibihim · 2023-01-19T18:18:20Z

pkg/proxy/proxy.go


-	var allAttrs []authorizer.Attributes
+	if len(proxyAttrs) == 0 {
+		return authorizer.DecisionDeny,


Looks amazing.

ibihim · 2023-01-19T18:19:57Z

README.md

@@ -49,36 +49,56 @@ Secure serving flags:
      --tls-private-key-file string            File containing the default x509 private key matching --tls-cert-file.
      --tls-sni-cert-key namedCertKey          A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. The domain patterns also allow IP addresses, but IPs should only be used if the apiserver has visibility to the IP address requested by a client. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.crt,example.key" or "foo.crt,foo.key:*.foo.com,foo.com". (default [])

+Delegating authentication flags:
+
+      --authentication-kubeconfig string                  kubeconfig file pointing at the 'core' kubernetes server with enough rights to create tokenreviews.authentication.k8s.io.


I think it would make sense to create an issue for a migration doc... the flags changed quite dramatically.

ibihim · 2023-01-19T18:29:12Z

pkg/filters/path.go

 )

-func WithAllowPaths(allowPaths []string, handler http.HandlerFunc) http.HandlerFunc {
+func NewAllowPathAuthorizer(allowPaths []string) authorizer.Authorizer {


I get the "lets return an authorizer.Authorizer logic", so that it fits better into the authz-fuzz... and we can do that, but the implementation is pretty heavy. I am not completely convinced... maybe a huge comment above the functions would help.

Is there an upstream equivalent? I think something like NewPassthroughPathAuthorizer or BlockAllTheOthers... 😆 name would fit better.

There's this, which was a huge inspiration: https://github.com/openshift/kubernetes/blob/7dab57f2302ec0f94b648ccb48b0fa67c2befbb3/staging/src/k8s.io/apiserver/pkg/authorization/path/path.go#L30-L31

ibihim · 2023-01-24T14:56:21Z

cmd/kube-rbac-proxy/app/kube-rbac-proxy.go

@@ -369,3 +312,28 @@ func secureServerRunner(

 	return runner, interrupter
 }
+
+func setupAuthorizer(krbInfo *server.KubeRBACProxyInfo, delegatedAuthz *serverconfig.AuthorizationInfo) (authorizer.Authorizer, error) {


Nit: we could move such code to the authz pkg.

ibihim · 2023-01-25T18:50:07Z

pkg/proxy/proxy.go

+var _ authorizer.Authorizer = &krpAuthorizer{}
+
+const kubeRBACProxyParamsKey = iota
+
 // Config holds proxy authorization and authentication settings
 type Config struct {
 	Authentication *authn.AuthnConfig
 	Authorization  *authz.Config


Feels like in the wrong place, but not part of this PR.

removed as a part of the re-packaging cleanup

pkg/proxy/proxy.go

ibihim · 2023-01-25T19:03:49Z

pkg/proxy/proxy.go

@@ -143,3 +160,43 @@ func templateWithValue(templateString, value string) string {
 	}
 	return out.String()
 }
+
+func WithKubeRBACProxyParamsHandler(handler http.Handler, authzConfig *authz.Config) http.Handler {


Hm, another filter. Strengthens my opinion to move it. WDYT?

this one belongs close to the authorizer

pkg/proxy/proxy.go

test/e2e/basics.go

ibihim · 2023-01-30T14:37:49Z

pkg/authorization/rewrite/rewrite_test.go

@@ -224,6 +233,7 @@ func createRequest(queryParams, headers map[string][]string) *http.Request {
 			}
 		}
 		r.URL.RawQuery = q.Encode()
+		r.URL, _ = url.Parse(r.URL.String())


To avoid mutating the original *url.URL, it would make sense to copy it above the r.URL.RawQuery = q.Encdoe().

This brings behavior changes: - ignore-paths now only allows astersisk to denote prefix matching - when a user fails to authenticate, the returned status is going to be 403 instead of 401 as they will appear as system:anonymous to the proxy

The upstream logic only allows prefix-matching for wildcard patterns but the proxy originally allowed shell-like filepath matching.

This option actually exists in the new options, so these two were shadowing. Also don't add the client-ca as request-header-client-ca, these each serve a different purpose.

stlaz force-pushed the delegating-auth branch 6 times, most recently from 05bb58b to e48a719 Compare December 15, 2022 13:55

stlaz changed the base branch from master to sig-auth-acceptance December 15, 2022 13:56

stlaz force-pushed the delegating-auth branch 2 times, most recently from 39d7104 to 2d62e6b Compare December 16, 2022 09:02

stlaz force-pushed the delegating-auth branch 5 times, most recently from f8d06a1 to fbb8af9 Compare January 5, 2023 12:44

stlaz changed the title ~~WIP: Use upstream delegating authn/z logic~~ Use upstream delegating authn/z logic Jan 5, 2023

stlaz force-pushed the delegating-auth branch from fbb8af9 to 101fdc3 Compare January 20, 2023 15:35

stlaz commented Jan 23, 2023

View reviewed changes

README.md Outdated Show resolved Hide resolved

ibihim reviewed Jan 25, 2023

View reviewed changes

stlaz force-pushed the delegating-auth branch 8 times, most recently from 04d7a34 to c9f4b71 Compare January 30, 2023 11:28

ibihim reviewed Jan 30, 2023

View reviewed changes

test/e2e/basics.go Outdated Show resolved Hide resolved

stlaz force-pushed the delegating-auth branch from c9f4b71 to 6605c76 Compare January 30, 2023 12:41

ibihim reviewed Jan 30, 2023

View reviewed changes

use upstream authn/z handling

ff0c84f

This brings behavior changes: - ignore-paths now only allows astersisk to denote prefix matching - when a user fails to authenticate, the returned status is going to be 403 instead of 401 as they will appear as system:anonymous to the proxy

stlaz added 7 commits January 30, 2023 15:58

remove --insecure-listen-address

758f80a

rework path authorization to allow the original wildcard patterns

6d83418

The upstream logic only allows prefix-matching for wildcard patterns but the proxy originally allowed shell-like filepath matching.

refactor the path authorizers

40c3768

reorganize packages and configs

464c3b6

remove unused SAR authorizer

547daa9

remove client-ca-file from legacy options

97fc22f

This option actually exists in the new options, so these two were shadowing. Also don't add the client-ca as request-header-client-ca, these each serve a different purpose.

regenerate README.md

4a034c4

stlaz force-pushed the delegating-auth branch from 6605c76 to 4a034c4 Compare January 30, 2023 15:00

ibihim merged commit e6f5d1a into brancz:sig-auth-acceptance Jan 30, 2023

stlaz mentioned this pull request Jan 31, 2023

WIP: Use SecureServingOptions and DelegatingAuthenticationOptions from new… #195

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use upstream delegating authn/z logic #215

Use upstream delegating authn/z logic #215

stlaz commented Dec 9, 2022 •

edited

Loading

ibihim left a comment

ibihim Jan 19, 2023

ibihim Jan 19, 2023 •

edited

Loading

stlaz Jan 26, 2023

ibihim Jan 19, 2023

stlaz Jan 26, 2023

ibihim Jan 24, 2023

ibihim Jan 25, 2023

stlaz Jan 26, 2023

ibihim Jan 25, 2023

stlaz Jan 26, 2023

ibihim Jan 30, 2023

Use upstream delegating authn/z logic #215

Use upstream delegating authn/z logic #215

Conversation

stlaz commented Dec 9, 2022 • edited Loading

ibihim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ibihim Jan 19, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stlaz commented Dec 9, 2022 •

edited

Loading

ibihim Jan 19, 2023 •

edited

Loading