*: Support reviewing audiences of token #56

brancz · 2019-12-03T13:30:15Z

This adds the ability to verify the audience of a token, so clients can use audience scoped tokens, as opposed to essentially allowing the kube-rbac-proxy to impersonate the requesting client using its serviceaccount token.

Closes #18

@s-urbaniak @paulfantom @lilic @metalmatze

s-urbaniak · 2019-12-03T14:39:50Z

do you mind to put the vendoring into a separate commit?

brancz · 2019-12-04T08:49:24Z

Done.

s-urbaniak · 2019-12-09T15:59:30Z

examples/non-resource-url-token-request/non-resource-url/README.md

@@ -0,0 +1,170 @@
+# non-resource-url example


hmm, how does this differ from examples/non-resource-url-token-request/README.md? Or is this duplication just accidentally?

whops I haven't finished this yet it seems

s-urbaniak · 2019-12-09T16:00:51Z

examples/non-resource-url/non-resource-url/README.md

@@ -0,0 +1,170 @@
+# non-resource-url example


same question as above: how do these example differ?

s-urbaniak · 2019-12-09T16:04:24Z

@brancz looking good so far, just a couple of questions:

the change commit contains vendoring code, do you mind to keep it separate?
I think there are duplicate readmes, or not?
How does audiences relate to non-resource URL protection?

brancz · 2020-01-25T09:38:33Z

the change commit contains vendoring code, do you mind to keep it separate?

Done, sorry about that.

I think there are duplicate readmes, or not?

Fixed this.

How does audiences relate to non-resource URL protection?

It doesn't really, I just wanted to provide some example showing the functionality. I added a note at the top of the example readme to make sure that's clearer:

Token audience reviews can be combined with any of the other features of kube-rbac-proxy, such as reviewing permission for specific resources, this example merely chooses to show the functionality using a non-resource-url permission.

This should be ready for another round of reviews now :)

metalmatze · 2020-01-30T09:55:41Z

Are you still waiting for reviews or something else?

brancz · 2020-01-30T10:07:10Z

Waiting for reviews :)

s-urbaniak · 2020-01-30T15:23:05Z

README.md

@@ -28,18 +28,22 @@ All command line flags:
 ```txt
 $ kube-rbac-proxy -h
 Usage of _output/linux/amd64/kube-rbac-proxy:
+      --add_dir_header                              If true, adds the file directory to the header


I am wondering if this is used at all?

It’s from klog

s-urbaniak · 2020-01-30T15:24:59Z

README.md

      --stderrthreshold severity                    logs at or above this threshold go to stderr (default 2)
      --tls-cert-file string                        File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert)
      --tls-cipher-suites strings                   Comma-separated list of cipher suites for the server. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). If omitted, the default Go cipher suites will be used
      --tls-min-version string                      Minimum TLS version supported. Value must match version names from https://golang.org/pkg/crypto/tls/#pkg-constants. (default "VersionTLS12")
      --tls-private-key-file string                 File containing the default x509 private key matching --tls-cert-file.
+      --tls-reload-interval duration                The interval at which to watch for TLS certificate changes, by default set to 1 minute. (default 1m0s)


good catch 👍

This actually came in as I regenerated the help text

s-urbaniak · 2020-01-30T15:25:34Z

examples/non-resource-url-token-request/README.md

+
+> Token audience reviews can be combined with any of the other features of kube-rbac-proxy, such as reviewing permission for specific resources, this example merely chooses to show the functionality using a non-resource-url permission.
+
+This examples is in essence similar to the [non-resource-url](../non-resource-url/) example, with the key difference, that this example requires the ServiceAccount token sent by a client must be scoped to the `kube-rbac-proxy.default.svc` audience. In this example the scoped ServiceAccount token is obtained via a projected volume and mounted into the client container from where it can be consumed. The reasoning here is that scroped tokens cannot be used to impersonate an entity by re-using the token to perform a request against the Kubernetes API itself.


s/scroped/scoped

brancz · 2020-02-07T19:07:16Z

I split the PR into multiple commits, which should make it very easy to review now, as the actual code changes (in the second commit) are minimal and are mainly upgrading to using the v1 APIs. The rest are tests and docs (95% of this PR).

s-urbaniak · 2020-02-17T07:31:54Z

pkg/authn/delegating.go

+	if len(authn.X509.ClientCAFile) > 0 {
+		p, err = dynamiccertificates.NewStaticCAContentFromFile(authn.X509.ClientCAFile)
+		if err != nil {
+			return nil, err


just a nit: let's wrap this err, so context is visible in log lines.

s-urbaniak · 2020-02-17T08:41:41Z

this lgtm 🎉 I really just have one nit regarding error wrapping, else this looks great. A small code footprint, but great security improvement 👍

…hift-4.12-kube-rbac-proxy OCPBUGS-11645: Updating kube-rbac-proxy images to be consistent with ART

brancz force-pushed the token-audience-review branch from 3a12f24 to 7e5f3bc Compare December 3, 2019 13:42

brancz force-pushed the token-audience-review branch from 7e5f3bc to 583e1f4 Compare December 3, 2019 15:56

s-urbaniak reviewed Dec 9, 2019

View reviewed changes

brancz force-pushed the token-audience-review branch from 583e1f4 to ede3776 Compare January 25, 2020 09:33

vendor: Update vendor

d88a01b

brancz force-pushed the token-audience-review branch 2 times, most recently from 41a4d7e to 938f07a Compare January 25, 2020 09:37

s-urbaniak reviewed Jan 30, 2020

View reviewed changes

brancz force-pushed the token-audience-review branch from 938f07a to 47799f6 Compare January 30, 2020 19:32

brancz added 3 commits February 7, 2020 19:59

*: Support reviewing audiences of token

4e7fde9

test/e2e: Add e2e tests for audience reviews

8d0cbe1

*: Add docs and examples on token audience reviews

96d3359

brancz force-pushed the token-audience-review branch from 47799f6 to 96d3359 Compare February 7, 2020 19:06

s-urbaniak reviewed Feb 17, 2020

View reviewed changes

s-urbaniak merged commit 9538692 into master Feb 17, 2020

s-urbaniak deleted the token-audience-review branch February 17, 2020 09:18

ibihim pushed a commit to ibihim/kube-rbac-proxy that referenced this pull request Oct 20, 2023

Merge pull request brancz#56 from openshift-bot/art-consistency-opens…

94f3fde

…hift-4.12-kube-rbac-proxy OCPBUGS-11645: Updating kube-rbac-proxy images to be consistent with ART

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

*: Support reviewing audiences of token #56

*: Support reviewing audiences of token #56

brancz commented Dec 3, 2019

s-urbaniak commented Dec 3, 2019

brancz commented Dec 4, 2019

s-urbaniak Dec 9, 2019

brancz Dec 9, 2019

s-urbaniak Dec 9, 2019

s-urbaniak commented Dec 9, 2019

brancz commented Jan 25, 2020 •

edited

Loading

metalmatze commented Jan 30, 2020

brancz commented Jan 30, 2020

s-urbaniak Jan 30, 2020

brancz Jan 30, 2020

s-urbaniak Jan 30, 2020

brancz Jan 30, 2020

s-urbaniak Jan 30, 2020

brancz Jan 30, 2020

brancz commented Feb 7, 2020

s-urbaniak Feb 17, 2020

s-urbaniak commented Feb 17, 2020


		> Token audience reviews can be combined with any of the other features of kube-rbac-proxy, such as reviewing permission for specific resources, this example merely chooses to show the functionality using a non-resource-url permission.

		This examples is in essence similar to the [non-resource-url](../non-resource-url/) example, with the key difference, that this example requires the ServiceAccount token sent by a client must be scoped to the `kube-rbac-proxy.default.svc` audience. In this example the scoped ServiceAccount token is obtained via a projected volume and mounted into the client container from where it can be consumed. The reasoning here is that scroped tokens cannot be used to impersonate an entity by re-using the token to perform a request against the Kubernetes API itself.

*: Support reviewing audiences of token #56

*: Support reviewing audiences of token #56

Conversation

brancz commented Dec 3, 2019

s-urbaniak commented Dec 3, 2019

brancz commented Dec 4, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

s-urbaniak commented Dec 9, 2019

brancz commented Jan 25, 2020 • edited Loading

metalmatze commented Jan 30, 2020

brancz commented Jan 30, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brancz commented Feb 7, 2020

Choose a reason for hiding this comment

s-urbaniak commented Feb 17, 2020

brancz commented Jan 25, 2020 •

edited

Loading