Add exclusions mechanism into jwtproxy config builder & exlude liveness probes from auth #10463

mshaposhnik · 2018-07-18T08:57:07Z

What does this PR do?

Adds code that parse exclusions in the server configuration attributes and puts it into jwtproxy conf.
Adds exec, terminal and wsagent http server /liveness paths into excludes;
Adds some jwtproxy required JWT claims like IAT, NBF, etc

What issues does this PR fix or reference?

#10400

Release Notes

N/A

Docs PR

N/A

mshaposhnik · 2018-07-18T08:57:31Z

ci-test

sleshchenko · 2018-07-18T09:02:35Z

...ipse/che/workspace/infrastructure/kubernetes/server/secure/jwtproxy/JwtProxyProvisioner.java

@@ -77,6 +81,7 @@

  static final String JWT_PROXY_CONFIG_FOLDER = "/config";
  static final String JWT_PROXY_PUBLIC_KEY_FILE = "mykey.pub";
+  static final String UNSECURED_PATHS_ATTRIBUTE = "unsecuredPaths";


It would be better to move this constant to https://github.com/eclipse/che/blob/efaef7e0d1a05c03a6819f240a267a015a542f05/core/che-core-api-model/src/main/java/org/eclipse/che/api/core/model/workspace/config/ServerConfig.java#L37
and document it there.

riuvshin · 2018-07-18T09:16:38Z

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:10463
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

sleshchenko · 2018-07-18T09:24:19Z

agents/exec/installer/src/main/resources/installers/1.0.0/org.eclipse.che.exec.json

@@ -11,15 +11,17 @@
      "protocol": "http",
      "path" : "/process",
      "attributes": {
-        "secure": "true"
+        "secure": "true",
+        "unsecuredPaths" : "/liveness"


Please remove space before :

mshaposhnik · 2018-07-18T09:25:02Z

ci-test

…ilder

sleshchenko

LGTM

mshaposhnik · 2018-07-18T11:04:06Z

infrastructures/kubernetes/src/test/resources/jwtproxy-confg.yaml

          public_key_path: /config/mykey.pub
      claims_verifiers:
      - type: static
        options:
          iss: wsmaster
      nonce_storage:
        type: void
+      excludes:


…nfig builder

riuvshin · 2018-07-18T14:39:10Z

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:10463
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

mshaposhnik · 2018-07-18T14:40:12Z

ci-test

riuvshin · 2018-07-18T17:28:50Z

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:10463
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

mshaposhnik · 2018-07-19T12:51:32Z

ci-test

riuvshin · 2018-07-19T18:40:21Z

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:10463
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

mshaposhnik · 2018-07-20T16:08:17Z

ci-test

riuvshin · 2018-07-20T22:10:35Z

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:10463
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

Ohrimenko1988 · 2018-07-23T12:06:38Z

@mshaposhnik Will this feature be enabled by default? I mean if it enabled we should rework tests or issue #10490 should be resolved previously.

mshaposhnik · 2018-07-23T12:17:12Z

No it will be turned off by def.

Ohrimenko1988 · 2018-07-23T14:54:09Z

It looks like everything except problem which described in issue #10490 is OK. But the opinion of QE team is - the issue #10490 should be resolved before the merge this PR because we do not guarantee protection from regression. And if enable the "jwt-proxy" by default in future it will lead to big regression (20 %) and possibly additional problems which related to the absence of regression checking.

Ohrimenko1988 · 2018-07-23T14:57:29Z

Also a very important point. If this PR merge with master it also should be checked for regression with disabled "jwt-proxy".

mshaposhnik · 2018-07-24T07:01:27Z

It was checked with proxy feature off: https://ci.codenvycorp.com/job/che-pullrequests-test-ocp/492/Selenium_20tests_20report/

mshaposhnik · 2018-07-24T07:53:48Z

ci-test

riuvshin · 2018-07-24T08:27:47Z

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:10463
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

mshaposhnik · 2018-07-24T08:42:35Z

ci-test

riuvshin · 2018-07-24T14:29:02Z

ci-test build report:
Build details
Test report
selenium tests report data
docker image: eclipseche/che-server:10463
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

Ohrimenko1988 · 2018-07-24T15:14:49Z

Tests which started on the assembly with disabled "jwt-proxy" didn't show any regression.
But the problem which described in the issue #10521 is still actual for enabled "jwt-proxy".
Disabling of this functionality looks like hiding the bug.
And it entails risks which I have described in the previous comment.

mshaposhnik · 2018-07-24T15:18:29Z

Ok, merging now.

mshaposhnik added 2 commits July 18, 2018 10:48

Add exclusions mechanism into jwtproxy config builder

32b7fde

fixup! Add exclusions mechanism into jwtproxy config builder

1703429

mshaposhnik requested review from garagatyi, skabashnyuk, sleshchenko and tolusha as code owners July 18, 2018 08:57

benoitf added status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. kind/task Internal things, technical debt, and to-do tasks to be performed. labels Jul 18, 2018

sleshchenko reviewed Jul 18, 2018

View reviewed changes

fixup! fixup! Add exclusions mechanism into jwtproxy config builder

9877ede

fixup! fixup! fixup! Add exclusions mechanism into jwtproxy config bu…

1120d4c

…ilder

sleshchenko approved these changes Jul 18, 2018

View reviewed changes

fixup! fixup! fixup! fixup! Add exclusions mechanism into jwtproxy co…

59b7842

…nfig builder

skabashnyuk approved these changes Jul 18, 2018

View reviewed changes

Add test export

be73f08

mshaposhnik requested a review from a user July 18, 2018 14:39

mshaposhnik requested review from l0rd and riuvshin as code owners July 18, 2018 14:39

vkuznyetsov mentioned this pull request Jul 19, 2018

QE-2018-07-31 (Sprint: 152) #10311

Closed

39 tasks

mshaposhnik requested a review from vparfonov as a code owner July 19, 2018 10:44

Add Bearer token prefix for project service requests in selenium

ad1ba95

mshaposhnik force-pushed the exclusions branch from 9495735 to ad1ba95 Compare July 19, 2018 10:47

mshaposhnik removed the request for review from l0rd July 19, 2018 10:48

mshaposhnik removed request for vparfonov, riuvshin, tolusha, garagatyi and a user July 19, 2018 10:48

Fix header for app saving state request

fd18704

Merge branch 'master' into exclusions

b6c5d9d

mshaposhnik added 2 commits July 24, 2018 10:52

Disable jwtproxy auth before merge

1cdd964

fixup! Disable jwtproxy auth before merge

eb0a8e2

Ohrimenko1988 mentioned this pull request Jul 24, 2018

Jwt-proxy is displayed as machine on IDE UI #10521

Closed

mshaposhnik merged commit 1471003 into master Jul 24, 2018

mshaposhnik deleted the exclusions branch July 24, 2018 15:18

benoitf removed the status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. label Jul 24, 2018

benoitf added this to the 6.9.0 milestone Jul 24, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add exclusions mechanism into jwtproxy config builder & exlude liveness probes from auth #10463

Add exclusions mechanism into jwtproxy config builder & exlude liveness probes from auth #10463

mshaposhnik commented Jul 18, 2018 •

edited

Loading

mshaposhnik commented Jul 18, 2018

sleshchenko Jul 18, 2018

riuvshin commented Jul 18, 2018

sleshchenko Jul 18, 2018

mshaposhnik commented Jul 18, 2018

sleshchenko left a comment

This comment was marked as resolved.

mshaposhnik Jul 18, 2018

riuvshin commented Jul 18, 2018

mshaposhnik commented Jul 18, 2018

riuvshin commented Jul 18, 2018

mshaposhnik commented Jul 19, 2018

riuvshin commented Jul 19, 2018

mshaposhnik commented Jul 20, 2018

riuvshin commented Jul 20, 2018

Ohrimenko1988 commented Jul 23, 2018

mshaposhnik commented Jul 23, 2018

Ohrimenko1988 commented Jul 23, 2018

Ohrimenko1988 commented Jul 23, 2018 •

edited

Loading

mshaposhnik commented Jul 24, 2018 •

edited

Loading

mshaposhnik commented Jul 24, 2018

riuvshin commented Jul 24, 2018

mshaposhnik commented Jul 24, 2018

riuvshin commented Jul 24, 2018

Ohrimenko1988 commented Jul 24, 2018

mshaposhnik commented Jul 24, 2018

Add exclusions mechanism into jwtproxy config builder & exlude liveness probes from auth #10463

Add exclusions mechanism into jwtproxy config builder & exlude liveness probes from auth #10463

Conversation

mshaposhnik commented Jul 18, 2018 • edited Loading

What does this PR do?

What issues does this PR fix or reference?

Release Notes

Docs PR

mshaposhnik commented Jul 18, 2018

sleshchenko Jul 18, 2018

Choose a reason for hiding this comment

riuvshin commented Jul 18, 2018

sleshchenko Jul 18, 2018

Choose a reason for hiding this comment

mshaposhnik commented Jul 18, 2018

sleshchenko left a comment

Choose a reason for hiding this comment

This comment was marked as resolved.

mshaposhnik Jul 18, 2018

Choose a reason for hiding this comment

riuvshin commented Jul 18, 2018

mshaposhnik commented Jul 18, 2018

riuvshin commented Jul 18, 2018

mshaposhnik commented Jul 19, 2018

riuvshin commented Jul 19, 2018

mshaposhnik commented Jul 20, 2018

riuvshin commented Jul 20, 2018

Ohrimenko1988 commented Jul 23, 2018

mshaposhnik commented Jul 23, 2018

Ohrimenko1988 commented Jul 23, 2018

Ohrimenko1988 commented Jul 23, 2018 • edited Loading

mshaposhnik commented Jul 24, 2018 • edited Loading

mshaposhnik commented Jul 24, 2018

riuvshin commented Jul 24, 2018

mshaposhnik commented Jul 24, 2018

riuvshin commented Jul 24, 2018

Ohrimenko1988 commented Jul 24, 2018

mshaposhnik commented Jul 24, 2018

mshaposhnik commented Jul 18, 2018 •

edited

Loading

Ohrimenko1988 commented Jul 23, 2018 •

edited

Loading

mshaposhnik commented Jul 24, 2018 •

edited

Loading