Add option to handle OAuth grants at a per-client granularity #9616
Conversation
|
looks good at a quick glance. I think we'll want to update |
sgallagher
force-pushed
the
grants-wip
branch
3 times, most recently
from
8278a5d to
328fafc
Compare
|
OK, I set the grant strategy to auto for those clients when they are created. The code will currently only write the grant strategy once and keep it that way, even if we were to change the default in the code. As @liggitt explained on IRC, we'd want an upgraded cluster to maintain its old behavior, even if we eventually change the default grant strategy. |
| func NewServiceAccountAwareGrant(standardGrantHandler, saClientGrantHandler GrantHandler) GrantHandler { | ||
| return &serviceAccountAwareGrant{standardGrantHandler: standardGrantHandler, saClientGrantHandler: saClientGrantHandler} | ||
| // NewPerClientGrant returns a grant handler that determines what to do based on the grant strategy in the client | ||
| func NewPerClientGrant(prompt GrantHandler, defaultStrategy oauthapi.GrantHandlerType, defaultServiceAccountStrategy oauthapi.GrantHandlerType) GrantHandler { |
There was a problem hiding this comment.
I think we'd want to plumb defaultServiceAccountStrategy into NewServiceAccountOAuthClientGetter instead, so that the OAuthClient returned by that method was accurate. That would mean by the time this was handed the OAuthClient for a serviceaccount, it would already have a grantStrategy
otherwise, anything using NewServiceAccountOAuthClientGetter is getting incomplete OAuthClient objects and has to do the service account detection/defaulting logic themselves
|
[test] |
sgallagher
force-pushed
the
grants-wip
branch
2 times, most recently
from
2e68b6b to
c97f2ed
Compare
|
@liggitt PTAL |
| @@ -540,7 +541,7 @@ func (c *MasterConfig) GetRestStorage() map[string]rest.Storage { | |||
| clientStorage, err := clientetcd.NewREST(c.RESTOptionsGetter) | |||
| checkStorageErr(err) | |||
| clientRegistry := clientregistry.NewRegistry(clientStorage) | |||
| combinedOAuthClientGetter := saoauth.NewServiceAccountOAuthClientGetter(c.KubeClient(), c.KubeClient(), clientRegistry) | |||
| combinedOAuthClientGetter := saoauth.NewServiceAccountOAuthClientGetter(c.KubeClient(), c.KubeClient(), clientRegistry, oauthapi.GrantHandlerType(c.Options.OAuthConfig.GrantConfig.Method)) | |||
There was a problem hiding this comment.
OAuthConfig can be nil if OAuth is not enabled... I'd probably default to deny in that case here... not sure
There was a problem hiding this comment.
should be ServiceAccountMethod
There was a problem hiding this comment.
Ah, I didn't realize OAuth could be disabled. (How does login work with out it?)
I'll check for that.
And yeah, typo. Thanks for catching it.
| // - auto: always approves grant requests, useful for trusted clients | ||
| // - prompt: prompts the end user for approval of grant requests, useful for third-party clients | ||
| // - deny: always denies grant requests, useful for black-listed clients | ||
| GrantStrategy GrantHandlerType `json:"grantStrategy,omitempty"` |
There was a problem hiding this comment.
this has been controlled by a field named "method" (or "serviceAccountMethod") in the config up until now... let's keep that terminology and use GrantMethod (and grantMethod in the JSON)
There was a problem hiding this comment.
Same thought - similar naming in config and API.
sgallagher
force-pushed
the
grants-wip
branch
2 times, most recently
from
28a7041 to
2663bd5
Compare
|
@liggitt PTAL I renamed the "method" pieces to strategy and fixed that typo with |
sgallagher
changed the title
|
test failure: |
openshift-bot
added
the
needs-rebase
openshift-bot
removed
the
needs-rebase
|
LGTM, squash and merge |
Signed-off-by: Stephen Gallagher <[email protected]>
|
Evaluated for origin test up to 95eb9bc |
|
@liggitt Squashed, please merge. |
|
[merge] |
|
continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/6163/) (Image: devenv-rhel7_4576) |
|
Evaluated for origin merge up to 95eb9bc |
|
continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/6163/) |
@liggitt Pushing my WIP so you can take a look.