OCPBUGS-45371: Fix issue where TokenReview was not working as expected #14681
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
openshift-ci-robot
added
jira/valid-reference
|
@TheRealJon: This pull request references Jira Issue OCPBUGS-45371, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
component/backend
TheRealJon
force-pushed
the
OCPBUGS-45371
branch
from
a2cc06b to
bc0b3e8
Compare
|
@TheRealJon: This pull request references Jira Issue OCPBUGS-45371, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
TheRealJon
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
| } | ||
|
|
||
| // Check if the token is authenticated | ||
| if !responseTokenReview.Status.Authenticated { | ||
| if !tokenReview.Status.Authenticated { | ||
| err := fmt.Errorf("invalid token: %v", token) |
There was a problem hiding this comment.
nit
| err := fmt.Errorf("invalid token: %v", token) | |
| err := fmt.Errorf("invalid token: %s", token) |
| these service account secrets need to be created manually. | ||
| Otherwise copy the CA bundle to | ||
| `examples/ca.crt`: | ||
| Create a long-lived API token Secret for the console ServiceAccount, and extract it to the |
There was a problem hiding this comment.
| Create a long-lived API token Secret for the console ServiceAccount, and extract it to the | |
| Create a long-lived API token Secret for the console ServiceAccount and extract it to the |
|
/lgtm cancel |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: TheRealJon The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
test-beckend.sh is failing on the TestNewOpenShiftAuthenticator apparently we are passing a nil client in some cases |
We expected the console service account bearer token to be present on the internal k8s REST configuration, but it was not. This caused all TokenReview requests to be skipped since no bearer token was available to make the requests. - Update OpenShift authenticator to use a k8s client-go Clientset to make TokenReview requests. This Clientset is configured using the same REST config that the main server uses to proxy console service account delegated requests, meaning whatever console service account bearer token is configured on the main server is the same one used for TokenReview requests. - Update main.go to accept an off-cluster bearer token, which is used to make console service account delegated requests in an off-cluster, auth-enabled environment. - Update the README instructions for auth-enabled dev environments to include setting up a console service account API token and consume it through the new bridge arg. - Update `examples/run-bridge.sh` to consume an off-cluster service acccount token file
TheRealJon
force-pushed
the
OCPBUGS-45371
branch
from
bc0b3e8 to
6d33e97
Compare
|
@jhadvig Tests should be fixed now! |
|
@TheRealJon: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
We expected the console service account bearer token to be present on the internal k8s REST
configuration, but it was not. This caused all TokenReview requests to be skipped since no bearer
token was available to make the requests.
Clientset is configured using the same REST config that the main server uses to proxy console
service account delegated requests, meaning whatever console service account bearer token is
configured on the main server is the same one used for TokenReview requests.
account delegated requests in an off-cluster, auth-enabled environment.
service account API token and consume it through the new bridge arg.
examples/run-bridge.shto consume an off-cluster service acccount token file