Commit Graph

19 Commits

Author SHA1 Message Date
Monis Khan
bc7aa13bf7
Mark StructuredAuthenticationConfiguration feature gate as beta
Signed-off-by: Monis Khan <mok@microsoft.com>
2024-03-05 11:34:30 -05:00
Kubernetes Prow Robot
8845c4c657
Merge pull request #123135 from munnerz/4193-beta-promotion
KEP-4193: promote ServiceAccountTokenJTI, ServiceAccountTokenPodNodeInfo and ServiceAccountTokenNodeBindingValidation to beta
2024-03-01 19:48:18 -08:00
Kubernetes Prow Robot
f139450e9b
Merge pull request #122885 from claudiubelu/unittests-10
unittests: Fixes unit tests for Windows (part 10)
2024-02-28 05:38:40 -08:00
Monis Khan
b5e0068325
Support all key algs with structured authn config
Signed-off-by: Monis Khan <mok@microsoft.com>
2024-02-14 09:40:25 -05:00
James Munnelly
e087acc791 refuse to allow apiserver to startup if ServiceAccountTokenNodeBinding is enabled without ServiceAccountTokenNodeBindingValidation 2024-02-06 14:03:50 +00:00
Claudiu Belu
b8df7e7684 unittests: Fixes unit tests for Windows (part 10)
Currently, there are some unit tests that are failing on
Windows due to various reasons:

- Different "File not found" error messages on Windows.
- Files need to be closed on Windows before removing them.
- The default RootHnsEndpointName (root-hnsendpoint-name) flag value is 'cbr0'
- On Windows, Unix Domain sockets are not checked in the same way in golang, which is why
  hostutils_windows.go checks for it differently. GetFileType will return an error in this
  case. We need to check for it, and see if it's actually a Unix Domain Socket.
2024-01-22 13:43:42 +00:00
Anish Ramasekar
9e1ff1e512
add loading config and wire feature flag
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2023-08-30 23:14:56 +00:00
Anish Ramasekar
1bad3cbbf5
wiring existing oidc flags with internal API struct
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2023-08-25 17:15:33 +00:00
Thomas Milox
3ad2ab18fa
pkg/kubeapiserver/options: Improving test coverage (#114234)
* pkg/kubeapiserver/options: Improving test coverage

Signed-off-by: TommyStarK <thomasmilox@gmail.com>

* pkg/kubeapiserver/options: Improving test coverage

Add a snippet of the expected error string related to the aspect being tested

Signed-off-by: TommyStarK <thomasmilox@gmail.com>

Signed-off-by: TommyStarK <thomasmilox@gmail.com>
2022-12-14 17:51:35 -08:00
Shihang Zhang
925900317e allow multiple of --service-account-issuer 2021-04-19 09:54:11 -07:00
JunYang
4e72e41387 test: fix the error of TestAuthenticationValidate
Signed-off-by: JunYang <yang.jun22@zte.com.cn>
2021-03-12 23:10:21 +08:00
Monis Khan
df292749c9
Remove support for basic authentication
This change removes support for basic authn in v1.19 via the
--basic-auth-file flag.  This functionality was deprecated in v1.16
in response to ATR-K8S-002: Non-constant time password comparison.

Similar functionality is available via the --token-auth-file flag
for development purposes.

Signed-off-by: Monis Khan <mok@vmware.com>
2020-03-11 20:55:47 -04:00
David Eads
6beb96261e wire up a means to dynamically reload ca bundles for kube-apiserver 2019-10-23 11:01:56 -04:00
David Eads
5825634669 add the ability for dynamic header names in delegated authentication 2019-10-11 11:50:37 -04:00
David Eads
51195dd860 add ability to authenticators for dynamic update of certs 2019-10-01 09:50:20 -04:00
walter
2af982abb9 Fixes lint errors in kubeapiserver packages
Fixes lint errors in kubeapiserver/admission, kubeapiserver/authorizer,
kubeapiserver/authenticator. Also enables lint testing of these
directories.
Fixed go format.
Fixed changes from config.
2018-11-04 17:22:41 -08:00
Mike Danese
a13b48de94 default api audiences to service account token issuer if available
This is a sane default that users can choose to migrate away from later.
2018-10-29 16:40:06 -07:00
hangaoshuai
cacf18f859 add unit test for func ToAuthenticationConfig 2018-08-16 19:24:11 +08:00
hangaoshuai
4157f5a1ae add unit test for Authentication Validate 2018-08-16 18:13:58 +08:00