Files

Monis Khan 9b23f22472 Make oidc authenticator audience agnostic

This change removes the audience logic from the oidc authenticator
and collapses it onto the same logic used by other audience unaware
authenticators.

oidc is audience unaware in the sense that it does not know or
understand the API server's audience.  As before, the authenticator
will continue to check that the token audience matches the
configured client ID.

The reasoning for this simplification is:

1. The previous code tries to make the client ID on the oidc token
a valid audience.  But by not returning any audience, the token is
not valid when used via token review on a server that is configured
to honor audiences (the token works against the Kube API because the
audience check is skipped).

2. It is unclear what functionality would be gained by allowing
token review to check the client ID as a valid audience.  It could
serve as a proxy to know that the token was honored by the oidc
authenticator, but that does not seem like a valid use case.

3. It has never been possible to use the client ID as an audience
with token review as it would have always failed the audience
intersection check.  Thus this change is backwards compatible.

It is strange that the oidc authenticator would be considered
audience unaware when oidc tokens have an audience claim, but from
the perspective of the Kube API (and for backwards compatibility),
these tokens are only valid for the API server's audience.

This change seems to be the least magical and most consistent way to
honor backwards compatibility and to allow oidc tokens to be used
via token review when audience support in enabled.

Signed-off-by: Monis Khan <mok@vmware.com>

2020-02-04 13:24:49 -08:00

publishing

publishing: Update to go@1.13.4 for kubernetes-1.16

2019-12-29 23:34:32 +02:00

src

Make oidc authenticator audience agnostic

2020-02-04 13:24:49 -08:00

BUILD

…

OWNERS

…

README.md

correct invalid urls

2019-12-06 23:34:34 +08:00

repos_generated.bzl

…

README.md

External Repository Staging Area

This directory is the staging area for packages that have been split to their own repository. The content here will be periodically published to respective top-level k8s.io repositories.

Repositories currently staged here:

The code in the staging/ directory is authoritative, i.e. the only copy of the code. You can directly modify such code.

Using staged repositories from Kubernetes code

Kubernetes code uses the repositories in this directory via symlinks in the vendor/k8s.io directory into this staging area. For example, when Kubernetes code imports a package from the k8s.io/client-go repository, that import is resolved to staging/src/k8s.io/client-go relative to the project root:

// pkg/example/some_code.go
package example

import (
  "k8s.io/client-go/dynamic" // resolves to staging/src/k8s.io/client-go/dynamic
)

Once the change-over to external repositories is complete, these repositories will actually be vendored from k8s.io/<package-name>.

Creating a new repository in staging

Adding the staging repository in `kubernetes/kubernetes`:

Send an email to the SIG Architecture mailing list and the mailing list of the SIG which would own the repo requesting approval for creating the staging repository.
Once approval has been granted, create the new staging repository.
Add a symlink to the staging repo in vendor/k8s.io.
Update import-restrictions.yaml to add the list of other staging repos that this new repo can import.
Add all mandatory template files to the staging repo as mentioned in https://github.com/kubernetes/kubernetes-template-project.
Make sure that the .github/PULL_REQUEST_TEMPLATE.md and CONTRIBUTING.md files mention that PRs are not directly accepted to the repo.

Creating the published repository

Create an issue in the kubernetes/org repo to request creation of the respective published repository in the Kubernetes org. The published repository must have an initial empty commit. It also needs specific access rules and branch settings. See #kubernetes/org#58 for an example.
Setup branch protection and enable access to the stage-bots team by adding the repo in prow/config.yaml. See #kubernetes/test-infra#9292 for an example.
Once the repository has been created in the Kubernetes org, update the publishing-bot to publish the staging repository by updating:
- rules.yaml: Make sure that the list of dependencies reflects the staging repos in the Godeps.json file.
- fetch-all-latest-and-push.sh: Add the staging repo in the list of repos to be published.
Add the staging and published repositories as a subproject for the SIG that owns the repos in sigs.yaml.
Add the repo to the list of staging repos in this README.md file.

README.md

External Repository Staging Area

Using staged repositories from Kubernetes code

Creating a new repository in staging

Adding the staging repository in kubernetes/kubernetes:

Creating the published repository

Adding the staging repository in `kubernetes/kubernetes`: