Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Self-test kube impersonation permissions at startup #3812

Merged
merged 4 commits into from
Jun 11, 2020

Conversation

awly
Copy link
Contributor

@awly awly commented Jun 8, 2020

To help operators diagnose mis-configured kubeconfig or k8s RBAC roles,
make proxy verify that impersonation is allowed. If not, fail at
startup.

Note: this requires the proxy to have permissions to create
SelfSubjectAccessReviews.

Fixes #3649

lib/kube/proxy/auth.go Outdated Show resolved Hide resolved
Andrew Lytvynov added 4 commits June 10, 2020 15:06
To help operators diagnose mis-configured kubeconfig or k8s RBAC roles,
make proxy verify that impersonation is allowed. If not, fail at
startup.

Note: this requires the proxy to have permissions to create
SelfSubjectAccessReviews.

Fixes #3649
The new permission is there to allow the proxy to self-test
impersonation powers at startup and surface RBAC problems early.
@awly awly force-pushed the andrew/k8s-perms-selftest branch from 37fda7e to 18d3893 Compare June 10, 2020 22:09
@awly awly merged commit 77903c4 into master Jun 11, 2020
@awly awly deleted the andrew/k8s-perms-selftest branch June 11, 2020 00:14
awly pushed a commit that referenced this pull request Oct 14, 2020
Prior to #3811, if users
wanted to run a root proxy without k8s clusters but leaf proxies with
k8s, they had to put a dummy `kubeconfig_file` on the root proxy.

The permissions self-test added in
#3812 didn't take that
into account.

So, users who keep the old workaround and upgrade to 4.4 will see their
proxies fail to start. To recover, they have to realize that
`kubeconfig_file` can be removed.
awly pushed a commit that referenced this pull request Oct 14, 2020
Prior to #3811, if users
wanted to run a root proxy without k8s clusters but leaf proxies with
k8s, they had to put a dummy `kubeconfig_file` on the root proxy.

The permissions self-test added in
#3812 didn't take that
into account.

So, users who keep the old workaround and upgrade to 4.4 will see their
proxies fail to start. To recover, they have to realize that
`kubeconfig_file` can be removed.
awly pushed a commit that referenced this pull request Oct 14, 2020
Prior to #3811, if users
wanted to run a root proxy without k8s clusters but leaf proxies with
k8s, they had to put a dummy `kubeconfig_file` on the root proxy.

The permissions self-test added in
#3812 didn't take that
into account.

So, users who keep the old workaround and upgrade to 4.4 will see their
proxies fail to start. To recover, they have to realize that
`kubeconfig_file` can be removed.
awly pushed a commit that referenced this pull request Oct 14, 2020
Prior to #3811, if users
wanted to run a root proxy without k8s clusters but leaf proxies with
k8s, they had to put a dummy `kubeconfig_file` on the root proxy.

The permissions self-test added in
#3812 didn't take that
into account.

So, users who keep the old workaround and upgrade to 4.4 will see their
proxies fail to start. To recover, they have to realize that
`kubeconfig_file` can be removed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Proxy should self-test k8s impersonation permissions at startup
2 participants