Setup heptio authenticator #5197

rdrgmnzs · 2018-05-24T00:51:33Z

This automates most of the process of setting up heptio authenticator using Kops.

https://github.com/heptio/authenticator

rdrgmnzs · 2018-05-24T00:53:46Z

/assign @justinsb @chrislovecnm @rifelpet

@rifelpet adding you since you created the kops docs in the heptio authenticator repo.
kubernetes-sigs/aws-iam-authenticator#45

gambol99

Left just the two comments .. the rest looks fine to me

gambol99 · 2018-05-29T22:13:11Z

nodeup/pkg/model/kube_apiserver.go

@@ -157,6 +157,103 @@ func (b *KubeAPIServerBuilder) writeAuthenticationConfig(c *fi.ModelBuilderConte
 		return nil
 	}

+	if b.Cluster.Spec.Authentication.Heptio != nil {


Perhaps left to another PR, but should consider merging the kopeio and this together given both is essentially just a web hook with a url diff ..

Will create another PR to merge / cleanup.

gambol99 · 2018-05-29T22:15:29Z

nodeup/pkg/model/kube_apiserver.go

+
+			c.AddTask(&nodetasks.File{
+				Path:     "/srv/kubernetes/heptio-authenticator-aws/key.pem",
+				Contents: fi.NewBytesResource(keyData),


Can you add file perms to 0600 please Mode: fi.String("600") .. as the default is world readable

These are the perms that I think are still missing @rdrgmnzs

@justinsb yeah I actually added them on diff f047677 and github says they have been pulled in to this PR but for some reason they are not showing up in the "files changed"

I don't think you added it to this task (key.pem( - I do see it for the other two file tasks though.

gambol99 · 2018-05-29T22:32:58Z

docs/authentication.md

+
+```
+---
+apiVersion: v1


What happen's if the config isn't there? .. does it's just crashloop the pods? ... Just wondering in case it effects rollouts .. i'm pretty sure the validate cluster code looks for pod restarts in kube-system ..

The pod will sit in a creating status. I have not tired doing a rollout while it's in this state, but will do so.

Ar yes! .. it would be stuck in pending .. Still if you can quickly verify / confirm it handles on a pre-built cluster and can rollout, that would be cool

The pod stays in state:
kube-system heptio-authenticator-aws-4fkzp 0/1 ContainerCreating 0 10m

with the error:
Unable to mount volumes for pod "heptio-authenticator-aws-4fkzp_kube-system(93f46fcb-654e-11e8-a014-0e21d0512306)": timeout expired waiting for volumes to attach or mount for pod "kube-system"/"heptio-authenticator-aws-4fkzp". list of unmounted volumes=[config]. list of unattached volumes=[config output state default-token-6rtmz]

However I'm still able to perform a full cluster rolling update while the cluster is in this state so we should be ok.

much appreciated 👍

gambol99 · 2018-05-31T14:29:36Z

hi @rdrgmnzs .. were you able to check a rollout on a existing cluster? ... also, can we add the filemode on the key ... other than those its LGTM

rdrgmnzs · 2018-05-31T14:33:19Z

Hey @gambol99 I won’t be able to test and make changes until Monday unfortunately. I’m out on vacation and don’t have my laptop with me.

rdrgmnzs · 2018-06-01T04:29:26Z

@gambol99 updated the perms and tested. (Jet lagged and borrowed a PC )

justinsb · 2018-06-01T04:58:02Z

Generally LGTM. The file perms that @gambol99 pointed out seems to be the only thing missing.

Because it's additive and opt-in, I'm happy to merge even if it's still in flux..

rdrgmnzs · 2018-06-01T05:23:00Z

I added the file perms on diff f047677 and github says they have been pulled in to this PR but for some reason they are not showing up in the "files changed".

gambol99 · 2018-06-01T13:28:21Z

hi @rdrgmnzs ...sorry, i meant file perms the private here as f047677 only appears to add on the manifest and cert

gambol99 · 2018-06-01T13:29:58Z

/approve
/lgtm

k8s-ci-robot · 2018-06-01T13:30:07Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gambol99, rdrgmnzs

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [gambol99]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rifelpet · 2018-06-01T13:44:57Z

fwiw this LGTM too. Thanks for adding this! We'll be able to simplify the instructions on the Authenticator readme and even the AWS blog post if that's allowed. cc @christopherhein

christopherhein · 2018-06-01T16:41:06Z

Nice work @rdrgmnzs ! thanks for invalidating the blog post 👍Happy to have this merged in.

rifelpet · 2018-06-27T16:03:50Z

@rdrgmnzs FYI It appears they're renaming the authenticator as they bring it into the kubernetes-sigs org. Given that this hasnt been in a stable release yet do you think we should update this to match?

Setup heptio authenticator

5ce8f9e

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels May 24, 2018

k8s-ci-robot assigned chrislovecnm, justinsb and rifelpet May 24, 2018

Add apimachinery

1fa2ae8

gambol99 suggested changes May 29, 2018

View reviewed changes

gambol99 reviewed May 29, 2018

View reviewed changes

fix file perms

f047677

k8s-ci-robot assigned gambol99 Jun 1, 2018

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 1, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 1, 2018

k8s-ci-robot merged commit 775b877 into kubernetes:master Jun 1, 2018

KashifSaadat mentioned this pull request Jun 1, 2018

File Permissions Private Key #5241

Merged

christopherhein mentioned this pull request Jun 1, 2018

Update the README to point to kops documentation kubernetes-sigs/aws-iam-authenticator#87

Closed

niclic mentioned this pull request Jul 8, 2018

Rename Heptio Authenticator to AWS IAM Authenticator. #5420

Closed

rifelpet mentioned this pull request Aug 17, 2018

Update Readme for simplified Kops 1.10 instructions kubernetes-sigs/aws-iam-authenticator#135

Merged

christopherhein mentioned this pull request Aug 21, 2018

REQUEST: New membership for @christopherhein kubernetes/org#24

Closed

6 tasks

rdrgmnzs deleted the heptio_authenticator branch August 9, 2019 21:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Setup heptio authenticator #5197

Setup heptio authenticator #5197

rdrgmnzs commented May 24, 2018

rdrgmnzs commented May 24, 2018 •

edited

Loading

gambol99 left a comment

gambol99 May 29, 2018

rdrgmnzs May 29, 2018

gambol99 May 29, 2018

justinsb Jun 1, 2018

rdrgmnzs Jun 1, 2018

justinsb Jun 1, 2018

gambol99 May 29, 2018 •

edited

Loading

rdrgmnzs May 29, 2018

gambol99 May 30, 2018

rdrgmnzs Jun 1, 2018 •

edited

Loading

gambol99 Jun 1, 2018

gambol99 commented May 31, 2018

rdrgmnzs commented May 31, 2018

rdrgmnzs commented Jun 1, 2018 •

edited

Loading

justinsb commented Jun 1, 2018 •

edited

Loading

rdrgmnzs commented Jun 1, 2018

gambol99 commented Jun 1, 2018

gambol99 commented Jun 1, 2018

k8s-ci-robot commented Jun 1, 2018

rifelpet commented Jun 1, 2018

christopherhein commented Jun 1, 2018

rifelpet commented Jun 27, 2018

Setup heptio authenticator #5197

Setup heptio authenticator #5197

Conversation

rdrgmnzs commented May 24, 2018

rdrgmnzs commented May 24, 2018 • edited Loading

gambol99 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gambol99 May 29, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rdrgmnzs Jun 1, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gambol99 commented May 31, 2018

rdrgmnzs commented May 31, 2018

rdrgmnzs commented Jun 1, 2018 • edited Loading

justinsb commented Jun 1, 2018 • edited Loading

rdrgmnzs commented Jun 1, 2018

gambol99 commented Jun 1, 2018

gambol99 commented Jun 1, 2018

k8s-ci-robot commented Jun 1, 2018

rifelpet commented Jun 1, 2018

christopherhein commented Jun 1, 2018

rifelpet commented Jun 27, 2018

rdrgmnzs commented May 24, 2018 •

edited

Loading

gambol99 May 29, 2018 •

edited

Loading

rdrgmnzs Jun 1, 2018 •

edited

Loading

rdrgmnzs commented Jun 1, 2018 •

edited

Loading

justinsb commented Jun 1, 2018 •

edited

Loading