enhancement: proxy request with bearer token in header without client certificate #437
Conversation
|
@rambohe-ch: GitHub didn't allow me to assign the following users: your_reviewer. Note that only openyurtio members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/assign @Fei-Guo |
rambohe-ch
force-pushed
the
proxy-bearer-token
branch
from
f9b0919
to
10ad97e
Compare
| @@ -80,6 +89,15 @@ func (rp *RemoteProxy) Name() string { | |||
| } | |||
|
|
|||
| func (rp *RemoteProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) { | |||
| rp.reverseProxy.Transport = rp.currentTransport | |||
| auth := strings.TrimSpace(req.Header.Get("Authorization")) | |||
| if auth != "" { | |||
There was a problem hiding this comment.
Can you add a comment here to explain when the auth is nil and when it is not nil?
rambohe-ch
force-pushed
the
proxy-bearer-token
branch
from
10ad97e
to
f1f2e0a
Compare
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Fei-Guo, rambohe-ch The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What type of PR is this?
/kind enhancement
What this PR does / why we need it:
background:
when pods on edge nodes access kube-apiserver through yurthub, yurthub will use client certificate to proxy requests to kube-apiserver. so in order to get authorization by kube-apiserver, we need to add rbac setting of pods to client certificate of yurthub(system:nodes group).
enhancement:
In order to prevent add additional rbac setting to
system:nodesgroup, we use the original bearer token to proxy request to kube-apiserver instead of using client certificate to proxy requests, so kube-apiserver can get authorization for pods based on the bearer token of pods instead of client certificate of yurthub.Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?
other Note