Grid proxy #242
Merged
Grid proxy #242
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alintulu
force-pushed
the
grid-proxy
branch
2 times, most recently
from
4728dd4 to
06ce6ac
Compare
| } | ||
| ] | ||
|
|
||
| proxy_pass = os.environ.get('VOMSPROXY_PASS') |
There was a problem hiding this comment.
Even if we are inside the function that creates the voms_proxy side card, we could use the voms_ prefix wherever we call the variable proxy_xxx, for more clarity, what do you think? i.e. voms_proxy_pass.
There was a problem hiding this comment.
Absolutely agree, that's a relic from when the field was just called proxy!
kubernetes: add sidecar for proxy proxy: change field from proxy to voms_proxy proxy: change env variable of proxy password kubernetes: change field name from proxy to voms-proxy
* Used to securely read the password and the virtual organisation (VO).
diegodelemos
force-pushed
the
grid-proxy
branch
3 times, most recently
from
5de0b1a to
cf3b991
Compare
diegodelemos
force-pushed
the
grid-proxy
branch
from
cf3b991 to
f2d0796
Compare
diegodelemos
approved these changes
Mar 31, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Sidecar container that creates a proxy certificate when user specifies
proxy: truein reana.yaml. The pem files needed to create the certificate is added to reana secrets as files, the password is added as an environment variablereana-client secrets-add --env VOMSPROXY_PASS=
--file userkey.pem
--file usercert.pem
The security context was before set on pod level to self.kubernetes_uid (default 1000). To read the pem files inside of reana secrets we need root privileges. Set the security context on container level instead at
reana_job_controller/kubernetes_job_manager.py. Set the job container to self.kubernetes_uid and leave the sidecar as root.closes reanahub/reana#256