Skip to content
This repository was archived by the owner on May 17, 2024. It is now read-only.

Commit 23a13dc

Browse files
JoshVanLJoshVanL
committed
Integrates the review token with flag - disabled by default
Signed-off-by: JoshVanL <[email protected]>
1 parent 871a5a5 commit 23a13dc

File tree

14 files changed

+591
-140
lines changed

14 files changed

+591
-140
lines changed

‎cmd/run.go

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"github.com/jetstack/kube-oidc-proxy/cmd/options"
2323
"github.com/jetstack/kube-oidc-proxy/pkg/probe"
2424
"github.com/jetstack/kube-oidc-proxy/pkg/proxy"
25+
"github.com/jetstack/kube-oidc-proxy/pkg/proxy/tokenreview"
2526
"github.com/jetstack/kube-oidc-proxy/pkg/version"
2627
)
2728

@@ -95,14 +96,24 @@ func NewRunCommand(stopCh <-chan struct{}) *cobra.Command {
9596
return err
9697
}
9798

99+
// Init token reviewer if enabled
100+
var tokenReviewer *tokenreview.TokenReview
101+
if tpOptions.Enabled {
102+
tokenReviewer, err = tokenreview.New(restConfig, tpOptions.Audiences)
103+
if err != nil {
104+
return err
105+
}
106+
}
107+
98108
// oidc auther from config
99109
reqAuther := bearertoken.New(oidcAuther)
100110
secureServingInfo := new(server.SecureServingInfo)
101111
if err := ssoptionsWithLB.ApplyTo(&secureServingInfo, nil); err != nil {
102112
return err
103113
}
104114

105-
p := proxy.New(restConfig, reqAuther, secureServingInfo)
115+
p := proxy.New(restConfig, reqAuther, tokenReviewer,
116+
secureServingInfo)
106117

107118
// run proxy
108119
waitCh, err := p.Run(stopCh)

‎pkg/e2e/e2e.go

Lines changed: 55 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"bytes"
66
"crypto/tls"
77
"crypto/x509"
8+
"errors"
89
"fmt"
910
"io/ioutil"
1011
"net/http"
@@ -40,9 +41,10 @@ type E2E struct {
4041
proxyClient *http.Client
4142
proxyCmd *exec.Cmd
4243
proxyPort string
43-
proxyCert []byte
4444
proxyTransport *http.Transport
4545

46+
proxyKeyCertPair *util.KeyCertPair
47+
4648
tmpDir string
4749
}
4850

@@ -141,24 +143,24 @@ func (e *E2E) newIssuerProxyPair() (*http.Transport, error) {
141143
}
142144
e.issuer = issuer
143145

144-
proxyCertPath, proxyKeyPath, _, proxyCert, err := util.NewTLSSelfSignedCertKey(pairTmpDir, "")
146+
pkcp, err := util.NewTLSSelfSignedCertKey(pairTmpDir, "")
145147
if err != nil {
146148
return nil, fmt.Errorf("failed to create key pair: %s", err)
147149
}
148-
e.proxyCert = proxyCert
150+
e.proxyKeyCertPair = pkcp
149151

150152
signer, err := jose.NewSigner(jose.SigningKey{
151153
Algorithm: jose.SignatureAlgorithm("RS256"),
152-
Key: issuer.Key(),
154+
Key: issuer.KeyCertPair().Key,
153155
}, nil)
154156
if err != nil {
155157
return nil, fmt.Errorf("failed to initialise new jwt signer: %s", err)
156158
}
157159
e.signer = signer
158160

159161
certPool := x509.NewCertPool()
160-
if ok := certPool.AppendCertsFromPEM(proxyCert); !ok {
161-
return nil, fmt.Errorf("failed to append proxy cert data to cert pool %s", proxyCertPath)
162+
if ok := certPool.AppendCertsFromPEM(pkcp.Cert); !ok {
163+
return nil, fmt.Errorf("failed to append proxy cert data to cert pool %s", pkcp.CertPath)
162164
}
163165

164166
transport := &http.Transport{
@@ -175,16 +177,16 @@ func (e *E2E) newIssuerProxyPair() (*http.Transport, error) {
175177

176178
cmd := exec.Command("../../kube-oidc-proxy",
177179
fmt.Sprintf("--oidc-issuer-url=https://127.0.0.1:%s", issuer.Port()),
178-
fmt.Sprintf("--oidc-ca-file=%s", issuer.CertPath()),
180+
fmt.Sprintf("--oidc-ca-file=%s", e.issuer.KeyCertPair().CertPath),
179181
"--oidc-client-id=kube-oidc-proxy_e2e_client-id",
180182
"--oidc-username-claim=e2e-username-claim",
181183
"--oidc-groups-claim=e2e-groups-claim",
182184
"--oidc-signing-algs=RS256",
183185

184186
"--bind-address=127.0.0.1",
185-
fmt.Sprintf("--secure-port=%s", proxyPort),
186-
fmt.Sprintf("--tls-cert-file=%s", proxyCertPath),
187-
fmt.Sprintf("--tls-private-key-file=%s", proxyKeyPath),
187+
fmt.Sprintf("--secure-port=%s", e.proxyPort),
188+
fmt.Sprintf("--tls-cert-file=%s", e.proxyKeyCertPair.CertPath),
189+
fmt.Sprintf("--tls-private-key-file=%s", e.proxyKeyCertPair.KeyPath),
188190

189191
fmt.Sprintf("--kubeconfig=%s", e.kubeKubeconfig),
190192
)
@@ -245,7 +247,7 @@ func (e *E2E) proxyRestClient() (*rest.Config, error) {
245247
},
246248
},
247249
TLSClientConfig: rest.TLSClientConfig{
248-
CAData: e.proxyCert,
250+
CAData: e.proxyKeyCertPair.Cert,
249251
},
250252

251253
APIPath: "/api",
@@ -265,5 +267,47 @@ func (e *E2E) cleanup() {
265267
err)
266268
}
267269

270+
e.proxyCmd = nil
271+
}
272+
}
273+
274+
func (e *E2E) runProxy(extraArgs ...string) error {
275+
if e.issuer == nil {
276+
return errors.New("failed to run proxy: issuer not ready")
277+
}
278+
279+
args := append(
280+
[]string{
281+
fmt.Sprintf("--oidc-issuer-url=https://127.0.0.1:%s", e.issuer.Port()),
282+
fmt.Sprintf("--oidc-ca-file=%s", e.issuer.KeyCertPair().CertPath),
283+
"--oidc-client-id=kube-oidc-proxy_e2e_client-id",
284+
"--oidc-username-claim=e2e-username-claim",
285+
"--oidc-groups-claim=e2e-groups-claim",
286+
"--oidc-signing-algs=RS256",
287+
"--v=5",
288+
289+
"--bind-address=127.0.0.1",
290+
fmt.Sprintf("--secure-port=%s", e.proxyPort),
291+
fmt.Sprintf("--tls-cert-file=%s", e.proxyKeyCertPair.CertPath),
292+
fmt.Sprintf("--tls-private-key-file=%s", e.proxyKeyCertPair.KeyPath),
293+
294+
fmt.Sprintf("--kubeconfig=%s", e.kubeKubeconfig),
295+
},
296+
extraArgs...,
297+
)
298+
299+
cmd := exec.Command("../../kube-oidc-proxy", args...)
300+
301+
cmd.Stderr = os.Stderr
302+
cmd.Stdout = os.Stdout
303+
if err := cmd.Start(); err != nil {
304+
return err
268305
}
306+
307+
e.proxyCmd = cmd
308+
309+
// wait more than enough for proxy to become ready
310+
time.Sleep(time.Second * 13)
311+
312+
return nil
269313
}

‎pkg/e2e/issuer/issuer.go

Lines changed: 11 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,21 @@
22
package issuer
33

44
import (
5-
"crypto/rsa"
65
"encoding/base64"
76
"fmt"
87
"net/http"
98
"time"
109

11-
"github.com/jetstack/kube-oidc-proxy/pkg/util"
1210
"k8s.io/klog"
11+
12+
"github.com/jetstack/kube-oidc-proxy/pkg/util"
1313
)
1414

1515
type Issuer struct {
16-
tlsDir string
17-
listenPort string
18-
certPath, keyPath string
16+
tlsDir string
17+
listenPort string
1918

20-
sk *rsa.PrivateKey
19+
keyCertPair *util.KeyCertPair
2120
}
2221

2322
func New(tlsDir string) *Issuer {
@@ -33,18 +32,16 @@ func (i *Issuer) Run() error {
3332
}
3433
i.listenPort = listenPort
3534

36-
certPath, keyPath, sk, _, err := util.NewTLSSelfSignedCertKey(i.tlsDir, "oidc-issuer")
35+
kcp, err := util.NewTLSSelfSignedCertKey(i.tlsDir, "oidc-issuer")
3736
if err != nil {
3837
return fmt.Errorf("failed to create issuer key pair: %s", err)
3938
}
40-
i.certPath = certPath
41-
i.keyPath = keyPath
42-
i.sk = sk
39+
i.keyCertPair = kcp
4340

4441
serveAddr := fmt.Sprintf("127.0.0.1:%s", i.listenPort)
4542

4643
go func() {
47-
err = http.ListenAndServeTLS(serveAddr, i.certPath, i.keyPath, i)
44+
err = http.ListenAndServeTLS(serveAddr, i.keyCertPair.CertPath, i.keyCertPair.KeyPath, i)
4845
if err != nil {
4946
klog.Errorf("failed to server secure tls: %s", err)
5047
}
@@ -80,16 +77,8 @@ func (i *Issuer) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
8077
}
8178
}
8279

83-
func (i *Issuer) CertPath() string {
84-
return i.certPath
85-
}
86-
87-
func (i *Issuer) KeyPath() string {
88-
return i.keyPath
89-
}
90-
91-
func (i *Issuer) Key() *rsa.PrivateKey {
92-
return i.sk
80+
func (i *Issuer) KeyCertPair() *util.KeyCertPair {
81+
return i.keyCertPair
9382
}
9483

9584
func (i *Issuer) Port() string {
@@ -128,7 +117,7 @@ func (i *Issuer) wellKnownResponse() []byte {
128117
}
129118

130119
func (i *Issuer) CertsDisc() []byte {
131-
n := base64.RawURLEncoding.EncodeToString(i.sk.N.Bytes())
120+
n := base64.RawURLEncoding.EncodeToString(i.keyCertPair.Key.N.Bytes())
132121

133122
return []byte(fmt.Sprintf(`{
134123
"keys": [

‎pkg/e2e/rbac_test.go

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import (
55
"fmt"
66
"testing"
77

8-
corev1 "k8s.io/api/core/v1"
98
rbacv1 "k8s.io/api/rbac/v1"
109
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1110
)
@@ -15,23 +14,11 @@ const (
1514
)
1615

1716
func Test_Rbac(t *testing.T) {
18-
if e2eSuite == nil {
19-
t.Skip("e2eSuite not defined")
20-
return
21-
}
17+
mustSkipMissingSuite(t)
18+
mustNamespace(t, namespaceRbacTest)
2219

23-
coreclient := e2eSuite.kubeclient.CoreV1()
2420
rbacclient := e2eSuite.kubeclient.RbacV1()
2521

26-
_, err := coreclient.Namespaces().Create(&corev1.Namespace{
27-
ObjectMeta: metav1.ObjectMeta{
28-
Name: namespaceRbacTest,
29-
},
30-
})
31-
if err != nil {
32-
t.Fatal(err)
33-
}
34-
3522
validToken := e2eSuite.validToken()
3623

3724
urlPods := fmt.Sprintf(
@@ -88,7 +75,7 @@ func Test_Rbac(t *testing.T) {
8875
for _, resource := range []string{
8976
"pods", "services", "secrets",
9077
} {
91-
_, err = rbacclient.Roles(namespaceRbacTest).Create(&rbacv1.Role{
78+
_, err := rbacclient.Roles(namespaceRbacTest).Create(&rbacv1.Role{
9279
ObjectMeta: metav1.ObjectMeta{
9380
Name: fmt.Sprintf("test-username-role-%s", resource),
9481
Namespace: namespaceRbacTest,
@@ -107,7 +94,7 @@ func Test_Rbac(t *testing.T) {
10794
}
10895

10996
// group-1 role-binding should give access to pods
110-
_, err = e2eSuite.kubeclient.RbacV1().RoleBindings(namespaceRbacTest).Create(
97+
_, err := e2eSuite.kubeclient.RbacV1().RoleBindings(namespaceRbacTest).Create(
11198
&rbacv1.RoleBinding{
11299
ObjectMeta: metav1.ObjectMeta{
113100
Name: "test-username-binding-group-1",

0 commit comments

Comments
 (0)