Skip to content

Commit eaceb7b

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#88419 from Jefftree/netproxy-udstoken
Add support for token authentication with network proxy
2 parents 53d63e1 + 2a98cb7 commit eaceb7b

File tree

16 files changed

+77
-35
lines changed

16 files changed

+77
-35
lines changed

‎cluster/gce/addons/konnectivity-agent/daemonset.yaml‎ renamed to ‎cluster/gce/addons/konnectivity-agent/konnectivity-agent-ds.yaml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,16 @@ spec:
2222
tolerations:
2323
- key: "CriticalAddonsOnly"
2424
operator: "Exists"
25-
hostNetwork: true
26-
volumes:
27-
- name: pki
28-
hostPath:
29-
path: /etc/srv/kubernetes/pki/konnectivity-agent
3025
containers:
31-
- image: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-agent:v0.0.4
26+
- image: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-agent:v0.0.7
3227
name: konnectivity-agent
3328
command: ["/proxy-agent"]
3429
args: [
3530
"--logtostderr=true",
3631
"--ca-cert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt",
3732
"--proxy-server-host=__APISERVER_IP__",
38-
"--proxy-server-port=8132"
33+
"--proxy-server-port=8132",
34+
"--service-account-token-path=/var/run/secrets/tokens/konnectivity-agent-token"
3935
]
4036
env:
4137
- name: POD_NAME
@@ -50,10 +46,20 @@ spec:
5046
limits:
5147
cpu: 50m
5248
memory: 30Mi
49+
volumeMounts:
50+
- mountPath: /var/run/secrets/tokens
51+
name: konnectivity-agent-token
5352
livenessProbe:
5453
httpGet:
55-
host: 127.0.0.1
5654
port: 8093
5755
path: /healthz
5856
initialDelaySeconds: 15
5957
timeoutSeconds: 15
58+
serviceAccountName: konnectivity-agent
59+
volumes:
60+
- name: konnectivity-agent-token
61+
projected:
62+
sources:
63+
- serviceAccountToken:
64+
path: konnectivity-agent-token
65+
audience: system:konnectivity-server

‎cluster/gce/addons/konnectivity-agent/konnectivity-agent-rbac.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: konnectivity-agent
5+
namespace: kube-system
6+
labels:
7+
kubernetes.io/cluster-service: "true"
8+
addonmanager.kubernetes.io/mode: Reconcile

‎cluster/gce/addons/konnectivity-agent/konnectivity-rbac.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: system:konnectivity-server
5+
labels:
6+
kubernetes.io/cluster-service: "true"
7+
addonmanager.kubernetes.io/mode: Reconcile
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: ClusterRole
11+
name: system:auth-delegator
12+
subjects:
13+
- apiGroup: rbac.authorization.k8s.io
14+
kind: User
15+
name: system:konnectivity-server

‎cluster/gce/gci/configure-helper.sh‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -652,8 +652,13 @@ function create-master-auth {
652652
append_or_replace_prefixed_line "${known_tokens_csv}" "${GCE_GLBC_TOKEN}," "system:controller:glbc,uid:system:controller:glbc"
653653
fi
654654
if [[ -n "${ADDON_MANAGER_TOKEN:-}" ]]; then
655-
append_or_replace_prefixed_line "${known_tokens_csv}" "${ADDON_MANAGER_TOKEN}," "system:addon-manager,uid:system:addon-manager,system:masters"
655+
append_or_replace_prefixed_line "${known_tokens_csv}" "${ADDON_MANAGER_TOKEN}," "system:addon-manager,uid:system:addon-manager,system:masters"
656656
fi
657+
if [[ -n "${KONNECTIVITY_SERVER_TOKEN:-}" ]]; then
658+
append_or_replace_prefixed_line "${known_tokens_csv}" "${KONNECTIVITY_SERVER_TOKEN}," "system:konnectivity-server,uid:system:konnectivity-server"
659+
create-kubeconfig "konnectivity-server" ${KONNECTIVITY_SERVER_TOKEN}
660+
fi
661+
657662
if [[ -n "${EXTRA_STATIC_AUTH_COMPONENTS:-}" ]]; then
658663
# Create a static Bearer token and kubeconfig for extra, comma-separated components.
659664
IFS="," read -r -a extra_components <<< "${EXTRA_STATIC_AUTH_COMPONENTS:-}"
@@ -807,10 +812,10 @@ kind: EgressSelectorConfiguration
807812
egressSelections:
808813
- name: cluster
809814
connection:
810-
proxyProtocol: HTTPConnect
815+
proxyProtocol: GRPC
811816
transport:
812817
uds:
813-
udsName: /etc/srv/kubernetes/konnectivity/konnectivity-server.socket
818+
udsName: /etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket
814819
- name: master
815820
connection:
816821
proxyProtocol: Direct
@@ -1652,13 +1657,17 @@ function prepare-konnectivity-server-manifest {
16521657
params+=("--log-file=/var/log/konnectivity-server.log")
16531658
params+=("--logtostderr=false")
16541659
params+=("--log-file-max-size=0")
1655-
params+=("--uds-name=/etc/srv/kubernetes/konnectivity/konnectivity-server.socket")
1660+
params+=("--uds-name=/etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket")
16561661
params+=("--cluster-cert=/etc/srv/kubernetes/pki/apiserver.crt")
16571662
params+=("--cluster-key=/etc/srv/kubernetes/pki/apiserver.key")
1658-
params+=("--mode=http-connect")
1663+
params+=("--mode=grpc")
16591664
params+=("--server-port=0")
16601665
params+=("--agent-port=$1")
16611666
params+=("--admin-port=$2")
1667+
params+=("--agent-namespace=kube-system")
1668+
params+=("--agent-service-account=konnectivity-agent")
1669+
params+=("--kubeconfig=/etc/srv/kubernetes/konnectivity-server/kubeconfig")
1670+
params+=("--authentication-audience=system:konnectivity-server")
16621671
konnectivity_args=""
16631672
for param in "${params[@]}"; do
16641673
konnectivity_args+=", \"${param}\""
@@ -2469,7 +2478,7 @@ function setup-node-termination-handler-manifest {
24692478
}
24702479

24712480
function setup-konnectivity-agent-manifest {
2472-
local -r manifest="/etc/kubernetes/addons/konnectivity-agent/daemonset.yaml"
2481+
local -r manifest="/etc/kubernetes/addons/konnectivity-agent/konnectivity-agent-ds.yaml"
24732482
sed -i "s|__APISERVER_IP__|${KUBERNETES_MASTER_NAME}|g" "${manifest}"
24742483
}
24752484

@@ -2777,6 +2786,10 @@ function main() {
27772786
if [[ "${ENABLE_APISERVER_INSECURE_PORT:-false}" != "true" ]]; then
27782787
KUBE_BOOTSTRAP_TOKEN="$(secure_random 32)"
27792788
fi
2789+
if [[ "${ENABLE_EGRESS_VIA_KONNECTIVITY_SERVICE:-false}" == "true" ]]; then
2790+
KONNECTIVITY_SERVER_TOKEN="$(secure_random 32)"
2791+
fi
2792+
27802793

27812794
setup-os-params
27822795
config-ip-firewall

‎cluster/gce/manifests/konnectivity-server.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ spec:
1111
hostNetwork: true
1212
containers:
1313
- name: konnectivity-server-container
14-
image: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-server:v0.0.4
14+
image: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-server:v0.0.7
1515
resources:
1616
requests:
1717
cpu: 25m
@@ -39,7 +39,7 @@ spec:
3939
mountPath: /etc/srv/kubernetes/pki
4040
readOnly: true
4141
- name: konnectivity-uds
42-
mountPath: /etc/srv/kubernetes/konnectivity
42+
mountPath: /etc/srv/kubernetes/konnectivity-server
4343
readOnly: false
4444
volumes:
4545
- name: varlogkonnectivityserver
@@ -51,5 +51,5 @@ spec:
5151
path: /etc/srv/kubernetes/pki
5252
- name: konnectivity-uds
5353
hostPath:
54-
path: /etc/srv/kubernetes/konnectivity
54+
path: /etc/srv/kubernetes/konnectivity-server
5555
type: DirectoryOrCreate

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -573,7 +573,7 @@ replace (
573573
mvdan.cc/lint => mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b
574574
mvdan.cc/unparam => mvdan.cc/unparam v0.0.0-20190209190245-fbb59629db34
575575
rsc.io/pdf => rsc.io/pdf v0.1.1
576-
sigs.k8s.io/apiserver-network-proxy/konnectivity-client => sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.5
576+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client => sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7
577577
sigs.k8s.io/kustomize => sigs.k8s.io/kustomize v2.0.3+incompatible
578578
sigs.k8s.io/structured-merge-diff/v3 => sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200207200219-5e70324e7c1c
579579
sigs.k8s.io/yaml => sigs.k8s.io/yaml v1.2.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -619,8 +619,8 @@ mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIa
619619
mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
620620
mvdan.cc/unparam v0.0.0-20190209190245-fbb59629db34/go.mod h1:H6SUd1XjIs+qQCyskXg5OFSrilMRUkD8ePJpHKDPaeY=
621621
rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
622-
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.5 h1:bwop2S7kJYCtltbitSoLqQb8HdTxbcRAKqAGzcB4Lk8=
623-
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.5/go.mod h1:PHgbrJT7lCHcxMU+mDHEm+nx46H4zuuHZkDP6icnhu0=
622+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7 h1:uuHDyjllyzRyCIvvn0OBjiRB0SgBZGqHNYAmjR7fO50=
623+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7/go.mod h1:PHgbrJT7lCHcxMU+mDHEm+nx46H4zuuHZkDP6icnhu0=
624624
sigs.k8s.io/kustomize v2.0.3+incompatible h1:JUufWFNlI44MdtnjUqVnvh29rR37PQFzPbLXqhyOyX0=
625625
sigs.k8s.io/kustomize v2.0.3+incompatible/go.mod h1:MkjgH3RdOWrievjo6c9T245dYlB5QeXV4WCbnt/PEpU=
626626
sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200207200219-5e70324e7c1c h1:xQP7F7Lntt2dtYmg12WPQHObOrAyPHlMWP1JVSa79GM=

‎staging/src/k8s.io/apiextensions-apiserver/go.sum‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎staging/src/k8s.io/apiserver/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ require (
5050
k8s.io/klog v1.0.0
5151
k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c
5252
k8s.io/utils v0.0.0-20200117235808-5f6fbceb4c31
53-
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.5
53+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7
5454
sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200207200219-5e70324e7c1c
5555
sigs.k8s.io/yaml v1.2.0
5656
)

‎staging/src/k8s.io/apiserver/go.sum‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)