Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

finish ut of sa token replacement #787

Merged
merged 2 commits into from
May 10, 2022
Merged

finish ut of sa token replacement #787

merged 2 commits into from
May 10, 2022

Conversation

MrGirl
Copy link
Contributor

@MrGirl MrGirl commented Mar 29, 2022 •
edited
Loading

add tenant sa token subsitute

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespace from that line:

/kind enhancement

/sig iot

What this PR does / why we need it:

Subsitute bearer token with tenant's default serviceaccount token when requests are from namespace kube-system. This PR make the master understand which tenant the request is from, when the request is from kube-system and flannel

Special notes for your reviewer:

Does this PR introduce a user-facing change?

If we want to active tenant sa toke subsitution, we should add param "hub-cert-organizations"

--hub-cert-organizations=system:bootstrappers:kubeadm:default-node-token,openyurt:tenant:iot-test

other Note

Maybe we should update clusterrolebinding first.

kubectl create clusterrolebinding system-node-role-bound --clusterrole=system:node --group=system:nodes

@openyurt-bot
Copy link
Collaborator

@MrGirl: GitHub didn't allow me to assign the following users: your_reviewer.

Note that only openyurtio members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

add tenant sa token subsitute

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespace from that line:
/kind bug
/kind documentation
/kind enhancement
/kind good-first-issue
/kind feature
/kind question
/kind design
/sig ai
/sig iot
/sig network
/sig storage
/sig storage

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

other Note

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openyurt-bot
Copy link
Collaborator

Welcome @MrGirl! It looks like this is your first PR to openyurtio/openyurt 🎉

@openyurt-bot openyurt-bot added the size/L size/L: 100-499 label Mar 29, 2022
@rambohe-ch
Copy link
Member

@MrGirl Very appreciate for your pull request. please fix the errors of github actions and merge two commits into one commit.

@MrGirl MrGirl force-pushed the sa-token-replace branch 2 times, most recently from 4a6e1c4 to c995d22 Compare March 30, 2022 07:51
@openyurt-bot openyurt-bot added size/XL size/XL: 500-999 and removed size/L size/L: 100-499 labels Mar 30, 2022
@MrGirl MrGirl force-pushed the sa-token-replace branch 2 times, most recently from 5c74edb to 6b501f0 Compare March 30, 2022 13:15
@openyurt-bot openyurt-bot added size/L size/L: 100-499 and removed size/XL size/XL: 500-999 labels Mar 30, 2022
@rambohe-ch rambohe-ch changed the title finish ut of sa token replacement 【WIP】finish ut of sa token replacement Apr 1, 2022
@openyurt-bot openyurt-bot added the do-not-merge/work-in-progress do-not-merge/work-in-progress label Apr 1, 2022
@rambohe-ch rambohe-ch changed the title 【WIP】finish ut of sa token replacement [WIP] finish ut of sa token replacement Apr 1, 2022
@MrGirl MrGirl force-pushed the sa-token-replace branch 5 times, most recently from 42674ed to b7e7be7 Compare April 5, 2022 13:07
@openyurt-bot openyurt-bot added size/XL size/XL: 500-999 and removed size/L size/L: 100-499 labels Apr 5, 2022
@MrGirl MrGirl force-pushed the sa-token-replace branch 3 times, most recently from 469bac4 to dbd16b4 Compare May 9, 2022 03:39
@rambohe-ch rambohe-ch changed the title [WIP] finish ut of sa token replacement finish ut of sa token replacement May 10, 2022
@openyurt-bot openyurt-bot removed the do-not-merge/work-in-progress do-not-merge/work-in-progress label May 10, 2022
@openyurt-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: MrGirl, rambohe-ch

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openyurt-bot openyurt-bot added the approved approved label May 10, 2022
@rambohe-ch
Copy link
Member

/lgtm
/approve

@openyurt-bot openyurt-bot added the lgtm lgtm label May 10, 2022
@openyurt-bot openyurt-bot merged commit 9988ce0 into openyurtio:master May 10, 2022
JameKeal pushed a commit to JameKeal/openyurt that referenced this pull request May 16, 2022
@MrGirl @JameKeal
finish ut of sa token replacement (openyurtio#787)
79505a4 
* finish ut of sa token replacement
add tenant sa token subsitute

* add tenant sa token subsitute
openyurt-bot pushed a commit that referenced this pull request May 16, 2022
@JameKeal @Congrool
@cndoit18 @pengbinbin1 @MrGirl @rambohe-ch @lonelyCZ
【ADD】Uniform use processCreateErr func to create resource (#828)
536db52 
* add yurt-app-manager yurtappdaemon/yurtingress deploy and revert

* Revert "add yurt-app-manager yurtappdaemon/yurtingress deploy and revert"

This reverts commit ba28364.

* fix git safe dir error (#807)

Signed-off-by: Congrool <chpzhangyifei@zju.edu.cn>

* 【Optimize】unified image pull policy (#805)

* add yurt-app-manager yurtappdaemon/yurtingress deploy and revert

* Revert "add yurt-app-manager yurtappdaemon/yurtingress deploy and revert"

This reverts commit ba28364.

* unified image pull policy

* 【Optimize】optimize kubernetes util function (#808)

* add yurt-app-manager yurtappdaemon/yurtingress deploy and revert

* Revert "add yurt-app-manager yurtappdaemon/yurtingress deploy and revert"

This reverts commit ba28364.

* optimize kubernetes util func

* 【FIX】fix cloud node was heterogeneous (#806)

* add yurt-app-manager yurtappdaemon/yurtingress deploy and revert

* Revert "add yurt-app-manager yurtappdaemon/yurtingress deploy and revert"

This reverts commit ba28364.

* fix bug: when cloud node was heterogeneous, this parameter will be error

* cleanup: io/ioutil (#813)

Signed-off-by: cndoit18 <cndoit18@outlook.com>

* use constants instead the string (#814)

* ingress: update edge ingress proposal to add enhancement (#816)

* finish ut of sa token replacement (#787)

* finish ut of sa token replacement
add tenant sa token subsitute

* add tenant sa token subsitute

* add enable-node-pool parameter for yurthub in order to disable nodepools list/watch in filters when testing. (#822)

* Remove convert and revert command (#826)

Signed-off-by: lonelyCZ <531187475@qq.com>

* uniform processCreateErr func to deal the resource create

Co-authored-by: Yifei Zhang <chpzhangyifei@zju.edu.cn>
Co-authored-by: cndoit18 <cndoit18@outlook.com>
Co-authored-by: pengbinbin1 <pengbiny@163.com>
Co-authored-by: zzguang <zhengguang.zhang@intel.com>
Co-authored-by: MrGirl <wuyingxingzyd@163.com>
Co-authored-by: rambohe <linbo.hlb@alibaba-inc.com>
Co-authored-by: Zhe Cheng <47743202+lonelyCZ@users.noreply.github.com>
JameKeal pushed a commit to JameKeal/openyurt that referenced this pull request May 16, 2022
@MrGirl @JameKeal
finish ut of sa token replacement (openyurtio#787)
b5665d7 
* finish ut of sa token replacement
add tenant sa token subsitute

* add tenant sa token subsitute
JameKeal pushed a commit to JameKeal/openyurt that referenced this pull request May 16, 2022
@MrGirl @JameKeal
finish ut of sa token replacement (openyurtio#787)
370cf4c 
* finish ut of sa token replacement
add tenant sa token subsitute

* add tenant sa token subsitute
@rambohe-ch
Copy link
Member

Fixes #788

@rambohe-ch rambohe-ch linked an issue May 25, 2022 that may be closed by this pull request
[feature request] add tenant isolation for components such as kube-proxy&flannel which run in ns kube-system #788
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rambohe-ch rambohe-ch rambohe-ch approved these changes

@kadisi kadisi Awaiting requested review from kadisi

@qclc qclc Awaiting requested review from qclc

Assignees

@rambohe-ch rambohe-ch

Labels
approved approved lgtm lgtm size/XL size/XL: 500-999
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[feature request] add tenant isolation for components such as kube-proxy&flannel which run in ns kube-system
3 participants
@MrGirl @openyurt-bot @rambohe-ch