Skip to content

svcacct: validate min and max expiration seconds on TokenRequest#63999

Merged
k8s-github-robot merged 1 commit intokubernetes:masterfrom
mikedanese:validatetr
Jun 1, 2018
Merged

svcacct: validate min and max expiration seconds on TokenRequest#63999
k8s-github-robot merged 1 commit intokubernetes:masterfrom
mikedanese:validatetr

Conversation

@mikedanese
Copy link
Copy Markdown
Member

@mikedanese mikedanese commented May 17, 2018

stop gap #63653

TokenRequests now are required to have an expiration duration between 10 minutes and 2^32 seconds.

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 17, 2018
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 17, 2018
@mikedanese mikedanese mentioned this pull request May 17, 2018
Merged
awly
awly suggested changes May 17, 2018
View reviewed changes
Comment thread pkg/apis/authentication/validation/validation.go Outdated
Copy link
Copy Markdown
Contributor

@awly awly May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add package and func doc comments

Comment thread pkg/apis/authentication/validation/validation.go Outdated
Copy link
Copy Markdown
Contributor

@awly awly May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2018

Comment thread pkg/apis/authentication/validation/validation.go Outdated
Copy link
Copy Markdown
Contributor

@awly awly May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should probably return a single error.
The conditions you check below are mutually exclusive anyway

Copy link
Copy Markdown
Member Author

@mikedanese mikedanese May 31, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is our validation convention https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/core/validation/validation.go

Comment thread pkg/apis/authentication/validation/validation.go Outdated
Copy link
Copy Markdown
Contributor

@awly awly May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make these into consts ( 10 * time.Minute and divide by time.Second during check)

Comment thread pkg/apis/authentication/validation/validation.go Outdated
Copy link
Copy Markdown
Contributor

@awly awly May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's > 100 years.
How about limiting to say 1 year?

@mikedanese
Copy link
Copy Markdown
Member Author

mikedanese commented May 31, 2018

/retest

3 similar comments
@mikedanese
Copy link
Copy Markdown
Member Author

mikedanese commented May 31, 2018

/retest

@mikedanese
Copy link
Copy Markdown
Member Author

mikedanese commented May 31, 2018

/retest

@mikedanese
Copy link
Copy Markdown
Member Author

mikedanese commented May 31, 2018

/retest

@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Jun 1, 2018

@mikedanese: The following test failed, say /retest to rerun them all:

Test name Commit Details Rerun command
pull-kubernetes-kubemark-e2e-gce-big dc9e3f1 link /test pull-kubernetes-kubemark-e2e-gce-big

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

liggitt
liggitt reviewed Jun 1, 2018
View reviewed changes
Comment thread test/integration/auth/svcaccttoken_test.go
time.Sleep(63 * time.Second)

// backdate the token
then := time.Now().Add(-2 * time.Hour)
Copy link
Copy Markdown
Member

@liggitt liggitt Jun 1, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clever

@liggitt
Copy link
Copy Markdown
Member

liggitt commented Jun 1, 2018

/milestone v1.11
/sig auth
/priority important-soon
/kind feature
/lgtm

@k8s-ci-robot k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. sig/auth Categorizes an issue or PR as relevant to SIG Auth. labels Jun 1, 2018
@k8s-ci-robot k8s-ci-robot added this to the v1.11 milestone Jun 1, 2018
@k8s-ci-robot k8s-ci-robot added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. kind/feature Categorizes issue or PR as related to a new feature. labels Jun 1, 2018
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Jun 1, 2018

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, mikedanese

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 1, 2018
@liggitt
Copy link
Copy Markdown
Member

liggitt commented Jun 1, 2018

/status approved-for-milestone

@k8s-github-robot
Copy link
Copy Markdown

k8s-github-robot commented Jun 1, 2018

[MILESTONENOTIFIER] Milestone Pull Request: Up-to-date for process

@awly @liggitt @mikedanese

Pull Request Labels
  • sig/auth: Pull Request will be escalated to these SIGs if needed.
  • priority/important-soon: Escalate to the pull request owners and SIG owner; move out of milestone after several unsuccessful escalation attempts.
  • kind/feature: New functionality.
Help

@k8s-github-robot
Copy link
Copy Markdown

k8s-github-robot commented Jun 1, 2018

Automatic merge from submit-queue (batch tested with PRs 59938, 63777, 64577, 63999, 64431). If you want to cherry-pick this change to another branch, please follow the instructions here.

@k8s-github-robot k8s-github-robot merged commit 4993d01 into kubernetes:master Jun 1, 2018
@mikedanese mikedanese deleted the validatetr branch June 1, 2018 17:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@liggitt liggitt liggitt left review comments

@caesarxuchao caesarxuchao Awaiting requested review from caesarxuchao

@spiffxp spiffxp Awaiting requested review from spiffxp

@sttts sttts Awaiting requested review from sttts

+1 more reviewer

@awly awly awly requested changes

Reviewers whose approvals may not affect merge requirements

Assignees

@liggitt liggitt

@awly awly

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

v1.11

Development

Successfully merging this pull request may close these issues.

5 participants

@mikedanese @k8s-ci-robot @liggitt @k8s-github-robot @awly