Skip to content

add extra group and usage check for bootstraptoken#86573

Merged
k8s-ci-robot merged 1 commit intokubernetes:masterfrom
zhlhahaha:e2e_kubeadm_1410
Dec 26, 2019
Merged

add extra group and usage check for bootstraptoken#86573
k8s-ci-robot merged 1 commit intokubernetes:masterfrom
zhlhahaha:e2e_kubeadm_1410

Conversation

@zhlhahaha
Copy link
Copy Markdown
Contributor

@zhlhahaha zhlhahaha commented Dec 24, 2019

kubeadm creates the bootstrap token with extra group
, system:bootstrappers:kubeadm:default-node-token,
should be able to be used for authentication and
signing.

Signed-off-by: Howard Zhang howard.zhang@arm.com

What type of PR is this?
/kind cleanup
/sig testing

@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Dec 24, 2019

@zhlhahaha: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. sig/testing Categorizes an issue or PR as relevant to SIG Testing. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 24, 2019
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Dec 24, 2019

Hi @zhlhahaha. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@lubinsz
Copy link
Copy Markdown

lubinsz commented Dec 24, 2019

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. area/kubeadm area/test sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 24, 2019
@zhlhahaha
Copy link
Copy Markdown
Contributor Author

zhlhahaha commented Dec 24, 2019

/assign @fabriziopandini

@zhlhahaha
Copy link
Copy Markdown
Contributor Author

zhlhahaha commented Dec 24, 2019

Hi @fabriziopandini
I see there are some TODO in bootstrap_token_test.go of kubeadm e2e test. I am trying to do these TODO. Is there anything I should notice?
BR, Howard Zhang

@zhlhahaha
Copy link
Copy Markdown
Contributor Author

zhlhahaha commented Dec 24, 2019

/retest

neolit123
neolit123 reviewed Dec 24, 2019
View reviewed changes
test/e2e_kubeadm/bootstrap_token_test.go Outdated
Copy link
Copy Markdown
Member

@neolit123 neolit123 Dec 24, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is already defined here:

kubernetes/staging/src/k8s.io/cluster-bootstrap/token/api/types.go

Line 57 in c179a9c

BootstrapTokenExtraGroupsKey = "auth-extra-groups"

neolit123
neolit123 reviewed Dec 24, 2019
View reviewed changes
test/e2e_kubeadm/bootstrap_token_test.go Outdated
Copy link
Copy Markdown
Member

@neolit123 neolit123 Dec 24, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these two are also defined

kubernetes/staging/src/k8s.io/cluster-bootstrap/token/api/types.go

Lines 63 to 74 in c179a9c

// BootstrapTokenUsageSigningKey signals that this token should be used to
// sign configs as part of the bootstrap process. Value must be "true". Any
// other value is assumed to be false. Optional.
BootstrapTokenUsageSigningKey = "usage-bootstrap-signing"
// BootstrapTokenUsageAuthentication signals that this token should be used
// as a bearer token to authenticate against the Kubernetes API. The bearer
// token takes the form "<token-id>.<token-secret>" and authenticates as the
// user "system:bootstrap:<token-id>" in the "system:bootstrappers" group
// as well as any groups specified using BootstrapTokenExtraGroupsKey.
// Value must be "true". Any other value is assumed to be false. Optional.
BootstrapTokenUsageAuthentication = "usage-bootstrap-authentication"

Copy link
Copy Markdown
Member

@neolit123 neolit123 Dec 24, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

note

to import this package use:
k8s.io/cluster-bootstrap/token/api/....

Copy link
Copy Markdown
Contributor Author

@zhlhahaha zhlhahaha Dec 25, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

neolit123
neolit123 reviewed Dec 24, 2019
View reviewed changes
test/e2e_kubeadm/bootstrap_token_test.go Outdated
Copy link
Copy Markdown
Member

@neolit123 neolit123 Dec 24, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

EDIT: never mind, this is fine as is.

@neolit123
Copy link
Copy Markdown
Member

neolit123 commented Dec 25, 2019

/release-note-none

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Dec 25, 2019
@zhlhahaha
add extra group and usage check for bootstraptoken
299a9c8 
kubeadm creates the bootstrap token with extra group
, system:bootstrappers:kubeadm:default-node-token,
should be able to be used for authentication and
signing.

Signed-off-by: Howard Zhang <howard.zhang@arm.com>
@k8s-ci-robot k8s-ci-robot removed the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Dec 25, 2019
@k8s-ci-robot k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Dec 25, 2019
@zhlhahaha
Copy link
Copy Markdown
Contributor Author

zhlhahaha commented Dec 25, 2019

/retest

1 similar comment
@zhlhahaha
Copy link
Copy Markdown
Contributor Author

zhlhahaha commented Dec 25, 2019

/retest

neolit123
neolit123 reviewed Dec 25, 2019
View reviewed changes
Copy link
Copy Markdown
Member

@neolit123 neolit123 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve
/priority backlog

@k8s-ci-robot k8s-ci-robot added priority/backlog Higher priority than priority/awaiting-more-evidence. lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Dec 25, 2019
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Dec 25, 2019

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: neolit123, zhlhahaha

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 25, 2019
@fejta-bot
Copy link
Copy Markdown

fejta-bot commented Dec 26, 2019

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

@k8s-ci-robot k8s-ci-robot merged commit 2914ba8 into kubernetes:master Dec 26, 2019
@k8s-ci-robot k8s-ci-robot added this to the v1.18 milestone Dec 26, 2019
@zhlhahaha zhlhahaha mentioned this pull request Mar 25, 2020
Closed
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@detiber detiber Awaiting requested review from detiber

@ereslibre ereslibre Awaiting requested review from ereslibre

1 more reviewer

@neolit123 neolit123 neolit123 left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@neolit123 neolit123

@fabriziopandini fabriziopandini

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/kubeadm area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. priority/backlog Higher priority than priority/awaiting-more-evidence. release-note-none Denotes a PR that doesn't merit a release note. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

v1.18

Development

Successfully merging this pull request may close these issues.

6 participants

@zhlhahaha @k8s-ci-robot @lubinsz @neolit123 @fejta-bot @fabriziopandini