KEP-3325: Auth API to get self user attributes #3326

nabokihms · 2022-05-30T13:40:56Z

One-line PR description: Auth API to get self user attributes

Issue link: Auth API to get self user attributes #3325

Other comments: -

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

k8s-ci-robot · 2022-05-30T13:41:03Z

Welcome @nabokihms!

It looks like this is your first PR to kubernetes/enhancements 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/enhancements has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2022-05-30T13:41:04Z

Hi @nabokihms. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

enj · 2022-06-06T15:16:33Z

/assign

deads2k · 2022-06-17T20:09:15Z

keps/sig-auth/3325-self-user-attributes-review-api/README.md

+
+- Corresponding kubectl command implemented
+
+NOTE: Should not be a part pf [conformance tests](https://git.k8s.io/community/contributors/devel/sig-architecture/conformance-tests.md).


Calling out to other reviewers. I'm ok with this position.

also typo: s/pf/of

I think it's worth explain that it's not part of conformance because the possession of a token does not necessarily imply the power to know who that token belongs to.

Good point. I extended the note.

deads2k · 2022-06-17T20:11:08Z

keps/sig-auth/3325-self-user-attributes-review-api/README.md

+}
+```
+
+On receiving a request, the Kubernetes API server fills the status with the user attributes and returns it to the user.


A GET request? Can you specify the exact URL of the request please?

OpenShift uses /apis/user.openshift.io/v1/users/~ as I recall, which has aged decently well. I'm open to others, but we should be specific.

I added an example of the request URL and the HTTP method.

deads2k · 2022-06-17T20:16:52Z

This design looks reasonable to me. I'd like to see

the exact URL we'll be accessing
the http method we'll be using
the proposed RBAC rule that grants access by default
whether the RBAC rule is always present or only conditionally present (I suggest always present)
the command line flag used to disable this API if a cluster-admin wants it off

Once those are cleared up, I'm ok proceeding if the others agree as well. I would review an implementation PR for this if you get me on slack for it.

The PRR lgtm, but I don't want to pre-approve this PR. cc @johnbelamaric

As I recall, @enj had opinions about the shape as well and @mikedanese had comments about what powers the possession of a token should imply. I think guaranteeing this won't be added to conformance, explaining why, and showing how it can be disabled would satisfy his needs, but please confirm.

/assign @enj @mikedanese

* Provide an example for the request and response * Add the note about how to disable the API Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

nabokihms · 2022-06-21T14:41:54Z

@deads2k, thank you for the review!

1,2. Added an example of the request URL and the HTTP method for it
3,4. Described RBAC rules in detail
5. Mentioned how to disable the API.

enj

This is pretty close. @mikedanese PTAL.

keps/sig-auth/3325-self-user-attributes-review-api/kep.yaml

keps/sig-auth/3325-self-user-attributes-review-api/README.md

enj · 2022-06-21T19:38:11Z

keps/sig-auth/3325-self-user-attributes-review-api/README.md

+This API is enabled by default and can be disabled by the following kube-apiserver flag (along with the TokenReview API).
+```
+--runtime-config=authentication.k8s.io/v1=false
+```


Disabling token review isn't practical? I am fine with this not being part of conformance but I think denying this via a validating admission webhook seems more practical (which is possible since this is a create).

@deads2k you mentioned:

the command line flag used to disable this API if a cluster-admin wants it off

Is that requesting a specific flag that disables this one API?

The note about using validating webhook was added. Thanks for the hint.

There is the KEP #3137 that extended the runtime-config option to be able to disable a single resource of an API like this:

--runtime-config=authentication.k8s.io/v1alpha1/selfsubjectattributesreview=false

Added a note about it to the KEP.

keps/sig-auth/3325-self-user-attributes-review-api/README.md

Co-authored-by: Mo Khan <theenjeru@gmail.com> Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

liggitt · 2022-06-22T18:13:20Z

keps/sig-auth/3325-self-subject-attributes-review-api/README.md

+  - create
+```
+
+This API is enabled by default and can be disabled by using one of the following options:


This API is enabled by default

which API is this referring to? the selfsubjectattributesreviews API would not be enabled by default until it reaches GA

It was a suggestion from @deads2k to add a note about how users can disable the selfsubjectattributesreview API. I will mention that the note about disabling only becomes relevant once the selfsubjectattributesreview API reaches GA.

Co-authored-by: Mo Khan <theenjeru@gmail.com> Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

…PI reaches GA Co-authored-by: Mo Khan <theenjeru@gmail.com> Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

enj · 2022-06-22T19:28:57Z

/ok-to-test
/lgtm
/approve
/milestone v1.25

keps/prod-readiness/sig-auth/3225.yaml

Co-authored-by: Mo Khan <theenjeru@gmail.com> Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

nabokihms · 2022-06-22T19:49:18Z

/retest

enj · 2022-06-22T19:52:33Z

/lgtm

johnbelamaric · 2022-06-22T21:58:57Z

/approve

k8s-ci-robot · 2022-06-22T21:59:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enj, johnbelamaric, nabokihms

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~keps/prod-readiness/OWNERS~~ [johnbelamaric]
~~keps/sig-auth/OWNERS~~ [enj,johnbelamaric]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

KEP-3325: Self user attributes review API

81bf29f

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 30, 2022

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory labels May 30, 2022

k8s-ci-robot requested review from enj and ritazh May 30, 2022 13:41

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label May 30, 2022

nabokihms mentioned this pull request Jun 2, 2022

Auth API to get self user attributes #3325

Closed

12 tasks

k8s-ci-robot assigned enj Jun 6, 2022

deads2k reviewed Jun 17, 2022

View reviewed changes

k8s-ci-robot assigned mikedanese Jun 17, 2022

* Clarify RBAC rules

fff21fe

* Provide an example for the request and response * Add the note about how to disable the API Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

nabokihms requested a review from deads2k June 21, 2022 14:42

enj requested changes Jun 21, 2022

View reviewed changes

mikedanese reviewed Jun 22, 2022

View reviewed changes

keps/sig-auth/3325-self-user-attributes-review-api/README.md Outdated Show resolved Hide resolved

mikedanese reviewed Jun 22, 2022

View reviewed changes

keps/sig-auth/3325-self-user-attributes-review-api/README.md Outdated Show resolved Hide resolved

mikedanese reviewed Jun 22, 2022

View reviewed changes

keps/sig-auth/3325-self-user-attributes-review-api/README.md Outdated Show resolved Hide resolved

Apply suggestions from code review

431b422

Co-authored-by: Mo Khan <theenjeru@gmail.com> Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

nabokihms force-pushed the 3325-self-user-attributes-review-api branch from 4d49551 to 431b422 Compare June 22, 2022 10:07

nabokihms requested a review from enj June 22, 2022 10:29

nabokihms force-pushed the 3325-self-user-attributes-review-api branch from c52fcc5 to 144f269 Compare June 22, 2022 18:06

liggitt reviewed Jun 22, 2022

View reviewed changes

nabokihms and others added 2 commits June 22, 2022 22:27

Mention how to disable APU using a flag

3f956b4

Co-authored-by: Mo Khan <theenjeru@gmail.com> Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

Clarify that the note about disabling become relevant only when the A…

0c594a0

…PI reaches GA Co-authored-by: Mo Khan <theenjeru@gmail.com> Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

nabokihms requested a review from liggitt June 22, 2022 18:42

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 22, 2022

k8s-ci-robot added this to the v1.25 milestone Jun 22, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 22, 2022

enj approved these changes Jun 22, 2022

View reviewed changes

enj reviewed Jun 22, 2022

View reviewed changes

keps/prod-readiness/sig-auth/3225.yaml Outdated Show resolved Hide resolved

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 22, 2022

Update keps/prod-readiness/sig-auth/3225.yaml

9f17245

Co-authored-by: Mo Khan <theenjeru@gmail.com> Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

nabokihms force-pushed the 3325-self-user-attributes-review-api branch from 6aee303 to 9f17245 Compare June 22, 2022 19:48

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 22, 2022

enj removed request for liggitt, mikedanese, ritazh and deads2k June 22, 2022 20:50

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 22, 2022

k8s-ci-robot merged commit 583c8df into kubernetes:master Jun 22, 2022

nabokihms mentioned this pull request Oct 3, 2022

Add doc about how to get self subject attributes kubernetes/website#35385

Merged

3 tasks

nabokihms mentioned this pull request Mar 5, 2023

KEP-3325: Promote SelfSubjectReview to Beta kubernetes/website#39794

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KEP-3325: Auth API to get self user attributes #3326

KEP-3325: Auth API to get self user attributes #3326

nabokihms commented May 30, 2022

k8s-ci-robot commented May 30, 2022

k8s-ci-robot commented May 30, 2022

enj commented Jun 6, 2022

deads2k Jun 17, 2022 •

edited

Loading

nabokihms Jun 21, 2022

deads2k Jun 17, 2022 •

edited

Loading

nabokihms Jun 21, 2022

deads2k commented Jun 17, 2022

nabokihms commented Jun 21, 2022

enj left a comment

enj Jun 21, 2022 •

edited

Loading

nabokihms Jun 22, 2022

nabokihms Jun 22, 2022

liggitt Jun 22, 2022

nabokihms Jun 22, 2022

enj commented Jun 22, 2022

nabokihms commented Jun 22, 2022

enj commented Jun 22, 2022

johnbelamaric commented Jun 22, 2022

k8s-ci-robot commented Jun 22, 2022


		- Corresponding kubectl command implemented

		NOTE: Should not be a part pf [conformance tests](https://git.k8s.io/community/contributors/devel/sig-architecture/conformance-tests.md).

KEP-3325: Auth API to get self user attributes #3326

KEP-3325: Auth API to get self user attributes #3326

Conversation

nabokihms commented May 30, 2022

k8s-ci-robot commented May 30, 2022

k8s-ci-robot commented May 30, 2022

enj commented Jun 6, 2022

deads2k Jun 17, 2022 • edited Loading

Choose a reason for hiding this comment

nabokihms Jun 21, 2022

Choose a reason for hiding this comment

deads2k Jun 17, 2022 • edited Loading

Choose a reason for hiding this comment

nabokihms Jun 21, 2022

Choose a reason for hiding this comment

deads2k commented Jun 17, 2022

nabokihms commented Jun 21, 2022

enj left a comment

Choose a reason for hiding this comment

enj Jun 21, 2022 • edited Loading

Choose a reason for hiding this comment

nabokihms Jun 22, 2022

Choose a reason for hiding this comment

nabokihms Jun 22, 2022

Choose a reason for hiding this comment

liggitt Jun 22, 2022

Choose a reason for hiding this comment

nabokihms Jun 22, 2022

Choose a reason for hiding this comment

enj commented Jun 22, 2022

nabokihms commented Jun 22, 2022

enj commented Jun 22, 2022

johnbelamaric commented Jun 22, 2022

k8s-ci-robot commented Jun 22, 2022

deads2k Jun 17, 2022 •

edited

Loading

deads2k Jun 17, 2022 •

edited

Loading

enj Jun 21, 2022 •

edited

Loading