Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add docs for Authorization Configuration #41892

Merged
merged 5 commits into from
Nov 27, 2023
Merged

Add docs for Authorization Configuration #41892

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
83bb609
add authorization config documentation
palnabarun Jun 30, 2023
5627db2
add documentation for AuthorizationConfiguration
palnabarun Nov 20, 2023
1056863
Update from code review
palnabarun Nov 22, 2023
03e2976
Add more context to downgrade example
palnabarun Nov 24, 2023
21ac70e
Wrap markdown text
palnabarun Nov 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update from code review 
Signed-off-by: Nabarun Pal <pal.nabarun95@gmail.com>
  • Loading branch information
@palnabarun
palnabarun committed Nov 22, 2023
commit 10568634b5faf70fb907f3077cfacb772ba20ed1
12 changes: 9 additions & 3 deletions content/en/docs/reference/access-authn-authz/authorization.md
View file
Open in desktop
palnabarun marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -209,14 +209,20 @@ The following flags can be used:
You can choose more than one authorization module. Modules are checked in order
so an earlier module has higher priority to allow or deny a request.

## Configuring the API Server using a Authorization Config File
## Configuring the API Server using an Authorization Config File
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(nit)

Suggested change
## Configuring the API Server using an Authorization Config File
## Configuring the API Server using an authorization config file


{{< feature-state state="alpha" for_k8s_version="v1.29" >}}

Kubernetes API Server authorizer chain can be configured using a config file by passing it through the `--authorization-config` flag. An example configuration with all possible values is provided below. In order to use the feature, the `StructuredAuthorizationConfiguration` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) has to be enabled.
Kubernetes API Server authorizer chain can be configured using a config file by passing it through the `--authorization-config` flag. This feature enables creation of authorization chains with multiple webhooks with well-defined parameters that validate requests in a certain order and enables fine grained control like explicit Deny on failures. An example configuration with all possible values is provided below. In order to use the feature, the `StructuredAuthorizationConfiguration` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) has to be enabled.
palnabarun marked this conversation as resolved.
Show resolved Hide resolved

Note: When the feature is enabled, setting both `--authorization-config` and configuring an authorization webhook using the `--authorization-mode` and `--authorization-webhook-*` command line flags is not allowed. If done, there will be an error and API Server would exit right away.

palnabarun marked this conversation as resolved.
Show resolved Hide resolved
{{< caution >}}
While the feature is in Alpha/Beta, there is no change if you want to keep on using command line flags. When the feature goes Beta, the feature flag would be turned on by default. The feature flag would be removed when feature goes GA.

When configuring the authorizer chain using a config file, make sure all the apiserver nodes have the file. Also, take a note of the apiserver configuration when upgrading/downgrading the clusters. For example, if upgrading to v1.29+ clusters and using the config file, you would need to add to the flags back to the cluster bootrap mechanism.
palnabarun marked this conversation as resolved.
Show resolved Hide resolved
{{< /caution >}}

```yaml
#
# DO NOT USE THE CONFIG AS IS. THIS IS AN EXAMPLE.
Expand All @@ -238,7 +244,7 @@ authorizers:
# Same as setting `--authorization-webhook-cache-authorized-ttl` flag
# Default: 5m0s
authorizedTTL: 30s
# The duration to cache 'authorized' responses from the webhook
# The duration to cache 'unauthorized' responses from the webhook
# authorizer.
# Same as setting `--authorization-webhook-cache-unauthorized-ttl` flag
# Default: 30s
Expand Down