From 8de046a561bc6909f54e49beb37ac57ef9c065e9 Mon Sep 17 00:00:00 2001 From: Matt Moyer Date: Mon, 14 Sep 2020 10:48:11 -0500 Subject: [PATCH] Remove static webhook config options. Signed-off-by: Matt Moyer --- pkg/config/api/types.go | 13 ---- pkg/config/config_test.go | 8 -- pkg/config/testdata/default.yaml | 3 - pkg/config/testdata/happy.yaml | 3 - .../invalid-duration-renew-before.yaml | 3 - .../testdata/negative-renew-before.yaml | 3 - pkg/config/testdata/zero-renew-before.yaml | 3 - pkg/config/webhook.go | 77 ------------------- pkg/config/webhook_test.go | 31 -------- 9 files changed, 144 deletions(-) delete mode 100644 pkg/config/webhook.go delete mode 100644 pkg/config/webhook_test.go diff --git a/pkg/config/api/types.go b/pkg/config/api/types.go index 81a8b1e14..1f5a80e38 100644 --- a/pkg/config/api/types.go +++ b/pkg/config/api/types.go @@ -7,23 +7,10 @@ package api // Config contains knobs to setup an instance of pinniped. type Config struct { - WebhookConfig WebhookConfigSpec `json:"webhook"` DiscoveryInfo DiscoveryInfoSpec `json:"discovery"` APIConfig APIConfigSpec `json:"api"` } -// WebhookConfig contains configuration knobs specific to pinniped's use -// of a webhook for token validation. -type WebhookConfigSpec struct { - // URL contains the URL of the webhook that pinniped will use - // to validate external credentials. - URL string `json:"url"` - - // CABundle contains PEM-encoded certificate authority certificates used - // to validate TLS connections to the WebhookURL. - CABundle []byte `json:"caBundle"` -} - // DiscoveryInfoSpec contains configuration knobs specific to // pinniped's publishing of discovery information. These values can be // viewed as overrides, i.e., if these are set, then pinniped will diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index e22a1255b..e188910d1 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -27,10 +27,6 @@ func TestFromPath(t *testing.T) { DiscoveryInfo: api.DiscoveryInfoSpec{ URL: stringPtr("https://some.discovery/url"), }, - WebhookConfig: api.WebhookConfigSpec{ - URL: "https://tuna.com/fish?marlin", - CABundle: []byte("-----BEGIN CERTIFICATE-----..."), - }, APIConfig: api.APIConfigSpec{ ServingCertificateConfig: api.ServingCertificateConfigSpec{ DurationSeconds: int64Ptr(3600), @@ -46,10 +42,6 @@ func TestFromPath(t *testing.T) { DiscoveryInfo: api.DiscoveryInfoSpec{ URL: nil, }, - WebhookConfig: api.WebhookConfigSpec{ - URL: "https://tuna.com/fish?marlin", - CABundle: []byte("-----BEGIN CERTIFICATE-----..."), - }, APIConfig: api.APIConfigSpec{ ServingCertificateConfig: api.ServingCertificateConfigSpec{ DurationSeconds: int64Ptr(60 * 60 * 24 * 365), // about a year diff --git a/pkg/config/testdata/default.yaml b/pkg/config/testdata/default.yaml index 234d9de84..ed97d539c 100644 --- a/pkg/config/testdata/default.yaml +++ b/pkg/config/testdata/default.yaml @@ -1,4 +1 @@ --- -webhook: - url: https://tuna.com/fish?marlin - caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tLi4u diff --git a/pkg/config/testdata/happy.yaml b/pkg/config/testdata/happy.yaml index f769cb834..3ed3c18a8 100644 --- a/pkg/config/testdata/happy.yaml +++ b/pkg/config/testdata/happy.yaml @@ -1,9 +1,6 @@ --- discovery: url: https://some.discovery/url -webhook: - url: https://tuna.com/fish?marlin - caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tLi4u api: servingCertificate: durationSeconds: 3600 diff --git a/pkg/config/testdata/invalid-duration-renew-before.yaml b/pkg/config/testdata/invalid-duration-renew-before.yaml index 83d1eaa6d..0c2ac2552 100644 --- a/pkg/config/testdata/invalid-duration-renew-before.yaml +++ b/pkg/config/testdata/invalid-duration-renew-before.yaml @@ -1,7 +1,4 @@ --- -webhook: - url: https://tuna.com/fish?marlin - caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tLi4u api: servingCertificate: durationSeconds: 2400 diff --git a/pkg/config/testdata/negative-renew-before.yaml b/pkg/config/testdata/negative-renew-before.yaml index 97481414a..bcc483d68 100644 --- a/pkg/config/testdata/negative-renew-before.yaml +++ b/pkg/config/testdata/negative-renew-before.yaml @@ -1,7 +1,4 @@ --- -webhook: - url: https://tuna.com/fish?marlin - caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tLi4u api: servingCertificate: durationSeconds: 2400 diff --git a/pkg/config/testdata/zero-renew-before.yaml b/pkg/config/testdata/zero-renew-before.yaml index 97481414a..bcc483d68 100644 --- a/pkg/config/testdata/zero-renew-before.yaml +++ b/pkg/config/testdata/zero-renew-before.yaml @@ -1,7 +1,4 @@ --- -webhook: - url: https://tuna.com/fish?marlin - caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tLi4u api: servingCertificate: durationSeconds: 2400 diff --git a/pkg/config/webhook.go b/pkg/config/webhook.go deleted file mode 100644 index b359b25af..000000000 --- a/pkg/config/webhook.go +++ /dev/null @@ -1,77 +0,0 @@ -/* -Copyright 2020 VMware, Inc. -SPDX-License-Identifier: Apache-2.0 -*/ - -package config - -import ( - "fmt" - "io" - "io/ioutil" - "os" - - authenticationv1beta1 "k8s.io/api/authentication/v1beta1" - utilnet "k8s.io/apimachinery/pkg/util/net" - "k8s.io/apiserver/pkg/authentication/authenticator" - "k8s.io/apiserver/plugin/pkg/authenticator/token/webhook" - "k8s.io/client-go/tools/clientcmd" - clientcmdapi "k8s.io/client-go/tools/clientcmd/api" - - "github.com/suzerain-io/pinniped/pkg/config/api" -) - -// NewWebhook creates a webhook from the provided API server url and caBundle -// used to validate TLS connections. -func NewWebhook(spec api.WebhookConfigSpec) (*webhook.WebhookTokenAuthenticator, error) { - kubeconfig, err := ioutil.TempFile("", "pinniped-webhook-kubeconfig-*") - if err != nil { - return nil, fmt.Errorf("create temp file: %w", err) - } - defer os.Remove(kubeconfig.Name()) - - if err := anonymousKubeconfig(spec.URL, spec.CABundle, kubeconfig); err != nil { - return nil, fmt.Errorf("anonymous kubeconfig: %w", err) - } - - // We use v1beta1 instead of v1 since v1beta1 is more prevalent in our desired - // integration points. - version := authenticationv1beta1.SchemeGroupVersion.Version - - // At the current time, we don't provide any audiences because we simply don't - // have any requirements to do so. This can be changed in the future as - // requirements change. - var implicitAuds authenticator.Audiences - - // We set this to nil because we would only need this to support some of the - // custom proxy stuff used by the API server. - var customDial utilnet.DialFunc - - return webhook.New(kubeconfig.Name(), version, implicitAuds, customDial) -} - -// anonymousKubeconfig writes a kubeconfig file to the provided io.Writer that -// will "use" anonymous auth to talk to a Kube API server at the provided url -// with the provided caBundle. -func anonymousKubeconfig(url string, caBundle []byte, out io.Writer) error { - config := clientcmdapi.NewConfig() - config.Clusters["anonymous-cluster"] = &clientcmdapi.Cluster{ - Server: url, - CertificateAuthorityData: caBundle, - } - config.Contexts["anonymous"] = &clientcmdapi.Context{ - Cluster: "anonymous-cluster", - } - config.CurrentContext = "anonymous" - - data, err := clientcmd.Write(*config) - if err != nil { - return fmt.Errorf("marshal config: %w", err) - } - - if _, err := out.Write(data); err != nil { - return fmt.Errorf("write config: %w", err) - } - - return nil -} diff --git a/pkg/config/webhook_test.go b/pkg/config/webhook_test.go deleted file mode 100644 index 3ba33cda9..000000000 --- a/pkg/config/webhook_test.go +++ /dev/null @@ -1,31 +0,0 @@ -/* -Copyright 2020 VMware, Inc. -SPDX-License-Identifier: Apache-2.0 -*/ - -package config - -import ( - "io/ioutil" - "os" - "testing" - - "github.com/stretchr/testify/require" - "k8s.io/client-go/tools/clientcmd" -) - -func TestAnonymousKubeconfig(t *testing.T) { - expect := require.New(t) - - f, err := ioutil.TempFile("", "pinniped-anonymous-kubeconfig-test-*") - expect.NoError(err) - defer os.Remove(f.Name()) - - err = anonymousKubeconfig("https://tuna.com", []byte("ca bundle"), f) - expect.NoError(err) - - config, err := clientcmd.BuildConfigFromFlags("", f.Name()) - expect.NoError(err) - - expect.Equal("https://tuna.com", config.Host) -}