Document proxy flows #12305

deitch · 2019-01-21T20:41:31Z

Document flows of proxy requests for aggregated API.

As discussed with @liggitt .

deitch · 2019-01-21T20:42:36Z

content/en/docs/tasks/access-kubernetes-api/configure-aggregation-layer.md

+
+Note that it is the responsibility of the extension server implementation to provide the above. Many do it by default, leveraging the `k8s.io/apiserver/` package. Others may provide options to override it using command-line options.
+
+### Extension Server Authorize the Request


@liggitt - this is the part I don't get. Didn't it already authorize the request at the first step?

from the extension API server's perspective, all that has been proven is the identity of the incoming request (authentication, not authorization). The auth proxy might be the aggregator which already ran an authorization check, but it could just as easily be a generic authenticating proxy that only checked identity and added user info into headers.

k8sio-netlify-preview-bot · 2019-01-21T20:46:41Z

Deploy preview for kubernetes-io-master-staging ready!

Built with commit 9cc9b4c

https://deploy-preview-12305--kubernetes-io-master-staging.netlify.com

bradtopol · 2019-01-21T21:58:37Z

hi @liggitt would you be willing to serve as the technical reviewer of this content? Simply add a /lgtm when you are satisfied with its technical accuracy. Thanks!!!

content/en/docs/tasks/access-kubernetes-api/configure-aggregation-layer.md

liggitt · 2019-01-24T05:45:39Z

content/en/docs/tasks/access-kubernetes-api/configure-aggregation-layer.md

+
+## Authentication Flow
+
+Unlike Custom Resource Definitions (CRDs), the Aggregation API involves another server - your Extension API Server - in addition to the standard Kubernetes apiserver. The Kubernetes apiserver will need to communicate with your extension server, and your extension server will need to communicate with the Kubernetes apiserver. In order for this communication to be secured, the apiserver uses x509 certificates to authenticate itself to the extension server.


nit: suggest API server over API Server and apiserver

also suggest explicitly saying "Kubernetes API server" and "Extension API server" everywhere instead of "apiserver" for clarity

Yeah, that makes sense. Elsewhere in the docs I have seen "apiserver" so stuck with it. I don't care much one way or the other though, so will follow your suggestion.

Actually, the original document uses "apiserver" everywhere (7 times). You sure you want me to change all of those as well?

But adding explicit "Kubernetes apiserver" vs "extension apiserver" (or "API server") is a definite.

Updated to use "Kubernetes apiserver" and "extension apiserver" everywhere. If you feel we should change all cases of "apiserver" to "API server" (including the pre-existing ones), no problem, quick search-and-replace.

content/en/docs/tasks/access-kubernetes-api/configure-aggregation-layer.md

liggitt · 2019-01-24T05:58:18Z

content/en/docs/tasks/access-kubernetes-api/configure-aggregation-layer.md

+
+Note that it is the responsibility of the extension server implementation to provide the above. Many do it by default, leveraging the `k8s.io/apiserver/` package. Others may provide options to override it using command-line options.
+
+### Extension Server Authorize the Request


from the extension API server's perspective, all that has been proven is the identity of the incoming request (authentication, not authorization). The auth proxy might be the aggregator which already ran an authorization check, but it could just as easily be a generic authenticating proxy that only checked identity and added user info into headers.

deitch · 2019-01-24T09:22:06Z

@liggitt I addressed everything in your comments. Just need a decision on "Kubernetes apiserver" and "extension apiserver" vs "Kubernetes API server" and "extension API server". I think I like "apiserver" just because it is consistent with what was there before, but your call.

content/en/docs/tasks/access-kubernetes-api/configure-aggregation-layer.md

liggitt · 2019-01-24T14:36:41Z

one note about the role that allows submitting subjectaccessreviews, technical content lgtm otherwise, thanks!

deitch · 2019-01-24T14:40:45Z

one note about the role that allows submitting subjectaccessreviews

Done!

liggitt · 2019-02-06T17:45:59Z

/lgtm

Rajakavitha1 · 2019-02-17T14:15:10Z

@bradtopol could you please take a look at this PR and state your suggestions/approval.

zparnold · 2019-02-18T02:12:31Z

/approve

k8s-ci-robot · 2019-02-18T02:12:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: zparnold

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [zparnold]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Bradamant3 · 2019-02-28T13:53:45Z

content/en/docs/tasks/access-kubernetes-api/configure-aggregation-layer.md

@@ -22,13 +22,173 @@ Configuring the [aggregation layer](/docs/concepts/extend-kubernetes/api-extensi
 There are a few setup requirements for getting the aggregation layer working in your environment to support mutual TLS auth between the proxy and extension apiservers. Kubernetes and the kube-apiserver have multiple CAs, so make sure that the proxy is signed by the aggregation layer CA and not by something else, like the master CA.
 {{< /note >}}

+{{% /capture %}}
+
+{{% capture authflow %}}


This tag isn't recognized by Hugo, the static site generator we use to build the docs. So the build ignores everything inside this capture tag. (Note that the change to the heading below does show up on the live site.) The tags are part of the template for the different topic types that we require; they can't be used with arbitrary strings to designate a section type.

one comment @Bradamant3 is that i run a quick test on my local dev env and i can confirm that by removing {{% capture authflow %}} and {{% /capture %}} does solve it however the text does show after the Enable Kubernetes Apiserver flags although in the file the new text added by @deitch is before

Good catch, @DanyC97, and thanks very much for testing -- my suggestion to remove the offending capture tags was incomplete. The added content needs to be placed inside the steps capture tag. See https://kubernetes.io/docs/contribute/style/page-templates/#task-template.

@deitch should you not have time/ spare cycle to fix this one, let me know and i'll take over

Thanks @DanyC97 . I must have copied it over from somewhere when doing the previous PR and it lingered. I will clean it up and update.

should you not have time/ spare cycle to fix this one, let me know and i'll take over

Never have, but I will do it anyways. :-)

I fixed the tags on the open PR that I have at #12890 since it was open anyways. Take a look there?

Bradamant3 · 2019-02-28T13:58:45Z

@deitch not sure how you'd like to proceed with this one -- I can revert the merge, but if you've deleted your local branch, you can submit a new PR instead. I suggest just removing the problem capture tags for the new content you've written.

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jan 21, 2019

k8s-ci-robot requested review from cheftako and chenopis January 21, 2019 20:41

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. language/en Issues or PRs related to English language labels Jan 21, 2019

deitch commented Jan 21, 2019

View reviewed changes

bradtopol requested a review from liggitt January 21, 2019 21:57

bradtopol self-assigned this Jan 21, 2019

deitch force-pushed the describe-agg-auth-flow branch from c092266 to 90f79a0 Compare January 22, 2019 14:06

liggitt reviewed Jan 24, 2019

View reviewed changes

deitch force-pushed the describe-agg-auth-flow branch from 90f79a0 to 16dfc9b Compare January 24, 2019 08:16

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 24, 2019

deitch force-pushed the describe-agg-auth-flow branch 9 times, most recently from c5fd8d2 to 14fd384 Compare January 24, 2019 09:21

liggitt reviewed Jan 24, 2019

View reviewed changes

content/en/docs/tasks/access-kubernetes-api/configure-aggregation-layer.md Outdated Show resolved Hide resolved

Document proxy flows

9cc9b4c

deitch force-pushed the describe-agg-auth-flow branch from 14fd384 to 9cc9b4c Compare January 24, 2019 14:40

k8s-ci-robot assigned liggitt Feb 6, 2019

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 6, 2019

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 18, 2019

k8s-ci-robot merged commit ef89679 into kubernetes:master Feb 18, 2019

deitch deleted the describe-agg-auth-flow branch February 18, 2019 08:16

deitch mentioned this pull request Feb 28, 2019

Document issues when client CA options conflict #12890

Merged

Bradamant3 reviewed Feb 28, 2019

View reviewed changes

kwiesmueller pushed a commit to kwiesmueller/website that referenced this pull request Feb 28, 2019

Document proxy flows (kubernetes#12305)

dadd9e3

krmayankk pushed a commit to krmayankk/kubernetes.github.io that referenced this pull request Mar 11, 2019

Document proxy flows (kubernetes#12305)

a9ce1fb

yagonobre pushed a commit to yagonobre/website that referenced this pull request Mar 14, 2019

Document proxy flows (kubernetes#12305)

55f93f1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Document proxy flows #12305

Document proxy flows #12305

deitch commented Jan 21, 2019

deitch Jan 21, 2019

liggitt Jan 24, 2019

k8sio-netlify-preview-bot commented Jan 21, 2019 •

edited

Loading

bradtopol commented Jan 21, 2019 •

edited

Loading

liggitt Jan 24, 2019

liggitt Jan 24, 2019

deitch Jan 24, 2019

deitch Jan 24, 2019

deitch Jan 24, 2019

deitch Jan 24, 2019

liggitt Jan 24, 2019

deitch commented Jan 24, 2019

liggitt commented Jan 24, 2019

deitch commented Jan 24, 2019

liggitt commented Feb 6, 2019

Rajakavitha1 commented Feb 17, 2019

zparnold commented Feb 18, 2019

k8s-ci-robot commented Feb 18, 2019

Bradamant3 Feb 28, 2019

DanyC97 Feb 28, 2019

Bradamant3 Feb 28, 2019 •

edited

Loading

DanyC97 Feb 28, 2019

deitch Mar 1, 2019

deitch Mar 1, 2019

Bradamant3 commented Feb 28, 2019


		Note that it is the responsibility of the extension server implementation to provide the above. Many do it by default, leveraging the `k8s.io/apiserver/` package. Others may provide options to override it using command-line options.

		### Extension Server Authorize the Request


		## Authentication Flow

		Unlike Custom Resource Definitions (CRDs), the Aggregation API involves another server - your Extension API Server - in addition to the standard Kubernetes apiserver. The Kubernetes apiserver will need to communicate with your extension server, and your extension server will need to communicate with the Kubernetes apiserver. In order for this communication to be secured, the apiserver uses x509 certificates to authenticate itself to the extension server.

Document proxy flows #12305

Document proxy flows #12305

Conversation

deitch commented Jan 21, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8sio-netlify-preview-bot commented Jan 21, 2019 • edited Loading

bradtopol commented Jan 21, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deitch commented Jan 24, 2019

liggitt commented Jan 24, 2019

deitch commented Jan 24, 2019

liggitt commented Feb 6, 2019

Rajakavitha1 commented Feb 17, 2019

zparnold commented Feb 18, 2019

k8s-ci-robot commented Feb 18, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Bradamant3 Feb 28, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Bradamant3 commented Feb 28, 2019

k8sio-netlify-preview-bot commented Jan 21, 2019 •

edited

Loading

bradtopol commented Jan 21, 2019 •

edited

Loading

Bradamant3 Feb 28, 2019 •

edited

Loading