kubehook
kubehook copied to clipboard
planetlabs
A JWT based Kubernetes webhook authentication service.
request client configuration from the backend, allowing the two systems to synchronize. the new API endpoint is accessible to anonymous clients, as it does not contain any secrets; only application...
the slider component has its limits hardcoded to [1,7], which matches with the default value of 168h. the value on the server can be changed however, using the `--max-lifetime` flag....
simple docker-compose based setup to showcase a possible deployment scenario.
instead of a hardcoded value, the configuration file uses the user information from the authentication context for the user and context settings. closes #45
add flag to parse and respond with v1 DTOs. closes #47
upgrade go to 1.17 and remove glide as dependency manager in favour of native go modules.
this change adds a new CLI flag, which allows the `/quitquitquit` endpoint to be replaced with a noop action instead of the default "shutdown the application" behaviour. for backwards compatibility,...
the TokenReview struct and its children have not changed between [v1beta](https://github.com/kubernetes/api/blob/b2d630a65cb2ef33faef611d793d551014defc0d/authentication/v1beta1/types.go#L36) and [v1](https://github.com/kubernetes/api/blob/b2d630a65cb2ef33faef611d793d551014defc0d/authentication/v1/types.go#L52) current versions of the kube-api-server still support the v1beta DTO, but adapting to the stable schema makes...
the [/quitquitquit](https://github.com/planetlabs/kubehook/blob/75b079549b93addb06b182c955588513b12713d1/cmd/kubehook/kubehook.go#L189) endpoint allows any authenticated user to shut down the service. not sure what the point of it is, but would like to have the ability to disable this...
the kubecfg endpoint renders the kubectl configuration file with a token generated for the [authenticated user](https://github.com/planetlabs/kubehook/blob/75b079549b93addb06b182c955588513b12713d1/handlers/kubecfg/kubecfg.go#L64), but uses a hardcoded user for the [user](https://github.com/planetlabs/kubehook/blob/75b079549b93addb06b182c955588513b12713d1/handlers/kubecfg/kubecfg.go#L70) and [context](https://github.com/planetlabs/kubehook/blob/75b079549b93addb06b182c955588513b12713d1/handlers/kubecfg/kubecfg.go#L92) sections. the resulting output...
Metadata
Owner
Metadata
A JWT based Kubernetes webhook authentication service.