Update OpenStack keystone integration #7304

dims · 2018-02-08T15:49:51Z

removing the keystone password section
adding a subsection under "Webhook Token Authentication" that details configuration of kubectl with the openstack auth provider

NOTE: After opening the PR, please un-check and re-check the "Allow edits from maintainers" box so that maintainers can work on your patch and speed up the review process. This is a temporary workaround to address a known issue with GitHub.>

Please delete this note before submitting the pull request.

This change is

k8sio-netlify-preview-bot · 2018-02-08T15:51:35Z

Deploy preview for kubernetes-io-master-staging ready!

Built with commit bdb564f

https://deploy-preview-7304--kubernetes-io-master-staging.netlify.com

dims · 2018-02-08T16:32:06Z

note from @liggitt

the kubectl side should be documented now.

your webhook authenticator is one possible option for turning keystone tokens into userinfo, and could be referenced as an example, without being positioned as the one true keystone webhook token authenticator (even once it is in the openstack foundation, alternative user mappings could be achieved through alternate webhooks)

heckj · 2018-02-28T23:23:42Z

/assign

ericchiang · 2018-03-06T21:56:34Z

@dims do you need any help here?

dims · 2018-03-06T22:39:39Z

@ericchiang will check with @heckj and report back (or pick up the work)

heckj · 2018-03-07T01:41:27Z

Sorry @dims - what did I miss? How can I help? I went ahead and assigned this to me to review, but it seemed still WIP so I didn't put much attention behind it.

dims · 2018-03-07T14:02:03Z

@heckj whoops. i remember someone volunteering for taking this over. sorry. will work on this today

dims · 2018-03-14T14:30:04Z

@dixudx i could use your help with this :) (mentioned it in kubernetes/kubernetes#60200)

- removing the keystone password section - adding a subsection under "Webhook Token Authentication" that details configuration of kubectl with the openstack auth provider

k8s-ci-robot · 2018-03-16T13:43:51Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: heckj

Assign the PR to them by writing /assign @heckj in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dixudx · 2018-03-19T14:19:07Z

docs/admin/authentication.md

@@ -486,6 +486,21 @@ An unsuccessful request would return:

 HTTP status codes can be used to supply additional error context.

+#### Using OpenStack Keystone authentication Webhook
+
+There are two parts to authentication with OpenStack Keystone. On the client-side, you can use `--auth-provider=openstack` option to reuse the `OS_*` environment variables:


s/authentication/authenticate

I suspect there's a word missing that would make this better than changing authentication to authenticate, which also reads oddly, perhaps better phrasing:

There are two parts to support authentication with OpenStack Keystone.

dixudx · 2018-03-19T14:26:05Z

docs/admin/authentication.md

+```
+Note that you will also need to use `kubectl config set-context` and `kubectl config use-context` to activate the context. Please make sure you have `OS_DOMAIN_NAME` to use Keystone V3 API.
+
+On the server-side, one choice is to use the webhook from:   


IIRC, from v1.10, this will be the only choice, right?

So we won't have other choices for now. This should be addressed well here. WDYT?

dixudx · 2018-03-19T14:30:41Z

docs/admin/authentication.md

+Documentation for the webhook is at  
+https://github.com/dims/openstack-cloud-controller-manager/blob/master/docs/using-keystone-webhook-authenticator-and-authorizer.md
+
+This webhook from folks in the OpenStack community is just one option. Other webhooks may be available with alternative user mappings in the future. 


Still not available for now. Shall we remove this line?

Recommend dropping the line about "other webhooks may be available..." - better to focus on what is now and how to utilize it vs. what could come.

dixudx · 2018-03-19T14:31:45Z

docs/admin/authentication.md

+```
+kubectl config set-credentials openstackuser --auth-provider=openstack
+```
+Note that you will also need to use `kubectl config set-context` and `kubectl config use-context` to activate the context. Please make sure you have `OS_DOMAIN_NAME` to use Keystone V3 API.


Adds an auth config file example to illustrate #60200?

Good information, but its unclear on how someone would actually use these commands and in what order to authenticate to the cluster. I'd recommend showing all three commands in sequence, explaining what they do to provide the authentication, and prefixing the whole thing by asserting that the administrator specifically needs to have OS_DOMAIN_NAME set. There's an implication of other OS_* environment variables that may need to be set - I'm not sure what those may be, but if any are critical, please include them in a "to use this, you need..." sort of requirements note above the sequence of commands.

heckj · 2018-03-20T22:20:18Z

docs/admin/authentication.md

@@ -486,6 +486,21 @@ An unsuccessful request would return:

 HTTP status codes can be used to supply additional error context.

+#### Using OpenStack Keystone authentication Webhook
+
+There are two parts to authentication with OpenStack Keystone. On the client-side, you can use `--auth-provider=openstack` option to reuse the `OS_*` environment variables:


I suspect there's a word missing that would make this better than changing authentication to authenticate, which also reads oddly, perhaps better phrasing:

There are two parts to support authentication with OpenStack Keystone.

heckj · 2018-03-20T22:24:35Z

docs/admin/authentication.md

+```
+kubectl config set-credentials openstackuser --auth-provider=openstack
+```
+Note that you will also need to use `kubectl config set-context` and `kubectl config use-context` to activate the context. Please make sure you have `OS_DOMAIN_NAME` to use Keystone V3 API.


Good information, but its unclear on how someone would actually use these commands and in what order to authenticate to the cluster. I'd recommend showing all three commands in sequence, explaining what they do to provide the authentication, and prefixing the whole thing by asserting that the administrator specifically needs to have OS_DOMAIN_NAME set. There's an implication of other OS_* environment variables that may need to be set - I'm not sure what those may be, but if any are critical, please include them in a "to use this, you need..." sort of requirements note above the sequence of commands.

heckj · 2018-03-20T22:26:45Z

docs/admin/authentication.md

+kubectl config set-credentials openstackuser --auth-provider=openstack
+```
+Note that you will also need to use `kubectl config set-context` and `kubectl config use-context` to activate the context. Please make sure you have `OS_DOMAIN_NAME` to use Keystone V3 API.
+


I wasn't entirely clear - are both of these (server side and client side) needed to authenticate, or is it one or the other if you want to use Keystone to Auth?

heckj · 2018-03-20T22:29:46Z

docs/admin/authentication.md

+Note that you will also need to use `kubectl config set-context` and `kubectl config use-context` to activate the context. Please make sure you have `OS_DOMAIN_NAME` to use Keystone V3 API.
+
+On the server-side, one choice is to use the webhook from:   
+https://github.com/dims/openstack-cloud-controller-manager/blob/master/cmd/k8s-keystone-auth/main.go


I don't know that referencing the Go code will help an administrator know how to use this, but if you want to reference it, I recommend something like:

The OpenStack Cloud Controller includes an webhook authenticator.

heckj · 2018-03-20T22:32:03Z

docs/admin/authentication.md

+On the server-side, one choice is to use the webhook from:   
+https://github.com/dims/openstack-cloud-controller-manager/blob/master/cmd/k8s-keystone-auth/main.go
+
+Documentation for the webhook is at  


Suggestion:

Documentation for how to install and configure the OpenStack authentication webhook can be found at https://github.com/dims/openstack-cloud-controller-manager/blob/master/docs/using-keystone-webhook-authenticator-and-authorizer.md.

to make that an active link

heckj · 2018-03-20T22:32:57Z

docs/admin/authentication.md

+Documentation for the webhook is at  
+https://github.com/dims/openstack-cloud-controller-manager/blob/master/docs/using-keystone-webhook-authenticator-and-authorizer.md
+
+This webhook from folks in the OpenStack community is just one option. Other webhooks may be available with alternative user mappings in the future. 


Recommend dropping the line about "other webhooks may be available..." - better to focus on what is now and how to utilize it vs. what could come.

dims · 2018-04-24T01:49:01Z

will revisit this in a bit. we are adding a bunch more in the new git repo (cloud-provider-openstack)

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Feb 8, 2018

k8s-ci-robot requested review from bradtopol and tengqm February 8, 2018 15:50

dims mentioned this pull request Feb 8, 2018

Remove experimental keystone authenticator kubernetes/kubernetes#59492

Merged

k8s-ci-robot assigned heckj Feb 28, 2018

dixudx mentioned this pull request Mar 1, 2018

read openstack auth config from client config kubernetes/kubernetes#60200

Merged

Update OpenStack keystone integration

bdb564f

- removing the keystone password section - adding a subsection under "Webhook Token Authentication" that details configuration of kubectl with the openstack auth provider

dims force-pushed the patch-6 branch from bd6b70b to bdb564f Compare March 16, 2018 13:43

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Mar 16, 2018

dims changed the title ~~[WIP] Update OpenStack keystone integration~~ Update OpenStack keystone integration Mar 16, 2018

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 16, 2018

dixudx reviewed Mar 19, 2018

View reviewed changes

tengqm mentioned this pull request Mar 20, 2018

Clean keystone authentication doc #7789

Closed

steveperry-53 added the Docs Review: Open Issues label Mar 20, 2018

heckj suggested changes Mar 20, 2018

View reviewed changes

dims closed this Apr 24, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update OpenStack keystone integration #7304

Update OpenStack keystone integration #7304

dims commented Feb 8, 2018 •

edited by k8s-reviewable

Loading

k8sio-netlify-preview-bot commented Feb 8, 2018 •

edited

Loading

dims commented Feb 8, 2018

heckj commented Feb 28, 2018

ericchiang commented Mar 6, 2018

dims commented Mar 6, 2018

heckj commented Mar 7, 2018

dims commented Mar 7, 2018

dims commented Mar 14, 2018

k8s-ci-robot commented Mar 16, 2018

dixudx Mar 19, 2018

heckj Mar 20, 2018

dixudx Mar 19, 2018

dixudx Mar 19, 2018

heckj Mar 20, 2018

dixudx Mar 19, 2018

heckj Mar 20, 2018

heckj Mar 20, 2018

heckj Mar 20, 2018

heckj Mar 20, 2018

heckj Mar 20, 2018

heckj Mar 20, 2018

heckj Mar 20, 2018

dims commented Apr 24, 2018

Update OpenStack keystone integration #7304

Update OpenStack keystone integration #7304

Conversation

dims commented Feb 8, 2018 • edited by k8s-reviewable Loading

k8sio-netlify-preview-bot commented Feb 8, 2018 • edited Loading

dims commented Feb 8, 2018

heckj commented Feb 28, 2018

ericchiang commented Mar 6, 2018

dims commented Mar 6, 2018

heckj commented Mar 7, 2018

dims commented Mar 7, 2018

dims commented Mar 14, 2018

k8s-ci-robot commented Mar 16, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dims commented Apr 24, 2018

dims commented Feb 8, 2018 •

edited by k8s-reviewable

Loading

k8sio-netlify-preview-bot commented Feb 8, 2018 •

edited

Loading