Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable multi-tenant authentication with UAMI + auxiliary token provider #6221

Merged
merged 1 commit into from
May 27, 2024
Merged

Enable multi-tenant authentication with UAMI + auxiliary token provider #6221

merged 1 commit into from
May 27, 2024

Conversation

zarvd
Copy link
Contributor

@zarvd zarvd commented May 18, 2024

What type of PR is this?

/feature

What this PR does / why we need it:

This PR introduces a new authentication method using UAMI and an auxiliary token provider to support Managed Identity in multi-tenant scenarios, where the token is stored in Azure KeyVault.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Enable multi-tenant authentication with UAMI and auxiliary token provider

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-kind labels May 18, 2024
@k8s-ci-robot
Copy link
Contributor

Hi @zarvd. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels May 18, 2024
zarvd
zarvd commented May 18, 2024
View reviewed changes
@zarvd zarvd marked this pull request as draft May 19, 2024 05:57
@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 19, 2024
@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch 3 times, most recently from 6979eaa to 74467fe Compare May 20, 2024 02:41
@zarvd zarvd marked this pull request as ready for review May 20, 2024 02:42
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 20, 2024
@k8s-ci-robot k8s-ci-robot requested a review from nilo19 May 20, 2024 02:42
@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch from 74467fe to 43112fb Compare May 20, 2024 05:16
@MartinForReal
Copy link
Contributor

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 20, 2024
@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch 2 times, most recently from 1c799fe to 11c0d6f Compare May 21, 2024 00:58
nilo19
nilo19 reviewed May 21, 2024
View reviewed changes
pkg/azureclients/armauth/multi_tenant_token_provider.go

var tokens []string
for _, cred := range p.auxiliaryCredentials {
token, err := cred.GetToken(ctx, policy.TokenRequestOptions{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it support list to reduce the cost?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, the list would only contain 1 token provider at most in the long run; will optimize if the list grows.

@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch from 11c0d6f to 8392576 Compare May 21, 2024 07:58
@MartinForReal
Copy link
Contributor

@zarvd Could you please rebase the branch? Thanks!

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 23, 2024
@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch from 8392576 to 909633e Compare May 23, 2024 08:38
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 23, 2024
@MartinForReal
Copy link
Contributor

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 23, 2024
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: MartinForReal, zarvd

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 23, 2024
@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch from 909633e to f70ca73 Compare May 23, 2024 14:06
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 23, 2024
@zarvd
Copy link
Contributor Author

zarvd commented May 23, 2024

rebased again

@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch from f70ca73 to 2cd4d78 Compare May 24, 2024 00:03
@zarvd
Copy link
Contributor Author

zarvd commented May 24, 2024

/kind feature

@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. and removed do-not-merge/needs-kind labels May 24, 2024
@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch from 2cd4d78 to da4b52b Compare May 24, 2024 02:48
@MartinForReal
Copy link
Contributor

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 24, 2024
@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch from da4b52b to 28c75d6 Compare May 24, 2024 08:02
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 24, 2024
@zarvd zarvd force-pushed the feat/cross-tenant/aux-token-provider branch from 28c75d6 to 8a94054 Compare May 25, 2024 03:20
@MartinForReal
Copy link
Contributor

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 27, 2024
@k8s-ci-robot k8s-ci-robot merged commit fcc9d46 into kubernetes-sigs:master May 27, 2024
18 checks passed
@zarvd zarvd deleted the feat/cross-tenant/aux-token-provider branch May 27, 2024 02:14
This was referenced May 28, 2024
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nilo19 nilo19 nilo19 left review comments

@andyzhangx andyzhangx Awaiting requested review from andyzhangx

@feiskyer feiskyer Awaiting requested review from feiskyer

Assignees

@MartinForReal MartinForReal

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@zarvd @k8s-ci-robot @MartinForReal @nilo19