Merge pull request #55456 from hzxuzhonghu/token

Automatic merge from submit-queue (batch tested with PRs 55682, 55444, 55456, 55717, 55131). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. verify token auth file **What this PR does / why we need it**: verify token auth file and to prevent empty token. https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/#token-authentication-file https://kubernetes.io/docs/admin/authentication/#static-token-file **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes #55434 **Special notes for your reviewer**: **Release note**: ```release-note NONE ```

Merge pull request #55456 from hzxuzhonghu/token
2abc4742 · Kubernetes Submit Queue · GitHub · d73157ba · 62c170fc · 2abc4742
Unverified Commit 2abc4742 authored Nov 15, 2017 by Kubernetes Submit Queue Committed by GitHub Nov 15, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 17 additions and 1 deletion

tokenfile.go ...apiserver/pkg/authentication/token/tokenfile/tokenfile.go +7 -1

tokenfile_test.go ...rver/pkg/authentication/token/tokenfile/tokenfile_test.go +10 -0

No files found.
--- a/staging/src/k8s.io/apiserver/pkg/authentication/token/tokenfile/tokenfile.go
+++ b/staging/src/k8s.io/apiserver/pkg/authentication/token/tokenfile/tokenfile.go
@@ -62,11 +62,17 @@ func NewCSV(path string) (*TokenAuthenticator, error) {
 		if len(record) < 3 {
 			return nil, fmt.Errorf("token file '%s' must have at least 3 columns (token, user name, user uid), found %d", path, len(record))
 		}
+		recordNum++
+		if record[0] == "" {
+			glog.Warningf("empty token has been found in token file '%s', record number '%d'", path, recordNum)
+			continue
+		}
 		obj := &user.DefaultInfo{
 			Name: record[1],
 			UID:  record[2],
 		}
-		recordNum++
 		if _, exist := tokens[record[0]]; exist {
 			glog.Warningf("duplicate token has been found in token file '%s', record number '%d'", path, recordNum)
 		}

--- a/staging/src/k8s.io/apiserver/pkg/authentication/token/tokenfile/tokenfile_test.go
+++ b/staging/src/k8s.io/apiserver/pkg/authentication/token/tokenfile/tokenfile_test.go
@@ -125,6 +125,16 @@ func TestInsufficientColumnsTokenFile(t *testing.T) {
 	}
 }
+func TestEmptyTokenTokenFile(t *testing.T) {
+	auth, err := newWithContents(t, ",user5,uid5\n")
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if len(auth.tokens) != 0 {
+		t.Fatalf("empty token should not be recorded")
+	}
+}
 func newWithContents(t *testing.T, contents string) (auth *TokenAuthenticator, err error) {
 	f, err := ioutil.TempFile("", "tokenfile_test")
 	if err != nil {