Merge pull request #33297 from liggitt/loopback-union-ordering

Automatic merge from submit-queue Put loopback authn/authz first in chain We want the loopback token auth to go first in the chain, for performance reasons, and so the loopback token isn't seen by any remote token authenticators configured. The loopback authorizer should also go first in the chain for performance.

Merge pull request #33297 from liggitt/loopback-union-ordering
44765616 · Kubernetes Submit Queue · GitHub · 4785f6f5 · 2ac293a0 · 44765616
Commit 44765616 authored Sep 25, 2016 by Kubernetes Submit Queue Committed by GitHub Sep 25, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 4 deletions

server.go cmd/kube-apiserver/app/server.go +2 -2

server.go federation/cmd/federation-apiserver/app/server.go +2 -2

No files found.
--- a/cmd/kube-apiserver/app/server.go
+++ b/cmd/kube-apiserver/app/server.go
@@ -279,10 +279,10 @@ func Run(s *options.APIServer) error {
 		}

 		tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens)
-		apiAuthenticator = authenticatorunion.New(apiAuthenticator, tokenAuthenticator)
+		apiAuthenticator = authenticatorunion.New(tokenAuthenticator, apiAuthenticator)

 		tokenAuthorizer := authorizer.NewPrivilegedGroups("system:masters")
-		apiAuthorizer = authorizerunion.New(apiAuthorizer, tokenAuthorizer)
+		apiAuthorizer = authorizerunion.New(tokenAuthorizer, apiAuthorizer)
 	}

 	sharedInformers := informers.NewSharedInformerFactory(client, 10*time.Minute)

--- a/federation/cmd/federation-apiserver/app/server.go
+++ b/federation/cmd/federation-apiserver/app/server.go
@@ -187,10 +187,10 @@ func Run(s *options.ServerRunOptions) error {
 		}

 		tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens)
-		apiAuthenticator = authenticatorunion.New(apiAuthenticator, tokenAuthenticator)
+		apiAuthenticator = authenticatorunion.New(tokenAuthenticator, apiAuthenticator)

 		tokenAuthorizer := authorizer.NewPrivilegedGroups("system:masters")
-		apiAuthorizer = authorizerunion.New(apiAuthorizer, tokenAuthorizer)
+		apiAuthorizer = authorizerunion.New(tokenAuthorizer, apiAuthorizer)
 	}

 	sharedInformers := informers.NewSharedInformerFactory(client, 10*time.Minute)