Skip to content

K
k3s
Commit 44765616 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #33297 from liggitt/loopback-union-ordering

Automatic merge from submit-queue Put loopback authn/authz first in chain We want the loopback token auth to go first in the chain, for performance reasons, and so the loopback token isn't seen by any remote token authenticators configured. The loopback authorizer should also go first in the chain for performance.
parents 4785f6f5 2ac293a0
Hide whitespace changes
Inline Side-by-side
Showing with 4 additions and 4 deletions
cmd/kube-apiserver/app/server.go
View file @ 44765616
...@@ -279,10 +279,10 @@ func Run(s *options.APIServer) error { ...@@ -279,10 +279,10 @@ func Run(s *options.APIServer) error {
} }
tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens) tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens)
apiAuthenticator = authenticatorunion.New(apiAuthenticator, tokenAuthenticator) apiAuthenticator = authenticatorunion.New(tokenAuthenticator, apiAuthenticator)
tokenAuthorizer := authorizer.NewPrivilegedGroups("system:masters") tokenAuthorizer := authorizer.NewPrivilegedGroups("system:masters")
apiAuthorizer = authorizerunion.New(apiAuthorizer, tokenAuthorizer) apiAuthorizer = authorizerunion.New(tokenAuthorizer, apiAuthorizer)
} }
sharedInformers := informers.NewSharedInformerFactory(client, 10*time.Minute) sharedInformers := informers.NewSharedInformerFactory(client, 10*time.Minute)
......
federation/cmd/federation-apiserver/app/server.go
View file @ 44765616
...@@ -187,10 +187,10 @@ func Run(s *options.ServerRunOptions) error { ...@@ -187,10 +187,10 @@ func Run(s *options.ServerRunOptions) error {
} }
tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens) tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens)
apiAuthenticator = authenticatorunion.New(apiAuthenticator, tokenAuthenticator) apiAuthenticator = authenticatorunion.New(tokenAuthenticator, apiAuthenticator)
tokenAuthorizer := authorizer.NewPrivilegedGroups("system:masters") tokenAuthorizer := authorizer.NewPrivilegedGroups("system:masters")
apiAuthorizer = authorizerunion.New(apiAuthorizer, tokenAuthorizer) apiAuthorizer = authorizerunion.New(tokenAuthorizer, apiAuthorizer)
} }
sharedInformers := informers.NewSharedInformerFactory(client, 10*time.Minute) sharedInformers := informers.NewSharedInformerFactory(client, 10*time.Minute)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment